NaSuno is a psychoacoustic DSP toolkit that documents and strips ultrasonic carriers, spread-spectrum tags, and metadata provenance markers from Suno, Udio, and SynthID audio for authorized forensic research.
| Tool | AhmadHassan-BTed/NaSuno — psychoacoustic audio DSP toolkit and forensic anti-attribution engine for studying synthetic-audio watermarks |
| Category | Audio forensics / psychoacoustic DSP / steganalysis |
| Primary Use | Studying and neutralizing watermark carriers such as 19.5 kHz ultrasonic pilots, SynthID spread-spectrum chips, and C2PA provenance manifests in audio you own, in lab and research contexts |
| Safe Use | Authorized audio-forensic research, watermark robustness testing on your own generated stems, and defensive understanding of how synthetic-audio provenance systems work |
| Telemetry Note | The browser studio is documented as fully client-side (no uploads, no logging); from the defensive side, platforms can detect countermeasure use via carrier-energy analysis, correlation degradation, and metadata anomalies in re-encoded uploads |
NaSuno, published at AhmadHassan-BTed/NaSuno under an MIT license with just over a thousand stars, is one of the more unusual entries in the audio-security space: a defensive-framed psychoacoustic DSP framework whose stated purpose is to document — and neutralize — the forensic watermarks that generative audio platforms embed in their output. The README opens with a clear thesis: models like Suno, Udio, ElevenLabs, and Google's SynthID inject ultrasonic carriers, phase-locked spread-spectrum sequences, and latent provenance tags into generated waveforms, which means any human composition that incorporates AI stems inherits that tracking surface. The project positions itself as a research instrument for understanding exactly those mechanisms, and it is worth reading as an unusually detailed public taxonomy of audio watermarking even if you never process a file with it.
The technical core rests on three pillars the README names explicitly: ISO 226 equal-loudness contours, Bark-scale critical-band psychoacoustics, and zero-phase IIR notch filtering. The first countermeasure targets what the project identifies as a 19.5 kHz continuous ultrasonic pilot associated with Suno output. Rather than a naive brick-wall lowpass, the tool applies bi-directional forward-backward IIR filtering with a quality factor of roughly Q >= 30 (the 14-vector table cites Q=35), which cancels the carrier while avoiding the phase smearing that single-pass filters introduce into upper harmonics. The README claims the carrier amplitude is driven below a -110 dBFS noise floor with deviation under 0.02 dB in the audible spectrum — claims that are exactly the kind of falsifiable engineering assertions watermark researchers should be testing.
The second pillar is the perceptual masking engine. Rather than simply deleting spectral content, NaSuno evaluates instantaneous masking thresholds across all 24 human auditory critical bands on the Bark scale, then confines any anti-attribution dither or micro-dispersion it injects strictly inside acoustically invisible masking corridors. This is the same trick lossy codecs exploit: below the masking threshold, energy changes are mathematically inaudible to human listeners but still perturb detector-side correlation. For forensic analysts, the interesting part is that this design implicitly acknowledges a cat-and-mouse dynamic — watermark robustness is measured against perceptual transparency constraints, and any countermeasure operating inside those constraints is where detection and evasion genuinely compete.
The README's centerpiece is a 14-vector anti-attribution matrix, and it reads like a field guide to contemporary audio provenance engineering. Beyond the ultrasonic notch (V-01), it catalogs Udio phase-locked micro-artifacts countered by formant-aware dynamic phase shifting (V-02), SynthID inaudible spread-spectrum chip sequences countered by Bark-band de-correlation (V-03), and C2PA provenance manifests removed by bitstream structural excision (V-04). Later vectors address subtler statistical fingerprints: comb peaks attributed to HiFi-GAN and EnCodec neural vocoders (V-05), rigid sample-grid quantization humanized with Gaussian micro-jitter (V-06), infrasonic phase-offset pilots between 5 Hz and 18 Hz removed with a 24 dB/oct Butterworth high-pass at 20 Hz (V-07), and deterministic quantization footprints randomized via TPDF psychoacoustic dithering (V-08).
