Explainability by Design: Structured Kolmogorov-Arnold Networks over Probabilistic Attributes for Speech Deepfake Source Tracing

Abstract: Modern speech synthesizers can produce highly realistic speech, making source tracing (i.e. identifying the generator behind a spoofed utterance) increasingly important for forensics, online content provenance, and platform accountability. Building on our prior work on transparent probabilistic attributes, which represent utterances as probability distributions over synthesizer sub-components, we extend speech deepfake source tracing with two key ingredients: multi-task training of the probabilistic attribute extractors and a structured Kolmogorov--Arnold Network (KAN) for attack classification. The probabilistic features are estimated jointly with a multi-task learning module built on a shared AASIST or SSL-AASIST countermeasure backbone. The resulting probabilistic feature embedding is classified by a structured KAN whose topology follows known attribute-to-attack relationships. This provides interpretability by construction: the architecture reflects the generative hierarchy of attacks, while KAN feature-importance scores quantify each probabilistic feature's contribution without post-hoc explainers such as SHAP. On ASVspoof2019-attr-17, the extended framework achieves balanced accuracies above 99% for all seven probabilistic feature extractors, with EERs of 0.16% to 0.07%, and 99.64% balanced accuracy with 0.11% EER for 17-class attack classification. Our revised model outperforms the earlier two-stage baselines, in addition to demonstrating reliable interpretability, with importance scores consistent with SHAP values, and stable results across batch sizes. These findings highlight the potential of structured KAN for speech deepfake source tracing that is both accurate and interpretable by design. For transparency and reproducibility, our codebase is publicly available: https://github.com/HoangHPham/KAN-Probabilistic-Deepfake-Attribution.

• The paper introduces a novel, end-to-end speech deepfake tracing framework combining multi-task learning for attribute extraction with structured Kolmogorov-Arnold Networks (SKMs) for classification enhancing explainability and performance.
• The proposed model achieved over 99% balanced accuracy and less than 0.2% EER for both attribute extraction and attack classification tasks on the ASVspoof2019-attr-17 dataset.
• The SKM's intrinsic interpretability, validated through global and local feature importance rankings, provide competitive insights with SHAP-based explanations, highlighting the key attributes in speech deepfake generation.

Overview and motivation

Speech deepfake source tracing—identifying the generative model behind a spoofed utterance, once it has been established that the utterance is not bona fide—is a multi-class extension of binary anti-spoofing detection. The paper under review extends the authors' prior work on probabilistic attribute embeddings [manasi_explainable; mishra_towards] by replacing their fragmented two-stage pipeline (independently trained MLP attribute extractors plus decision-tree or logistic-regression back-ends, with SHAP for post-hoc explanation) with a unified end-to-end architecture. Two ingredients drive the extension: (1) multi-task learning (MTL) of seven probabilistic attribute extractors over a shared countermeasure backbone (AASIST or SSL-AASIST), and (2) a structured Kolmogorov–Arnold Network (SKM) whose topology encodes known attribute-to-attack relationships from ASVspoof 2019 LA metadata. The design goal is interpretability "by construction": intrinsic transparency through an architecture that mirrors the generative hierarchy of attacks, and extrinsic interpretability through KAN 2.0's built-in feature-importance mechanism, eliminating reliance on external explainers.

Background: KAN as an interpretable classifier

The paper grounds its choice in the distinction between the universal approximation theorem underlying MLPs and the Kolmogorov–Arnold representation theorem underlying KANs. Whereas MLPs place fixed nonlinearities at nodes with learnable linear weights, KANs place learnable univariate functions on edges, parameterized as residual SiLU connections combined with B-splines whose basis coefficients are learned during training. The authors are explicit that their motivation for adopting KAN is interpretability rather than predictive superiority: they cite systematic evidence that KANs do not uniformly outperform MLPs outside symbolic regression, and note prior speech anti-spoofing work uses KAN only as a feature projector or drop-in replacement without exploiting its native importance-analysis capability. This positioning distinguishes the work from prior KAN usage in the field.

The built-in feature-importance mechanism quantifies contribution via activation variability: node and edge scores, computed as standard deviations of activations over a dataset $\mathscr{D}$, are propagated backward from output nodes (initialized at unit importance) to input features. Because the SKM's inputs are already semantically defined posterior distributions over synthesizer sub-components, the resulting scores are directly attributable to named attributes such as vocoder type or system inputs.

