1Institute of Neuroinformatics, University of Zurich and ETH Zurich, Switzerland 2NAVER Cloud
Speech language models such as Moshi generate audio as discrete codec tokens. A token-level watermark
biases those tokens during generation, but decoding the tokens to a waveform and encoding it again changes some token
identities, and repeated codec passes erase most of the signal. Redwing builds the watermark around these
substitutions. Tokens that replace each other under retokenization define a smooth basis, and in that basis the embedding
and detection functions are optimized so that the watermark survives resynthesis, within the same distortion (KL) budget as KGW.
This page plays watermarked and unwatermarked speech from three models, and the same clips after repeated codec passes.
How it works
Figure 1 of the paper. Token IDs, graphs and matrices are schematic.
The watermark biases the codec tokens that the model samples, using a secret key and an embedding function g. The
detector re-encodes the received audio with the model's codec and sums a keyed score h over the recovered tokens.
Because g and h are built from the substitutions that decoding and re-encoding actually make, the score
survives resynthesis through neural codecs. The speech model and the codec weights are unchanged.
How to read the samples
Each watermarked clip sits beside its own unwatermarked clip. WMAR's unwatermarked clip comes from the same
fine-tuned decoder. CRAW, a post-hoc waveform watermark, is embedded into the unwatermarked clip of the same row.
On Moshi, every column is a separate answer to the same spoken question, because the watermark changes which tokens
are sampled, so the answers differ in content. The answer's text stream is printed under each player. The TTS models
read the same sentence in every column.
Detected and
Not detected are the paper's decisions for that exact
clip at each method's fixed threshold. The threshold is set on unwatermarked calibration answers so that at most 1% of
them exceed it, and it is never recalibrated for an attack. Token-domain methods also show their score z.
Post-hoc scores are on other scales, so only the decision is shown.
Moshi is watermarked on streams 1–4 at δ = 0.7, CosyVoice3 at δ = 0.9 and MOSS-TTS on heads 1–16 at δ = 0.9. KGW
uses δ = 2 on the same streams. WMAR is shown in its FT variant; FT+Augs is in the paper.
All audio is served as the evaluated files, 24 kHz WAV copied byte for byte with no re-encoding. The spoken prompts
are the original WildVoice recordings.
Moshi
Full-duplex spoken dialogue with the Mimi codec. Each card is one test question.
Drawn by the stated rule, not hand-picked
1
Spoken prompt (human recording)
“Give theoretical framework of female's health and education.”
Token domain
Unwatermarked
I'm here to learn more about the education system in Italy. Can you tell me about the different levels of schooling?
Redwing
Detectedz = 7.15 · threshold 2.94
is a fundamental property of electromagnetism, which is responsible for the characteristic behavior of electric and magnetic fields.
KGW
Detectedz = 5.09 · threshold 2.97
The author's purpose in writing the book was to inform readers about the importance of education and the role it plays in the lives of women.
WMAR (fine-tuned Mimi decoder)
Unwatermarked (FT decoder)
I'm here to learn more about the education system in Italy. Can you tell me about the different levels of schooling?
WMAR FT
Detectedz = 9.97 · threshold 3.14
The author's purpose in writing the book was to inform readers about the importance of education and the role it plays in the lives of women.
Post-hoc waveform watermark
CRAW (post-hoc)
Detected
Embedded into the Unwatermarked clip of this row.
2
Spoken prompt (human recording)
“Why is the statistic 16% of drinkers usually consume 5 or more standard drinks concerning?”
Token domain
Unwatermarked
Sure, I'll be happy to help you with that. What information do you need?
Redwing
Detectedz = 7.74 · threshold 2.94
It's not that they drink faster than usual. They simply have a much better ability to consume alcohol than the rest of us.
KGW
Detectedz = 3.29 · threshold 2.97
plus sur 100.
WMAR (fine-tuned Mimi decoder)
Unwatermarked (FT decoder)
Sure, I'll be happy to help you with that. What information do you need?
