Audio Deepfake Verification Methods

Updated 10 July 2026

Audio Deepfake Verification (ADV) is a suite of forensic techniques that detect, localize, and verify manipulated audio by assessing authenticity and source consistency.
ADV systems employ diverse methodologies such as binary detection, temporal localization, and open-set source verification using scoring functions and deep learning backbones.
Research in ADV reveals challenges like dataset artifacts and anti-forensic attacks while demonstrating superior performance over human evaluators through robust protocol designs.

Audio Deepfake Verification (ADV) denotes a family of forensic tasks for assessing the authenticity, provenance, or integrity of audio under contemporary synthesis and manipulation pipelines. In recent literature, the term is used for at least two related formulations: binary authenticity assessment, in which a system decides whether an input clip is bona-fide or spoofed via a score $f(x)\in[0,1]$ thresholded at $\tau$ , and open-set source verification, in which a system decides whether a test utterance shares the same generative source as a reference set or a second query sample (Klemt et al., 6 Jun 2025, Negroni et al., 20 May 2025). Closely related extensions include temporal localization of manipulated regions in general audio, hierarchical attribution and model recognition, privacy-preserving verification using acoustic-only information, and proactive watermark-based authentication with localization (Xie et al., 2024, Pierno et al., 4 Aug 2025, Li et al., 2024, Pujari et al., 23 Jul 2025).

1. Task scope and formal problem statements

Recent work treats ADV as a broader category than a single binary classifier. The main formulations can be summarized as follows.

Formulation	Core output	Representative works
Binary authenticity detection	real vs. fake score and thresholded decision	(Klemt et al., 6 Jun 2025, Li et al., 2024)
Manipulation localization	clip label plus temporal fake intervals	(Xie et al., 2024)
Source verification	same-generator or different-generator decision	(Negroni et al., 20 May 2025, Wang et al., 10 Sep 2025)
Attribution and model recognition	generator family or model identity, with unknown rejection	(Pierno et al., 4 Aug 2025)
Proactive authentication	embedded watermark recovery and sample-level localization	(Pujari et al., 23 Jul 2025)

In the binary setting, the task statement is: given an input audio clip $x\in X$ , decide whether it is bona-fide or spoofed by learning a scoring function $f:X\to[0,1]$ , where $f(x)$ close to $1$ indicates “fake” and $f(x)$ close to $0$ indicates “real,” followed by thresholding at $\tau$ (Klemt et al., 6 Jun 2025). This formulation is directly aligned with standard metrics such as FAR, FRR, EER, AUC, and AP.

A more structured formulation appears in deepfake general audio detection. Given a raw audio clip $x\in\mathbb{R}^T$ , the objective is to determine both whether $\tau$ 0 has been manipulated and the temporal intervals within $\tau$ 1 that are deepfake. In the FakeSound benchmark, the model outputs $\tau$ 2, where $\tau$ 3 is the clip-level manipulation label and $\tau$ 4 is the frame-level or segment-level label, with $\tau$ 5 corresponding to $\tau$ 6 ms resolution over $\tau$ 7 s (Xie et al., 2024).

A distinct formulation recasts ADV as verification against a reference set. In source verification for speech deepfakes, a reference set $\tau$ 8 is assumed to be generated by a single unknown synthesis model $\tau$ 9, and the system must decide whether a test utterance $x\in X$ 0 was produced by that same model. The decision is based on a verification score $x\in X$ 1 compared with a threshold $x\in X$ 2 (Negroni et al., 20 May 2025). A closely related pairwise form defines a shared embedding function $x\in X$ 3 and a cosine score $x\in X$ 4, with “same-method” declared when the score exceeds $x\in X$ 5 (Wang et al., 10 Sep 2025).

These formulations are not interchangeable. Binary authenticity answers whether content is spoofed; verification answers whether two samples or a sample and a reference set share a source; attribution answers which source family or model produced a fake; watermark-based authentication answers whether media carries an embedded authenticity signal. This suggests that “ADV” has become an umbrella term spanning detection, provenance analysis, and integrity verification rather than a single canonical benchmark.

