{"id":"95e7c861-2c61-4d05-acb1-ea52b68604f8","arxiv_id":"2412.10649","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"Imperceptible echoes embedded in audio training data are reproduced by DDSP, RAVE, and Dance Diffusion models, enabling a simple watermarking method for audio-to-audio AI models.","lead":"The authors show that adding tiny echoes to audio training data causes three different types of generative audio models to reproduce those echoes in their synthesized outputs. The work suggests a simple way to tag and trace audio used to train AI models, with implications for copyright and model auditing.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Equation (5) defines the z-score as background mean divided by standard deviation, with no dependence on the cepstral value at the test lag; as written, it cannot detect the echo peaks that all experiments rely on.","rationale":"Read in good faith, the paper is an empirical demonstration that a classical echo-hiding watermark placed in training data persists through training in three very different audio-to-audio architectures. The experiments are extensive (three architectures, three datasets, multiple echo delays, time-spread patterns, fine-tuning, demixing, pitch-shift augmentation), and the authors provide code and audio examples, which is real independent support. However, the detection statistic is the microscope through which every result is viewed. Equation (5) computes mean/standard_deviation, a background statistic with no c[i] term, so it cannot indicate a peak; the accompanying text and the figures y-axes (z-scores) imply the intended quantity is a standardized residual (c[i] - mean)/standard_deviation. This is not a matter of external consensus but of internal consistency: the equations and the claims do not match. Until this is resolved, the empirical conclusions rest on an ambiguous foundation. The reader's weakest assumption identified exactly this issue, and I agree. My recommended verdict is unchanged from the reader's CONDITIONAL: the concern is concrete and testable but very likely a correctable typo, so conditional acceptance pending code verification and, secondarily, a perceptual check of the alpha=0.4 echoes is appropriate. I would not reject, because the papers structure, available artifacts, and preliminary negative results (e.g., pitch-shift degradation) indicate a genuine empirical investigation rather than an absent phenomenon; the metric issue is precisely the kind of artifact that revisions and code inspection can settle.","tokens_in":8911,"tokens_out":3454,"duration_ms":31565,"concrete_test":"Fetch the public code from https://www.ctralie.com/echoes, locate the z-score computation for single-echo detection, and recompute the headline result of Figure 4 for one model/dataset pair (e.g., RAVE on GuitarSet, delta=75, 30-second clips). Use the formula actually implemented and also the corrected definition (c[delta] - mean)/standard_deviation; if either produces a clear separation between watermarked and clean models, the typo is benign. If no implemented formula reproduces the reported separations, the central claim is unsupported by the paper as written.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires reliably detecting the embedded echo as a peak in the output cepstrum. The detection statistic is introduced in Section 2.2: Equations (3)-(5) define the z-score at lag i as z = mean/standard_deviation of the cepstrum over [a,b] excluding i. As written, the statistic has no term involving c[i], so a peak at i cannot raise the score, and the definition is inconsistent with the prose that says the z-score scores the cepstrum value at delta. Every experimental figure (Figures 3-6 and 9-12) and the time-spread variant in Section 2.3 report separations in these z-scores. If the implementation literally follows Equation (5), the reported detections cannot be produced by the described metric; if the implementation uses a corrected form such as (c[i] - mean)/standard_deviation, the paper contains a typo that must be fixed before the experimental claims can be reproduced. This is the single load-bearing point: the empirical support for echoes surviving training is only as strong as the detection metric, and the metric as written is internally inconsistent. Resolving this is a prerequisite for evaluating the otherwise plausible and well-scoped empirical study.