WMAR FT
Detectedz = 4.25 · threshold 3.14
plus sur 100.
Post-hoc waveform watermark
CRAW (post-hoc)
Detected
Embedded into the Unwatermarked clip of this row.
3
Spoken prompt (human recording)
“"Ripped a piece of his arm for her to be romantic" what does it mean by that? Make it a breakdown. Also tell me, it means that the speaker has ripped a piece of his arm so that her starting to be more romantic, or the speaker has ripped a piece of his arm as a act of romance?”
Token domain
Unwatermarked
a off someone, or you can also say that it means to make someone's heart a little bit more happy. It's a bit of an old fashioned way of saying it, but it's still used sometimes.
Redwing
Detectedz = 8.65 · threshold 2.94
2007 suggests that it should be interpreted as a piece of writing, like a letter, speech, or poem, and that it could be used to express love, but it's not necessarily a romantic act.
KGW
Detectedz = 6.34 · threshold 2.97
well, it's a practice that allows someone to have their arms around another person's shoulders, often used in a romantic context.
WMAR (fine-tuned Mimi decoder)
Unwatermarked (FT decoder)
a off someone, or you can also say that it means to make someone's heart a little bit more happy. It's a bit of an old fashioned way of saying it, but it's still used sometimes.
WMAR FT
Detectedz = 7.01 · threshold 3.14
well, it's a practice that allows someone to have their arms around another person's shoulders, often used in a romantic context.
Post-hoc waveform watermark
CRAW (post-hoc)
Detected
Embedded into the Unwatermarked clip of this row.
CosyVoice3
Text-to-speech. Each card is one test sentence.
Drawn by the stated rule, not hand-picked
1
Sentence read
“Saudi is a tax haven, so you won't have to pay any taxes in Australia. However, if you're a tax resident in Australia, you'll still have to file your taxes and pay any applicable taxes.”
Token domain
Unwatermarked
Redwing
Detectedz = 8.79 · threshold 2.80
KGW
Detectedz = 7.15 · threshold 3.00
Post-hoc waveform watermark
CRAW (post-hoc)
Detected
Embedded into the Unwatermarked clip of this row.
2
Sentence read
“is a percentage of time a player spends on the field. It is used to compare the performance of players and teams.”
Token domain
Unwatermarked
Redwing
Detectedz = 7.57 · threshold 2.80
KGW
Detectedz = 7.04 · threshold 3.00
Post-hoc waveform watermark
CRAW (post-hoc)
Detected
Embedded into the Unwatermarked clip of this row.
3
Sentence read
“magic 1 library from the LGPL license.”
Token domain
Unwatermarked
Redwing
Detectedz = 5.40 · threshold 2.80
KGW
Detectedz = 4.24 · threshold 3.00
Post-hoc waveform watermark
CRAW (post-hoc)
Detected
Embedded into the Unwatermarked clip of this row.
MOSS-TTS Delay-8B
Text-to-speech. Each card is one test sentence.
Drawn by the stated rule, not hand-picked
1
Sentence read
“That's a great question. However, harivastra is the correct word to use. Karma is a concept from Hinduism, and the plural form is harivastra.”
Token domain
Unwatermarked
Redwing
Detectedz = 24.38 · threshold 2.96
KGW
Detectedz = 7.67 · threshold 2.60
Post-hoc waveform watermark
CRAW (post-hoc)
Detected
Embedded into the Unwatermarked clip of this row.
2
Sentence read
“there may be some presets or settings that allow you to do this, but I'm not sure. can try looking in the preferences or options menu.”
Token domain
Unwatermarked
Redwing
Detectedz = 19.68 · threshold 2.96
KGW
Detectedz = 9.15 · threshold 2.60
Post-hoc waveform watermark
CRAW (post-hoc)
Detected
Embedded into the Unwatermarked clip of this row.