2. Detection and localization of manipulated audio

The FakeSound work extends detection beyond speech to general audio events and explicitly couples identification with localization. FakeSound is built from AudioCaps clips of approximately $x\in X$ 6 s, each paired with a human-written caption. Its automated manipulation pipeline first applies weakly supervised audio-text grounding and masking to locate a key event segment and zero it out, then regenerates the masked region using AudioLDM2 or AudioLDM1 and upsamples it with AudioSR, and finally splices the inpainted segment back into the original waveform (Xie et al., 2024). The training split contains $x\in X$ 7 manipulated instances with manipulated regions limited to $x\in X$ 8– $x\in X$ 9 s; Test-Easy contains $f:X\to[0,1]$ 0 instances under the same settings; Test-Hard contains $f:X\to[0,1]$ 1 instances with no limit on manipulated segment length; and Test-Zeroshot contains $f:X\to[0,1]$ 2 instances with AudioLDM1 inpainting. Each split is balanced $f:X\to[0,1]$ 3 between genuine and deepfake clips.

The benchmark detector uses EAT as a backbone feature extractor pretrained on large-scale general audio. EAT outputs per-frame embeddings $f:X\to[0,1]$ 4, which are processed by two CNN blocks, a $f:X\to[0,1]$ 5-block ResNet, a two-layer Transformer encoder, a one-layer bi-LSTM, and a frame-wise classification layer producing $f:X\to[0,1]$ 6. A separate identification branch applies an FC layer over pooled frame features to produce $f:X\to[0,1]$ 7 (Xie et al., 2024). Training minimizes a weighted sum of localization and clip-level BCE losses,

$f:X\to[0,1]$ 8

with the EAT backbone frozen and the remaining parameters trained using AdamW at learning rate $f:X\to[0,1]$ 9 for $f(x)$ 0 epochs.

The reported results show a pronounced gap between machine and human performance on this benchmark. On Test-Easy, the proposed EAT single-task model reaches $f(x)$ 1, $f(x)$ 2, and Score $f(x)$ 3, whereas human testers achieve $f(x)$ 4, $f(x)$ 5, and Score $f(x)$ 6. On Test-Hard, the model obtains $f(x)$ 7 and $f(x)$ 8; on Test-Zeroshot, $f(x)$ 9 and $1$0. The average binary accuracy of humans on all test sets is consistently below $1$1, and the DKU-ADD2023 baseline with WavLM lags by $1$2–$1$3 points across metrics, especially on Test-Hard and Test-Zeroshot (Xie et al., 2024).

A second line of work emphasizes that binary detection performance is sensitive to dataset artifacts and protocol choices. DeepSpeak v1 introduces a per-identity split, cross-manipulation method splits, family splits, and cross-dataset evaluation between DeepSpeak v1 and FakeAVCeleb. Within this benchmark, the SIMBA audio branch uses raw waveform resampling, log-Mel spectrograms with $1$4 and $1$5, a BYOL-A backbone, self-attention over time, and temporal max-pooling (Klemt et al., 6 Jun 2025). The paper diagnoses a leading-silence shortcut in FakeAVCeleb: all fake-audio samples begin with a brief silence of $1$6–$1$7 ms not present in real clips, allowing a model to achieve more than $1$8 AUC by detecting leading silence alone. Without temporal jittering, cross-manipulation AUC can drop from approximately $1$9 on untrimmed clips to approximately $f(x)$ 0 on silence-trimmed clips; with temporal jittering, the drop is reduced to approximately $f(x)$ 1. The same study reports audio-only AUC of $f(x)$ 2 on the DeepSpeak v1 Wav2Lip split, $f(x)$ 3 on the Retalking split, and EER reduction from approximately $f(x)$ 4 to approximately $f(x)$ 5 when temporal jittering and subsampling are enabled (Klemt et al., 6 Jun 2025).

Together, these results establish two points. First, localization-capable detectors can strongly outperform human listeners on controlled but challenging manipulations. Second, apparent gains on benchmark datasets may reflect exploitable shortcuts rather than learned deepfake artifacts, so protocol design is part of the ADV problem rather than a peripheral implementation detail.

3. Verification, attribution, and open-set source tracing

Open-set source tracing has become a central extension of binary detection. In “Source Verification for Speech Deepfakes,” the task is defined by analogy to speaker verification: determine whether a test track was produced using the same model as a set of reference signals, without requiring retraining when new models appear (Negroni et al., 20 May 2025). The system first trains a multi-class attribution network on known synthetic generators, then removes the final softmax and uses the penultimate $f(x)$ 6-dimensional layer as an embedding extractor. Verification is performed with cosine similarity, and the reference-to-test score is aggregated by a maximum operation,

$f(x)$ 7

The evaluation covers MLAAD, ASVspoof 2019, TIMIT-TTS, and ADD 2023, and studies speaker diversity, language mismatch, and post-processing robustness. The paper reports that multi-speaker training outperforms single-speaker training on multi-speaker test sets, English-trained models perform better on English test sets while non-English-trained models perform better on non-English sets, and speech enhancement inflicts the heaviest drop, with average EER increasing by approximately $f(x)$ 8 points. The deployment recommendations include using multiple reference utterances, with $f(x)$ 9 in the reported experiments, and monitoring threshold $0$0 in situ (Negroni et al., 20 May 2025).

