Contents
Music AI-protection works in the sense that matters most: in its own evaluation it measurably degrades what a generator learns, and it holds up against the standard noise-removal tools it was tested against. What it cannot claim is immunity from a purifier built specifically to strip it, because no such tool has been published against it yet, and in neighboring media those purifiers are already winning. Treat HarmonyCloak as a working deterrent with a known expiry risk, not a permanent guarantee.
Does HarmonyCloak actually work?
On its own numbers, clearly yes. Meerza, Sun, Liu (IEEE S&P 2025) report that cloaking the training audio dropped the target-genre classification of the generated output from 89.2% to 32.3%, across MuseGAN, SymphonyNet, and MusicLM, in both white-box and black-box settings, while a 31-participant listening study confirmed the noise stays inaudible. A protection that both survives a change of generator and passes a human listening test is doing real work, not cosmetic work. The question that decides its value is what happens when someone stops cooperating and starts attacking it.
What removal attacks has it been tested against?
This is where “does it work” gets sharper, because the real question is not whether it survives a cooperative scraper but whether it survives someone actively trying to strip it. Meerza, Sun, Liu (IEEE S&P 2025) test HarmonyCloak against four established noise-removal baselines, spectral subtraction, NMF, EPIc, and DP-InstaHide, and report that the cloak resists all four. Those are standard, off-the-shelf ways to pull added noise out of a signal, and surviving them is the difference between a protection that washes off in a single pass and one that holds. The reason they fail is structural. Meerza, Sun, Liu (IEEE S&P 2025) engineer the perturbation to harmonize with the music’s own frequencies and sit inside its masked region rather than as a separable layer laid on top, so a stripper that assumes the protection is additive noise, estimates its spectrum, and subtracts it has almost nothing to isolate. What that result does not cover is a purifier designed from the ground up to target error-minimizing audio noise specifically, one that models the signal-aligned perturbation instead of treating it as generic noise.
So can the noise be removed?
That is a moving target, and the answer crosses media. No learned, adaptive purifier has been published against HarmonyCloak specifically, so as of now there is no demonstrated break. But the removal direction is advancing fast next door.
| Medium | Removal tool | Status |
|---|---|---|
| Music | none published vs HarmonyCloak | no demonstrated break yet |
| Images | LightShed | strips Nightshade and Glaze |
| Voice | De-AntiFake | neutralizes voice cloaks |
In images, Foerster, Behrouzi, Rieger, Jadliwala, Sadeghi (USENIX Security 2025) present LightShed as “a generalizable depoisoning attack that effectively identifies poisoned images and removes adversarial perturbations,” reporting 99.98% true-positive and 100% true-negative detection on Nightshade (Shan, Ding, Passananti, Wu, Zheng, Zhao, IEEE S&P 2024) and demonstrating it against Glaze (Shan, Cryan, Wenger, Zheng, Hanocka, Zhao, USENIX Security 2023) as well. In voice, Fan, Chen, Liu, Zhang, Yu (ICML 2025) show with De-AntiFake that “existing purification methods can neutralize a considerable portion of the protective perturbations” that tools like AntiFake (Yu, Zhai, Zhang, ACM CCS 2023) apply, leaving a protected speaker with a “false sense of security.” Music is the same kind of target, and it is reasonable to expect it is next in line.
Deterrent or guarantee?
Deterrent. The pattern here is the one the image side already lived through: a tool posts strong first-party numbers, then an independent purifier arrives and resets expectations. That is exactly the arc of does Glaze actually work, where a cloak with strong authored results was later stripped by cheap steps. Nothing published has done that to HarmonyCloak yet, which is a real distinction, but “not yet broken” is a weaker promise than “unbreakable,” and only one of those is a safe assumption to build a catalog on.
Read music protection the way you would a lock rated for a specific set of tools: it defeats the attacks it was tested against, it degrades what a scraper can learn, and it buys time. It does not certify that a future purifier, purpose-built for error-minimizing audio noise, will fail, and the trend in images and voice is that such tools do eventually arrive. Pair the cloak with the one thing no purifier can reach, the clean master you never publish, per how to protect my music from AI training. For the mechanism this reliability rests on, see how HarmonyCloak makes songs unlearnable; for the codec and generator question, does music poisoning survive MP3, Suno, and MusicGen; and for how removal works in the image world, can Glaze and Nightshade be bypassed.
Sources
- Meerza, Sun, Liu (2025). HarmonyCloak: Making Music Unlearnable for Generative AI. IEEE S&P 2025.
- Foerster, Behrouzi, Rieger, Jadliwala, Sadeghi (2025). LightShed: Defeating Perturbation-based Image Copyright Protections. USENIX Security 2025.
- Shan, Ding, Passananti, Wu, Zheng, Zhao (2024). Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Models. IEEE S&P 2024.
- Shan, Cryan, Wenger, Zheng, Hanocka, Zhao (2023). GLAZE: Protecting Artists from Style Mimicry by Text-to-Image Models. USENIX Security 2023.
- Fan, Chen, Liu, Zhang, Yu (2025). De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks. ICML 2025.
- Yu, Zhai, Zhang (2023). AntiFake: Using Adversarial Audio to Prevent Unauthorized Speech Synthesis. ACM CCS 2023.
New protection tests, breakdowns and how-long-does-it-hold checks. No spam, unsubscribe anytime.