3
Sentence read
“military and emphasised on chivalry, elegance, and gentleness as opposed to the combative and bulwark nature of the armed knights.”
Token domain
Unwatermarked
Redwing
Detectedz = 23.59 · threshold 2.96
KGW
Detectedz = 7.33 · threshold 2.60
Post-hoc waveform watermark
CRAW (post-hoc)
Detected
Embedded into the Unwatermarked clip of this row.
Robustness to repeated resynthesis
Each pass decodes the waveform with a neural codec and encodes it again. The clips below are the audio the
detector received, and each mark is the detector's decision on that clip.
Moshi
Row 1 of the Moshi samples (question: “Give theoretical framework of female's health and education.”).
Unwatermarked
Redwing
KGW
WMAR FT
CRAW (post-hoc)
As generated
Unwatermarked
Redwing
Detectedz = 7.15 · threshold 2.94
KGW
Detectedz = 5.09 · threshold 2.97
WMAR FT
Detectedz = 9.97 · threshold 3.14
CRAW (post-hoc)
Detected
Mimi × 1
Unwatermarked
Redwing
Detectedz = 7.18 · threshold 2.94
KGW
Detectedz = 4.11 · threshold 2.97
WMAR FT
Detectedz = 4.51 · threshold 3.14
CRAW (post-hoc)
Not detected
Mimi × 8
Unwatermarked
Redwing
Detectedz = 5.19 · threshold 2.94
KGW
Not detectedz = 2.55 · threshold 2.97
WMAR FT
Not detectedz = 1.16 · threshold 3.14
CRAW (post-hoc)
Not detected
EnCodec 6 kbps × 8
Unwatermarked
Redwing
Detectedz = 5.30 · threshold 2.94
KGW
Not detectedz = 1.30 · threshold 2.97
WMAR FT
Not detectedz = 1.43 · threshold 3.14
CRAW (post-hoc)
Not detected
DAC 16 kHz × 8
Unwatermarked
Redwing
Not detectedz = 1.41 · threshold 2.94
KGW
Not detectedz = 1.67 · threshold 2.97
WMAR FT
Not detectedz = 2.39 · threshold 3.14
CRAW (post-hoc)
Not detected
CosyVoice3
Row 1 of the CosyVoice3 samples (“Saudi is a tax haven, so you won't have to pay any taxes in Australia. However, if you're a tax resident in Australia, you'll still have to file your taxes and pay any applicable taxes.”).
Unwatermarked
Redwing
KGW
As generated
Unwatermarked
Redwing
Detectedz = 8.79 · threshold 2.80
KGW
Detectedz = 7.15 · threshold 3.00
CosyVoice3 codec (native) × 8
Unwatermarked
Redwing
Detectedz = 6.88 · threshold 2.80
KGW
Not detectedz = 0.75 · threshold 3.00
MOSS-TTS Delay-8B
Row 1 of the MOSS-TTS Delay-8B samples (“That's a great question. However, harivastra is the correct word to use. Karma is a concept from Hinduism, and the plural form is harivastra.”).
Unwatermarked
Redwing
KGW
As generated
Unwatermarked
Redwing
Detectedz = 24.38 · threshold 2.96
KGW
Detectedz = 7.67 · threshold 2.60
MOSS-TTS codec (native) × 8
Unwatermarked
Redwing
Detectedz = 12.32 · threshold 2.96
KGW
Not detectedz = 2.17 · threshold 2.60
Limitations. A time shift by a fraction of a codec frame, such as 40 ms on the 12.5 Hz models
Moshi and MOSS-TTS, or cropping the start of a clip, removes most of the watermark, and repeated DAC 16 kHz passes weaken
it (see the paper's appendix).
Prompt audio
The Moshi prompts are recordings from the WildVoice subset of VoiceBench (Chen et al., 2024,
arXiv:2410.17196;
dataset). They are released under the Apache License 2.0
and redistributed here unmodified; see NOTICE. All other audio on this page is the output of the evaluated
models.
