Stem Separators vs. Watermarks: Does Remixing Kill the Fingerprint?

August 11, 2026 · audio DSPsource separationwatermarkingAI music

A popular idea in AI-music circles runs like this: take a watermarked track from a service like Suno, split it into stems with a source-separation model, rebuild the arrangement in a DAW, and render a fresh mix — because the original waveform “no longer exists” anywhere in the signal chain, the watermark cannot survive. This article takes that hypothesis seriously, tests its assumptions against the signal-processing facts, and reaches a more interesting verdict than either the fans or the critics usually offer: stem separation is neither necessary nor sufficient for watermark removal; the method’s real engine is a destructive, codec-equivalent channel hidden inside a creative workflow; and the suspicion that it works on instrumentals but not on vocals is exactly right — for reasons that are worth spelling out precisely.

1 · The hypothesis, stated precisely

Before evaluating an idea, it helps to write it down as a falsifiable claim. The method under discussion is a pipeline of four stages:

1. Stem extraction. Feed the watermarked stereo mix \(y = x + w\) to a source-separation model (Demucs/HTDemucs, MDX-net, Spleeter, or a commercial stem splitter) to obtain estimates of instrument groups — drums \(\hat{d}\), bass \(\hat{b}\), vocals \(\hat{v}\), and “other” \(\hat{o}\).
2. DAW reconstruction. Drop those stems into a DAW, optionally re-balance or process them, and render a new stereo mix \(\hat{x} = g(\hat{d}, \hat{b}, \hat{v}, \hat{o})\).
3. The “no original waveform” claim. Because neither the renderer nor any intermediate file contains the original watermarked waveform, the reasoning goes, the watermark — which lived in that waveform — cannot be present in the output.
4. The instrumental/vocal asymmetry. The idea is expected to work better on purely instrumental material, because instrumental stems tolerate the damage of separation and resynthesis, while vocal stems do not.

Each of these steps contains a mix of truth, wishful thinking, and a subtle misconception. The most important misconception is in step 3, and it is worth defusing first: “no original waveform” is not a mechanism. A watermark is not a property of the file that contains it, nor of the samples in that file. It is a pattern in the signal — a correlation with a known spreading sequence that survives as long as enough energy in that pattern survives, in any signal, no matter how it was produced. The detector never needs the original file; it needs only enough surviving correlation in whatever waveform it is given. “We re-rendered from scratch” is therefore not an argument in itself. What matters is only what the pipeline does to the statistics of the signal: how much watermark-pattern energy remains after every operation, summed across all stems. That is the question the rest of this article actually answers.

2 · What a watermark actually survives

The companion article on this site (“Music watermarks: how Suno tags its MP3s”) covers the embedding mathematics in detail; only the conclusions we need are repeated here. A spread-spectrum audio watermark embeds a pseudorandom sequence \(p[n]\) — the “spreading sequence” or “chip train” — into the audio at a gain \(\alpha\) scaled by a psychoacoustic masking model:

where \(m[n]\) is a time-varying mask that hides the watermark under the music. Detection correlates the received signal with the (known) sequence and compares the statistic to a threshold \(\tau\):

The first term is small — music is effectively uncorrelated with a pseudorandom sequence — while the second term is the “despread” watermark energy that accumulates with \(N\). Three properties follow, and all three matter for the stem-separation idea:

• The watermark is spread across the entire mix and across time. It is not localized to one stem, one instrument, or one moment. It is a low-level broadband signal added to the summed mix, so every instrument’s contribution to the mix carries a share of it.
• The watermark is designed to survive exactly the operations the stem pipeline performs. Re-encoding, resampling, EQ, reverb, dithering, and re-quantization are all standard attacks in the watermarking literature (Petitcolas et al., 1998); robust embedders are tested against them. Simply processing the audio is not, in itself, a countermeasure — the scheme is built to shrug off processing.
• Detection only needs a fraction. Because chips are repeated across the duration, even a 10–20 second excerpt carries enough accumulated correlation to be flagged. A remix that preserves 30% of the original watermark energy may still be detected, depending on \(\tau\). The bar for “removal” is not “some energy gone”; it is “statistically indistinguishable from an unwatermarked master.”

