Pick an attack on a wire transfer and watch execution refuse. The digests are computed in your own browser. Then take the record it hands you and check the second signature against a published key, again in your own browser.
What the demo does not do. It proves the instruction did not change in custody. It does not prove the answer was right or that any model was honest. The second signer is a separate key, a separate clock and a separate log operated by Hive, so it is not an outside party and the service reports that itself. It signs Ed25519, which is not post quantum. The operator side signs ML-DSA-65 under NIST FIPS 204. The second signer's log does not survive a redeploy today, and it says so too. Patent pending.
EU AI Act Article 50(2) has applied since 2 August 2026. Providers of AI systems that generate synthetic audio must mark the output in a machine-readable format and make it detectable as artificially generated (Article 50 text). A new Article 111(4), added in July 2026, gives providers whose systems were already on the market before 2 August 2026 until 2 December 2026 (Regulation (EU) 2026/1744). The complete Fish Audio developer documentation corpus, re-counted at 707,317 bytes, still contains zero occurrences of watermark, C2PA, provenance, or content credential (llms-full.txt).
Hive comes alongside a voice stack as a sidecar. At the moment of each generation, each clone creation, and each takedown, it makes an independent, signed receipt that anyone can check offline. It never generates audio, never blocks a request, never decides whether a consent was valid, and never holds your keys. It is invisible to your users, invisible to your inference path, and fail-open. If Hive is unreachable, generation runs exactly as it does today.
This is the strongest fact on the page. It is not an opinion, a benchmark, or a competitive comparison. It is a date in in-force law. Article 50(2) already applies. What is left is a four month transitional window, and it is the last one.
The counter above runs to 2 December 2026, 00:00 UTC. That is the Article 111(4) date for providers whose systems were already on the market before 2 August 2026, so it reads in exact hours rather than calendar days. For anything Fish Audio places on the market on or after 2 August 2026 there is no counter. Article 50(2) applies on day one.
Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated. EU AI Act, Article 50(2) · artificialintelligenceact.eu/article/50
Article 50(2) has applied since 2 August 2026. Article 111(4) adds a four month transitional window for providers whose systems were already on the market before that date: they have until 2 December 2026. S2.1 Pro launched 28 July 2026, so it sits inside the window. The next model will not. Anything placed on the market from 2 August 2026 onward is due on day one (Regulation (EU) 2026/1744, Art. 111(4)).
Non-compliance with Article 50 carries administrative fines of up to EUR 15 million or 3 percent of total worldwide annual turnover, whichever is higher (European Commission FAQ).
The Commission's final Article 50 guidelines, adopted 20 July 2026, confirm that "persons" covers "digital replicas of real people... and personal characteristics or expressions such as a person's image, voice, behaviour and performances" (Bird & Bird).
Verified against the complete published developer documentation corpus, re-counted 707,317 bytes on 11 August 2026: docs.fish.audio/llms-full.txt. A term count is a fact about the published documentation. It is not a statement about what runs in production.
Media Origin Receipt™ and MoR Segments™. A machine-readable, signed origin receipt emitted with every generation. Verifiable offline by anyone. No dependency on Fish Audio being available, reachable, or willing to confirm it. The mark travels with the file rather than living in a vendor database.
A receipt is not a Commission-approved marking method, and no regulator has reviewed it. It makes the origin of a file independently checkable. Whether a given marking approach satisfies Article 50(2) is a legal determination for Fish Audio's counsel, not one a receipt makes.
The Commission's final Article 50 guidelines, C(2026) 5054 final of 20 July 2026, split Article 50(2) into two duties and say plainly that doing one of them is not enough. This is the part of the guidance that decides whether a built-in watermark is an answer or a half answer.
Each of the two above-mentioned elements must be fulfilled to achieve effectively the objectives of the transparency obligations of Article 50(2) AI Act. Fulfilling only one element (e.g. for machine-readable marking of outputs without the means for their detection being available) will not suffice to comply with that provision. European Commission, Guidelines on Article 50 transparency obligations, C(2026) 5054 final, paragraph 70 · guidelines PDF
Marks must be "structured in a way that allows software applications to easily identify, recognise and extract them without human intervention" (paragraph 71). A perceptible label on a web player does not satisfy this one.