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes embedding an imperceptible echo (a single delayed copy or a time-spread pseudorandom pattern) into every clip of a training set for audio-to-audio generative models, specifically DDSP, RAVE, and Dance Diffusion. It reports that trained models reproduce the embedded echo in their synthesized outputs, as detected by a peak in the cepstrum at the embedded delay, and that this effect survives fine-tuning, mixing/demixing, and partial pitch-shift augmentation. The central claim is that classical echo-hiding watermarks can serve as persistent tags for generative audio models and for tracing training data.","tokens_in":9150,"tokens_out":7012,"duration_ms":61963,"significance":"If the central claim holds, the paper offers an unusually simple and practical method for tracing generative audio models to their training data, with potential applications in licensing, copyright, and model forensics. The experimental scope is broad: three architecturally distinct models, three datasets, several echo delays, time-spread patterns with ROC evaluation, and multiple transfer scenarios. The authors provide code and supplementary audio, which is commendable and supports reproducibility. However, the detection statistic defined in Eq. (5) is internally inconsistent, and because every quantitative conclusion is expressed in terms of that statistic, the paper's experimental support is currently unverifiable as written. This issue is likely fixable, but it is load-bearing.","major_comments":[{"comment":"The z-score is defined as z = μ/σ, where μ and σ are the mean and standard deviation of the cepstrum over [a,b] with the test index i excluded. As written, this statistic does not include the cepstral value c[i], so it cannot measure the height of a peak at the embedded echo lag δ. The prose states that the z-score 'scores the cepstrum value at δ', and every experimental figure (Figures 3–12) reports separations in these z-scores. With the equation literally implemented, the reported detections could not be obtained; in fact, excluding a large positive peak from μ and σ would tend to produce a lower value at the peak location than elsewhere. The authors must correct Eq. (5) (e.g., to (c[i]−μ)/σ or a similar peak-normalized form), verify the corrected formula against the released code, and regenerate the affected results.","section":"Section 2.2, Eq. (5)"},{"comment":"The same defect carries over to the time-spread echo detection, where the z-score on the cross-correlation c* is computed using 'an equation analogous to Eq. 5'. As written, that metric also lacks any dependence on the value of c* at the candidate lag, so the ROC curves and AUROC values in Section 3.2 are not meaningful under the stated definition. Both equations need to be corrected, and the time-spread analyses must be re-run with a peak-sensitive statistic.","section":"Section 2.3"}],"minor_comments":[{"comment":"The text says 'we train DDSP for 500,000 samples on all models', but the other models are trained for a number of steps; please clarify the units (presumably 500,000 steps) for consistency.","section":"Section 2.1"},{"comment":"In the paragraph after Eq. (1), 'andx1 is fully mixed in if the payload contains a 0' should read 'a 1'.","section":"Section 2.2"},{"comment":"The list of experimental echo delays appears as 'δ ∈ {50, 76, 76, 100}', which contains a duplicated 76; Section 3.1 correctly lists {50, 75, 76, 100}.","section":"Section 2.2"},{"comment":"The phrasing 'we then embed echoes in the test set and fine tune the corresponding Dance Diffusion trained on the clean training sets' is ambiguous; it is unclear whether the fine-tuning subset is drawn from the training set or a held-out set, and what role the validation set plays in preventing overfitting. Please clarify the experimental setup.","section":"Section 4.1"},{"comment":"The paper repeatedly describes the echoes as 'imperceptible', but it provides no perceptual evaluation. In particular, the single-echo experiments use α = 0.4, which places the echo roughly 8 dB below the carrier; at such a level audibility is a real concern. A listening test or an objective perceptual metric would substantiate the claim; otherwise, the wording should be tempered.","section":"Abstract and Section 2.2"},{"comment":"The paper reports z-score distributions but does not provide formal statistical comparisons (e.g., p-values or confidence intervals) between embedded and clean models, or between different echo delays. Adding such tests would strengthen the conclusions, especially for the smaller separation observed for Dance Diffusion.","section":"Section 3"}],"recommendation":"major_revision","confidential_remarks":"The Eq. (5) issue is the main concern. It is likely a typographical error rather than a fundamental flaw, because the authors' code and audio examples are provided and the overall experimental design is sensible. The authors should be asked to correct the equation, confirm that the released code uses the corrected form, and regenerate all figures and ROC analyses accordingly. The imperceptibility claim also needs support or softening. The paper is otherwise potentially a good fit for an audio/ISMIR-style venue and could make a nice contribution after these revisions."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a genuinely useful empirical result that is currently obstructed by a broken-looking definition of its own detection statistic. Fix Eq. (5) and the paper deserves a serious review.