How GenAI music is hacking the system – and getting paid

This is a guest post by veteran tech and music executive Virginie Berger. It’s the latest in a short series of posts (here’s the first, the second, and the third) by Berger on high-level AI developments and how she thinks they may impact the music industry.

---

“Copyright laundering” and generative AI music

In 2025, “copyright laundering” isn’t happening in the shadows – it’s unfolding right in front of us. A growing ecosystem now exists to “humanise” generative AI music – just enough to evade detection – allowing synthetic songs to pass as original human works.

How do they do this? Creators can now apply a sequence of deliberate transformations to AI-generated tracks, editing stems in DAWs, randomising timing to erase robotic perfection, curing the sound with analog-style mastering, and even hiring session musicians to re-record parts.

Some services explicitly advertise this premise: upload your AI song, we’ll humanise it, and you can register it for copyright protection. These tracks flow undetected into streaming platforms, get registered with CMOs, and earn royalties, all without disclosure, attribution, or consent.

One Reddit user recently claimed they had earned nearly $1,000 in just three months by uploading 42 Suno-generated tracks after light DAW editing. Another anonymous producer profiled in Wired said he earns about $200 a month from a catalog of AI-generated “butt songs” (Editor’s note: these are exactly what you probably expect) that are placed on Spotify playlists. The tracks involved no musicians, no studios, and no original recording sessions. The entire pipeline consisted of text prompts, synthetic outputs, minor edits, and frictionless monetisation.

“A growing ecosystem now exists to “humanise” generative AI music – just enough to evade detection”

A recent investigation by musician and researcher Benn Jordan revealed that out of 560 top songs and staff picks on Suno, 549 are already monetised on streaming platforms. That’s 98%. Most show up on Spotify under fake artist accounts that pose as real musicians, some even verified. One highlighted example – a track featured by Jordan – had over 688,000 plays, diverting an estimated $2,000 from the Spotify royalty pool, money that would otherwise support human musicians. And it’s not slowing down.

Spotify’s artist base grew by about 20% from 2023 to 2024, going from 10 million to 12 million artists. And Luminate’s data shows that around 99,000 new songs are uploaded daily across streaming services, amounting to roughly 2.77 million monthly.

From prompts to profits

“Humanising” generative music is not just about improving the sound. It’s about deleting AI fingerprints, tricking detection systems, and slipping synthetic works into an industry built for human creators. On Reddit and YouTube, you’ll find detailed workflows explaining how to defeat YouTube’s Content ID, DSP ingestion filters, or royalty detection. 

These creators share all the same playbook:

1. Generate music in generative AI music platforms.
2. “Humanise” it: adding hiss, swing quantisation, maybe re-record a vocal line.
3. Upload via a distributor that still treats provenance as a tick-box.
4. Collect the same royalty rate a studio band would receive.

Their bet is: if the file looks and sounds “human,” rights organisations and platforms will never challenge the claim of authorship.

The laundering process follows a predictable logic. A user prompts a generative AI model to generate a track. Instead of uploading it raw, they “clean” the file: re-exporting at a different bitrate, adding silence, inserting dither noise, or trimming artefacts, and so on.

In the most elaborate scenarios, some companies offer full humanisation: a real performance of an AI-generated composition, using live musicians and marketed as ready for copyright registration. These companies explicitly promote the output as “copyright-eligible” and “safe to register.”

The most advanced laundering tactic is model poisoning. In underground circles, users share techniques for injecting adversarial noise into AI outputs, inaudible perturbations that confuse classifiers without affecting how the track sounds. These “microscopic cloaks” are designed to produce false negatives in AI detectors.

GenAI music platforms often embed subtle generation metadata or headers – not formal watermarks, but enough to suggest an AI origin. Laundering guides now instruct users to strip these traces entirely.

This isn’t just about whether AI tracks can be detected. The real problem is that once they’ve been humanised, poisoned, scrubbed, and re-performed, they often don’t look like AI at all. That’s what makes the laundering so effective. And by the time a distributor, a DSP or CMO touches the file, the forensic trail is already cold.

“In underground circles, users share techniques for injecting adversarial noise into AI outputs that confuse classifiers without affecting how the track sounds”

The influx Of synthetic artists

The DSP Deezer now reports receiving 20,000 AI-generated tracks per day, and on the consumption side, 70% of streams of that AI-generated music are linked to fraudulent activity. At least 13 AI “artists” on Spotify have surpassed 4 million monthly listeners. Spotify verified albums made by fully AI-generated artists produced by Pedro Sandoval, a visual artist better known for abstract painting than music. And The Velvet Sundown, an AI generated band, just hit 1.1m Spotify listeners. (Spotify has subsequently removed a number of Velvet Sundown releases).

In the Michael Smith case, a fraud ring is alleged to have earned $10 million in royalties by uploading generative music and streaming it via bot networks. These tactics directly dilute royalty pools, distort discovery, and reduce legitimate payouts for real artists. These songs don’t need to fool people, they only need to fool systems: the ingestion engines of DSPs, the unchecked forms of collective management organisations, the algorithms that match names to royalties.

Meanwhile, GenAI detection technology exists. Companies like Deezer claim near-perfect AI music detection rates. Believe’s “AI Radar” system demonstrate a 97% accuracy even on edited tracks. Detection stacks now combine watermarking, spectral analysis, and compositional fingerprinting.