With these facts in hand, the crucial question becomes: what fraction of the watermark energy survives the stem → DAW → remix pipeline? The answer, as the next two sections show, is “far more than the hypothesis assumes.”

3 · How stem separators work — and what they damage

Modern music source separation is a supervised deep-learning problem. A model such as Demucs v4 (HTDemucs) is trained on thousands of full multitrack songs to map a mixed spectrogram back to its constituent sources: drums, bass, vocals, and “other.” State-of-the-art systems are hybrid: they operate simultaneously in the waveform domain and in the spectrogram (STFT) domain, and they combine a U-Net-style encoder with a Transformer over the time axis. The output is a set of estimated stems \(\hat{d}, \hat{b}, \hat{v}, \hat{o}\) that, by design, sum back to approximately the input:

That “approximately” is the first crack in the hypothesis. Source separation is a lossy decomposition, and the loss is not uniform noise — it is structured error. Three kinds of damage matter for our question:

• Bleed and leakage. The separated “vocals” stem contains residuals of drums and reverb; the “other” stem contains vocal remnants. The masks learned by the network are soft — every time-frequency bin is shared between sources — so no stem is ever pure. Typical instrument-to-stem bleed can be several percent of the energy in real deployments, and it is worst exactly where sources overlap.
• Phase smearing and comb filtering. The masks are applied in the magnitude or complex domain and the phase must be reconstructed or inherited from the mix. Where two stems overlap in a bin, cancellation artifacts appear; where masks change abruptly, the output develops a “swirly,” metallic, or underwater character.
• Hallucinated content. When a source is briefly absent (a drum hit under a loud vocal, a bass note in a quiet intro), the network must guess. It often invents plausible-sounding content that was never in the original — a “phantom” cymbal or a synthesized bass transient. The stem is not a copy of what was recorded; it is a generative reconstruction of what the network believes the source probably was.

The last point is worth emphasizing because it is the only part of the hypothesis that has any physical truth in it: a separated stem is not the original waveform of that instrument. The stem has been denoised, masked, regenerated, and quantized by a neural network. So in a literal sense, the original waveform indeed “does not exist” in the DAW session. But — and this is the whole question — the watermark does not care about the file, only about the pattern. And for reasons we now examine, that pattern is not removed by the separation; it is redistributed.

4 · Why the watermark leaks into every stem

Consider what a source-separation network is actually doing when it sees the watermarked mix \(y = x + \alpha m p\). The network was trained on clean multitrack data. It has never seen the watermark as a concept; it has only seen that some low-level, broadband energy is present in every training mix. What does the network do with that energy? Three facts combine to a strong answer:

4.1 · The watermark is statistically invisible to a content-based masker

The watermark \(p[n]\) is, by construction, pseudorandom and orthogonal-in-expectation to the musical content: \(\mathbb{E}[x[n]\,p[n]] \approx 0\). The separator’s masking decisions are based on content features — harmonic structure, onsets, spectral centroids, source priors. The watermark carries none of those features, so the network has no basis on which to assign it to one stem rather than another. It is treated the way the network treats any unexplained residual noise: as part of “everything,” distributed across the source estimates roughly in proportion to each stem’s energy.

The mathematics is the same as the collusion/estimation argument from the companion article, but in reverse. There, an attacker averages copies to make music cancel and leave the watermark; here, the separator estimates sources by masking the music, and the watermark — being uncorrelated with the music — is neither cancelled nor captured. It passes through the masks, partially into each stem:

If the soft mask \(\mathcal{M}_i\) preserves (say) 30% of the energy in a given bin for each of three stems that share that bin, then roughly 90% of the watermark energy in that bin survives somewhere in the stem set — and is then recombined when the stems are mixed back together.