"The provider is obliged to ensure that the means of detection are available to the persons potentially exposed to the content" (paragraph 75). Providers "must rely on publicly-available industry standard detection solutions that allow any third party to implement detection" (paragraph 76).
Accepted techniques include watermarks, metadata identifications, "cryptographic methods for proving provenance and authenticity of content", logging methods, fingerprints, or a combination of these (paragraph 73, restating Recital 133).
A signed origin receipt is a cryptographic method for proving provenance and authenticity, verifiable offline by anyone, with no account and no call back to the issuer. That is duty two done in the shape the guidance describes, because a third party can implement the check locally. It pairs with whatever marking Fish Audio already does rather than replacing it.
The same paragraph is explicit that providers "are not required to record or keep a full provenance chain containing information on content origin and modifications". So a receipt is a permitted route to Article 50(2), not a mandated one. No regulator has approved any specific product, including this one. Whether a given approach satisfies Article 50(2) is a determination for Fish Audio's counsel.
The developers page says "Audio watermarking is built into the cloning pipeline." Take that at face value. The question the guidance then asks is whether the technical solution is robust, which it defines as accurate identification "under varying conditions, covering both common alterations and adversarial attacks" (paragraph 79). The published research says audio watermarking is not there yet.
None of the surveyed watermarking schemes is robust enough to withstand all tested distortions in practice. SoK: How Robust is Audio Watermarking in Audio Generative Models? 22 schemes evaluated over more than 200,000 files · arXiv 2503.19176v2
Read the first two numbers together. WavMark goes from 100% to 0.00% when the same clip is re-recorded at 2.5 metres. Playing audio out of a speaker and catching it on a phone is not an attack. It is Tuesday. It is what happens to a voice note before it reaches a journalist, a bank fraud team, or an exhibit list, and a scheme that reads 0.00% after that has stopped being evidence.
A watermark answers one question: did this audio come out of our model. That is worth having. But it is not the question anyone actually fights about. A rights holder asks whether the clone was authorised. A regulator asks who was told. A court asks what the vendor knew and when. None of those are answerable from a signal buried in the waveform, however robust it gets, because the answer was never in the audio to begin with. It was in the moment of the request.
So put the evidence beside the audio instead of inside it. A receipt is a separate signed artifact about the event: this voice was created at this instant, against this reference, under this attested authority, by this software build. It survives re-recording, format conversion and regeneration, because it was never carried by the sample. It also survives the vendor, which is the point when the vendor is the party being questioned.
And if someone is going to publish a number for how well your detector works, you want the test itself on the record. Run that one live further down the page.
Handled factually. This is not an allegation of bad faith. It is an observation that two published Fish Audio surfaces do not currently line up, and that the gap is visible to anyone who reads both.
Cloned voices require consent verification. Audio watermarking is built into the cloning pipeline.
Consent attestation is part of the API call. Fish Audio developers page, verbatim · fish.audio/developers
The five occurrences of consent in the 707KB documentation corpus are all about call-recording consent for voice agents, or a browser widget attribute. None is voice-clone consent. Watermark, C2PA, provenance and content credential are at zero (llms-full.txt).
There is no consent field, parameter, or endpoint in the API reference or in the published OpenAPI schema (api.fish.audio/openapi.json). Authentication is a static bearer key (developers).
There is no published watermark specification, no verification endpoint, no robustness claim, and no third-party attestation to point a reviewer at (llms-full.txt).
A security reviewer at a regulated-industries buyer will read the marketing page, search the documentation for the feature it promised, fail to find it, and escalate. That escalation is not about the feature. It is about the difference between the two pages.
An unverifiable claim costs more in procurement than an absent feature, because it converts a product gap into a credibility question. A gap can be closed on a roadmap. A credibility question follows the vendor into every subsequent review.
