The file was a 48 kHz WAV, 2:14 long, sitting at 124 BPM: a moody synth bed with a pad that drifted slightly out of tune under a filtered kick. It arrived for a documentary rough cut. The composer said it was played. The embedded metadata said "original composition." Nothing inside that audio confirmed or contradicted either statement, and nothing I could run on it would have. That is the working reality of AI music generation as it meets streaming distribution: the waveform is the least informative part of the file, and every system currently being built to fix that is quietly fixing something narrower.
Can a streaming platform tell whether a track was made with AI?
Not by listening, and not by analyzing the audio in any way that would hold up in a dispute. What platforms can actually do is check three separate things: whether a known generator left an inaudible marker inside the recording, whether someone declared AI involvement in the paperwork that travels with the release, and whether a statistical classifier thinks the recording resembles machine output. Only the first two produce something anyone would act on, and both depend on cooperation from the tool or the person uploading. The thing readers picture — drop a song in, get a verdict — is not what is shipping.
A signal inside the signal
Audio watermarking works by perturbing the generated audio in ways tuned to sit under the threshold of hearing, then recovering that pattern with a detector that holds the matching key. Google DeepMind's SynthID is the best-known implementation across modalities, and Suno has said it intends to mark its output this way; as of writing, several generators have made similar commitments. The engineering is genuinely good. Marks of this class are designed to survive the things that actually happen to a file in the wild — an AAC or Opus transcode on the way to a listener, level changes, a modest crop.
The constraint is structural rather than technical. A watermark is only present if the generator put it there, and it is only readable by whoever operates the detector. A label's A&R department cannot run it in-house on a suspicious submission. Neither can you. Detection becomes a service, offered by the same companies whose output is being checked, and it covers exactly the models that opted in. Open-weight generators running on someone's own GPU are outside that set by definition, and stripping the marking code from a model you control is not a hard afternoon.
The paperwork route
The second approach ignores the audio and attaches a claim to it. C2PA manifests carry cryptographically signed provenance alongside a file. At the distribution layer, industry credit standards have been extended with fields for declaring AI involvement, and Spotify said it would surface disclosures supplied that way. This is unglamorous compared with a watermark, and it has one property the watermark lacks: the claim lives in the release database, not in the bytes. Transcoding does not remove it. Stem separation does not remove it. The distributor holds it, timestamped, attached to a payee.
What it proves is narrow and worth stating plainly. It proves that a specific party asserted something at a specific moment. It does not verify the assertion. Somebody can lie in the disclosure field, and plenty will.
The classifier, and why it is the weakest evidence
The third approach is a trained detector that examines the recording for the statistical fingerprints of generation. It has one enormous advantage over the other two: it requires cooperation from nobody, which makes it the only option against an open model, a stripped watermark, or an undeclared upload.
It is also the one I would trust least with consequences. These models degrade against generators they were not trained on, which is every generator released after the training set closed. They get confused by processing that has nothing to do with AI — heavy tape saturation, aggressive re-amping, a lo-fi bounce through a cassette four-track. And the cost asymmetry is brutal: a missed detection is invisible, while a false positive is a human being told their own performance is synthetic. Anyone building enforcement on classifier output alone is building on the least reliable of the three signals.
The same three systems, on named criteria
| Criterion | Embedded watermark | Declared provenance | Classifier |
|---|---|---|---|
| Requires cooperation from | the generator | the uploader/distributor | nobody |
| Covers open-weight models | no | only if declared | in principle, yes |
| Survives AAC/Opus transcode | designed to | held in the release record | not applicable |
| Survives stem-splitting, pitch/time edits, re-recording | degrades | unaffected | degrades |
| What it establishes | this tool produced this audio | a named party made a statement | resemblance, with a confidence score |
| Who can run the check | the watermarking party | the platform and distributor | anyone |
| Failure mode | silent miss | a documented lie | a false accusation |
Where this lands
Read down that table and the ranking inverts against expectation. The watermark is the most sophisticated and the least universal. The classifier is the most universal and the least safe to act on. The disclosure field — a checkbox, essentially — is the only one of the three that produces an enforceable object, because it is a statement made by an identified party at the point where money enters the system. A platform does not need to prove anything about the spectrum of a recording to act on a false declaration. It needs a contract term and a payment to withhold.
There is a further wrinkle that reframes the whole exercise. The problem streaming services describe when they talk about this is not really the existence of machine-made records. It is spam uploads at volume, voice impersonation of named artists, and royalty fraud driven by artificial listening. None of those are properties of the audio. They are properties of accounts: upload velocity, payout routing, listener graphs that do not look like listeners. A perfect origin detector would leave all three intact, and the fraud teams that have worked historically have gone after behavior, not musicology.
The folder to keep, whatever you use
If you deliver music to anyone — a client, a distributor, a game studio — keep this alongside the bounce. It costs an hour and settles arguments later.
- The render receipt. Tool, model or version as of that session, date, and the prompt or seed if there was one.
- The session material. Stems, MIDI, DI and mic takes, project file. Nothing establishes human performance like the multitrack.
- The disclosure, in writing. Whatever you ticked at delivery, saved as you submitted it.
- The license as it read that day. Save a copy. Generator terms change, and the version that governs your track is the one in force when you rendered it.
- Credits at the part level. Who played what, who wrote what, who sang. This is the layer disclosure standards are built on, and most people fill it in badly.
Back to the file
That 2:14 synth bed never gave up its origin, and it never will. The audio genuinely is the least informative part of the file — but the point is not that the answer is missing. It was never encoded in the waveform to begin with. It sits in the manifest, the delivery form, the payout record, and the account that pressed upload, and those are all things the industry already knows how to inspect. Authenticity in music was always a claim somebody made and stood behind; the machines only removed the last excuse for not writing it down.
Not sure which tool to use?
Compare the top AI music and sound tools side by side — honest reviews, real pricing, no sponsorships.
