Fake Artist Prevention: Why Your AI Music Generation Policy Should Ignore the Audio

A few months back I dropped twenty-four thirty-second clips into a Discord full of working mixing engineers and asked them to sort human from machine. Twelve came out of text-to-music models. Twelve came off my own drives — cues I wrote for indie games between 2016 and 2023, all of it bounced to the same 48kHz WAV, loudness-matched, metadata stripped. Nineteen people answered. The group averaged fifteen right out of twenty-four. That number is why an AI music generation policy that starts from "we'll know it when we hear it" is broken before it ships, and why fake artist prevention turns out to have almost nothing to do with listening.

This is an anecdote, not a study. Nineteen people, no controls, clips I chose myself, and I knew the answers. Treat it as a smoke test — the kind you run before you commit engineering time, not the kind you cite in a policy document. But the failure pattern in the results is worth more than the score.

The clip that broke the test

The most-flagged track in the whole set was mine.

It was a 2019 stealth-level loop: 92 BPM, F minor, an arpeggiated cello sample gridded hard to sixteenths, a sine sub underneath, and a hi-hat pattern quantized to 100% because the cue looped for six minutes and any swing I put in got irritating by minute three. Twelve of nineteen people called it machine-made. Two wrote back with reasons, and the reasons were fair: no room, no breath, no drift, nothing that sounded like a decision made in a take.

Meanwhile a model render sailed through as human because it had a hi-hat sitting a few milliseconds behind the grid and a hiss floor that came from the codec chain, not from a room.

So the group wasn't detecting synthesis. They were detecting the absence of accident — which is a judgment about production choices, not a fact about provenance. And it is trivially defeatable. Print the render through a tape emulation, nudge one note off the grid, add a noise floor at -60 dBFS, bounce at 24-bit. You have not changed who made the track. You have changed every cue the listener was actually using.

If you are building moderation for a platform, that's the load-bearing finding. The signal your reviewers think they're hearing is a signal an adversary can remove in four minutes, and one your most careful users will fail by accident because they mixed something clean and repetitive on purpose.

Can you detect AI-generated music?

Not reliably from the audio alone. Classifiers trained on model outputs perform well on clean renders from models they have seen, and degrade quickly once a file has been through the ordinary chain of music production — re-encoded, pitch-shifted, time-stretched, layered under live instruments, re-recorded through a monitor, or bounced back out of a DAW with a bus compressor on it. Detection also cannot answer the question a platform actually cares about, which is authorship rather than synthesis. Vendors publish accuracy figures from their own benchmarks; those figures describe their test set, not your catalog, and you should validate against your own uploads before you build enforcement on top of them.

The authorship problem is the harder half. Take the last three things I delivered. One had a percussion bed I generated, chopped into eight hits, and re-sequenced by hand. One had a lead line I played badly and repaired with a pitch editor. One used a cello library recorded in 2004 — somebody else's performance, sold by the gigabyte, and nobody has ever asked me to disclose it.

Those three files carry the same extension and the same waveform statistics. A binary label — AI or not — flattens all of it into a category that doesn't map to anything a listener, a rights holder, or a court cares about. Which is why the useful question is never "is this AI." It is "who is standing behind this, and what did they say they did."

Three technical fixes, and where each one leaks

Every platform that has looked at this lands on one of three mechanisms. All three are worth having. None of them does the job alone.

Classifiers are the one everyone builds first because it feels like the shape of the problem. It isn't. You are training a model to recognize other models, in a space where new models ship constantly and where the transformation that defeats you is a normal production step somebody would perform anyway.

Watermarking is stronger than people give it credit for, because it is a positive signal rather than a guess. If the watermark is there, something real happened. But it only exists where a vendor chose to put it, it degrades unevenly across the processing chain, and it says a tool was involved — not who wrote the part, not who performed it, not who owns it.

Provenance manifests are the most honest of the three, because they are explicit about being a claim rather than a measurement. A signed manifest travels with the file and says: this account, this tool, this date. That is genuinely useful. It also gets destroyed by the average upload pipeline, and a bad actor removes it by exporting through anything.

Notice the asymmetry the three share. Each is decent positive evidence and worthless negative evidence. No watermark does not mean human. No manifest does not mean fraud. A policy that treats absence as guilt will convict the producer who bounced through an old converter and clear the one who stripped metadata deliberately, which is exactly backwards from what you wanted.

The problem is arithmetic, not aesthetics

Here is the part that survives every model generation, and the reason to treat this as engineering rather than taste.

A release used to cost something. Studio time, a session player, a mastering pass, at minimum somebody's weekend. Any system where uploading is free and payouts are per-play was already being arbitraged before generative models existed — the models moved the cost of the supply side toward zero while leaving the payout side unchanged. That's a one-sided change in an equation, and one-sided changes get exploited.

In practice the exploitation shows up in four distinct shapes, and it is worth separating them because they have different fixes:

• Volume flooding. One entity, thousands of tracks, hundreds of invented artist names, harvesting the long tail of algorithmic and mood-playlist plays where nobody is looking for a specific song.
• Streaming fraud. Bot plays pointed at those catalogs. This is fraud whether the music was generated, sampled, or performed live. It is a payments problem wearing a music costume.
• Metadata hijack. A release delivered onto an existing artist's page through a name collision, a sloppy distributor, or a deliberate mis-delivery. Cheap to execute, genuinely damaging, and completely invisible to any audio analysis.
• Voice and likeness. A cloned voice credited to a person who never sang the part. This is the only one of the four that is really about the audio, and it is also the one with actual legal exposure attached.

Only the last item is a listening problem. The first three are account, payment, and metadata problems, and every one of them can be worked without ever classifying a waveform. That is the good news buried in the bad news: the things you can measure reliably happen to be the things that matter most.