Fish Audio does publish the enterprise posture a reviewer will also ask about, including that a SOC 2 Type II "audit is currently underway" (enterprise). The assurance table further down sets out what exists and what does not, in the company's own words.
R3Pv™ turns the claim into a checkable artifact. The consent attestation and the watermark assertion become one grouped, signed receipt that the buyer's own reviewer verifies offline, without taking anyone's word for it. The marketing sentence and the technical reality become the same object.
A receipt does not decide whether the original marketing sentence was accurate, does not certify a watermark as robust, and does not resolve a disclosure question. It fixes what was asserted, by which system, under which key, at which moment.
The published position places the rights question on the user. That is a defensible commercial choice. It is also a position with no artifact behind it, which is a different problem.
You are responsible for confirming you have the rights, consents, and disclosures required for any voice you clone... Fish Audio does not pre-clear individual use cases. Fish Audio voice-clone FAQ · fish.audio/voice-clone
The voice-clone FAQ says ten seconds is enough and that "most public-figure clips, podcast cuts, or phone-quality recordings work on the first try" (voice-clone). The documentation says "Never use celebrity or public figure voices without permission" (docs). Both are published. Only one can be the rule.
The model licence "incorporates an Acceptable Use Policy by reference" (LICENSE). No AUP is published. Both /acceptable-use/ and /aup/ return 404, and the phrase "Acceptable Use" appears zero times in the Terms (Terms). The binding document is the one nobody can read.
Equity, the UK performers' union, published a demand letter dated 22 May 2026 from Industrial Official Shannon Sailing on behalf of 22 members. It seeks removal of all unauthorised cloned voices plus lawful-basis and international-transfer disclosures under UK GDPR and the Data Protection Act 2018, and states the union was "yet to receive a reply" (Equity).
TechCrunch reported creator allegations of voices uploaded without consent and slow takedowns. Rissa Cao says takedowns are now automated in "less than three minutes" (TechCrunch).
A three-minute takedown is a real operational improvement. It is also a claim about a process, told after the fact, from the same systems whose conduct is in question. The union's letter asks for a lawful basis, not a response time.
OriginProof™ for human-origin attestation. SPR™ to prove the instruction came from an authorised party. Physiological Provenance Receipt™ to bind the reference audio to a live capture rather than a downloaded clip. A signed consent receipt cut at the moment the voice model is created, not reconstructed afterward from support tickets.
A receipt does not establish that consent was legally sufficient, does not resolve a rights dispute, and does not decide a UK GDPR lawful-basis question. It fixes the record of what was attested, by whom, and when.
Weights are downloadable from Hugging Face under cc-by-nc-sa-4.0 (s1-mini) and the fish-speech repository carries 32,153 stars (GitHub). Anyone can self-host and generate voices Fish Audio never sees.
The licence, the Fish Audio Research License, is free for research and non-commercial use only, requires a paid licence for commercial use, and requires "Built with Fish Audio" attribution (LICENSE). Model copyright sits with a second entity, 39 AI, INC. Reputation therefore attaches to output that Fish Audio cannot observe, under an attribution requirement that is currently an honour system.
A self-hosted deployment can honour the "Built with Fish Audio" requirement or quietly ignore it. Either way, the output carries the name in the eyes of anyone who hears it and no signal distinguishes the two cases.
S2S™ hardware-rooted GPU attestation and PBS™ provenance-bonded sandbox. A self-hosted deployment still emits a signed receipt proving which weights ran in which environment. MiR™ binds which model answered.
When an unattributed clip surfaces, the question stops being "was this yours" and becomes "is there a receipt". A receipted deployment can be separated from an unreceipted one without inspecting anyone's servers.
A receipt cannot compel an unlicensed self-hoster to emit one, cannot decide whether a licence was breached, and cannot attribute an unreceipted clip to any origin. It proves the environment and weights for deployments that opt in, which is what separates a compliant integrator from an unknown one.
In Lehrman v. Lovo, No. 1:24-cv-03770 (S.D.N.Y.), Judge Oetken's 10 July 2025 opinion let breach of contract, New York right-of-publicity, and New York consumer-protection claims proceed, while dismissing the Lanham Act and most copyright claims (Reuters, opinion PDF).