4.2 · The “sum is the mix” constraint works against the remixer

Because the stems are trained to sum back to the input, any watermark energy the network fails to assign to a specific source falls into the residual that is distributed across all stems. The remixer cannot “leave the watermark out” without also leaving out the residual noise floor, which would remove the tails of reverb and room tone that make the stems sound natural. In practice, the DAW recombines nearly all of it. The famous estimate that “separation is a lossy decomposition” is precisely the problem: the loss is mostly in the musical detail, not in the watermark.

4.3 · Quantify it: the detection statistic after remixing

Let the original watermark energy be \(E_w = \alpha^2 \sum_n m^2[n] p^2[n] = \alpha^2\, \overline{m^2}\, N\), and let each stage of the pipeline retain a fraction \(\rho_1, \rho_2, \dots\) of it (separation, DAW processing, re-encode). After the full chain the surviving watermark energy is roughly

Detection fails only when \(E_w’\) drops below the threshold the detector needs. But the embedder designs \(E_w\) so that even after the expected channel — MP3 at 128 kbps, streaming re-encodes, casual edits — the statistic stays comfortably above \(\tau\). A stem pipeline whose \(\rho_j\) values are each 0.8–0.9 (as separation typically achieves for broadband content) retains on the order of 40–70% of the watermark energy. That is not a removal; that is a slightly degraded copy. The only stages that push \(\rho\) down hard are the ones that also destroy the music — heavy low-bitrate re-encoding, aggressive noise gating, or hard high-frequency filtering. And those are available without any stem separation at all.

4.4 · The one legitimate force: separation as a denoiser

There is a real mechanism buried in all of this, and honesty requires naming it. Because the separator is trained to produce clean, dry stems, it acts as a learned denoiser: it tends to discard energy that looks like codec noise, reverb tails, or low-level broadband hiss — and a spread-spectrum watermark at masking level can partially look like exactly that. Separation therefore can shave some watermark energy, especially in sparse, clean arrangements. This is the “neural denoising” attack family from the watermarking literature, and it is a genuinely useful ingredient. But it is an unreliable one: it depends on how much the watermark resembles noise to this particular network, it removes musical ambience alongside the watermark, and the surviving fraction is still typically far above the removal threshold. Separators are not trained to remove watermarks; they are trained to remove noise, and the two are not the same thing.

5 · The “DAW resynthesis” step is the real mechanism

If stem separation is not what removes the watermark, why does the overall method appear to work in practice? The honest answer is that it sometimes does — and when it does, the work is being done by the other ingredients of the pipeline, all of which are independently known watermark attacks that happen to be dressed up as music production. The DAW is not a magic wand; it is a delivery vehicle for a codec-grade destructive channel. Consider what actually happens between “stems loaded” and “file rendered”:

• Re-encoding. The final render goes through an encoder (MP3, AAC, Ogg, or lossless), and the stems themselves are typically exchanged as lossy files. A 320→128→320 kbps chain is the classic “chemical peel” of watermark removal — it destroys the fine spectral structure the watermark lives in, while audibly dulling the music (companion article, Section 3.4).
• Resampling. Stem tools often export at 44.1 kHz; DAWs render at 48 kHz; the project bounces at whatever rate the user chose. Each resample is a low-pass filtering step that attenuates the ultrasonic band where community analyses place Suno-style watermarks (roughly 18–24 kHz). A single 48 kHz render is enough to cut into that band.
• EQ and processing. The very acts a producer naturally performs — high-pass filtering the bass stem, shelf-EQing the top end, adding saturation, gating noise, gluing with a limiter — all subtract or decorrelate the low-level broadband energy that carries the watermark.
• Time-base editing. Chopping, time-stretching, pitch-shifting, or re-aligning stems is the desynchronization attack from the watermarking literature: it breaks the detector’s chip alignment, which is exactly why detectors build search grids to defeat it.
• Dither and re-quantization. A 32-bit float DAW rendering to 24- or 16-bit PCM with dithering adds shaped noise that decorrelates the watermark, another classic attack.

