CRAW: Codec Robust Audio Watermarking

Source code for CRAW, a robust audio watermarking method built on STFT-magnitude-domain embedding. An encoder embeds a binary message into an audio clip's magnitude spectrogram (phase is preserved from the clean signal); a decoder recovers the message under a wide range of signal-processing, neural-codec, denoising, and vocoder attacks.

This repository is a fork of TimbreWatermarking (NDSS 2024), extended with:

• Robust distortion layer — differentiable attack simulation (noise, filtering, FACodec, MP3, spectral gating, ...) during training.
• Q-Former pooling — attention-based aggregation of the extracted watermark features, replacing simple mean pooling.
• PESQ masking — at inference time, a per-sample mask restores clean spectrogram content in the cells least useful for robustness (by PESQ-gradient magnitude), trading a small, tunable amount of robustness for a fidelity gain.
• Error-correcting codes (ECC) — repetition, Reed–Solomon, LDPC, and BCH codecs wrapping the raw message bits.

Repository layout

• watermarking_model/ — all watermarking model code: architecture (model/), training (train.py), attack simulation (distortions/, utils/distortions.py), evaluation (eval/), and export/exp scripts (scripts/).

Setup

Requires Python 3.8.

The vendored third-party dependencies below aren't bundled in this repo. They're only needed for the FACodec/denoiser/TiCodec attacks specifically — not for basic embed/decode verification (see Inference below). If you want to run those attacks, clone the public repos yourself into the paths shown:

git clone https://github.com/lifeiteng/naturalspeech3_facodec.git watermarking_model/naturalspeech3_facodec
git clone https://github.com/modelscope/ClearerVoice-Studio.git watermarking_model/ClearerVoice-Studio
git clone https://github.com/y-ren16/TiCodec.git watermarking_model/codecs/ticodec_repo

Python dependencies for the main training/evaluation pipeline are listed in watermarking_model/requirements.txt. For codec attack rendering (EnCodec, TiCodec), we recommend a separate conda environment per codec, since each has its own — sometimes conflicting — dependencies; see the setup instructions in each script's docstring (codecs/encode_*.py).

Data

Training and evaluation use LibriSpeech (train + test splits) and, for the zero-shot cross-domain experiments, LJSpeech. Dataset paths are set in the path.raw_path field of each experiment's train config (watermarking_model/config/**/train_*.yaml) and via --audio_dir on the eval/export scripts — point these at your own local copies of LibriSpeech and LJSpeech.

Training

cd watermarking_model
python3 train.py \
  -p config/process.yaml \
  -m config/craw/model.yaml \
  -t config/craw/train.yaml

This trains the full model (robust distortion layer + Q-Former + repetition ECC) — the configuration used for CRAW's main results. Training logs to Weights & Biases under the craw project; set WANDB_ENTITY/log in via wandb login for your own account first.

Training uses a fixed random seed (2022, set in train.py for random/numpy/torch/torch.cuda) for reproducibility.

PESQ masking is applied at export/inference time, not during training — see scripts/export_watermarked_dynamic.py --grad_mode spect_ft.

Inference

A pretrained CRAW checkpoint (epoch 20, matching the paper's main results) is bundled directly in this submission — no download needed — at watermarking_model/results/craw/ckpt/pth/ (config/craw/model.yaml's test.model_path points here).

To embed a message into one WAV file and immediately decode it back (no attack applied) as a quick sanity check:

cd watermarking_model
python3 -m scripts.infer \
  -p config/process.yaml \
  -m config/craw/model.yaml \
  -t config/craw/train.yaml \
  --input /path/to/clean.wav \
  --output /path/to/watermarked.wav \
  --ckpt 20

This prints the embedded/decoded message and bit accuracy. For the full attack-suite evaluation used in the paper, see eval/common_test.py below.

Evaluation

eval/common_test.py runs the full attack suite (classical signal processing, neural codecs, denoisers, vocoders) against a trained checkpoint and reports per-attack decode accuracy and fidelity (SI-SNR, PESQ, STOI).

eval/tpr_eval.py calibrates a per-model detection threshold from clean-audio false-positive rates and reports TPR at a shared FPR; eval/compare_tpr.py aggregates results across experiments into the paper's comparison tables with paired-bootstrap significance testing. scripts/plot_ablation_sweep.py, scripts/plot_fidelity_sweep.py, scripts/visualize_mask.py, and scripts/visualize_mask_zoom.py generate the paper's figures.

Citation

If you use this code, please cite:

@article{chernin2026craw,
  title={CRAW: Codec Robust Audio Watermarking},
  author={Chernin, David and Fetaya, Ethan},
  journal={arXiv preprint arXiv:2609.03107},
  year={2026},
  url={https://arxiv.org/abs/2609.03107}
}

Acknowledgments

Built on TimbreWatermarking (NDSS 2024). Uses NaturalSpeech3 FACodec, ClearerVoice-Studio, TiCodec, and EnCodec for codec/denoiser attacks.