Architecture

The MTL module shares a front-end (AASIST or SSL-AASIST with its final classification layer removed) across seven attribute-specific branches, each comprising a Houlsby-style adapter (layer normalization, bottleneck down/up-projection, GELU, dropout, residual connection) and a linear head with softmax producing posteriors $g_t(h(X)) \in \mathbb{P}^{C_t}$ per attribute $t$. Training minimizes the sum of categorical cross-entropy losses over all attributes plus the attack-classification loss. The SKM is a shallow single-hidden-layer KAN mapping the 50-dimensional logit vector (50 indexed attribute values) into 17 attack logits; crucially, its edges are manually restricted to valid attribute–attack connections derived from the dataset metadata, yielding structural transparency. Preprocessing includes silence trimming (STE/ZCR-based) and RawBoost augmentation with eight equally probable composition schemes.

Source tracing performance

On ASVspoof2019-attr-17 (closed-set, 17 attacks), the proposed end-to-end model substantially outperforms both the originally reported and reproduced two-stage baselines:

Model	Attr. extraction (best/worst BAcc)	Attack classification
Baseline (reported)	— / EER 2.0–4.2%	90.23% / 2.07%
Baseline (reproduced)	91.59% / 83.82%	84.37% / 3.35%
Proposed (SSL-AASIST ff)	99.92% / 99.59%	99.64% / 0.11%

All seven attribute extractors exceed 99% balanced accuracy in the strongest configurations, with EERs between 0.07% and 0.16%. Notably, training from scratch matches full fine-tuning (99.53%/0.12% vs. 99.61%/0.11% with AASIST), despite the latter benefiting from bona fide data and additional epochs—an implication that pretraining on the detection task is not necessary for this closed-set attribution task. In contrast, partial fine-tuning degrades severely, particularly with SSL-AASIST (61.71% attack classification BAcc, 9.86% EER), indicating that freezing pretrained detection representations is unsuitable here.

An ablation removing the metadata-derived structure—replacing the SKM with a fully connected single-layer KAN—yields essentially identical results (99.65% vs. 99.61% BAcc with AASIST ff). The authors state plainly that the auxiliary structure does not improve accuracy; its justification rests entirely on interpretability, and a conventional fully connected KAN remains a viable alternative when transparency is not required. This is an honest concession that the structural prior confers no predictive benefit on this benchmark.

Interpretability validation

Two evaluation criteria assess the reliability of the built-in feature-importance mechanism.

Consistency with SHAP: global model-level rankings agree strongly (Spearman $\rho = 0.72$), and per-class correlations are positive for most attacks. Exceptions include A01, A06(19), A09, A13, and A17 ($\rho < 0.5$), and notably A18 with a negative correlation of $-0.71$—the one case where the built-in mechanism and SHAP disagree in rank ordering, which the paper reports but does not resolve.

Stability across batch sizes: local (mini-batch) versus global FI rankings correlate at 0.88–0.92 for batch sizes 8 through 256, and local-to-local correlations range up to 1.00. Batch size 1 degrades markedly (0.56 against global FI), confirming that singleton-batch explanations are unreliable while typical batched settings are stable.

Substantively, both the KAN mechanism and prior SHAP analyses identify system input type (text vs. speech) and waveform generation as dominant discriminative cues, with conversion and processor attributes ranked low. Analysis of learned activation shapes further suggests an inverse relationship between activation nonlinearity and assigned importance—the most important feature, text (inputs), exhibits near-monotonic piecewise-linear activations with large gradient magnitude, consistent with the variability-based definition of importance.

Limitations and open questions

The principal limitation, acknowledged by the authors, is dependence on generator metadata: the attribute taxonomy and the SKM wiring presuppose annotated synthesis pipelines, limiting generalization to generators without such metadata. Evaluation is confined to a closed-set protocol on ASVspoof 2019 LA, so behavior under open-set conditions or cross-dataset transfer remains unexamined. Robustness to realistic channel conditions (noise, compression) is untested. Additionally, the negative SHAP correlation for A18 and the null effect of the structured topology on accuracy leave open whether the metadata-derived wiring generalizes beyond this dataset, and the higher computational cost of spline-based activations relative to MLPs remains a practical concern.

Conclusion

The paper presents a unified, end-to-end source-tracing framework combining multi-task probabilistic attribute extraction with a structured KAN classifier, achieving above-99% balanced accuracy and sub-0.2% EERs on all tasks while providing explanations intrinsically—through architecture mirroring the generative hierarchy—and extrinsically through KAN's built-in importance analysis, validated against SHAP and batch-size perturbations. Its value lies chiefly in demonstrating that native architectural interpretability can match the fidelity of post-hoc explainers in speech forensics, though the approach's dependence on rich generator metadata bounds its current applicability.