{"id":"2635db3c-c268-494f-8b22-f307c4e5cd0d","arxiv_id":"2607.21132","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Embedding watermarks inside a codec-like autoencoder's continuous latent space improves EnCodec-24k bit accuracy to ~95–97%, but the gain is in-distribution and does not transfer to EnCodec-16k.","lead":"This paper hides 32-bit messages inside the continuous latent representation of a codec-like speech autoencoder instead of on the waveform, then measures how well the messages survive EnCodec compression. It reports that training on EnCodec-24k raises bit accuracy from 78.8% to 95.6–97.1%, with PESQ falling from 3.727 to about 3.4–3.5.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"No matched waveform-domain control isolates latent placement from attack-aware training; the central causal claim is untested.","rationale":"The reader's weakest assumption correctly identifies the missing control. I examined the full text for any comparison of carrier location under matched training; the backbone probes (SEANet vs DAC) change architecture, not location, and the no-embed diagnostic only removes the residual, not the location. The paper's internal numbers are consistent, and the improvement is real, but the causal attribution to latent placement is the central claim and it is untested. A waveform-domain matched control is feasible and would settle it. I therefore recommend no change to the CONDITIONAL verdict; I would not upgrade to ACCEPT or downgrade to REJECT, because the concern is addressable and the paper is explicitly framed as an investigation rather than a final baseline.","tokens_in":9556,"tokens_out":6943,"duration_ms":68357,"concrete_test":"Train a matched waveform-domain control: keep the same SEANet autoencoder, detector, loss function, and the EnCodec-24k-focused attack sampler, but generate the bounded watermark residual in the time domain (e.g., a learned waveform perturbation conditioned on the message) and add it to the input/output waveform rather than to the latent z. Evaluate EnCodec-24k bit accuracy and PESQ on the same 1000-sample test set. If the waveform control achieves bit accuracy comparable to the latent method (within a few points), the latent-space premise is not the cause of codec robustness; if it remains near chance, latent placement is supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim—that embedding in continuous latent space reduces codec mismatch (Section I)—rests on Table I, which only varies the attack sampling distribution (balanced/focused/heavy), not the carrier location. The paper provides no control where the identical embedder/detector/training procedure is applied to a waveform-domain carrier; its only controls (Table II) replace the backbone (SEANet vs DAC-style), leaving location fixed. The no-embed diagnostic and DAC probe do not address location either. Thus the observed EnCodec-24k improvement (78.8% → 95.6%) could be caused entirely by the increased EnCodec-24k exposure in the focused regime (removing the destructive 16k route) and by the heavy regime's higher EnCodec sampling probability (2.5 weight vs 1.0), rather than by the latent carrier. The paper's Limitations section acknowledges EnCodec-16k failure but does not flag this missing isolation, so the load-bearing premise is unsupported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper investigates embedding a 32-bit watermark into the continuous pre-decoder latent of a codec-like SEANet autoencoder, with an RVQ-guided decomposition, a Conformer-based message embedder, and a latent-domain detector. The main empirical result is Table I, where EnCodec-aware training increases EnCodec-24k bit accuracy from 78.8% to 95.6% (focused) and 97.1% (heavy), at the cost of PESQ decreasing from 3.727 to 3.514 and 3.427. The paper also reports backbone controls (SEANet vs. DAC-style), a no-embed diagnostic, and an EnCodec-16k stress condition that remains at chance. The stated goal is to characterize the trade-offs of moving the watermark carrier into the latent representation rather than to propose a production-ready watermarking system.","tokens_in":9851,"tokens_out":4183,"duration_ms":41759,"significance":"If the central claim were established, the paper would provide a useful design insight: that watermark embedding inside a codec-like continuous latent, rather than on the waveform, can reduce the mismatch between insertion and codec-style reconstruction. The paper deserves credit for honestly reporting the EnCodec-16k failure, for running backbone and no-embed diagnostics, and for explicitly distinguishing between the investigated continuous-latent carrier and discrete-token embedding. However, the central causal claim is currently under-supported by the experimental design, for the reasons detailed in the major comments. The contribution is therefore a promising investigation rather than an established