C2PA soft binding algorithm

AIDR Studio audio watermark

Every AI-generated speech clip from AIDR Studio carries an inaudible watermark with a per-clip identifier. That identifier is the soft binding in the clip's C2PA manifest: when the manifest has been stripped or no longer validates, the watermark leads back to the original signed manifest.

Overview

Algorithm identifier

studio.aidr.silentcipher.1, entry 60 on the C2PA soft binding algorithm list

Type

Watermark: embedding and extraction

Media

Audio; delivered as PCM WAV (audio/wav), 48 kHz, 16-bit

Model

SilentCipher 44.1 kHz model by Sony Research, open source (MIT), used without retraining (silentcipher 1.0.5)

Payload

40 bits: the AIDR brand byte 0xAD and a 32-bit per-clip identifier

Binding value

The five payload bytes; base64 in the manifest and in API queries

Manifest repository

AIDR's watermark register; resolution API at https://aidr.studio/api/c2pa/v1

Operated by

AIDR Studio, Clear Audio BV, Amsterdam, the Netherlands

Contact

info@aidr.studio

Model

AIDR Studio uses SilentCipher, a deep-learning audio watermark published by Sony Research (github.com/sony/silentcipher; paper: SilentCipher: Deep Audio Watermarking, Interspeech 2024). We run the published 44.1 kHz model unmodified as a single GPU service. Audio at other sample rates is resampled to 44.1 kHz for embedding and detection, and back to the clip's own rate afterwards.

This entry has its own algorithm identifier because the payload scheme and the manifest repository are AIDR's. Another deployment of SilentCipher carries a different payload and resolves against a different repository.

Payload

Identifier as text

ad6d5ee57a

Binding value (base64)

rW1e5Xo=

The brand byte is a fixed public value. The 32-bit identifier is drawn from a cryptographic random source and reserved in AIDR's watermark register before embedding, so no two clips receive the same identifier. It contains no personal data. The example above is a test clip signed in production on 28 October 2026; the queries below work against it.

In the C2PA manifest

The marker declares the watermark in a c2pa.soft-binding assertion. The block value is the base64 of the five payload bytes. This is the assertion from the clip above:

{
  "label": "c2pa.soft-binding",
  "data": {
    "alg": "studio.aidr.silentcipher.1",
    "blocks": [ { "scope": {}, "value": "rW1e5Xo=" } ]
  }
}

The same manifest records c2pa.created with digital source type trainedAlgorithmicMedia, and AIDR's consent assertion com.aidr.consent.

Embedding

1. A speech engine generates the clip. AIDR's finalisation step denoises and loudness-normalises it and delivers it at 48 kHz.
2. The watermark register reserves a new identifier.
3. The marker first checks for an existing AIDR watermark. A clip converted for an editing session keeps its watermark; no second one is embedded, and the new manifest records the conversion as c2pa.transcoded or c2pa.edited. Otherwise the marker embeds the 40-bit payload.
4. The marker signs the C2PA manifest with the soft binding assertion shown above.
5. The register records the signing event and stores the signed manifest store under its identifier.

Extraction and recovery

The SilentCipher decoder returns a 40-bit message and a confidence value. A message with brand byte 0xAD and confidence of at least 0.9 is an AIDR watermark. Its five bytes are the binding value; the resolution API returns the manifests stored for that identifier: the manifest signed at generation, and the manifests of later conversions that kept the same watermark.

On very short clips (around two seconds) the decoder can return a few wrong bits. The public API matches only exact identifiers. Inside AIDR Studio, within one production, the register also accepts an identifier up to 3 bits away from a registered one, and only when exactly one candidate qualifies.

Resolution API

AIDR implements the C2PA Soft Binding Resolution API (version 1.0.0). Base URL:

https://aidr.studio/api/c2pa/v1

curl 'https://aidr.studio/api/c2pa/v1/matches/byBinding?alg=studio.aidr.silentcipher.1&value=rW1e5Xo%3D'

{"matches":[
  {"manifestId":"85da9cbba9bf6a839ba3c807e5a9dba2b91645d8bfc707faf6ba210d8468695b","similarityScore":100},
  {"manifestId":"a09a20687b8af7aaaa5bc4e5a487aa81f01ccac08c56e7051b6ca9a411f1f99c","similarityScore":100}
]}

curl -o clip.c2pa 'https://aidr.studio/api/c2pa/v1/manifests/85da9cbba9bf6a839ba3c807e5a9dba2b91645d8bfc707faf6ba210d8468695b'

The first match is the manifest signed at generation, the second the manifest of a later conversion that kept the same watermark. The manifest identifier is the SHA-256 of the manifest store. The binding value is the base64 of the five payload bytes; standard and URL-safe base64 are accepted, with or without padding.

The API is public and needs no account. Requests are rate limited per client (60 lookups and 60 manifest downloads per minute). GET on the base URL returns a description of the service. POST /matches/byContent (uploading audio for the service to decode) is not offered: decode the watermark with the open SilentCipher model and query by binding. returnActiveManifest=true returns the whole manifest store.

Robustness and limits

• The watermark is part of the audio. It survives sample-rate conversion, re-encoding to common formats and the metadata that digital audio workstations add to a file. Those additions break the C2PA hard binding of the delivered file, which is the case this soft binding exists for.
• On clips of about two seconds the decoder sometimes reads a few bits wrong or does not find the mark. AIDR therefore never embeds a second watermark over a mark it found, and avoids conversions inside its own pipeline: generated clips leave the server at the sample rate of a typical editing session.
• It is not designed to survive heavy processing such as strong pitch shifting or time stretching.

Privacy and security

• The identifier is random and carries no personal data. The manifests returned by the API are the manifests that were embedded in the delivered files.
• The public API answers exact identifiers only; tolerant matching stays inside AIDR Studio, behind authentication and within one production.
• The identifier space is 2³² and requests are rate limited, which makes harvesting manifests by guessing identifiers impractical.
• Signing keys stay in AIDR's marker service. The marker only signs manifests it builds itself.

References

• SilentCipher source code: github.com/sony/silentcipher
• M. K. Singh, N. Takahashi, W. Liao, Y. Mitsufuji, SilentCipher: Deep Audio Watermarking, Interspeech 2024
• C2PA specification, soft binding
• C2PA Soft Binding Resolution API
• C2PA soft binding algorithm list, entry 60 (added 28 October 2026, pull request #91)