Spotify ingests roughly 100,000 new tracks every single day. If you tried to listen to just 30 seconds of each one, it would take you 35 days of nonstop listening to get through a single day's uploads. Most of those tracks aren't music in any meaningful sense — they're algorithmically generated noise designed to siphon money from the artists who actually make music.
This is the streaming fraud crisis, and it's draining $2 billion to $3 billion annually from the music industry's royalty pools. The tools we've relied on to police this — audio fingerprinting, metadata checks, human moderators — were built for a world where creating music was hard. Generative AI has made it trivially easy. The defensive infrastructure hasn't caught up, and the gap is widening every day.
Our research points to a fundamentally different approach: latent audio watermarking — invisible, inaudible signals embedded directly into audio that survive everything from MP3 compression to being played through a laptop speaker and re-recorded on a phone across the room. We believe this technology is the missing layer of trust the audio industry needs to survive the age of generative AI.
75 Million Spam Tracks and Counting
The scale of the problem is staggering. In 2024 and 2025, Spotify was forced to purge over 75 million tracks identified as spam or artificial noise. That number rivals the size of the entire historical catalog of recorded music. Think about that: the volume of fake music being uploaded now approaches the total volume of real music humanity has ever recorded.
We categorize this flood into three types. First, there's functional audio spam — white noise generators, rain sounds, binaural beats — content that requires zero creative input but generates royalties when bot farms loop it endlessly. Second, algorithmic ambient music — generative models churning out thousands of lo-fi hip hop or drone tracks under fake artist names to avoid detection. Third, and most damaging to individual creators, deepfake impersonations — unauthorized clones of artists like Drake or Taylor Swift that trade on their brand and confuse listeners.
The economics make this fraud irresistible. Most major platforms use a "pro-rata" royalty model: all subscription and ad revenue goes into a single pool, divided by total streams. Every fraudulent stream increases the denominator, which lowers the per-stream payment for every legitimate artist. It's a zero-sum game where bot farms directly steal from human musicians.
Every fake stream doesn't just pay a fraudster — it cuts the check of every real artist on the platform.
The "Low and Slow" Playbook
What makes modern streaming fraud so dangerous isn't just its scale — it's its sophistication. The crude approach of hammering one track with millions of bot streams from a single IP address is largely dead. It created obvious statistical spikes that even basic detection could flag.
Today's fraud operations run what the industry calls "low and slow" campaigns. Instead of one track getting a million fake streams, a fraudster uses AI to generate 10,000 tracks and ensures each one gets only a few hundred plays from a distributed botnet. The total payout is identical, but no single track looks suspicious. The fraud hides in the long tail, buried under the sheer volume of legitimate listening data.
The infrastructure behind these operations is genuinely enterprise-grade. Botnets route traffic through compromised residential IP addresses — your neighbor's smart fridge might be streaming fake lo-fi beats right now — making each stream appear to come from a real home user. Headless browser tools simulate human behavior: mouse movements, pausing, skipping tracks, searching. Fraudsters even generate thousands of playlists with SEO-friendly names like "Chill Lo-Fi for Coding," seeding them with a few real hits from major artists as camouflage. The platform's own recommendation algorithm then does the rest, serving the spam tracks to real human listeners.
We explored this threat landscape in depth in our interactive analysis of the streaming fraud crisis, including how Deezer found that 70% of plays on AI-generated tracks showed signs of fraud.
Why Audio Fingerprinting Can't Save Us
The music industry has long treated audio fingerprinting — the technology behind Shazam and YouTube's Content ID — as the gold standard for rights management. It works by extracting a perceptual "hash" from audio (a mathematical summary of its frequency peaks, rhythm, and contours) and matching it against a massive database of known recordings.
This approach has a fatal flaw in the age of generative AI: it requires a known original to match against.
Generative AI doesn't copy. It synthesizes. When a diffusion model creates a new track, that waveform has never existed before. There is no reference file in any database. To a fingerprinting system, a brand-new AI spam track looks exactly like a brand-new human masterpiece — it's simply "unknown content." Fingerprinting is an identification technology. What the industry needs is an authentication technology.