result.","major_comments":[{"comment":"The core claim that embedding in a deep latent representation reduces codec mismatch is not isolated from the effect of attack-aware training. The three rows of Table I differ only in the attack sampling distribution (balanced, focused, heavy), not in the carrier location. The EnCodec-24k improvement from 78.8% to 95.6% and 97.1% could plausibly be caused entirely by the focused regime removing the destructive 16k route and by the heavy regime increasing EnCodec sampling weight from 1.0 to 2.5. The paper provides no matched control in which the identical embedder, detector, loss, backbone, and training procedure are applied to a waveform-domain carrier, so the reader cannot tell whether the latent location or the training exposure produces the gain. This is load-bearing because the Introduction and Abstract attribute the robustness to the representational level. Please add such a wavefor","section":"I, Table I, and Section IV-C"},{"comment":"The latent-consistency loss term λ_lat ∥Eθ(A(ˆx))−z_wm∥₂² directly trains the attacked re-encoded latent to be close to the watermarked latent. Since the detector operates on exactly this re-encoded latent, the high EnCodec-24k accuracy is partly a fitted property of the training distribution rather than an emergent property of the latent carrier. The only effectively held-out stress test, EnCodec-16k, remains at chance, which is consistent with the concern that the model has learned a mapping tuned to the specific EnCodec-24k reconstruction path. To support the generalization claim, please report results under codecs or configurations not seen in training (e.g., different EnCodec bitrates/framerates, or HiFiCodec as a true held-out attack), and provide an ablation that removes the λ_lat term to show that detection does not rely on this direct latent alignment.","section":"III-G, Eq. (13), and Section IV-F"},{"comment":"The reported comparison is statistically weak. All numbers come from a single 1000-sample subset with no error bars, confidence intervals, or significance tests. The perceptual differences in ViSQOL (4.590 to 4.553 to 4.531) are small and may not be perceptible, yet PESQ differences are interpreted as a clear trade-off. Additionally, the balanced and focused rows are at 258k steps, while the heavy endpoint is at 222k steps, confounding training duration with the training-regime change; Table II similarly compares the DAC full pipeline at 276k with the SEANet checkpoints at 258k. Please report multiple seeds or subsamples, align step counts, or justify why the step mismatch is not material. Also, the statement in Section IV-B that two 24k EnCodec configurations 'produced the same reconstructed waveform in our evaluation pipeline' should be substantiated (e.g., by showing the merged config","section":"Table I and Table II"}],"minor_comments":[{"comment":"The phrase 'even a mask close to one changes the relative magnitude' is unclear: a mask close to one should change magnitudes only slightly. Clarify that the concern is that any multiplicative scaling, even small, alters the relative scale across channels in a way the decoder is sensitive to.","section":"Eq. (6)"},{"comment":"Figure 1 is referenced in Section III and IV-C but no figure content is visible in the manuscript. Ensure the figure is included in the submitted version.","section":"Figure 1"},{"comment":"The Aura reference lists ICASSP 2026 pages as '16 522–16 526'; the page range is implausible for a conference paper. Please verify the bibliographic details.","section":"Reference [12]"},{"comment":"The comparison with AudioSeal is useful, but it is only mentioned textually; adding a quantitative comparison (even on a subset of attacks) would help the reader calibrate the proposed method's absolute robustness, despite the paper's stated goal of not being a universal baseline.","section":"Section II-B"},{"comment":"The no-embed diagnostic is described as 'not a pure autoencoder ceiling' because the autoencoder is jointly optimized with watermark objectives. This caveat is appreciated; consider also reporting a watermark-free autoencoder PESQ for the identical backbone as an explicit ceiling, as is partially done in Table II.","section":"Section IV-D"}],"recommendation":"major_revision","confidential_remarks":"The paper is a reasonable and honest investigation, but the missing matched waveform-domain control is essential for the central claim. I would be willing to see a revision that adds this control, a held-out codec evaluation, and basic statistical rigor. I also note a possible citation-integrity concern: Reference [12] has an implausible page range for ICASSP and appears to be a self-citation; this should be checked before publication. The writing is clear and the limitations are mostly stated, but the missing isolation of latent placement from training distribution is a limitation that should be explicitly acknowledged."