Lovo appears here only as litigation precedent. No comparison to any voice vendor is drawn or implied anywhere on this page.
Copyright does not protect against imitation of a voice, only direct copying of a fixed recording. Vendor exposure therefore runs through state right-of-publicity and contract, not federal IP (Loeb & Loeb, Skadden).
The court rejected a one-year limitations defence, reasoning that a model trained on the plaintiffs' voices "was arguably continuing to replicate those voices each time the model generated new clips" (opinion PDF). A trained model keeps the exposure current.
Lovo filed for bankruptcy and the copyright suit was automatically stayed in May 2026 (case tracker). The precedent survives the defendant.
Tennessee's ELVIS Act, in force 1 July 2024, reaches vendors directly. It creates liability for distributing "an algorithm, software, tool or other technology, service or device, the primary purpose or function of which is to produce a particular, identifiable individual's photograph, voice or likeness" without authorisation (Holland & Knight).
A tool-provider clause is what makes "the user agreed to our terms" an incomplete answer. The question becomes what the provider can show about the moment the voice model was made.
Forensic Rail™ for threshold-signed, deterministic replay under a consortium credential. Hive Ledger for append-only history. ViewKey™ so a rights-holder, a regulator, a union, and an enterprise customer each read the same event from their own vantage, without a shared database and without new access.
A receipt does not decide a right-of-publicity claim, does not satisfy a discovery obligation on its own, and does not make a filing go away. It replaces a self-authored log with an independently checkable record of what the system did.
Nine artifacts a regulated-industries security review asks for, with the current published status in Fish Audio's own words. One row is confirmed strong. Two are in progress or contract-gated. The rest are absences, and an absence is easier to close than a contradiction.
| Artifact | Fish Audio status | Source |
|---|---|---|
| SOC 2 Type II | "audit is currently underway... available to customers under NDA once it is complete" | enterprise |
| ISO 27001 | No mention anywhere | enterprise |
| HIPAA | "HIPAA-aligned configurations and can sign a BAA for qualifying healthcare workloads"; plan note "SOC2 / HIPAA upon requests" | enterprise |
| Zero data retention | "available on enterprise contracts", not the default; consumer policy retains | enterprise, Privacy |
| On-premises | Confirmed: "Deploy to your VPC, data center, sovereign cloud, or air-gapped environment" | developers |
| Trust / security page | Does not exist. /security/, /trust/, /compliance/ all 404 | probed |
| Published AUP | Does not exist, despite the licence incorporating one by reference | LICENSE |
| Watermarking | Marketing claim only. Zero occurrences in the 707KB docs corpus | llms-full.txt |
| Consent attestation | Marketing claim only. The corpus consent hits are call-recording consent and a browser widget attribute; no API field | llms-full.txt |
On a narrow screen, scroll the table sideways to read the source column. The on-premises row matters more than it looks. An air-gapped deployment is exactly the environment where a signed receipt is the only evidence that can leave, because the audio, the reference clip, and the logs cannot.
Nine rows. Every one names the primitive, the receipt it cuts, and the boundary it refuses to cross. The last line of each row is the point of the page. Hive proves conditions, never verdicts.
A machine-readable, signed origin receipt emitted with every generation, verifiable offline by anyone, with no dependency on Fish Audio being available or willing to confirm it. The mark is carried by the artifact rather than looked up in a vendor system.
It is not a Commission-approved marking method and no regulator has reviewed it. Whether a marking approach satisfies Article 50(2) is a legal determination for counsel, not one a receipt makes.
The consent attestation and the watermark assertion become one grouped, signed receipt that a buyer's own reviewer verifies offline. A marketing sentence becomes a checkable artifact, so the review ends at verification instead of escalation.
It does not judge whether the original claim was accurate, does not certify watermark robustness, and does not clear a disclosure question. It fixes what was asserted, by which system, under which key.
