MerkleSpeech: Public-Key Verifiable, Chunk-Localised Speech Provenance via Perceptual Fingerprints and Merkle Commitments

• URL: http://arxiv.org/abs/2602.10166v1
• Date: Tue, 10 Feb 2026 11:58:19 GMT
• Title: MerkleSpeech: Public-Key Verifiable, Chunk-Localised Speech Provenance via Perceptual Fingerprints and Merkle Commitments
• Abstract summary: We propose MerkleSpeech, a system for public-key verifiable, chunk-localised speech provenance.<n>The system computes perceptual fingerprints over short speech chunks, commits them in a Merkle tree whose root is signed with an issuer key.<n>We present experiments targeting very low false positive rates under resampling, bandpass filtering, and additive noise.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Speech provenance goes beyond detecting whether a watermark is present. Real workflows involve splicing, quoting, trimming, and platform-level transforms that may preserve some regions while altering others. Neural watermarking systems have made strides in robustness and localised detection, but most deployments produce outputs with no third-party verifiable cryptographic proof tying a time segment to an issuer-signed original. Provenance standards like C2PA adopt signed manifests and Merkle-based fragment validation, yet their bindings target encoded assets and break under re-encoding or routine processing. We propose MerkleSpeech, a system for public-key verifiable, chunk-localised speech provenance offering two tiers of assurance. The first, a robust watermark attribution layer (WM-only), survives common distribution transforms and answers "was this chunk issued by a known party?". The second, a strict cryptographic integrity layer (MSv1), verifies Merkle inclusion of the chunk's fingerprint under an issuer signature. The system computes perceptual fingerprints over short speech chunks, commits them in a Merkle tree whose root is signed with an issuer key, and embeds a compact in-band watermark payload carrying a random content identifier and chunk metadata sufficient to retrieve Merkle inclusion proofs from a repository. Once the payload is extracted, all subsequent verification steps (signature check, fingerprint recomputation, Merkle inclusion) use only public information. The result is a splice-aware timeline indicating which regions pass each tier and why any given region fails. We describe the protocol, provide pseudocode, and present experiments targeting very low false positive rates under resampling, bandpass filtering, and additive noise, informed by recent audits identifying neural codecs as a major stressor for post-hoc audio watermarks.

