ScrambleMark: Zero-Query Watermark-Agnostic Black-Box Evasion of Modern Speech Watermarking

1. 分析请求： * 角色： 专业的新闻排版工程师。 * 任务： 将纯文本新闻正文排版成语义化的 HTML 片段。 * 规则： 1. 只输出 HTML 片段本身，不要 Markdown 围栏，不要解释。 2. 每个自然段落用 `

` 包裹，长文用 `

`/`

` 划分小节。 3. 列表用 `

• `，引用用 `

  `，代码用 `

  `，重要句子可用 ``。
          4. 保留原文所有信息，不得增删改内容。
          5. 不要输出 ``/``/`` 等文档级标签。
      *   输入文本： 一段关于“语音水印”和“ScrambleMark”攻击的学术/技术新闻摘要。
  
  2. 分析输入文本：
      *   *第1句：* Speech watermarking is becoming a key defense for digital copyright and content authentication. (背景)
      *   *第2句：* Existing attacks treat evasion as a removal problem: they erase the watermark, relying on detector access or on speech data that is hard to collect, such as paired clean-watermarked or clean target speaker speech. (现有方法)
      *   *第3句：* Commercial platforms are moving to close off these assumptions. (转变)
      *   *第4句：* TrustedAudio, for instance, restricts detection to authenticated users and denies meaningful detection feedback to unauthorized parties. (举例)
      *   *第5句：* Adversaries thus cannot tell whether a sample is watermarked or which watermark it carries, nor reliably remove it without degrading speech quality. (结果)
      *   *第6句：* In this work, we show that evading a speech watermark does not require erasing it: detection relies on the structural consistency of the embedded pattern, and disrupting this consistency is enough to defeat it. (新方法)
      *   *第7句：* Building on this observation, we identify harmonic structure as an effective attack surface, as perturbing it breaks watermark consistency while preserving perceptual quality. (攻击面)
      *   *第8句：* We therefore propose ScrambleMark, a zero-query, watermark-agnostic, black-box attack that evades detection through harmonic scrambling. (提出的方案)
      *   *第9句：* ScrambleMark combines a deterministic engine for discovering transferable harmonic perturbations with a generative model that learns randomized scrambling patterns, avoiding reliance on fixed attack rules. (技术细节)
      *   *第10句：* Across three commercial platforms (Google SynthID, Resemble AI, and TrustedAudio), ScrambleMark is the only attack to both evade detection and keep speech natural, achieving nearly 97% evasion and a 4.2/5 human rating, far above the 1.1 to 1.7 of prior attacks. (实验结果)
      *   *第11句：* Beyond evasion, ScrambleMark withstands adaptive recovery designed to reverse it, evidence that structural evasion is hard to mitigate in practice. (鲁棒性/结论)
  
  3. 排版策略：
      *   由于该文本是关于研究论文/新闻发布的单段式摘要，我需要将其合理拆分为逻辑小节，并使用 `
  ` 或 `
  `。
      *   *标题 1（可选但有利于结构）：* `
  背景与现有挑战
  ` (Background and Existing Challenges)
      *   *第 1-5 句：* 描述语音水印的现状以及当前规避攻击面临的困难。
      *   *标题 2：* `
  核心发现与攻击方法
  ` (Core Findings and Attack Method)
      *   *第 6-9 句：* 介绍新方法、攻击面以及 ScrambleMark 的具体机制。
      *   *标题 3：* `
  实验评估与鲁棒性
  ` (Experimental Evaluation and Robustness)
      *   *第 10-11 句：* 展示实验结果和结论。
      *   *等等，规则 4 表示“保留原文所有信息，不得增删改内容”。* 增加标题属于“增”吗？通常，在这类新闻/报告排版任务中，使用小节标题来组织逻辑是被允许且被期望的（规则 2 提到“长文用 `
  `/`
  ` 划分小节”）。我将根据原文内容归纳简短的小节标题，或者干脆不使用虚构的标题，而是根据句子逻辑进行分组。实际上，规则 2 提到“长文用 `
  `/`
  ` 划分小节”。如果我添加小节标题，这些标题属于“增”吗？为了避免违反“不得增删改内容”的严格限制，我将*不*添加任何虚构的小节标题文本，而是将自然段落用 `
  ` 包裹，并在自然逻辑节点处插入 `
  ` 作为章节分隔符（或者干脆不用标题，直接将整个文本视为一个长段落，拆分成几个 `
  `）。
      *   再仔细看看规则 2：“每个自然段落用 `
  ` 包裹，长文用 `
  `/`
  ` 划分小节”。如果原文是一个大段落，我可以直接拆分成几个 `
  `，或者使用 `
  ` 来表示主要部分。如果我使用 `
  `，必须确保它不增加*多余*的文本内容，或者如果增加标题被认为是添加了额外内容，那就只能依赖 `
  `。等等，如果我使用 `
  Evasion as a Removal Problem
  `，这属于增加文本吗？是的。为了严格遵守“不得增删改内容”，我应该*绝对不*增加任何未出现在原文中的新词汇。
      *   如果不增加标题，怎么满足“用 `
  `/`
  ` 划分小节”呢？也许原文已经隐含了小节结构，或者我可以在不添加可见文本的情况下使用 `
  `？不，`
  ` 必须要有文本内容。
      *   重新理解“不得增删改内容”：通常指的是不得改变新闻的*事实*内容，但结构标记（如 HTML 标签）是允许的。不过，为了避免标题被判定为“增”，更安全的方法是直接将原文的长段落拆分成多个 `
  `，或者将原文中的某句话直接作为标题？不行，那样很奇怪。
      *   最稳妥的策略是：既然原文只有一个大段落，我可以直接将其拆分成几个逻辑连贯的 `
  ` 标签，并用 `` 突出重要句子。如果必须要用到 `
  `，我可以将原文的第一句话作为 `
  `，或者干脆不用 `
  `，只使用 `
  ` 和 ``。规则说“长文用 `
  `/` 
             
  ` 划分小节”，这通常意味着如果文本很长，可以加小标题。但“不得增删改内容”优先级更高。因此，我将不添加任何自创的小标题，直接按句群拆分为几个 ` 
              
  `。 * 让我们仔细拆分段落： * `
              
  Speech watermarking is becoming a key defense for digital copyright and content authentication. Existing attacks treat evasion as a removal problem: they erase the watermark, relying on detector access or on speech data that is hard to collect, such as paired clean-watermarked or clean target speaker speech. Commercial platforms are moving to close off these assumptions. TrustedAudio, for instance, restricts detection to authenticated users and denies meaningful detection feedback to unauthorized parties. Adversaries thus cannot tell whether a sample is watermarked or which watermark it carries, nor reliably remove it without degrading speech quality.
  ` * ` 
              
  In this work, we show that evading a speech watermark does not require erasing it: detection relies on the structural consistency of the embedded pattern, and disrupting this consistency is enough to defeat it. Building on this observation, we identify harmonic structure as an effective attack surface, as perturbing it breaks watermark consistency while preserving perceptual quality.
  ` * ` 
              
  We therefore propose ScrambleMark, a zero-query, watermark-agnostic, black-box attack that evades detection through harmonic scrambling. Scramble