In almost 97% of tests, ScrambleMark stops speech watermark checks

Researchers made ScrambleMark, an attack on watermarks, which are marks in audio that a person cannot see. The attack changes the harmonic structure, the pattern of tones in the voice. On Google SynthID, Resemble AI and TrustedAudio, the checks did not find the mark in almost 97% of tests, and the rating by persons of the voice was 4.2 out of 5.

How it works

Attacks before this one tried to erase the watermark. The authors tell that a check uses a pattern that stays the same in the mark. To break the pattern is sufficient. ScrambleMark uses an engine with set rules that finds changes that work on many systems. It also uses one more model that makes random changes to the tones.

The numbers

• Evasion: almost 97% across 3 commercial platforms.
• Rating by persons: 4.2 out of 5.
• Attacks before this one: 1.1 to 1.7 out of 5.

The authors tell that the attack also works against adaptive recovery, a method made to remove its effect.

What is not known

The source gives no test results for other platforms. It gives no answer from the 3 platforms. The claim that this type of evasion is hard to stop is the claim of the authors.

Insight: Closing the detector does not stop this attack

In October 2026, Google opened SynthID Detector to all users. Google tells that a no does not show that a person made the media. TrustedAudio does the opposite and limits detection to known users. This paper shows that a closed detector does not stop the attack, and a watermark by itself reads as a weak proof of source. Leaders who must show the source of content must add one more check.