Most major services have moved in this direction — disclosure fields at delivery, spam and duplicate filtering, tighter distributor accountability — rather than toward outright bans. The specifics differ by platform and change often enough that anything I state here as current would be stale by the time you read it. Read the terms as of your reading, and treat this as the shape of the response, not the letter of it.

Draw the line at authorship, not at the toolchain

If your policy bans "AI," you have to define AI, and the definition will accidentally ban a pitch editor, a stem separator, a drum replacer, a synth with a neural oscillator, an automated mastering service, a noise reduction pass, and a de-reverb plugin. Every one of those is a model. Producers have shipped commercial records with all of them for years. Write the rule loosely and your enforcement queue fills with your most competent users.

The line that holds is authorship plus disclosure. Something like this:

Releases must be attributable to a verified human account holder who
authored or directed the work.

Tools, including generative ones, are permitted at any stage of
production.

Two disclosures are required at upload:
  1. Whether any released audio was generated from a text or audio
     prompt rather than performed or programmed by the account holder.
  2. Whether any voice in the release imitates an identifiable person.

A false disclosure is a catalog-level violation.
Using a tool is not a violation.

The reason this shape works is not that it is morally superior. It is that every clause is checkable against an account rather than against a file. You are not asserting that you can hear the difference; you are asserting that a claim was made, attached to a verified person, and can be revoked. That gives you a lever — the false statement — that does not require winning an audio-forensics argument you would lose.

It also means a legitimate user knows exactly what to do, which is the part most policies get wrong. "Don't upload AI music" gives a game composer with a generated percussion bed no idea whether they are in violation. "Declare generated audio, don't imitate real voices" gives them an action.

Where enforcement actually bites

Seven moves, roughly in order of how much fraud they remove per unit of engineering:

1. Verify the payee, not the track. Identity has a marginal cost; files do not. One verified human, one payout identity, and a hard cap on how many artist names can hang off it. This is the single highest-leverage constraint available, because it reintroduces scarcity at the only point in the system where scarcity is enforceable.
2. Put the friction on the payout, not the upload. Hold the first payout behind identity verification and a waiting period. Flooding rings die at the cashier, not at the door — and this costs a real artist a delay, not a rejection.
3. Rate-limit catalog shape, not audio. Sixty releases in a week, tracks clustered under ninety seconds, near-identical cover art, sequential titles, no cross-linking to anything outside the platform. Catalog structure is cheap to compute and much harder to fake convincingly than a waveform.
4. Treat metadata fraud as tier one. Name collisions against existing artists, mis-delivered releases, reused ISRCs. Cheapest class to detect, fastest to remedy, and the one that does concrete harm to a specific identifiable person who will otherwise find out from a fan.
5. Give voice and likeness its own policy and its own takedown path. It is a rights and publicity question, it varies by jurisdiction, it is moving, and it needs to resolve in hours rather than sitting in a general content queue. Describe your process; do not promise legal outcomes you cannot control.
6. Publish your false-positive rate and staff the appeal. If you cannot measure how often you are wrong, you do not have a policy, you have a mood. Human review does not scale to the upload firehose — it scales to the appeals queue, which is two or three orders of magnitude smaller. That is the only place human judgment is affordable, and it is also the place it matters most.
7. Say plainly what you do not detect. "We do not scan audio for model fingerprints. We act on disclosure, account behavior, and reports." Users can plan around a stated limit. They cannot plan around a capability you implied and do not have, and the moment somebody demonstrates you do not have it, the rest of your policy loses credibility with it.

If you are the one using the tools

Most readers here are not writing platform policy. You are the game dev who needs adaptive loops by Friday, the editor covering a montage, the podcaster who wants an intro that does not sound like the other four in the category. The enforcement wave lands on you too, mostly through disclosure fields and client legal teams. Keep the paper trail and it costs you nothing.

• Save the prompt, the model name and version string, and the date in a plain text file next to the render.
• Keep the raw render and the session, not only the final bounce.
• Save the license terms as a PDF on the day you generated. Terms change; what you agreed to is the version you saved, and you will not be able to reconstruct it later.
• Do not strip metadata on delivery. If your DAW writes an iXML or BWF chunk, leave it in.
• Fill in the disclosure field even when it feels excessive. The people who get swept up in enforcement are rarely the ones who declared.

When we test generators for reviews here at City of Punk, every render gets a sidecar text file with model, prompt, date, and a license snapshot. It has saved me twice — both times when someone asked, months later, exactly what was in the bed under the dialogue.

And know what the real question is. A client's legal team almost never asks "is this AI." They ask whether you can indemnify it. That is a terms question, answered from the license you saved, and if the terms are silent on commercial use or on training-data provenance, the honest answer is that they are silent — not that you are covered.

Back to the Discord

I went back and listened to the cue that got flagged, the one twelve people were sure a machine made.

They were not wrong about what they heard. The hats are dead on the grid because a loop that swings gets grating by minute four. The bass sits still because the tension in that scene was carried by the sound design, not the score. There is no room noise because the whole thing was going under gunfire and footsteps, and any air I left in it would have turned to mud. Every quality that made it sound machine-made was a decision I made on purpose, for a build that shipped.

What the test measured was not provenance. It was how much a track resembles the thing people currently expect a machine to produce — a moving target, defined by whatever last year's models were bad at.

The myth is that fake artist prevention is a detection problem: build a good enough classifier, or train a good enough ear, and the machine-made tracks fall out of the feed.

The accurate version is that it is an identity and payout problem: you will never reliably hear who made a track, but you can always decide who gets verified, who gets paid, how quickly, and under whose name.