\n\nWhat is new: as far as I can tell, no one has shown that classical echo-hiding (Gruhl et al. 1996) embedded in training audio survives training of DDSP, RAVE, and Dance Diffusion, and persists through fine-tuning, mixing/demixing, and mostly through pitch-shift augmentation. That is a clean, practical claim with real utility for dataset tagging and model auditing. The experimental design is broad: three architectures, three datasets, multiple echo delays, single echoes plus time-spread patterns, and open code/data. The paper is honest about weaknesses (adjacent-echo confusion, degradation under pitch shift, weaker effect in larger models).\n\nThe soft spot is large: the z-score in Eq. (5) is defined as µ[i]/σ[i], with no term involving the cepstral value at the test lag i. As written, it cannot detect a peak; it is just a standardized background statistic. Every experimental figure reports separations in these z-scores, so either the code implements something else (e.g. (c[i]−µ)/σ) and Eq. (5) is a typo, or the reported detections do not follow from the stated metric. This must be resolved before the empirical conclusions can be reproduced. The authors explicitly say they use a loudness-independent score of the cepstrum value at δ, so my expectation is a typo, but the paper cannot stand as is.\n\nMinor issues: the parameter set δ ∈ {50, 76, 76, 100} contains a duplicated 76; presumably one is 75 from the experiments. The imperceptibility claim is asserted, not tested; α=0.4 for a single echo is high and likely audible on many sources. The code is public but there is no commit hash or data pipeline pinned, so independent replication will take some effort.\n\nBottom line: the central empirical claim is plausible and valuable, but it currently rests on a statistic that, as printed, is a blank check. This deserves review after the authors clarify the metric and check the code. If the corrected form matches the prose, I would be happy to cite it.","headline":"Useful empirical result, but the detection statistic as defined cannot detect the peaks it reports; fix Eq. (5) and this deserves full review.","tokens_in":9724,"tokens_out":1934,"would_cite":false,"duration_ms":18026,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Embedding a faint echo into every clip of a training set makes DDSP, RAVE, and Dance Diffusion reproduce that echo in their synthesized audio, so a watermark as old as echo hiding can tag what a generative model was trained on.","keywords":["echo hiding","audio watermarking","generative audio models","training data tagging","cepstral analysis","DDSP","RAVE","Dance Diffusion"],"falsifier":"Run the released code and model outputs and test the detection claim directly: for each synthesized clip, check whether the cepstrum has a genuine local maximum at the embedded lag ($c[\\delta] > c[j]$ for every $j$ in the band from 25 to 125 samples), comparing models trained on watermarked data with models trained on clean data. If a corrected peak-based metric no longer separates the two distributions the way Figures 3–6 report, the claim that echoes survive training fails; if the separation survives, the printed z-score formula (Eq. 5) is a typo and the underlying claim stands.","tokens_in":8666,"feed_emoji":"🎵","tokens_out":22539,"duration_ms":175570,"temperature":0.7,"pith_summary":"Echo hiding is a classical watermarking idea: mix a faint, delayed copy of a signal back into itself, and the delay can later be read out of the signal's cepstrum. The authors ask whether such a watermark, placed in the training data rather than in the model, survives the training of modern audio-to-audio generative models, and they report that it does: when every clip of a corpus carries a single echo at a fixed delay, models as different as the differentiable synthesizer DDSP, the adversarial autoencoder RAVE, and the diffusion model Dance Diffusion produce synthesized outputs whose cepstra peak at that same delay. If this holds, a dataset owner can tag audio before release and later test a black-box generative model, with no access to its weights, for whether the tag shows up in its output. The paper also reports that the echo survives fine-tuning, survives mixing and demixing, and partially survives pitch-shift augmentation, and that longer pseudorandom time-spread echo patterns survive in two of the three architectures, increasing the amount of information one tag can carry.","feed_headline":"One echo hides a persistent tag in AI-generated audio","feed_subtitle":"DDSP, RAVE, and Dance Diffusion all reproduce a training-data echo in their output, even after fine-tuning.","key_machinery":"The workhorse is the echo-hiding transform, a one-tap feedforward filter $\\hat{x}[n] = x[n] + \\alpha x[n-\\delta]$ whose short delay (tens of samples at 44.1 kHz) is masked by temporal aliasing of human hearing, so the watermark is