In other words, the stem method’s real power is that it bundles a half-dozen established attacks into a workflow that a user would plausibly do anyway, and adds a neural denoiser (the separator) on top. The “no original waveform” framing is a red herring; the accurate description is “heavy lossy processing plus regeneration, wrapped in a creative task.” And that reframing has a sharp consequence: any of these operations can be applied to the mixed track directly, with no stems at all. If a producer is prepared to accept the audible cost of heavy EQ, low-bitrate re-encode, and denoising, the stem pipeline adds nothing except its own artifacts. The separation step is not the engine of removal; it is a (sometimes welcome) way of making the engine look like art.

6 · Why vocals defeat the method

The user’s intuition that the method works better on instrumentals than on vocalized tracks is one of the strongest parts of the idea, and it can be justified on several independent grounds:

6.1 · The vocal stem is the least separable and least forgiving

Vocals are the most spectrally and temporally concentrated source in a mix: a single dominant harmonic line, strong formants, and fine pitch and timing detail that listeners judge harshly. They are also the source where separation is most likely to leave artifacts (bleed from the “other” stem, phase smear, breath-loss, and the dreaded “tunnel” or “swimmy” reverb tail). A vocal stem that has been through a separator and re-rendered is audibly worse in ways that a bass or drum stem is not — drums and synths tolerate noise, phase smear, and even hallucinated hits far better than a lead vocal does.

6.2 · The vocal stem still carries watermark residue

Section 4.1’s argument holds for every stem, including vocals: the watermark energy is distributed into the vocal stem in proportion to the vocal’s share of the mix energy. The vocal stem is therefore not “clean” just because it went through a separator. And a lead vocal that occupies a quiet section of the mix can even carry a larger relative watermark fraction, because the mask \(m[n]\) allows the watermark to be louder when the music is quiet. Dropping a separated vocal into a fresh mix reintroduces exactly the pattern the method is trying to destroy.

6.3 · You cannot “resynthesize” a voice without destroying it

The most honest way to defeat the watermark in an instrumental stem is to regenerate it — but regeneration requires a model of the source, and there is no general “vocal synthesizer” that reproduces a given performance from a stem without either losing the performance (vocoder mush, autotune artifacts, formant damage) or falling back to the very same recording. A producer can replace a drum loop, re-draw a bass line, or swap a synth pad with samples and lose almost nothing. They cannot replace a singer. For instrumentals, the method can approach a true “resynthesis” (a sampled or re-triggered replacement); for vocals, it degenerates into processing the original — and processing does not remove the watermark, it just degrades the voice.

6.4 · The “vocal still means human” problem is aesthetic, not technical

There is a separate, subtler reason vocals are the sticking point: a lead vocal is the element listeners identify with the identity of the track. Even a technically watermark-free vocal render that sounds processed will be rejected by ear. The bar for “success” on a vocal track is therefore higher in a way that has nothing to do with detection statistics. For an instrumental, a slightly dulled, denoised top end is an acceptable trade; for a vocal, it is a reason to abandon the whole pipeline.

7 · Counterarguments and critiques

An article that ends with “this method works for instrumentals” would be doing the reader a disservice. The critiques are not footnotes; they are the substance. Here are the strongest objections, each of which the method’s proponents have to answer.

7.1 · The information-theoretic wall

The pipeline observes only \(y\). Every “clean” stem is a lossy reconstruction of a component of \(x\), and the watermark energy that is not assigned to any stem is not destroyed — it is smeared into the stems’ noise floors, then recombined. Formally, the remix \(\hat{x}\) is produced by a many-to-one map from \((x, w)\) pairs; infinitely many pairs yield the same \(\hat{x}\), and only one of them is “watermark-free by construction.” Nothing in the pipeline can prove it produced the watermark-free member of the equivalence class. At best it can hope the accumulated distortion dropped the correlation below threshold — a claim that must be tested on the actual detector, not assumed from the workflow.