And yet: most platforms don’t run them. Detection is rarely automatic. It’s often reactive, only triggered when a rightsholder complains.

When detection isn’t enough

So what happens when we don’t catch the obvious? What about the songs that are actively trying to hide?

The good news is that leading detection systems now operate across multiple layers: spectral fingerprints, melodic structure, behavioural patterns, and dataset comparison. Their systems don’t rely solely on sound; they triangulate structure, rhythm, and stylistic convergence. Style-swapped tracks with identical chord progressions, reused melodic DNA, and algorithmic pacing can all still be flagged.

But this is the blind spot: detection exists, but enforcement doesn’t.

Most DSPs and distributors still accept files without verifying authorship. Most CMOs still rely on self-declared metadata. And most regulators haven’t enforced traceability. Detection isn’t just a technical race; it hinges on whether critical forms of evidence, like generation logs, embedded metadata, or model-specific fingerprints, still exist and can be accessed. Without these, even the best detection tools are rendered useless.

Detection then becomes a legal problem, not a technical one. Unless a platform stores a server-side generation log, or the AI vendor cooperates, only a subpoena can unearth whether a track was model-generated. And since most DSPs don’t require proof-of-origin, these traces are rarely preserved.

Industry contradictions – and the fight for trust

At the UN’s 2025 AI for Good Summit, Universal Music Group’s Michael Nash, Chief Innovation Officer, declared that “AI innovation can drive music culture, and in so doing generate even greater benefits to the quality of life on this planet.” But the major labels, including UMG, via the RIAA are also suing Suno and Udio for generating “substitutional” content trained on copyrighted material without permission. So if AI is really driving music culture, who’s footing the cleanup bill? Not the model vendors. Not the platforms.

And certainly not the freelance producer earning $1,000 from AI outputs with no paper trail.

This contradiction runs through the entire industry. While labels and societies issue warnings and lawsuits, uploads are quietly approved. Platforms benefit from inflated catalogue numbers. Distributors earn transaction fees regardless of legitimacy. Streaming catalogues now exceed 200 million tracks, and discovery may favour whoever manipulates the algorithm best, rewarding gaming strategies over artistic merit or audience connection.

Metadata is unreliable and metadata verification is collapsing. Detection systems are inconsistently applied. Listeners are losing trust. And all the while, the public increasingly can’t tell whether the music they’re hearing is real or fake. We’re heading toward a future where we don’t trust the artist, the song, or the system that pays them.

“We’re heading toward a future where we don’t trust the artist, the song, or the system that pays them.”

Enforcing Proof, Not Perception

So what’s the answer? Proof. Not perception. The British Phonographic Industry is calling for ‘clear’ streaming labels on tracks pumped out with AI and ask for the UK government to protect copyright and introduce new transparency obligations for AI companies. This is a good start. But we should also stop treating detection as an afterthought.

The winning model isn’t perfect detection. It’s auditable origin trails:

• Generators must watermark every output, log it, and publish verification APIs. Even when waveforms are fully transformed and metadata is stripped, a digital paper trail usually survives.
• DAWs embed timestamps and edit histories. Upload hubs log when and how files were ingested.
• DSPs and distributors must adopt a “No manifest, no royalties” policy, pairing it with fraud detection and catalog hygiene, with multi-layer detection at ingestion.
• CMOs and labels must fund detectors at scale and shared blacklists, melody fingerprinting, auditing tools and tie payouts to verifiable provenance. CMOs should be able to extend collective licences and license training uses.
• And regulators must enforce ledger retention, impose fines,  punish missing data and criminalise bot fraud.

With the EU AI Act coming into force in 2026, model providers will be required to watermark outputs and provide detection tools to regulators and vetted researchers. Destroying the watermark will not erase the service-side ledger. Crucially, once litigation starts, courts can subpoena the generator’s logs. If Suno’s database shows your prompt is from 14 May 2025 and the hash matches the composition, the “nobody will ever know” element collapses.

Platforms and rights organisations have begun clustering near-identical tracks using melody-level analysis. If dozens of “different” songs submitted from the same user share an identical bridge, timing structure, or chord cadence, that’s a mathematical red flag. On top of that, batch uploads from a single IP range, machine-perfect DAW quantisation, or suspicious mastering chains across a catalog all trigger behavioural heuristics.

“The point isn’t to stop AI. It’s to stop pretending it’s human.”

They spot patterns that are statistically impossible for real-world human production. And they turn anonymised behaviour into evidence. So while the sound recording watermark is gone, the composition infringement risk remains, and is often easier to prove because substantial-similarity tests rely on the notes, not the mix. And future detectors will go deeper: identifying adversarial noise, tracking pattern reuse across catalogs, and comparing outputs to known model behaviours.

Detection alone can’t stop “music laundering”, but it exposes trends, flags fraud, and arms rights-holders with evidence. Crucially, it complements provenance: while provenance proves origin upfront, detection investigates after the fact. Both are necessary. Without detection, enforcement is blind. Without provenance, it’s too late.

Platforms that want to survive this shift must build detection into their infrastructure and treat unverifiable content as high-risk. The point isn’t to stop AI. It’s to stop pretending it’s human.