OriginProof™ attests human origin. SPR™ proves the instruction came from an authorised party. Physiological Provenance Receipt™ binds the reference audio to a live capture rather than a downloaded clip, which is the exact distinction a ten-second podcast cut erases.
It does not establish that consent was legally sufficient, does not resolve a rights dispute, and does not decide a UK GDPR lawful-basis question. It fixes the record of what was attested, by whom, and when.
S2S™ gives hardware-rooted GPU attestation. PBS™ runs the model in a provenance-bonded sandbox whose kernel, engine hash, and firmware version are on a signed heartbeat chain. MiR™ binds which model answered. Attribution stops being an honour system for deployments that opt in.
It cannot compel an unlicensed self-hoster to emit anything and cannot decide whether a licence was breached. It separates a receipted deployment from an unknown one.
Forensic Rail™ gives threshold-signed, deterministic replay under a consortium credential. Hive Ledger keeps append-only history. ViewKey™ lets a rights-holder, a regulator, a union, and an enterprise customer each read the same event from their own vantage, without a shared database and without new access.
It does not decide a right-of-publicity claim, does not discharge a discovery obligation, and does not adjudicate any filing. It replaces a self-authored log with an independently checkable record.
The thresholds that govern which voice uploads are refused, and which takedown conditions trigger removal, live on a public Merkle mutation ledger with a zero-knowledge envelope-bond. A union, a rights-holder, or an auditor can verify that the bounds were in force without seeing the exact numbers.
It does not decide whether a threshold was set correctly, adequately disclosed, or lawful. It proves which threshold was in force when a refusal or a removal ran.
A signed freeze receipt fires the instant an identifiable-likeness feature activates during a clone or generation request. The event is recorded at the moment it happens, not discovered later in a support thread.
It does not identify a person, does not decide whether a likeness was used without authorisation, and does not block the request. It records that a flagged feature activated.
Egress Bond™ meters caps on reference-audio and voice-identity egress per semantic class using Pedersen commitments, and a cap breach retroactively invalidates the downstream graph. Diurnal Bond™ requires k-of-n countersign before a high-impact action, such as reinstating a removed voice, runs during evening or weekend hours.
It does not decide what the correct cap should be, does not classify a transfer as lawful, and does not answer an international-transfer question. It proves the cap that applied and whether the second key signed.
Every receipt above folds into one append-only history, so the absence of an expected receipt is itself a signal. A certificate-transparency style log for receipt inclusion is serving, as transparency.checkpoint, anchored to a public RFC 3161 timestamp authority. See /transparency-log/. Nothing on this page depends on it, because verification is offline.
transparency.checkpoint, liveAn append-only history cannot prove that an event nobody receipted ever happened. It can prove that a receipted event was never altered, and it can make a missing receipt visible.
Nothing above enters the inference path, refuses a generation, or decides a rights question. Each primitive proves that the thing that made a call was itself the thing it claimed to be. Hive proves conditions, never verdicts.
A receipt is only usable if it is free at the millisecond level. These are the measured figures, with the sample size and date attached, and with an honest label on maturity.
Sample size n=40. Measured 27 July 2026. 37 of 37 smoke tests pass. Figures are reported as medians and labelled as such.
The signing and verification path runs in production. Mint and verify are live at thehiveryiq.com/v1, verification is open and needs no key, and the figures above are measured on that path. Fish Audio is not a customer and nothing on this page says otherwise.
The seven upstream pre-effect controls were filed as USPTO 64/119,279 on 26 July 2026. A filing is a filing. It is not a granted patent, and nothing on this page depends on it.
The certificate-transparency style inclusion log is serving. It runs as transparency.checkpoint: an RFC 6962 tree over receipt roots, anchored to a public RFC 3161 timestamp authority, with inclusion and consistency proofs anyone can check at /transparency-log/. Verification still does not depend on it. A receipt is checked offline against the signature and the content-addressed roots, with no call to Hive and no call to anyone else.
Signatures use a hybrid of Ed25519 and ML-DSA-65, the NIST FIPS 204 federal standard. Receipts carry one-way fingerprints and cryptographic commitments, never raw audio, never a reference clip, and never a voice embedding.