7.2 · Forensic detection of the pipeline itself

The method’s greatest vulnerability is not the watermark — it is the trace of the attempt. Separation leaves a signature: characteristic comb-filtered phase, hallucinated transients, an unnaturally clean noise floor, and stem-sum residual mismatches. A forensic classifier trained on “separated-and-remixed” audio can flag the pipeline even when it cannot read the watermark (companion article, Section 5.3). From an enforcement standpoint this is enough: platforms do not need to prove the watermark survived; they need to show the file went through exactly the processing that the ecosystem associates with evasion. The remix method, ironically, is more detectable as an evasion attempt than a simple lossy re-encode, because stem artifacts are distinctive.

7.3 · The watermark may not be where you think

Community descriptions of Suno’s scheme (an 18–24 kHz spread-spectrum band) are informed speculation, not documentation. If the scheme also embeds energy in the midband (under a different masking strategy), or if it is a learned, model-native watermark (the frontier direction discussed in the companion article, Section 6.1), then the stem pipeline’s accidental attacks — which target codec noise, ultrasonic content, and broadband hiss — may barely touch it. A detector with access to midband features defeats a method optimized for the ultrasonic-band story. Designing a removal method against an unverified model is building on sand.

7.4 · Scheme rotation and the treadmill

Watermark schemes are not static. When the generator rotates the spreading sequence, changes the band, or moves to model-native embedding, every tuned removal pipeline — including a stem-separation one — must be revalidated from scratch. The method’s fragility is structural: it relies on incidental properties (where the watermark lives, how much it resembles noise, how the separator’s denoiser behaves) rather than on any general guarantee. “It worked once, on one track, at one moment” is not a technique; it is an observation.

7.5 · The “one surviving layer” asymmetry

Even a perfectly executed remix must contend with the fact that the enforcement stack does not depend on the audio watermark alone. Metadata provenance, Content ID reference matching, disclosure requirements, and ML classifiers are all independent layers (companion article on this site, How YouTube catches AI content). The remixer must defeat every layer that survives; the platform needs only one layer to survive. A track that beats the audio watermark but is still flagged by a separated-and-remixed forensic classifier, or by Content ID on the melodic fingerprint, has not achieved anything.

8 · A fair test: an experimental protocol

Claims like this should be tested, not asserted. The following protocol is designed to be honest about the outcome — it sets up a real experiment that separates the genuine mechanism (codec-grade destruction) from the narrative (stem magic). Run it on a batch of, say, 20 generated tracks: 10 instrumental, 10 vocal.

1. Baseline. Render each original track to a canonical lossless format (WAV 48 kHz/24-bit) and record the platform’s detection statistic \(c_0\) (or a Yes/No flag) for each.
2. Stem pipeline. Split with a fixed model (e.g., HTDemucs), re-balance minimally in a DAW, and render to WAV and to MP3 at a chosen bitrate. Record the detection statistic \(c_1\).
3. No-stem control. Apply only the lossy part of the pipeline to the full mix — the same resample, the same MP3 bitrate, the same dither, no separation at all. Record \(c_2\).
4. Analysis. Compare \(c_1\) vs \(c_2\). If the stem pipeline is doing real work beyond generic lossy processing, \(c_1\) should be meaningfully lower than \(c_2\) at matched quality. If they are comparable, the separation step is decorative. Also compare instrumental vs vocal subsets (Section 6), and listen blind to judge quality damage.
5. Forensic check. Run a “was this separated?” classifier (or at least inspect the stem-sum residual and the noise floor) to see whether the output carries the pipeline’s fingerprint, regardless of detection outcome.
6. Variation. Repeat with a different separator, a different bitrate, and a different watermark generation (different prompts/dates) to test scheme-rotation sensitivity (Section 7.4).

The prediction that follows from this article: on instrumentals, the method will sometimes clear the detector — but so will the no-stem control at matched quality, and often with less audible damage. On vocals, the method will rarely clear the detector at acceptable quality, and the forensic classifier will flag both the attempt and the pipeline. If those predictions fail, this article should be corrected; that is what a falsifiable claim is for.