A conceptually different verification strategy uses only genuine speech during training. In “Deepfake audio detection by speaker verification,” deepfake detection is cast as a one-class speaker-verification problem with no fake examples seen during training (Pianese et al., 2022). Given a reference set of genuine utterances for a claimed identity, the system computes either a centroid-based score or a maximum-similarity score using speaker embeddings extracted from models such as ECAPA-TDNN or POI-Forensics. Across ASVspoof2019, FakeAVCeleb, and IWA, the best reported average performance is for POI-Forensics-MS with EER approximately $0$1 and AUC approximately $0$2, while frame-supervised deepfake detectors trained on ASVspoof2019 drop to near-chance on FakeAVCeleb and IWA, with AUC approximately $0$3–$0$4 (Pianese et al., 2022). This formulation targets identity consistency rather than generator identity.

The person-of-interest variant in audio-visual forensics uses genuine reference segments of a claimed person and measures identity consistency by nearest-neighbor scoring in an audio embedding space learned with supervised contrastive loss. The audio-only branch yields average AUC of $0$5 and $0$6 across the manipulation scenarios considered, while in the case where only audio is manipulated and inconsistent with the claimed identity it reaches AUC $0$7 and $0$8 (Cozzolino et al., 2022). This is still a verification problem, but the verified entity is the person rather than the synthesis model.

Attribution and model recognition extend verification toward explicit source labeling. LAVA introduces a fake-trained convolutional autoencoder and two sequential classifiers: Audio Deepfake Attribution (ADA), which predicts one of $0$9ASVspoof2021, FakeOrReal, CodecFake $\tau$ 0, and Audio Deepfake Model Recognition (ADMR), which is triggered only when ADA predicts “CodecFake” with confidence above $\tau$ 1 (Pierno et al., 4 Aug 2025). The encoder is trained exclusively on fake audio from CodecFake using a Smoothed-L1 reconstruction loss, then frozen except for the last convolutional layer. Attention-enhanced latent representations feed the ADA and ADMR heads. On the test split, ADA with attention reports Precision/Recall/F1 of $\tau$ 2 for CodecFake, $\tau$ 3 for ASVspoof2021, and $\tau$ 4 for FakeOrReal, with Macro-F1 approximately $\tau$ 5 and Accuracy $\tau$ 6. ADMR with attention reaches Macro-F1 approximately $\tau$ 7 and Accuracy $\tau$ 8 across six codec classes (Pierno et al., 4 Aug 2025). Confidence thresholds are set at the percentile that guarantees at least $\tau$ 9 training accuracy, yielding explicit rejection of unknowns in the open-set regime.

The paper explicitly titled “Audio Deepfake Verification” introduces the Audity dual-branch architecture for open-set deepfake source tracing (Wang et al., 10 Sep 2025). Audity combines an Audio Structural Branch based on w2v-BERT 2.0 with a Generation Artifacts Branch based on ECAPA-TDNN, ResNet239, or CAM++, fuses the two $x\in\mathbb{R}^T$ 0-dimensional features, and normalizes the fused embedding. On the MLAAD SourceTrace split, the best dual-branch configuration, CAM++ with w2v-BERT 2.0, reaches Acc $x\in\mathbb{R}^T$ 1 and EER $x\in\mathbb{R}^T$ 2, outperforming the structural branch alone at Acc $x\in\mathbb{R}^T$ 3, EER $x\in\mathbb{R}^T$ 4, and the artifacts branch alone at Acc $x\in\mathbb{R}^T$ 5, EER $x\in\mathbb{R}^T$ 6. On held-out sets, performance varies sharply with enrollment size and domain. For ADD2023, the $x\in\mathbb{R}^T$ 7 protocol gives EER $x\in\mathbb{R}^T$ 8, whereas $x\in\mathbb{R}^T$ 9 gives EER $\tau$ 00; for Demo Pages, the EER is $\tau$ 01 under $\tau$ 02 and $\tau$ 03 under $\tau$ 04 (Wang et al., 10 Sep 2025). The same work reports deepfake-detection EERs of $\tau$ 05 on In-the-Wild, $\tau$ 06 on SpoofCeleb, and $\tau$ 07 on ASVspoof2019.