Numbers on this page are measurements of the Hive signing path, not projections about any Fish Audio system, and not a benchmark of any voice model.
The developers page says "Consent attestation is part of the API call" and "Cloned voices require consent verification." There is no consent field in the OpenAPI schema and no voice-clone consent anywhere in the documentation corpus. Every run below is live against the production verifier. Nothing on this page is a claim about what Fish Audio runs internally.
A checkbox proves a click happened. It does not prove who clicked, and it does not prove the person whose voice is at stake was ever in the room. This receipt binds an affirmation to the request bracket it belongs to, so the yes cannot be moved, reused on a second clone, or assembled afterwards when somebody asks.
Run the voice case. That is a spoken readback affirmed inside the same bracket, which is the shape that matters for a voice product: the subject says the words, and the receipt ties that utterance to this clone and no other. The display and messaging cases are the weaker channels, and they are worth running precisely because you can see the difference in what comes back.
The affirmation content never crosses the boundary. What crosses is a commitment plus a bracket binding, so this can be handed to a rights holder, a broadcaster, or a regulator without handing over the recording of the subject.
What it does not prove, in plain words. It does not prove the person had the right to grant the licence, that they understood it, that they were not coerced, or that the affirmation is legally sufficient consent in any jurisdiction. It proves an affirmation of a stated form happened in the right place in the sequence. Whether that is valid consent is a question for counsel.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Equity wrote on 22 May 2026 asking for the removal of unauthorised AI voices for 22 named UK performers, and reported no reply. The BBC reported one performer whose voice had been downloaded more than 900 times. In a dispute like that, the fight is never about whether a takedown happened. It is about when, and about what was generated in the gap.
Run before and then run after. Same voice, same authority chain, two sides of a revocation instant. Today a vendor answers this from its own database, which is the answer the other side will not accept. A signed revocation boundary makes it checkable by the performer's own lawyer, offline, without asking the vendor for anything.
This also protects the vendor. Right now Fish Audio cannot cheaply prove it stopped when it says it stopped. A revocation receipt is the artifact that ends that argument in its favour when it did act promptly.
What it does not prove, in plain words. It does not prove the original grant was valid, that the revocation was timely enough in law, or that no copy of the voice exists elsewhere. It fixes when authority ended and makes that instant independently checkable.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
This is the receipt a rights holder actually wants and no vendor currently ships. Removing a voice from a library is a change to a listing. It is not evidence that no generation occurred. Absence is the hardest thing to prove and the only thing that closes a dispute.
Run quiescent for a clean window where nothing landed. Then run effect. It is a valid receipt too, and that is the point: the signature holds while the receipt states that an effect did land inside the window. The second one is the useful case. A vendor with a stake in the outcome will not volunteer it, and a receipt that can only ever say "all clear" is not evidence of anything.
The window is bounded and signed, so it cannot be widened later to swallow an inconvenient event, or narrowed to exclude one. That is what makes it usable in a settlement rather than in a status page.
What it does not prove, in plain words. It covers the window it names and the emitters it binds. It does not prove that no third party generated the voice from open weights on their own hardware, and it does not reach systems outside the bracket.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
The voice library carries more than two million community-uploaded voices. When a performer asks whether their voice was listed on a particular date, the honest answer today is a screenshot and a database query. Neither is evidence a third party can check.
Run all three. present and absent are the obvious ones. rotated is the case that catches the real behaviour: an entry that was replaced rather than removed, which is how a takedown quietly becomes a relisting under a new identifier.
What it does not prove, in plain words. It speaks to the listing state of an entry at an instant. It does not say the entry was lawfully uploaded, that the voice belongs to whoever claims it, or that no copy exists outside the directory.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
In every voice dispute the decisive question is notice. When did the provider first know a voice was unauthorised, and what happened next. A log entry answers that only if you trust the party holding the log, which is exactly the party being asked.