Related papers

• DenMark: Robust Semantic Watermarking for Diffusion Language Models [56.836684262732994]
  DenMark is a semantic watermarking framework for diffusion language models (DLMs)<n>It injects key-dependent signals directly into the DLM denoising process.<n>It partitions the output into fixed token regions and uses temporary rollouts as semantic lookahead.<n>For detection, DenMark uses calibrated scanning over candidate unit sizes to remain robust to boundary shifts introduced by semantic attacks.
  arXiv  Detail & Related papers  (2026-09-13T03:37:48Z)
• Watermarks Without Verification: AI Text Watermarking After the EU AI Act [49.51124343181601]
  Article 50 of the EU AI Act requires generative AI providers to mark the content their systems produce and ensure it can be detected as AI-generated.<n>Anthropic disclosed that every Claude model released after that date embeds a watermark based on SynthID-Text in all generated text, enabled by default with no user opt-out.<n>We argue that neither the objections nor the assurances can currently be verified and that this unverifiability, rather than watermarking itself, is the substantive governance failure.
  arXiv  Detail & Related papers  (2026-09-09T01:56:17Z)
• Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks [68.64050157343334]
  Existing watermarks preserve provenance under editing, but this same robustness allows an adversary to alter critical content while retaining attribution.<n>We introduce an innovative watermark that jointly provides provenance and tamper evidence.<n>The signals share the same mechanism but use independent keys and different seeding windows over normalized text, making one resilient to edits and the other sensitive to reader-visible changes.
  arXiv  Detail & Related papers  (2026-08-13T01:55:16Z)
• DHMark: Public-Key Watermarking for LLM-Generated Text via Diffie-Hellman-Guided Rejection Sampling [3.785115615093019]
  DHMark is a public-key watermarking framework for large language model (LLM) generated text.<n>During generation, a Diffie-Hellman-guided token-labeling interface assigns each candidate token a public equation vote.<n>Third-party verifiers use public information to extract token votes, aggregate them into equation-level evidence, and score only signed registry records.
  arXiv  Detail & Related papers  (2026-08-04T04:08:40Z)
• Selective Disclosure Watermarking for Large Language Models [16.579884795891754]
  We propose Hierarchical Vocabulary Routing (HeRo), a watermarking framework that enables selective disclosure of embedded metadata.<n>We show that the proposed scheme preserves the unbiasedness of the underlying sampling process and thus maintains text quality.
  arXiv  Detail & Related papers  (2026-07-06T17:32:01Z)
• QuantileMark: A Message-Symmetric Multi-bit Watermark for LLMs [43.011999511057134]
  QuantileMark is a white-box watermark that embeds messages within a cumulative probability interval.<n>It partitions this interval into $M$ equal-mass bins and samples strictly from the bin assigned to the target symbol.<n>For detection, the verifier reconstructs the same partition under teacher forcing, computes posteriors over latent bins, and aggregates evidence for verification.
  arXiv  Detail & Related papers  (2026-04-15T12:22:40Z)
• Authenticated Contradictions from Desynchronized Provenance and Watermarking [48.47756819432157]
  This work formalizes and empirically demonstrates the $textitIntegrity Clash$, a condition in which a digital asset carries a cryptographically valid C2PA manifest asserting human authorship.<n>We propose a cross-layer audit protocol that jointly evaluates provenance metadata and watermark detection status, achieving 100% classification accuracy across 3,500 test images.
  arXiv  Detail & Related papers  (2026-03-02T20:42:12Z)
• Unforgeable Watermarks for Language Models via Robust Signatures [12.643204293013007]
  We introduce two novel guarantees: unforgeability and recoverability.<n>We construct the first undetectable watermarking scheme that is robust, unforgeable, and recoverable.
  arXiv  Detail & Related papers  (2026-02-17T03:09:06Z)
• Speech Watermarking with Discrete Intermediate Representations [45.892635912641836]
  We propose a novel speech watermarking framework that injects watermarks into the discrete intermediate representations of speech.<n>DiscreteWM achieves state-of-the-art performance in robustness and imperceptibility, simultaneously.<n>Our flexible frame-wise approach can serve as an efficient solution for both voice cloning detection and information hiding.
  arXiv  Detail & Related papers  (2024-12-18T14:57:06Z)
• Bileve: Securing Text Provenance in Large Language Models Against Spoofing with Bi-level Signature [39.973130114073605]
  We introduce a bi-level signature scheme, Bileve, which embeds fine-grained signature bits for integrity checks. Bileve can differentiate 5 scenarios during detection, reliably tracing text and regulating LLMs.
  arXiv  Detail & Related papers  (2024-06-04T03:58:14Z)
• An Unforgeable Publicly Verifiable Watermark for Large Language Models [84.2805275589553]
  Current watermark detection algorithms require the secret key used in the watermark generation process, making them susceptible to security breaches and counterfeiting during public detection. We propose an unforgeable publicly verifiable watermark algorithm named UPV that uses two different neural networks for watermark generation and detection, instead of using the same key at both stages.
  arXiv  Detail & Related papers  (2023-07-30T13:43:27Z)
• Who Wrote this Code? Watermarking for Code Generation [53.24895162874416]
  We propose Selective WatErmarking via Entropy Thresholding (SWEET) to detect machine-generated text. Our experiments show that SWEET significantly improves code quality preservation while outperforming all baselines.
  arXiv  Detail & Related papers  (2023-05-24T11:49:52Z)
• Watermarking Text Generated by Black-Box Language Models [103.52541557216766]
  A watermark-based method was proposed for white-box LLMs, allowing them to embed watermarks during text generation. A detection algorithm aware of the list can identify the watermarked text. We develop a watermarking framework for black-box language model usage scenarios.
  arXiv  Detail & Related papers  (2023-05-14T07:37:33Z)
• Quantum Proofs of Deletion for Learning with Errors [91.3755431537592]
  We construct the first fully homomorphic encryption scheme with certified deletion. Our main technical ingredient is an interactive protocol by which a quantum prover can convince a classical verifier that a sample from the Learning with Errors distribution in the form of a quantum state was deleted.
  arXiv  Detail & Related papers  (2022-03-03T10:07:32Z)
• Tracing Text Provenance via Context-Aware Lexical Substitution [81.49359106648735]
  We propose a natural language watermarking scheme based on context-aware lexical substitution. Under both objective and subjective metrics, our watermarking scheme can well preserve the semantic integrity of original sentences.
  arXiv  Detail & Related papers  (2021-12-15T04:27:33Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.