imperceptible at moderate $\\alpha$. Detection runs through the cepstrum $c = \\mathrm{ifft}(\\log(|\\mathrm{fft}(x_w)|))$: a time-domain echo is a convolution, so it separates additively in the log-magnitude spectrum and shows up as a peak at lag $\\delta$. The paper's evaluation metric is a z-score over cepstral lags 25 to 125 (Eq. 5) on model outputs, comparing models trained on watermarked data against clean-trained baselines over 100 test stems per instrument from MUSDB18-HQ. For the high-capacity variant, the machinery is the time-spread echo $\\hat{x} = x \\ast \\alpha p_\\delta$ with a pseudorandom bit pattern mapped to $\\pm 1$, and detection cross-correlates the output cepstrum with the pattern to obtain $c^\\ast$, then z-scores that correlation. The three architectures — DDSP at about 5 million parameters, RAVE at about 32 million, and Dance Diffusion at about 222 million — are chosen to span very different inductive biases, so a positive result across all three is what supports the generality of the tag.","core_discovery":"The central claim is that a single echo embedded in every training clip acts as a persistent, detectable tag on a trained audio-to-audio model. Concretely, the authors take a training corpus and form $\\hat{x}[n] = x[n] + \\alpha x[n-\\delta]$ with $\\alpha = 0.4$ and $\\delta$ between 50 and 100 samples at a 44.1 kHz rate; they train DDSP, RAVE, or Dance Diffusion on the watermarked corpus; and they then feed unseen audio into the model and compute the cepstrum $c = \\mathrm{ifft}(\\log(|\\mathrm{fft}(x_w)|))$ of the output. The synthesized audio shows a cepstral peak at the embedded delay $\\delta$ that a clean-trained model does not produce, across three corpora (Groove drums, VocalSet singing, GuitarSet guitar). The paper reports this for all three architectures, with the echo reproduced most strongly by DDSP, clearly but more weakly by RAVE, and by Dance Diffusion with some confusion between adjacent lags. The same procedure with a pseudorandom time-spread pattern $p_\\delta[n] = 2p[n-\\delta] - 1$ at a much smaller $\\alpha = 0.01$, detected by cross-correlating the output cepstrum with the pattern, also works for RAVE and DDSP and carries far more bits. The paper additionally reports that the single echo survives fine-tuning a diffusion model, survives mixing the outputs of three differently tagged models and demixing them with a source-separation network, and survives pitch-shift augmentation up to a 90% shift probability, with degraded but still detectable separation.","pith_inferences":["The most plausible mechanism consistent with these results is statistical: the echo is a linear, stationary operation applied to every clip, so any waveform-domain model that matches the marginal statistics of its training distribution has an incentive to reproduce the resulting autocorrelation structure; if that is the mechanism, the same tag should appear in other waveform-domain generators, inc","The paper leaves implicit a design rule for practitioners: since Dance Diffusion confused adjacent lags 75 and 76, tags should use well-separated lags for large diffusion models, while the simpler models can afford denser lag spacing and hence more bits.","The per-gender tagging experiment suggests the tag can be attribute-specific within one dataset; extended to per-licensor or per-artist patterns, the scheme becomes a forensic fingerprint for screening a model's outputs before release to detect unlicensed training data, an audit use case the paper describes but does not develop into a procedure."],"forward_implications":["A dataset owner can tag a corpus before training with two lines of signal processing, then later probe any released black-box audio-to-audio model by checking its output cepstrum for the embedded lag — no access to weights or training logs needed.","The tag's survival of fine-tuning and of mixing/demixing means the watermark travels through realistic production pipelines: a model that is fine-tuned by a third party or whose outputs are embedded in a mix still reveals its training data's tag.","Because 1024-bit time-spread patterns survive in RAVE and DDSP with detection confidence that grows with output length, the scheme can carry far more than a single bit-pattern signature — enough for per-artist, per-instrument, or per-licensor tags within one dataset.","Detection strength orders by architecture (DDSP most reliable, RAVE next, Dance Diffusion weakest and prone to confusing adjacent lags), so the practical embedding strength and lag spacing must be chosen with the target model's complexity in mind."],"supporting_citations":[{"why":"Supplies the original echo-hiding watermark and its cepstral peak decoding, which the paper repurposes from payload communication to training-data tagging.","marker":"[17]"},{"why":"Supplies the time-spread echo method, the pseudorandom pattern embedding and the cepstral cross-correlation detector used