Two of the three cases refuse, and those are the ones to run. fail comes back valid false because the mint latency, 96 seconds, exceeds the bound the emitter itself declared. That is what a backfilled notice record looks like from the outside. fail2 comes back valid false because a human signed something the receipt requires a machine to have emitted on its own.
A receipt that cannot fail is not evidence. This one fails loudly, in public, on this page.
What it does not prove, in plain words. It does not prove the underlying observation was correct, or that nobody at the company knew earlier by another route. It proves ordering, and it proves the record was not written late.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Both the Commission guidance and California SB 942 land in the same place: it is not enough to mark the audio, you have to give people a way to detect it, and SB 942 says that way has to be reachable through an API without visiting your website. That creates a question nobody has an artifact for. When someone tests your detector and publishes a number, who ran the test, what did they ask, and did they decide what counted as a hit before or after they saw the answers.
Every other receipt on this page has a party to the deal as its subject. This one does not. The exerciser is a stranger: a regulator, a platform trust team, an insurer, or the other side's expert. They fix the published claim they are testing, commit a challenge set with a declared expectation for each item, and only then contact the detector. The rate comes out of recomputation here, floored, not out of anybody's press release.
Run conformant first. Forty clean clips, forty hits, 10000 basis points. Then run rerecorded. Same forty clips after a trip through a speaker and back into a phone, and the rate is zero. That is still a valid receipt. That is the whole point: a receipt that can only say all clear is worth nothing to the person relying on it. Then run unexercisable, where there is no published interface to call at all, which is also a finding and also gets signed.
The last two refuse, and they are the ones to look at closely. tuned moves the commitment to the moment the provider was contacted, which is what picking your test set after you have seen the answers looks like from outside, and it fails CHALLENGE_PRECOMMITMENT_ORDER. affiliated has the exerciser sharing a control principal with the provider, and independence is recomputed as set disjointness rather than accepted as a claim, so it fails EXERCISER_INDEPENDENCE_RECOMPUTE. Nobody gets to declare themselves independent here.
The challenge content never crosses the boundary. What crosses is a commitment per challenge plus a set digest, so the same test can be re-run against a second provider later without the first one having learned the questions.
What it does not prove, in plain words. It does not prove the detector is accurate, effective, or fit for anything. It does not prove any watermark is robust. It does not prove the provider complies with any law. It does not prove a different tester, network path, or set of clips would get the same result. And it does not decide whether any particular audio was generated by any particular system. It proves who ran the test, what they asked before they asked it, and what actually came back.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
A watermark is a claim about a file. It survives what it survives, and the survey says re-recording it at two and a half metres takes one scheme from 100 percent to 0.00 percent. So put the recording on the record instead. This receipt fixes what the bytes were, what the samples were, and where in the recording any clip sits, without the recording ever leaving the holder. Then it stays useful after somebody re-encodes it, because a re-encode changes the container and the container digest says so out loud instead of pretending.
The holder hashes the delivered bytes plain. Then they decode to one fixed canonical form, mono, signed sixteen bit, at the container's own rate with no resampling, and hash that under its own label. Then they cut the samples into one second frames and commit each one under a random salt, folding the commitments in order. What crosses the boundary is three digests, the salt, and the list of commitments. No samples, no transcript, no file name. Twenty two gates recompute all of it.
The two digests do different work on purpose. The container digest is the delivered file, so a re-encode breaks it, which is the honest answer. The sample digest is what the audio actually sounds like once decoded, so the same recording remuxed from wav to flac keeps it. remuxed is that case: the container digest is different, the sample digest is the same, and the receipt still verifies.
Two of these refuse. misdeclared claims a longer recording than the frame list can account for and fails FRAME_COUNT_AGREEMENT. relabeled keeps the same file but swears it decoded at a different rate, which is what a resampled digest looks like from outside, and it fails DECODED_DIGEST_BINDING. Neither can be talked around, because both numbers are recomputed here.
