Speaker Verification, Spoofing and Watermarks

Enroll, score and threshold speakers, detect spoofed audio, and mark every generation with a watermark and C2PA.

Verify and mark#

Task	Code
Verify a speaker	`verify(enroll, test, threshold=0.75)`
EER and its threshold	`eer(same_scores, diff_scores)`
Diarize a meeting	`Pipeline.from_pretrained("pyannote/speaker-diarization-3.1")`
Load the watermark generator	`AudioSeal.load_generator("audioseal_wm_16bits")`
Detect a watermark	`detector.detect_watermark(watermarked, sample_rate=16000)`
Toy spoof feature	`spectral_rolloff(spec, percentile=0.85)`
Toy text watermark	`watermarked_sample(n, seed_prefix, bias=0.9)`
Green-token z-score	`detect(tokens)`

from speechbrain.pretrained import EncoderClassifier

clf = EncoderClassifier.from_hparams(source="speechbrain/spkrec-ecapa-voxceleb")

enroll = torch.stack([clf.encode_batch(load(x))3-5 clean samples

for x in enrollment_clips]).mean(0)average them

score = clf.similarity(enroll, clf.encode_batch(load("test.wav"))).item()

verdict = score > 0.25tune on your data

generator = AudioSeal.load_generator("audioseal_wm_16bits")

detector = AudioSeal.load_detector("audioseal_detector_16bits")

audio = load_wav("generated.wav", sr=16000)[None, None, :]

payload = torch.tensor([[1, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 1, 1, 0]])

watermark = generator.get_watermark(audio, sample_rate=16000, message=payload)

watermarked = audio + watermark

result, decoded_payload = detector.detect_watermark(watermarked, sample_rate=16000)

EER: the threshold where False Accept Rate equals False Reject Rate.
AAM-softmax: $inline$ for the correct class. Typical $inline$ , $inline$ .
Verification: 1:1. Identification: 1:N. Open-set: unenrolled speakers in the test set.
Green list: hash the previous K tokens, add $inline$ to green logits.
z-score: (green count - expected) / $inline$ , $inline$ .
Bit Recovery Accuracy: fraction of payload bits recovered after an attack.

AudioSeal: localized, per frame. Survives MP3, AAC, EQ, ±10% speed, +10 dB SNR noise.
WavMark: 32 bits/sec. Gaussian noise or MP3 compression removes it.
WaveVerify: FiLM generator, Mixture-of-Experts detector. Handles reversal and speed.
Stable Signature: fine-tuned image decoder. Decoder fine-tuning removes it.
SynthID-text: biased next-token sampling. Paraphrase destroys it.
Pitch shift: Bit Recovery Accuracy below 0.6 for all watermarks.

Symptom	Cause	Fix
EER rises on phone calls	Trained on VoxCeleb web video	Evaluate on the target channel
EER degrades sharply	Test audio under 3 seconds	Get longer test audio
Anchor fails for one speaker	One noisy enrollment	Average 3 or more clean samples
Magnitude dominates the score	Embeddings not normalized	L2-normalize first
Detector fails in the real world	AASIST overfits ASVspoof LA	Calibrate on your domain
Watermark gone after an edit	Aggressive pitch shift	Keep a detection fallback
Manifest missing on a rehost	Metadata strip and re-encode	Add a watermark too
Text watermark gone	Paraphrase	Do not rely on it alone

Watermark or detector?: Both. Pitch shift removes most watermarks.
Does a liveness phrase stop clones?: It stops replay, not real-time cloning.
No SynthID signal means real?: No. Other models do not add it.
Why C2PA and a watermark?: Metadata is rich but strippable. Watermarks persist but carry bits.
What do you report with EER?: The EER and the threshold at the EER.