Fingerprinting asks "Have I heard this before?" Watermarking asks "Where did this come from?" Against AI-generated content, only the second question matters.
Even with deepfakes or derivative works, AI can alter pitch, tempo, key, and instrumentation just enough to slip past the similarity threshold of hash-matching algorithms. Neural fingerprinting — using AI embeddings instead of traditional peaks — improves resilience somewhat, but it remains a probabilistic game of cat-and-mouse. The defender is always one step behind.
Metadata-based approaches fail for an even simpler reason: metadata can be stripped. Convert a file format, play it over the radio, re-record it — the metadata header vanishes. The audio itself carries no proof of where it came from.
What Latent Audio Watermarking Actually Does
Latent audio watermarking takes a completely different approach. Instead of trying to identify content after the fact, it embeds an invisible, inaudible signal directly into the audio waveform at the moment of creation. Think of it like a serial number etched into the molecular structure of a banknote — you can't see it, you can't feel it, but a detector can always read it.
The technique we use is called spread spectrum embedding, combined with psychoacoustic masking. Rather than hiding data in one specific frequency or one moment in time, the watermark signal is spread across a wide band of frequencies using a pseudo-random noise pattern.
This achieves two things simultaneously. The watermark energy in any single frequency stays below the threshold of human hearing — it sounds like the natural "air" in a recording, not a digital artifact. And because the information is redundant across the entire spectrum, an attacker can't destroy it by filtering out specific frequencies. Remove half the frequency band, and there's still enough signal left to recover the watermark.
We then apply mathematical decomposition techniques — specifically, we break the audio into its fundamental oscillation patterns and embed watermark data into the structural properties of those patterns, not just their surface values. The result is a watermark that survives resampling, requantization, and lossy compression down to 64 kbps MP3 — the kind of aggressive compression that would make an audiophile wince.
Surviving the Hardest Test: Speaker to Microphone
Surviving MP3 compression is table stakes. The real test — and the one that separates serious watermarking from academic exercises — is what we call the Analog Gap.
Picture this: a deepfake track plays through a laptop speaker, travels through the air in a reverberant room, and gets picked up by a smartphone microphone. During that journey, the audio signal gets brutalized. Sound waves bounce off walls, creating thousands of overlapping echoes. The laptop speaker cuts off low frequencies below 300 Hz and high frequencies above 15 kHz. The phone's microphone adds its own distortion. And critically, the recording device has no idea where the watermark "starts" — the signal is completely desynchronized.
Most watermarking approaches die here. Our architecture survives it through a technique called autocorrelation — the signal compares itself to itself rather than to an external reference.
We embed a short noise pattern that repeats at a fixed interval within the audio. When the signal passes through the air, everything gets distorted — but the relationship between the repeating blocks stays constant. The room echo affects Block A and Block B identically. The detector simply looks for a periodic spike in the signal's self-similarity. That spike confirms the watermark exists without needing to know what the original audio sounded like.
To prevent false alarms from naturally rhythmic music (a steady techno beat could mimic a repeating pattern), we apply a cryptographic twist: specific blocks are randomly phase-inverted according to a secret binary key. A drum loop repeats identically; our watermark repeats with a cryptographic signature that no natural audio can accidentally produce. The result is near-zero false positives, even in noisy environments.
A watermark that can't survive being played through a speaker isn't a watermark. It's a suggestion.
Staying Ahead of Adversarial Attacks
Sophisticated attackers won't just compress or re-record audio — they'll train AI models specifically to find and strip watermarks. We designed for this.
Our training process borrows from adversarial machine learning. We don't just test against a fixed list of known attacks like "add noise" or "compress to MP3." Instead, we train the watermark encoder and decoder in a continuous arms race against an attacker network. The attacker tries to destroy the watermark while keeping the audio listenable. The encoder adapts to survive whatever the attacker throws at it. Over thousands of iterations, this produces generalized robustness — resilience not just against today's attacks, but against attack strategies that don't exist yet.