9 · Legal and ethical framing

The technical analysis above is independent of whether the method is legal, but the two cannot be cleanly separated in practice. Watermarking is deployed as a technological protection measure, and circumventing such measures is regulated in most jurisdictions:

• United States. The DMCA (17 U.S.C. §1201) prohibits circumventing access or protection controls and trafficking in circumvention tools. Courts have treated persistent digital watermarks as protectable technical measures.
• European Union. The Information Society Directive (2001/29/EC, Art. 6) protects effective technological measures, with narrow and nationally inconsistent exceptions.
• Terms of service. Generators such as Suno prohibit removing or altering identification markers; violating those terms can cost a user their account and their license to the generated content.
• Regulatory context. Transparency obligations (EU AI Act Art. 50, US Executive Order 14110) push platforms toward machine-readable provenance; evading those marks runs against the regulatory tide, not with it.

None of this changes the signal-processing facts. It changes what the reader is legally entitled to do with them. Analyzing a method, evaluating it experimentally on content you own, and discussing it openly are legitimate; deploying it on tracks you do not own or are not licensed to modify is where the line is drawn. This article takes the former position.

10 · Bottom line

The stem-separation hypothesis contains a true observation wrapped in a false mechanism. The true part: separated stems are genuinely new signals, and the original watermarked waveform genuinely does not exist in the DAW. The false part: that this absence matters. What removes a watermark is destruction of the pattern, not absence of the original, and the pattern survives separation because it is statistically orthogonal to the content the separator uses. The pipeline’s real power comes from the lossy, destructive channel it wraps — re-encoding, resampling, EQ, time-editing, dithering, and a neural denoiser — all of which are classic attacks available without a single stem.

Where the idea is strongest is exactly where the user suspected it: instrumentals. A producer can regenerate or replace instrumental parts without losing the music, so the pipeline can approach true resynthesis and can accumulate enough incidental destruction to matter. Where the idea fails is also exactly where the user suspected it: vocals. The vocal stem still carries watermark residue, the voice cannot be replaced, and listeners judge vocal damage harshly. And in all cases, the approach faces the information-theoretic wall, the forensic trace of separation, unverified watermark models, scheme rotation, and the enforcement stack’s one-surviving-layer asymmetry.

The verdict, stated plainly: stem separation does not remove Suno-style watermarks; heavy lossy processing with a remix wrapper sometimes does, mostly on instrumentals, and at the cost of quality and detectability that a forensic classifier can read. If your goal is a track that sounds like music and is not identifiable, this method is a gamble. If your goal is to understand what actually survives lossy processing, it is a valuable experiment.

11 · References and further reading

• Companion article on this site — Music watermarks: how Suno tags its MP3s — and the arms race to remove them. The DSP/mathematics of spread-spectrum embedding, detection statistics, and the full taxonomy of removal attacks. Read it here
• Companion article on this site — How YouTube catches AI content — and what Suno sends to the detector. The multi-layer enforcement stack, Content ID, C2PA, SynthID. Read it here
• Rouard, Massa, Défossez — “Hybrid Transformers for Music Source Separation,” ICASSP 2023. The HTDemucs architecture behind the most widely used stem splitter.
• Défossez — “Hybrid Spectrogram and Waveform Source Separation,” ISMIR 2021 Workshop on Music Source Separation. The hybrid domain approach and its loss trade-offs.
• Stoller, Ewert, Dixon — “Jointly Detecting and Separating Singing Voice,” ISMIR 2018. Why vocal separation is harder than instrumental separation — the “singing voice in a mix” problem.
• Petitcolas, Anderson, Kuhn — “Attacks on Copyright Marking Systems,” Information Hiding, 1998. The canonical taxonomy of watermark attacks, including the removal-by-processing families the stem pipeline accidentally deploys.
• Cox, Miller, Bloom, Fridrich, Kalker — Digital Watermarking and Steganography, 2nd ed., Morgan Kaufmann, 2008. The standard textbook; the robustness triangle and detection theory.
• Demucs documentation — model zoo, separation quality, and the caveat that separated stems are estimates, not master-quality components. github.com/adefossez/demucs
• DMCA 17 U.S.C. §1201 and InfoSoc Directive 2001/29/EC Art. 6 — the anti-circumvention provisions relevant to removing watermarks from content the user does not own.