Vectors nine through fourteen extend the taxonomy into mastering-domain signals. Stereo phase correlation vectors are decorrelated with what the README calls a Blumlein decorrelator while preserving mono compatibility (V-09); flat AI compression curves are re-dynamized with a non-linear transient expander (V-10); RIFF and ID3 padding-byte payload injections are sanitized by bit-perfect header rewrites (V-11); pitch-synchronous comb fingerprints, constant spectral flux, and bit-depth statistical regularities each get dedicated countermeasures (V-12 through V-14). Even setting aside the neutralization claims, this matrix is a useful checklist for defenders: each row names a measurable statistical property of synthetic audio, and several of those properties — flux regularity, quantization determinism, timing-lattice rigidity — are detection features in their own right.
Architecturally, the repository is honest about what it actually contains. The public NaSuno repo hosts documentation, research papers, and a browser-based Web Audio DSP studio deployed via GitHub Pages; the high-throughput C++/Python pipeline, batch CLI, and a 72-test forensic verification suite live in a private NaSuno-core component. The README calls this hexagonal architecture, segregating the public specification and interface from the core engine. Practically, that means a security researcher cloning the repo gets the taxonomy, the math, and an interactive studio — not the full offline processing stack. The repo's ci.yml workflow verifies documentation and a JSON parameter registry, and pages.yml automates studio deployment, which is consistent with a documentation-heavy project.
The web studio itself is the most accessible evaluation surface. It is documented as 100% client-side, processing audio strictly in memory via the Web Audio API with no uploads or logging, which matters if you are experimenting with sensitive stems. The interface is an FL Studio-inspired skeuomorphic rack with rotary knobs, LED VU meters, a live 2048-point FFT spectrum analyzer, and a stereo phase oscilloscope. A parametric humanization dial sweeps from 0% (raw AI signal) to 100% (fully processed master), letting an analyst observe how each countermeasure alters the spectrum in real time — genuinely useful pedagogy for anyone teaching or studying perceptual watermarking.
The accompanying research tree under docs/ is where the documentary value concentrates. It includes a forensic watermark taxonomy analyzing Suno, Udio, and SynthID vectors; a psychoacoustics reference covering the ISO 226 equal-loudness math and Bark-band calculations; a master evasion plan with differential audio test methodologies; and an architecture document specifying ports, adapters, buffer contracts, and latency budgets. A roadmap targets future VST3/AU plugin builds and hardware DSP ports. For an authorized professional, the differential-testing methodology document is arguably the most defensible artifact in the repo — it describes how to measure whether a countermeasure is truly transparent, which is the same methodology watermark designers use to measure robustness.
Now the uncomfortable part, which any honest writeup has to state plainly. The project's own framing — decoupling human creativity from platform surveillance — describes defeating copyright-attribution and provenance systems, and the phrase "Evasion Status: Neutralized" in the matrix makes the intent unambiguous. Using tools like this against watermarks on audio you do not own rights to, or to misrepresent AI-generated content as human-authored in violation of platform terms or disclosure law such as the EU AI Act's transparency provisions, is not a gray area. The legitimate uses are narrower and real: robustness testing of your own watermarking schemes, forensic research into how provenance signals survive transcoding, and understanding the statistical fingerprints of generative audio for detection purposes. The dual-use line here is sharper than with most security tooling, and professionals should treat it accordingly.
From a defensive perspective, NaSuno is most valuable as a red-team map. Every countermeasure in the matrix tells a platform designer where their watermark is fragile: if a Q=35 zero-phase notch kills a carrier, the carrier needs redundancy across masked bands; if TPDF dither breaks bit-depth fingerprints, detection must rely on robust statistical features rather than fragile deterministic ones; if metadata excision is trivial, provenance must live in the audio itself. Analysts on detection teams can invert each row of the matrix into a sensor — carrier energy at 19.5 kHz, comb-peak periodicity, quantization entropy — and monitor for their absence, since suspiciously clean spectra are themselves a signal. That adversarial loop, documented in public, is precisely what makes this repository worth studying rather than ignoring.
If you work in audio forensics, watermarking research, or synthetic-media detection, clone the repo, read docs/research/forensic-taxonomy.md and docs/research/psychoacoustics-reference.md, and spend an hour with the client-side studio on audio you generated yourself. Treat the neutralization claims as hypotheses to verify with differential testing, not advertised guarantees, and keep the work inside your own lab. As an educational specimen of how perceptual coding theory collides with provenance engineering, NaSuno is one of the more thorough public writeups available — and for the engineers building the next generation of SynthID-style systems, it doubles as a free adversarial requirements document.
AhmadHassan-BTed/NaSuno.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.