VEIL

1. What VEIL is

VEIL protects music from being learned by generative AI models. Before release, it adds a carefully optimised, perceptually hidden perturbation to a track. If models such as MusicGen, Stable Audio, or similar systems are trained on protected music, they should struggle to learn the artist's sound, voice, and style.

VEIL has two parts:

1. Protection method: A music-aware adversarial protection targeting rhythm, harmony, melody, timbre, and voice while remaining robust to removal attempts.
2. Platform: An application where artists upload music, select protection layers and strength, and receive the protected track together with protection and audio-quality metrics.

2. The problem

Generative music models may be trained on large collections of recorded music without artists' consent. Once trained, they can reproduce characteristics of an artist's style or voice.

Existing approaches are limited:

• Opt-outs and licensing depend on AI developers cooperating.
• Watermarking can detect usage but does not prevent learning.
• Existing adversarial music protection covers only parts of the problem and has limited testing against removal attacks.

VEIL instead aims to make music resistant to learning before it is published.

3. How VEIL solves it

3.1 Optimised perturbations

Random inaudible noise is generally insufficient because models can still learn through it. VEIL therefore optimises perturbations against surrogate models and representations such as EnCodec, audio VAEs, MERT, and CLAP.

Two objectives will be investigated:

• Untargeted / unlearnable: reduce useful learning from protected tracks.
• Targeted / poisoning: push learned representations toward an incorrect or decoy style.

The project currently leans toward targeted poisoning.

3.2 Stem-aware protection

VEIL separates tracks into vocals, drums, bass, and other stems using Demucs.

Stems are used for:

• Per-stem perceptual budgets: stronger perturbations where masking allows them and weaker perturbations in sensitive regions such as exposed vocals.
• Component targeting: protection can focus on voice, harmony, timbre, or other musical features.

The final perturbation is applied directly to the original mix, avoiding source-separation artifacts.

3.3 Robustness

VEIL uses Expectation over Transformations (EOT) so protection remains effective after likely preprocessing attacks, including:

• MP3/AAC/Opus compression and resampling;
• source separation followed by remixing;
• EQ and denoising;
• diffusion-based purification where feasible.

3.4 What do models learn?

Before finalising the protection method, VEIL tests how strongly models rely on rhythm, harmony, melody, timbre, and voice.

Models are fine-tuned on controlled variations where individual components are altered or removed. The resulting imitation quality determines which components the protection should prioritise.

3.5 Target models

VEIL will evaluate several model families:

• MusicGen: transformer over EnCodec tokens.
• Stable Audio Open: latent diffusion model.
• ACE-Step or YuE: open models supporting vocals.

Closed or unavailable models such as Suno and MusicLM can only be considered as transfer targets rather than directly fine-tuned models.

3.6 Datasets

The main datasets are:

• MUSDB18
• MedleyDB
• Slakh2100

MUSDB18 and MedleyDB provide real recordings with stems, while Slakh2100 provides synthetic multitrack audio and MIDI for controlled experiments.

3.7 Platform

Users will be able to:

1. upload a track;
2. select protection layers and strength;
3. download the protected version;
4. view protection, signal-change, and perceptual-quality metrics.

This allows users to choose their preferred trade-off between protection strength and audio quality.

4. Evaluation

4.1 Experimental setup

The threat model assumes an attacker downloads an artist's music and fine-tunes an open generative model using LoRA.

Each artist's tracks are divided into:

• training tracks, which are protected;
• held-out reference tracks, used only for evaluation.

Three models are compared:

All models generate clips using identical prompts and seeds.

Baselines include random noise, full-mix perturbations, stem-only perturbations, and existing methods such as HarmonyCloak/HarmonyDagger.

4.2 Metric 1: Protection Score

Artist similarity is measured using Fréchet Audio Distance (FAD) with music-aware embeddings such as CLAP and MERT.

Protection Score =
(D_protected − D_clean) /
(D_untrained − D_clean)

Interpretation:

• 0: protection had no effect.
• 1: protected training performs approximately like no artist-specific training.
• >1: generations move even further away from the artist.

Results will include confidence intervals and component-level analysis for rhythm, harmony, melody, timbre, and voice.

4.3 Metric 2: SI-SDR

SI-SDR measures the objective signal difference between the original and protected track:

SI-SDR = 10 log10(
    ||αs||² /
    ||αs − ŝ||²
)

Higher values indicate smaller signal changes.

SI-SDR will be reported alongside standard SNR.

4.4 Metric 3: ViSQOL

ViSQOL v3 evaluates the perceptual difference between the original and protected audio and produces a MOS-LQO score from 1 to 5.

A small MUSHRA or ABX listening study with approximately 15–30 participants will be used to verify that the objective metric matches human perception.

4.5 Combined evaluation

Successful protection should produce:

• a high Protection Score, meaning the model learns less;
• a high ViSQOL score, meaning the protected audio still sounds like the original.

SI-SDR provides an additional objective measurement of perturbation size.

The main result will be a Protection Score vs. ViSQOL trade-off curve across protection strengths, methods, and attacks.

5. Expected contributions

VEIL aims to contribute:

1. A stem-aware and perceptually shaped protection method for both instrumental music and vocals.
2. Systematic evaluation against source-separation attacks.
3. Analysis of which musical components generative models learn most strongly.
4. A reusable evaluation framework combining protection, signal, perceptual, component-level, and robustness metrics.
5. A user-facing platform that makes protection accessible to artists.

6. Difference from existing work

References

• Meerza, Sun, Liu. HarmonyCloak: Making Music Unlearnable for Generative AI. IEEE S&P 2025.
• Wei et al. Do Music Generation Models Encode Music Theory? ISMIR 2024.
• Copet et al. Simple and Controllable Music Generation. 2023.
• Shan et al. Glaze. USENIX Security 2023; Nightshade. IEEE S&P 2024.
• Huang et al. Unlearnable Examples. ICLR 2021.
• Zhang et al. SafeSpeech. USENIX Security 2025.
• Hönig et al. Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI. ICLR 2025.
• Fan et al. De-AntiFake. ICML 2025.
• Epple et al. Watermarking Training Data of Music Generation Models. 2024.
• Gui et al. Adapting Fréchet Audio Distance for Generative Music Evaluation. ICASSP 2024.
• Le Roux et al. SDR – Half-baked or Well Done? ICASSP 2019.
• Chinen et al. ViSQOL v3. QoMEX 2020.
• ACE-Step, YuE, and Demucs project repositories.