Spotify ingests roughly 100,000 new tracks every single day. If you tried to listen to just 30 seconds of each one, it would take you 35 days of nonstop listening to get through a single day's uploads. Most of those tracks aren't music. They're algorithmic noise — AI-generated rain sounds, lo-fi loops, and deepfake vocals — uploaded by fraud operations designed to siphon money from the artists you actually listen to. The streaming fraud crisis is draining $2 to $3 billion per year from the music industry, and the tools we've relied on for decades to fight it are fundamentally broken against generative AI.
I've spent the last year studying this problem with my team, and what we found shook a core assumption I'd held: that audio fingerprinting — the technology behind Shazam and Content ID — could be adapted to catch AI-generated fraud. It can't. The reason is almost embarrassingly simple once you see it, and it changes everything about how we need to think about trust in audio.
75 Million Fake Tracks and the New Economics of Fraud
Between 2024 and 2025, Spotify purged over 75 million tracks it identified as spammy or artificial. That number rivals the size of the entire historical catalog of recorded music. Think about that: the platform had to delete more garbage than humanity has produced in legitimate music across its entire history.
The fraud has gotten smarter, too. The old playbook was crude — upload one track, blast it with millions of bot streams from a single IP address. Easy to catch. The new playbook is what the industry calls "low and slow."
Instead of one track streamed a million times, a fraud operation uses AI to generate 10,000 unique tracks. A botnet then plays each track just 100 times. The total payout is identical, but no single track triggers a spike alert. The fraud hides in the long tail, buried under the sheer volume of legitimate data.
Every fraudulent stream doesn't just steal from the platform. It steals from every legitimate artist on it.
This is because of how streaming royalties work. Spotify, Apple Music, and most major platforms use a "pro-rata" model: all subscription and ad revenue goes into one pool, divided by total streams. When bots generate a billion fake streams on AI noise tracks, they inflate the denominator, pushing down the per-stream payout for everyone. An independent artist releasing their debut album is literally subsidizing criminal operations.
The infrastructure behind these operations is enterprise-grade. Fraud rings route traffic through compromised smart home devices to mimic real residential IP addresses. They use browser automation tools that simulate mouse movements, pauses, and searches to fake human engagement. They generate thousands of playlists with SEO-friendly titles like "Chill Lo-Fi for Coding," stuffing them with spam tracks camouflaged by a few legitimate hits from major artists.
Deezer found that 70% of plays on AI-generated tracks on its platform were fraudulent. That's not a rounding error. That's the system working as the fraudsters designed it.
Why Audio Fingerprinting Can't Save Us
When I first started digging into this, my instinct was the same as most people's: surely we can fingerprint AI music and flag it. Fingerprinting has worked for decades. Shazam can identify a song playing in a noisy bar from a five-second clip.
But fingerprinting solves a fundamentally different problem. It answers the question: "Have I heard this exact audio before?" It works by extracting a perceptual signature from a track and matching it against a massive database of known recordings.
Generative AI breaks this completely. When a diffusion model creates a new track, it produces a waveform that has literally never existed before. There's no entry in any database to match against. To a fingerprinting system, a brand-new AI spam track looks exactly like a brand-new human masterpiece — both are simply "unknown content."
I call this the Originality Paradox. The very thing that makes AI-generated music dangerous — its ability to create unique, never-before-heard audio — is the same thing that makes it invisible to our best detection tools.
Fingerprinting tells you what something is. It can't tell you where it came from.
Even with deepfakes — say, an AI clone of Drake's voice singing a new song — the fingerprinting approach struggles. The AI can shift pitch, tempo, key, and instrumentation just enough to slip outside the similarity threshold of any matching algorithm. It's a permanent game of cat and mouse, and the cat is getting faster.
We explored this detection gap in depth in our interactive analysis, where we walk through exactly how and why each traditional method fails against modern generative models.
The Problem Nobody Talks About: The Analog Gap
There's a technical challenge that makes this whole situation dramatically harder, and it rarely gets discussed outside of signal processing circles. My team calls it the Analog Gap — and it's the reason most "robust" watermarking solutions quietly fall apart in the real world.
Picture this: someone plays a deepfake track through laptop speakers. Someone else records it on their phone across the room. That recording gets uploaded to TikTok. A rights holder wants to prove the original audio was AI-generated.
Between the speaker and the microphone, the audio signal gets brutalized. Sound bounces off walls, creating thousands of tiny echoes that smear the signal. Cheap speakers cut off low and high frequencies entirely. The microphone doesn't know where the "start" of any embedded data is. The recording might be slightly pitch-shifted from sample rate mismatches.
Most watermarking approaches survive MP3 compression just fine. That's the easy part — the "digital gap." But surviving the journey through actual air, through speakers and microphones and room acoustics? That's where nearly everything breaks.
And this matters enormously, because a huge amount of content consumption happens through exactly this chain: social media videos, radio broadcasts, live calls, screen recordings. If your watermark can't survive the analog gap, it can't protect artists in the real world.
What We're Building: Watermarks That Survive the Air
This is the problem my team has been obsessed with solving. The core idea behind latent audio watermarking is straightforward: instead of trying to identify content after the fact, you embed an invisible, inaudible signal directly into the audio at the moment it's created. Think of it as a digital DNA strand woven into the sound itself.
The engineering challenge is making that signal simultaneously imperceptible to human ears and recoverable by machines after the audio has been compressed, re-encoded, played through speakers, bounced off walls, and captured by a phone microphone.
Our approach uses a technique called spread spectrum embedding. Instead of hiding watermark data in one specific frequency — which an attacker could simply filter out — we spread the signal energy across a wide frequency band using a pseudo-random pattern. In any single frequency, the watermark is below the threshold of human hearing. It sounds like the natural "air" in a recording. But when you know the pattern, you can extract it from the full spectrum even if half the frequencies have been destroyed.