For handling time distortions — someone speeding up a track by 10% or 20% — we use cross-attention mechanisms that allow the detector to recover the watermark message even from heavily time-stretched or pitch-shifted audio, achieving attribution accuracy above 98%. And for cropping attacks, where a fraudster cuts a 3-minute track down to a 30-second clip, our detector aggregates evidence for each watermark bit over whatever audio fragment remains. Even a short clip carries enough statistical signal to decode the provenance.
For the full technical methodology behind these resilience mechanisms, see our detailed research on audio watermarking architecture.
The "Nutrition Label" for Audio
A watermark alone tells you something is embedded. But what does it actually say? This is where integration with the C2PA standard — the Coalition for Content Provenance and Authenticity — becomes critical.
C2PA is an open standard that functions as a nutrition label for digital content. It records who created an asset (verified with cryptographic certificates), how it was created (human recording vs. AI generation), and what edits were made along the way. Major technology companies already support it.
The problem with C2PA alone is the same problem with all metadata: it can be stripped. Convert a signed WAV file to a generic MP3, and the provenance header disappears. Play the track on the radio and re-record it, and there's nothing left.
Our approach uses the watermark as a permanent anchor. We embed a unique identifier into the audio via the watermark. That identifier points to a cloud-hosted provenance record containing the full C2PA manifest. Even if the file is stripped of metadata, converted, played through speakers, broadcast on radio, and re-recorded — the watermark survives, the identifier is recoverable, and the complete provenance chain can be retrieved.
Metadata travels with the file. A watermark travels with the sound itself.
This also addresses a legitimate concern about privacy. Not every creator wants their legal identity attached to their work — think of anonymous artists or journalists in hostile environments. The C2PA framework supports pseudonymous credentials: an artist can sign a track as "Verified Artist #892," linked to a credential issued by a trusted third party, without revealing personal information.
What About the Cost? And Does This Actually Scale?
A reasonable objection: if the industry is already struggling with 100,000 uploads per day, can watermark detection actually keep up?
The answer comes down to what you're comparing it against. Human moderation is roughly 40 times more expensive than automated detection — and human ears are increasingly unable to distinguish high-quality AI voice clones from real recordings. The cognitive load of reviewing thousands of ambient noise tracks leads to fatigue and errors.
Watermark detection, by contrast, is computationally cheap and deterministic. A watermark is either present or it isn't. There's no confidence score requiring human review, no probability curve to interpret. This allows fully automated decisions — flagging, demonetizing, or removing content — with high legal confidence. It scales with compute, not headcount.
There are two natural integration points. AI model providers can embed watermarks directly during the generation process — similar to how Google's SynthID works — so every AI-generated file is marked at birth with zero additional processing time. Streaming platforms and distributors can watermark content at upload, creating a chain of custody for human-created work. If that track is later scraped and used to train a model, the watermark persists inside the training data, providing evidence of the copyright violation.
With the EU AI Act and emerging US regulation on deepfakes and copyright transparency, this is shifting from a competitive advantage to a compliance requirement. Platforms that implement watermarking plus C2PA can demonstrate best efforts to combat fraud, significantly reducing their legal exposure.
The Value Has Shifted From Creation to Proof
The generative capability is now a commodity. Anyone with an API key can create music. What's scarce — and therefore valuable — is the ability to prove where a piece of audio came from, whether a human made it, and whether it has been tampered with.
The music industry won't be destroyed by AI. It will be destroyed only if it fails to distinguish signal from noise. Audio fingerprinting was built for a world of known originals. Metadata was built for a world where files stayed intact. Neither assumption holds anymore.
Latent audio watermarking — embedded at the physics level, surviving compression, surviving the air gap, surviving adversarial attack — is the infrastructure layer that makes trust possible at scale. Not trust based on promises or policies, but trust based on mathematics embedded in the sound itself.
We'd welcome hearing from anyone working on content authenticity, royalty integrity, or platform trust and safety. How is your organization approaching the provenance problem?