How Khaos marks what it makes
Every piece of audio made with Khaos carries two marks: an inaudible watermark and a signed record saying it is AI-generated. Both are on by default and neither can be turned off. If a piece cannot be marked, it cannot leave.
The two marks
- Watermark
- An inaudible signal in the audio itself, carrying an error-corrected ID that narrows it to a small group of models. It travels with the sound through common file conversions.
- Signed record
- Content Credentials (the C2PA standard) inside the file: signed, and time-stamped when the time-stamping service answers, saying the audio was made by a trained model and naming the artist's model, the base model and its licence.
- Register
- Released pieces are fingerprinted into the Guild Register's index, so the exact piece can be recognised after re-encoding or trimming, when the signed record is gone.
What survives what
Measured on 7 marked pieces from 3 models, October 2026. A small sample, re-run whenever the marking changes.
| Change to the file | Watermark heard | Signed record |
|---|---|---|
| None: the file as made | 7 of 7 | 7 of 7 |
| MP3 at 320, 128 or 64 kbps | 7 of 7 | lost |
| AAC (M4A) at 128 or 64 kbps | 7 of 7 | lost |
| Opus 64 kbps, Ogg Vorbis | 7 of 7 | lost |
| Resampled, folded to mono, 6 dB quieter | 7 of 7 | lost |
| Noise added at 30 dB | 7 of 7 | lost |
| A 10 or 5 second excerpt | 7 of 7 | lost |
| Mixed 6 dB below another piece of music | 0 of 7 | lost |
| 6 dB louder, hard-clipped | 7 of 7 | lost |
| 12 dB louder, hard-clipped | 3 of 7 | lost |
| Pitch shifted by one or two semitones | 0 of 7 | lost |
| Sped up or slowed down by 10% | 0 of 7 | lost |
| Played in a room and recorded again (simulated) | 0 of 7 | lost |
Limits, said plainly
- The signed record lives in the file. Any re-encode or edit that rewrites the file drops it, which is why the watermark and the Register's index carry the claim beyond the first copy.
- The watermark's presence is robust; its ID is corroboration. On one of the seven pieces the ID did not read even untouched, so a piece is identified by its content, never by the ID alone.
- Changing the pitch or the speed, mixing a piece quietly under other music, recording the sound again in a room, or heavy clipping removes the watermark, and a determined attacker can remove watermarks. Neural codecs and a real speaker-to-microphone recording were not measured.
- Each installation of Khaos signs with its own key. Until Khaos certifies that key, a signature shows the record is intact, not who made it.
- Finding no Khaos mark is never proof that a person made the audio.
Check a file
The verifier is free to use. It answers with one of five verdicts, and only a match in an index confirms that Khaos made a piece.
- Confirmed
- The audio matches a released Khaos piece.
- Signed
- An intact signed record claims Khaos made it.
- Tampered
- The file was changed after it was signed.
- Marked
- A Khaos watermark alone, which is not proof.
- None
- No Khaos mark found.
On your own machine: khaos-verify --register https://register.khaos.dev song.wav, from the Khaos Attribution package with its verify and detector extras (Python 3.10 or later). Only the Register can confirm a piece, so without --register the answer stops at Signed or Marked. It reads WAV, FLAC, MP3, OGG and Opus, and M4A or AAC with FFmpeg installed. The Guild Register's verifier runs in the EU, in Nuremberg, Germany. Every Khaos Workshop and Listening Space also has a Verify a file page. Authorities, researchers and the press can have a free verify key that lifts the per-address limit: ask at foundation@khaos.dev.
Hear when there is something to try
The Workshop is a working prototype and the Listening Space is in proof of concept, both for public release in 2027. The toolkit is free to use.
Join the waitlist