What it does not prove, in plain words. It does not prove who spoke, that a human spoke at all, or that anything in the audio is true. It does not prove the recording was not synthesised before it was captured. It does not prove consent. It does not detect a watermark and it does not replace one. It proves what the bytes and the samples were at the moment they were committed, and that a clip sits where somebody says it does.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
This is the part a file hash cannot do. Hand over the frames of your clip, the frames after it, and one opaque value standing in for everything before it. The chain has to land on the head that was already signed. The frames before the clip stay closed. The checker learns how many seconds came first and nothing about what was in them.
interior is a clip from the middle, and the answer says how many seconds sat on each side of it while staying shut. opening starts at second zero, so the prefix has to be the fixed genesis value and cannot be some other prefix wearing a disguise. spliced is the interesting one: the same clip, claimed one second later in the recording. Nothing about the audio changed. The chain refuses it at SEGMENT_LENGTH_AGREEMENT, because a position claim is not a matter of opinion once the order is committed.
What it does not prove, in plain words. It does not prove the clip is unedited audio of anything. It does not prove the surrounding seconds are innocent. It does not tell you what is in the closed frames. It proves the clip occupies exactly the offsets claimed inside a recording that was committed before this argument started.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Everything above the widget runs on prepared cases. The widget runs on your audio. Open the console network tab while you use it. You will see one request go out with three digests in it and nothing else, and you will see the verifier's answer come back separately.
In plain words: your organization holds the pen that signs. Hive never touches raw audio, never holds your keys, and never enters the generation path.
You keep the private key that stamps your receipts. Nobody else can sign in your name, and the key never leaves your own hardware. The signature is yours, not Hive's.
Hive gives you the way to make and check receipts. It does not generate audio, clone a voice, refuse a request, decide whether a consent was valid, or run your pipeline. Each event is recorded as a one-way fingerprint and a cryptographic commitment, never the underlying audio.
One surface. Not the platform, not a migration, not a rebuild. The obvious candidate is the generation endpoint, where a Media Origin Receipt™ can be emitted alongside the audio and checked offline by anyone. The second candidate is voice-model creation, where a consent receipt is cut at the moment the model is made. Hive builds it, runs it, and hands over receipts that verify without Hive in the loop. Nothing changes in the inference path. If the receipt rail is unreachable, generation proceeds exactly as it does today.
Naming Fish Audio does not imply any agreement. This page does not state or imply that Fish Audio is a customer, partner, pilot, or endorser, or that Fish Audio uses Hive. Customers referenced anywhere in Hive materials are HeyGen, LiveKit, Retell, and Telnyx integrations confirmed on the customer side (HeyGen, LiveKit, Retell, Telnyx), which are facts about Fish Audio's own integrations rather than about Hive.
One line to start: sales@thehiveryiq.com
Stephen Rotzin, Founder, Hive Civilization Inc (Wyoming) · steve@thehiveryiq.com
This page is illustrative only. It is prepared privately by Hive Civilization Inc. and is not affiliated with, sponsored by, or endorsed by Fish Audio, 39 AI, Inc., or any of their affiliates. It does not state or imply that Fish Audio is a customer, partner, pilot, or endorser, or that Fish Audio uses Hive.
Every statement about Fish Audio on this page is quoted or counted from a published Fish Audio surface or a named public source and linked to it. Nothing here is an accusation of wrongdoing. Where two Fish Audio surfaces differ, both are quoted and both are linked, and the difference is presented as a published fact rather than an inference about intent. Facts were verified on 11 August 2026 and should be re-verified before any external use.
A signed receipt proves that a step ran and what it returned. It does not decide legality, does not guarantee compliance with the EU AI Act or any other law, does not resolve a rights or consent dispute, and does not adjudicate any court matter. Lehrman v. Lovo is cited only as litigation precedent on the doctrinal question of voice imitation and vendor exposure. The Equity demand letter is a published demand, not a finding. Fish Audio is not a Hive customer, partner, or pilot.
Each link opens that entry in the canon implementation explorer, where its schema, mint route, open verify route, auth requirement and implementation state are stated. The state shown here is read from the same registry file the explorer renders from, so the two cannot drift apart. Nothing here implies a customer, a deployment or an endorsement.