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Hi — quick read of Hu et al., 'Investigating Codec-Internal Latent Audio Watermarking.' The headline: this is a clean, clearly-scoped empirical study, and the authors deserve credit for being honest about what they did and didn't do. But the motivating idea — that embedding in the continuous latent is what gives codec robustness — is unsupported by the experiments. The Table I gains (EnCodec-24k accuracy 78.8% → 95.6% → 97.1% as PESQ drops from 3.727 to 3.427) come from changing the attack training distribution (balanced vs EnCodec-focused vs heavy), not from changing the embedding location. There is no matched waveform-domain control that keeps the same embedder/detector/training pipeline and just moves the carrier. So you can't separate 'latent placement helps' from 'more EnCodec exposure helps.' The only controls swap the backbone, which doesn't address location.\n\nWhat's new: the architecture embeds a trainable watermark in the continuous latent of a jointly-trained codec-like autoencoder, with RVQ-guided decomposition and protected front-layer embedding. That's a genuine departure from AudioSeal (waveform addition) and VoiceMark (fixed pretrained tokenizer). The paper also reports failure modes (EnCodec-16k at chance) and runs useful diagnostics like no-embed and backbone probes. No overclaiming a universal baseline. Good practice.\n\nSoft spots, in order: (1) the missing control is the big one; the intro's 'key intuition' is a hypothesis, not a tested result. (2) No error bars or significance tests; the differences could shrink under seed variation. (3) Evaluation is in-distribution: EnCodec-24k is the trained attack, and the out-of-distribution stress test fails. These are addressable in a revision, not fatal.\n\nWho should read it: anyone working on watermarking for neural speech codecs, especially on carrier-location questions. It's a useful data point: attack-aware training drives robustness; whether the latent carrier adds anything remains open.\n\nPeer-review call: send it out, with instructions that the authors add a matched waveform-domain control and error bars. It deserves referee time because the question is important and the paper is honestly executed, even if its central hypothesis is currently under-supported.","headline":"A scoped, honest exploration of latent-space audio watermarking, but the central claim that latent placement helps codec robustness is never tested against a waveform-domain control.","tokens_in":10300,"tokens_out":3911,"would_cite":true,"duration_ms":75311,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that embedding watermarks in the continuous latent space of a codec-like autoencoder, combined with codec-aware training, substantially improves robustness to neural codecs such as EnCodec-24k at a modest perceptual cost.","keywords":["audio watermarking","neural codec robustness","continuous latent space","EnCodec","residual vector quantization","speech quality","bit accuracy"],"falsifier":"Train the same embedder, detector, loss weights, and codec-aware attack schedule but inject the watermark residual into the input waveform or spectrogram instead of the continuous latent; if EnCodec-24k bit accuracy stays above 95%, the paper's central motivation (latent placement as the cause) would be falsified.","tokens_in":9474,"feed_emoji":"🔊","tokens_out":6436,"duration_ms":52436,"temperature":0.7,"pith_summary":"The paper investigates where in a neural speech-processing pipeline a watermark should live to survive neural codecs such as EnCodec, which re-encode, quantize, and resynthesize speech. Instead of perturbing the waveform or spectrogram, the authors inject a 32-bit message into the continuous latent representation of a codec-like autoencoder, before the decoder creates the output waveform. With training that emphasizes EnCodec-24k reconstruction, bit accuracy under that codec rises from 78.8% to 95.6% and 97.1%, while PESQ falls from 3.727 to 3.514 and 3.427. The authors present this as a characterization of the quality-robustness trade-off, not a universal watermarking baseline, and note that the more destructive EnCodec-16k condition still defeats all current checkpoints.","feed_headline":"Latent-space watermark lifts EnCodec-24k bit accuracy to 97.1%","feed_subtitle":"Moving the watermark before neural decoding lifts EnCodec-24k recovery from 78.8% to 97.1%, at a small quality cost.","key_machinery":"The central mechanism is the continuous latent carrier: a tanh-bounded latent z = tanh(E(x)) from a SEANet-style encoder, into which a Conformer-based embedder injects a message-conditioned bounded residual Δ = tanh(W(u,m)) scaled by α, giving z_wm = z_base + αΔ. RVQ residual components guide the embedder and define a 'protected front' part that the watermark perturbation is projected away from, so the decoder always receives a