for the high-capacity experiments.","marker":"[22]"},{"why":"Defines the DDSP architecture, the simplest of the three models whose echo reproduction is reported.","marker":"[12]"},{"why":"Defines the RAVE architecture, the adversarial autoencoder whose echo reproduction and pitch-shift tolerance are measured.","marker":"[5]"},{"why":"Defines the Dance Diffusion architecture, the largest model tested, including the stochastic conditioning used for style transfer.","marker":"[13]"},{"why":"Provides the Groove drum corpus used to train the drum models with embedded echoes.","marker":"[16]"},{"why":"Provides the VocalSet singing corpus used to train the vocal models, including the male/female subgroup tagging experiment.","marker":"[31]"},{"why":"Provides the GuitarSet guitar corpus used to train the guitar models.","marker":"[32]"},{"why":"Provides the MUSDB18-HQ stems used as the evaluation inputs for every z-score measurement.","marker":"[24]"},{"why":"Supplies the source-separation model (the paper's 'hybrid Demucs') used in the mixing/demixing survival experiment.","marker":"[9]"}],"fun_headline_variants":["Echo in training data tags AI audio models for life","One echo leaves permanent tag on generative audio","Imperceptible echo survives fine-tuning in audio AIs","Training echo marks AI audio even after mixing and pitch shift"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise of the evaluation is that the z-score of Eq. 5 detects a cepstral peak at the embedded echo lag, but as printed that formula divides the mean of the surrounding cepstrum by its standard deviation and contains no term involving the cepstral value at the lag itself, so it cannot by itself indicate a peak; if the released code computes a corrected metric, the printed equation is a typo, and this discrepancy must be resolved for the experimental conclusions to hold.","fun_headline_variants_meta":{"raw":{"variants":["Echo in training data tags AI audio models for life","One echo leaves permanent tag on generative audio","Imperceptible echo survives fine-tuning in audio AIs","Training echo marks AI audio even after mixing and pitch shift"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000363,"raw_usage":{"total_tokens":2016,"prompt_tokens":1064,"completion_tokens":952,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":680,"completion_tokens_details":{"reasoning_tokens":888}},"tokens_in":680,"tokens_out":952,"duration_ms":7453,"temperature":1.0,"reasoning_tokens":888,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T15:44:27.739484+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the released code and model outputs and test the detection claim directly: for each synthesized clip, check whether the cepstrum has a genuine local maximum at the embedded lag ($c[\\delta] > c[j]$ for every $j$ in the band from 25 to 125 samples), comparing models trained on watermarked data with models trained on clean data. If a corrected peak-based metric no longer separates the two distributions the way Figures 3–6 report, the claim that echoes survive training fails; if the separation survives, the printed z-score formula (Eq. 5) is a typo and the underlying claim stands.","supporting_citations":[{"cited_title":"Ddsp: Differentiable digital signal processing","cited_arxiv_id":null,"evidence_quote":"Defines the DDSP architecture, the simplest of the three models whose echo reproduction is reported."},{"cited_title":"Echo hiding","cited_arxiv_id":null,"evidence_quote":"Supplies the original echo-hiding watermark and its cepstral peak decoding, which the paper repurposes from payload communication to training-data tagging."},{"cited_title":"Time-spread echo method for digital audio watermarking","cited_arxiv_id":null,"evidence_quote":"Supplies the time-spread echo method, the pseudorandom pattern embedding and the cepstral cross-correlation detector used for the high-capacity experiments."},{"cited_title":"Dance diffusion","cited_arxiv_id":null,"evidence_quote":"Defines the Dance Diffusion architecture, the largest model tested, including the stochastic conditioning used for style transfer."},{"cited_title":"Learning to groove with inverse sequence transformations","cited_arxiv_id":null,"evidence_quote":"Provides the Groove drum corpus used to train the drum models with embedded echoes."},{"cited_title":"Vocalset: A singing voice dataset","cited_arxiv_id":null,"evidence_quote":"Provides the VocalSet singing corpus used to train the vocal models, including the male/female subgroup tagging experiment."},{"cited_title":"Guitarset: A dataset for guitar transcription","cited_arxiv_id":null,"evidence_quote":"Provides the GuitarSet guitar corpus used to train the guitar models."},{"cited_title":"Musdb18-hq - an uncompressed version of musdb18, August 2019","cited_arxiv_id":null,"evidence_quote":"Provides the MUSDB18-HQ stems used as the evaluation inputs for every z-score measurement."}],"review_version":1}