--- title: Watermark-Spoofing Dataset url: https://www.emergentmind.com/topics/watermark-spoofing-dataset type: topic --- # Watermark-Spoofing Dataset Searching arXiv for the specified dataset paper and closely related watermark-spoofing benchmark papers to ground the article. The Watermark-Spoofing dataset is a watermark-augmented benchmark for audio anti-spoofing in which established spoof-detection corpora are systematically transformed with audio watermarks in order to measure how watermark-induced perturbations alter bonafide/spoof discrimination [2509.20736]. It was introduced as part of the first study on the impact of audio watermarking on audio anti-spoofing countermeasures, with the explicit aims of quantifying the effect of both handcrafted and neural watermarking methods on state-of-the-art spoofing detectors, providing dedicated training and held-out evaluation corpora under controlled watermark-density conditions, and serving as a public benchmark for watermark-resilient anti-spoofing research [2509.20736]. ## 1. Research setting and intended use Modern audio anti-spoofing systems are typically trained on clean or conventionally augmented speech, whereas real deployments may involve invisible watermarks inserted for copyright or provenance purposes. In the dataset description, such watermarks are treated as structured perturbations that can constitute a previously unstudied domain shift, and the benchmark is designed to make that shift measurable under controlled conditions [2509.20736]. The benchmark has three stated objectives. First, it evaluates how a variety of handcrafted and neural-network watermarking methods affect spoof detectors. Second, it provides a training corpus and held-out evaluation corpora with explicit watermark ratios. Third, it establishes a public benchmark for developing robust, watermark-resilient anti-spoofing countermeasures. A central empirical claim associated with the benchmark is that watermarking consistently degrades anti-spoofing performance, with higher watermark density correlating with higher Equal Error Rates (EERs), and that naïve training on watermarked data only sometimes helps and usually hurts clean-data performance [2509.20736]. This design places the dataset at the intersection of watermarking, speech deepfake detection, and domain adaptation. A plausible implication is that the dataset is not merely an augmentation pack, but a controlled stress test for assessing whether anti-spoofing models rely on brittle signal cues that are destabilized by watermark overlays. ## 2. Source corpora and waveform preprocessing The dataset is built by augmenting four pre-existing anti-spoofing corpora: ASVspoof 2019 Logical Access training, ASVspoof 2021 Logical Access evaluation, ASVspoof 2021 DeepFake evaluation, and In-the-Wild evaluation [2509.20736]. | Corpus | Role in benchmark | Approximate composition | |---|---|---| | ASVspoof 2019 LA19 | Training source | $\approx 25{,}260$ utterances: $2{,}580$ bonafide + $22{,}680$ spoof | | ASVspoof 2021 LA21 | Evaluation source | $\approx 30{,}750$ utterances: $7{,}359$ bonafide + $23{,}391$ spoof | | ASVspoof 2021 DF21 | Evaluation source | $\approx 12{,}880$ utterances: $2{,}582$ bonafide + $10{,}298$ spoof | | In-the-Wild | Evaluation source | $\approx 1{,}800$ utterances, balanced bonafide/spoof | All waveforms undergo a common preprocessing pipeline. They are resampled to 16 kHz, normalized or pad/truncated to 64,600 samples, corresponding to approximately 4.03 seconds, and processed with RawBoost colored-noise augmentation with random SNR as in Tak et al., ICASSP ’22. The final output format is single-channel mono WAV [2509.20736]. This preprocessing standardizes temporal extent and sampling conditions across corpora that were originally collected for different evaluation protocols. The resulting benchmark isolates watermark effects from confounds due to heterogeneous duration and channel configurations. Because the bonafide/spoof labels are inherited from the source corpora, the watermarking layer becomes an additional nuisance variable rather than a replacement label space. ## 3. Watermarking schemes and density control The benchmark description states that the dataset uses nine distinct watermarking schemes, divided into six handcrafted methods and three DNN-based methods. The handcrafted methods are Blind SVD watermarking, improved phase-coding steganography, LSB amplitude steganography, Frequency Singular Value Coefficient modulation, Patchwork multilayer modulation, and Lifting Wavelet Transform. The DNN-based enumeration lists RobustDNN, WavMark, Timbre, and AudioSeal [2509.20736]. This enumeration creates an internal discrepancy: the text states “nine distinct watermarking schemes” and “three DNN-based,” but it then lists four DNN-based methods. This suggests a mismatch between the stated total and the explicit method list rather than a substantive ambiguity about the methods actually named [2509.20736]. The dataset defines a nominal watermark density $$ d \;=\; \frac{\text{length of watermark bits } L_\text{watermark}}{\text{length of host signal bits } L_\text{signal}}. $$ In practice, however, the benchmark controls the proportion of utterances in each split that carry any watermark, while the exact bit-rate varies by method and is chosen to be imperceptible, with distortion below 1% [2509.20736]. The dataset-level watermark ratios are $\{0\%, 25\%, 50\%, 75\%\}$. A further design choice is the treatment of mixed-watermark splits. In such splits, DNN and handcrafted methods are present in equal proportion, and within each group all methods are equally likely [2509.20736]. This makes the benchmark suitable for evaluating method-specific sensitivity as well as robustness to heterogeneous watermark families. It also means that “watermarked” is not a single nuisance source but a mixture distribution spanning transform-domain, steganographic, and learned watermarking procedures. ## 4. Dataset organization, splits, and metadata The training portion, termed Watermark-Spoofing Training, is derived from LA19 train. It contains 25,260 utterances in total, consisting of 2,580 bonafide and 22,680 spoof utterances. Exactly 50% are watermarked, approximately 12,630 utterances, and 50% are clean. Within the watermarked half, 50% are DNN-based and 50% are handcrafted, and the split is class-balanced across bonafide and spoof [2509.20736]. The evaluation portion, termed Watermark-Spoofing Seen Evaluation, releases three parallel variants for each of LA21, DF21, and ITW: 75% watermarked plus 25% clean, 50% watermarked plus 50% clean, and 25% watermarked plus 75% clean. All retain the original bonafide/spoof proportions of the underlying corpora [2509.20736]. For LA21, whose size is approximately 30,750 utterances, the example breakdowns are 23,063 watermarked and 7,688 clean for the 75% variant, 15,375 watermarked and 15,375 clean for the 50% variant, and 7,688 watermarked and 23,063 clean for the 25% variant [2509.20736]. The released files are 16 kHz single-channel WAV with 16-bit PCM encoding. The directory structure includes `train_LA19/clean`, `train_LA19/watermarked/handcrafted`, `train_LA19/watermarked/dnn_based`, and evaluation directories such as `eval_LA21_75`, `eval_DF21_50`, and `eval_ITW_25`. Filenames follow the pattern `__