continuous watermarked latent. Detection recovers the message by re-encoding the attacked waveform and applying a latent-domain detector D(E(A(x̂))). The decisive design choices are keeping RVQ as guidance rather than a hard quantization bottleneck, and using codec-aw","core_discovery":"The central discovery is that a message-conditioned bounded residual injected into the continuous latent representation of a codec-like autoencoder can survive EnCodec-24k re-encoding and resynthesis far better when training is made codec-aware. The shared encoder-decoder and a latent-domain detector are trained jointly, with residual vector quantization (RVQ) used as a guidance and decomposition mechanism rather than a hard reconstruction bottleneck. On 48 kHz speech, shifting from balanced training to EnCodec-24k-focused training improves EnCodec-24k bit accuracy from 78.8% to 95.6%, and further to 97.1% with an EnCodec-heavy attack-sampling schedule, while PESQ decreases from 3.727 to 3.5","pith_inferences":["The paper's premise would be directly testable by running its exact training procedure with the watermark residual added to the input waveform instead of the continuous latent; if the waveform-domain carrier reaches similar EnCodec-24k accuracy, latent placement would not be the driving cause.","The 'protected front' RVQ-guided decomposition suggests that keeping watermark perturbation away from perceptually critical latent directions is what preserves quality; an extension would adapt the protected region per utterance based on codebook usage.","Since EnCodec-16k still defeats all checkpoints, a natural next step is to train across a mixture of codec bitrates or to design a carrier that is invariant to resampling before codec processing, which could yield robustness that transfers.","The paper's framing as a trade-off characterization implies that a universal codec-robust watermark might combine continuous latent embedding (for 24k codecs) with discrete token or index embedding (for extreme codec conditions), exploiting complementary strengths."],"forward_implications":["If the central claim is correct, watermark designers can trade a small perceptual-quality drop for a large robustness gain under 24 kHz neural codecs by moving the carrier into a continuous latent space and training with codec-specific attacks.","The success of the continuous pre-decoder carrier suggests that codec-robust watermarking does not require access to discrete codec tokens or RVQ indices.","The sharp failure on EnCodec-16k shows robustness is tied to the exact codec condition seen in training; it does not automatically transfer to more severe resampling-plus-codec pipelines.","The backbone probes imply that improving autoencoder reconstruction quality alone is insufficient; the whole embedder-detector-backbone system must be trained together with attack-aware objectives.","The reported trade-off curve (PESQ 3.727/78.8%, 3.514/95.6%, 3.427/97.1%) gives a concrete reference point for future continuous latent watermarking systems."],"fun_headline_variants":["Latent watermark: 97% EnCodec recovery from 78.8% baseline","Hidden latent carrier lifts watermark accuracy 18 points","Neural codec watermark: latent embedding beats re-encoding","Latent-space watermarking survives EnCodec with 97% accuracy","EnCodec attack? Latent watermark still hits 97% bit accuracy"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The load-bearing premise is that the robustness gain comes from embedding the watermark in the continuous latent representation, rather than from the codec-aware training of the shared encoder and detector; the paper includes no control with the identical training procedure applied to a waveform-domain carrier.","fun_headline_variants_meta":{"raw":{"variants":["Latent watermark: 97% EnCodec recovery from 78.8% baseline","Hidden latent carrier lifts watermark accuracy 18 points","Neural codec watermark: latent embedding beats re-encoding","Latent-space watermarking survives EnCodec with 97% accuracy","EnCodec attack? Latent watermark still hits 97% bit accuracy"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000593,"raw_usage":{"total_tokens":2612,"prompt_tokens":738,"completion_tokens":1874,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":482,"completion_tokens_details":{"reasoning_tokens":1780}},"tokens_in":482,"tokens_out":1874,"duration_ms":13388,"temperature":1.0,"reasoning_tokens":1780,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-01T08:20:32.662783+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train the same embedder, detector, loss weights, and codec-aware attack schedule but inject the watermark residual into the input waveform or spectrogram instead of the continuous latent; if EnCodec-24k bit accuracy stays above 95%, the paper's central motivation (latent placement as the cause) would be falsified.","supporting_citations":[],"review_version":1}