The watermark doesn't ride on top of the audio. It lives inside the audio's structure.
For the analog gap specifically, we use an autocorrelation approach. Rather than comparing a received signal against an external database — which requires connectivity and introduces latency — our system embeds a repeating pattern within the signal itself. The detector compares the audio to itself, looking for the signature of that repetition.
When audio travels through a room and picks up reverb, the entire signal gets distorted — but the relationship between repeating blocks stays constant. The echo affects each block the same way. So the detector can find the watermark by finding that consistent internal relationship, without needing to know what the original audio sounded like.
To prevent false alarms from naturally repetitive music (a steady techno beat could theoretically mimic a repeating pattern), we add a cryptographic twist: randomly inverting the phase of specific blocks using a secret key. A drum loop repeats identically. Our watermark repeats with a cryptographic signature that natural music simply cannot produce.
Training Against Attackers Who Don't Exist Yet
Sophisticated fraud operators won't just accept watermarks passively. They'll train AI models specifically to find and remove them. This is the arms race dimension that keeps me up at night.
The traditional approach to watermark robustness is to test against a fixed list of attacks: add noise, compress to MP3, apply equalization. The problem is that this creates a system that's robust against yesterday's attacks but brittle against tomorrow's.
We took a different approach, inspired by a methodology called AWARE (Audio Watermarking with Adversarial Resistance to Edits). During training, we include an adversarial "attacker" network that actively tries to destroy the watermark while keeping the audio sounding good. The watermark encoder and the attacker evolve together in a continuous arms race. The encoder learns to survive attacks that haven't been invented yet, because it's been training against an attacker that's constantly inventing new ones.
The results from this adversarial training approach are striking. Our protocol achieves under 1% bit error rate even after aggressive MP3 compression at 64 kbps — the kind of quality you'd get from a low-bandwidth stream. For time-scale modifications — speeding up or slowing down a track by 20% — the system achieves near-zero error using cross-attention mechanisms that track temporal distortions. Even when an attacker crops a track down to a fragment, a bitwise readout mechanism accumulates enough statistical evidence from whatever audio remains to decode the provenance signature.
For the full technical methodology behind these robustness benchmarks, see our detailed research.
Watermarks Need an Identity System
A watermark by itself is just a signal. It proves something was embedded, but it doesn't tell you what. This is where the technology becomes a system.
We bind our watermarks to the C2PA standard — the Coalition for Content Provenance and Authenticity, an open framework backed by Adobe, Microsoft, and others. Think of C2PA as a "nutrition label" for digital content. It records who created an asset, how it was created (human or AI), and what edits were made — all cryptographically signed so it can't be forged.
The vulnerability of C2PA alone is that metadata can be stripped. Convert a signed WAV to a generic MP3, and the provenance data disappears. Play it over the radio, and it's gone entirely.
Our watermark solves this. We embed a unique identifier into the audio signal itself. That identifier points to a cloud-hosted provenance record. Even if the file is stripped of all metadata, converted to analog, played on the radio, and re-recorded by a phone — the watermark survives. Our decoder extracts the identifier, queries the ledger, and retrieves the full provenance history.
Metadata can be stripped. File formats can be converted. But the watermark travels with the sound itself.
This also addresses the privacy concern that immediately comes up in these conversations. A dissident journalist or anonymous artist doesn't want their legal identity attached to every file. C2PA supports pseudonymous claims — an artist can sign a track as a verified stage name, linked to a credential issued by a trusted third party, without exposing personal information.
What About the Cost? And Can't Fraudsters Just Remove It?
Two questions I get constantly. On cost: human content moderation is roughly 40 times more expensive than automated detection, and it can't scale to 100,000 tracks per day. Watermark-based detection is deterministic — a watermark is either present or it isn't. There's no confidence score requiring human review, no probability curve to interpret. That means fully automated decisions with high legal confidence, at a fraction of the cost.
On removal: this is where adversarial training earns its keep. A watermark built through our protocol isn't a single fragile signal hiding in one spot. It's spread across the entire frequency spectrum, embedded in the mathematical structure of the audio, and trained to survive attacks from networks specifically designed to destroy it. Could a sufficiently motivated attacker with unlimited resources eventually strip it? In theory, perhaps — but the degradation required would make the audio commercially useless. The watermark and the audio quality are entangled. Destroying one destroys the other.
There's also a deployment question worth addressing. We've designed two integration points: one at the AI model level, where the watermark gets embedded during the generation process itself (similar to how Google's SynthID works), and one at the platform ingestion level, where content is watermarked as it's uploaded. The first ensures every AI-generated file is marked at birth. The second creates a chain of custody for human-created content — if an artist's watermarked track gets scraped to train an AI model, the watermark persists in the output, proving the copyright violation.
The Value Has Shifted
I'll end with the observation that reshaped how I think about this entire space. For decades, the scarce resource in music was creation. You needed talent, equipment, studio time, distribution deals. AI has made creation essentially free. Anyone with an API key can generate a track.
The scarce resource now is provenance — the ability to prove where something came from, who made it, and whether it's real. That shift changes the economics of the entire industry. The future of AI music isn't about which model generates the best melody. It's about which infrastructure can guarantee that melody is real, that the artist gets paid, and that the listener can trust what they're hearing.
We're building that infrastructure. If you're working on content authenticity, platform integrity, or rights management, I'd genuinely like to hear how you're thinking about the provenance problem. The solutions won't come from any single company — they'll come from the ecosystem deciding that trust is worth embedding into the signal itself.