From my perspective, the only fool proof way of removing all audio watermarks from a conversation is to run individual speaker detection, STT detection, and voice cloning algorithms to "recreate" the conversation from scratch.

Even things like background electrical hum have been used in audio forensics.

I've seen the demos of AI systems that can be trained on an individual's voice, and generate new speech in the same voice. If I was waterprinting a meeting, I would train a system like this on the fly on the people in the meeting and use it to dynamically insert filler words (um...) in a unique pattern into the audio stream for each member of the meeting. That would defeat any audio filter tricks or recreating the meeting from scratch, so you would want to summarize/rephrase the meeting too.

> I've seen the demos of AI systems that can be trained on an individual's voice, and generate new speech in the same voice. If I was waterprinting a meeting, I would train a system like this on the fly on the people in the meeting and use it to dynamically insert filler words (um...) in a unique pattern into the audio stream for each member of the meeting. That would defeat any audio filter tricks or recreating the meeting from scratch, so you would want to summarize/rephrase the meeting too.

But wouldn't doing something like that make the recording seem like a deepfake, potentially reducing it's credibility? To an outside observer, it may make a genuine recording appear to be fake.

I'm reminded of the controversy over the faked Bush Texas ANG documents. They were discovered by randos on the internet realizing the text looked like the output of a modern version of Word than the 70s typewriter they should have been written on if genuine. Imagine a similar but genuine document where the content was deliberately retyped using anachronistic equipment to obscure the leaker's identity.

[1] https://en.wikipedia.org/wiki/Killian_documents_controversy

I don't remember the details, but there was a lawsuit (in India IIRC) over some contractual documents, which were proven to be fake since they used Microsoft's Calibri font, but were supposed to be from before Calibri et al. was released.

Imagine getting caught through an even more obscure difference, like different default margins/spacing in new Word, or... letter kerning!

Calibri comes up surprisingly often. There were lawsuits and scandals in other countries, too.

But if certain frequencies are in the training data, they still will be in the output. Won't you end up with watermarked audio still?

you could let your recreation algorithm do the same thing. add and remove filler words randomly. This way in the end you can't be sure whos audio it was :)

How would you explain these filler words if the lips don’t match?

I think in this case you don't always have the visual recording of the speaker.

Zoom's quality ain't that great. You often have random lags and delays, and I don't think audio and video are always 100% in sync anyway.

> "recreate" the conversation from scratch

Why not do speech to text at that point?

Also need to quantize all of the pauses between speakers and the time of each new speaker starting, and the rate of speaking, since as others have pointed out, Zoom varies these anyway for delay compensation.

That's a problem tho, because then people will claim that what you recorded is doctored or even "a deep fake".

Agreed, but at this point even images and videos can be faked and doctored to a pretty high standard. Privacy of the leakers should be worth it IMO.

Well, why release 'the meeting' in the first place then? If you recreate a deep fake, you might as well start from a transcript. Or leak a transcript.

Leakers need some fidelity to prove their credibility. But fidelity also identifies them.

The journalist, editor, or their lawyer might need something genuine to be comfortable publishing. If that journalist and editor have a good reputation, however, the general public shouldn't need that. "The Intercept" may not have that good reputation? They seem at least as trustworthy as the typical USA war media firm to me.

Yes. But in that scenario, what's the value added compared to the journalist just publishing a transcript?

Yeah that's a good point. Just because you've removed the watermark, doesn't mean you've removed all of the unique features.

Just make parts of the session randomly unintelligible and use the absence or presence in the transcript as an identifier.

I mean, should be as easy as recording your own zoom call with the Watermark enabled and a well known audio track (a metronome, dead silence, etc). Rip audio from the recording and examine it for anything outside of the metronome.

Probably need to do this several times for different participants and meetings to get an idea of what the watermark looks like and where in the spectrum it sits.

Perhaps they have countermeasures for this? Maybe a unique identifier for each meeting that alters the audio signature.

That's why it'd be necessary to record several meetings and see how things change between them.

Easier way would be to get 2 copies of the same stream from 2 or more clients then compare. Repeat until extra/missing data is found.

That is my first thought. I have a few specialty plugins in Wavelab that I would be curious to run a Zoom capture through. If its ultrasonic, then as you say a low pass filter should suffice, but theres a million ways to encode data...

Not if Zoom uses something like this: https://en.wikipedia.org/wiki/Cinavia