A further generalization of source verification appears in forensic similarity for speech deepfakes. Instead of comparing embeddings with cosine or Euclidean distance alone, the method trains a shallow similarity network on pairs of embeddings extracted from LCNN, ResNet18, RawNet2, or AASIST backbones fine-tuned for closed-set source tracing (Negroni et al., 3 Oct 2025). Using an LCNN backbone with fine-tuning, the reported source-verification results are EER approximately $\tau$ 08, AUC approximately $\tau$ 09 on unseen MLAAD generators, EER approximately $\tau$ 10, AUC approximately $\tau$ 11 on TIMIT-TTS, and EER approximately $\tau$ 12, AUC approximately $\tau$ 13 on ASVspoof 2019. The same similarity formulation is also applied to splicing detection on PartialSpoof, with AUC approximately $\tau$ 14 on the development set and approximately $\tau$ 15 on the evaluation set (Negroni et al., 3 Oct 2025).

4. Representations and model families

ADV systems differ substantially in how they represent audio and where they expect forensic evidence to reside. One major family operates on raw waveforms or learned waveform-like embeddings. EAT in FakeSound is pretrained on large-scale general audio and reused as a frozen per-frame feature extractor (Xie et al., 2024). Source-verification systems use raw-audio backbones such as RawNet2 and AASIST, while SHIELD builds its triplet model on RawNet3 as a shared feature extractor over concatenated waveform pairs (Negroni et al., 20 May 2025, Uddin et al., 17 Jul 2025). The adversarial benchmark later categorizes RawNet3, MS-ResNet, SeNet, LCNN, Res-TSSDNet, and Inc-TSSDNet as raw-waveform approaches and notes that they learn convolutional filters directly on $\tau$ 16 s, $\tau$ 17 kHz inputs (Uddin et al., 8 Sep 2025).

A second family uses explicit time-frequency front ends. AVT2-DWF extracts MFCCs from a sliding Hanning window of length $\tau$ 18 ms with hop size $\tau$ 19 ms, projects frame features into a Transformer token sequence with a learnable class token and positional embeddings, and applies a multi-head self-attention encoder followed by a BCE classifier in the audio-only setting (Wang et al., 2024). The audio branch of POI-Forensics computes an STFT spectrogram from $\tau$ 20 s of audio at $\tau$ 21 kHz, producing approximately $\tau$ 22 amplitude maps that feed a ResNet-50 with GroupNorm and a final $\tau$ 23-dimensional embedding layer (Cozzolino et al., 2022). SIMBA uses log-Mel spectrograms as input to a BYOL-A backbone and self-attention layer (Klemt et al., 6 Jun 2025). A simpler mel-spectrogram pipeline appears in a multimodal framework that compares a custom CNN to VGG19 on $\tau$ 24-band mel-spectrogram “images,” with VGG19 reporting Precision $\tau$ 25, Recall $\tau$ 26, F1 $\tau$ 27, Accuracy $\tau$ 28, and validation AUC approximately $\tau$ 29 on a held-out subset of Fake-or-Real (Gandhi et al., 2024).

Self-supervised pretrained encoders are increasingly prominent. EAT, WavLM, BYOL-A, and w2v-BERT 2.0 all appear as backbone components across recent ADV systems (Xie et al., 2024, Kang et al., 2024, Klemt et al., 6 Jun 2025, Wang et al., 10 Sep 2025). Retrieval-Augmented Detection is especially explicit about the role of pretrained representations: WavLM-Large features from multiple layers are averaged over time to build bonafide reference databases, and a Multi-Fusion Attentive classifier jointly ingests the query and retrieved bonafide features. On ASVspoof 2021 DF, the full RAD-MFA model reports EER $\tau$ 30, compared with $\tau$ 31 without RAD, and sample analysis shows retrievals often come from the same speaker or share acoustic conditions with the query (Kang et al., 2024). The paper also emphasizes interpretability through retrieval logs.

Other methods seek artifact-specific latent spaces. LAVA trains a convolutional autoencoder only on fake audio so that its latent representation “learns” generation artifacts, then attaches lightweight attention and classifier heads for attribution and model recognition (Pierno et al., 4 Aug 2025). SafeEar uses a neural audio codec with cascaded residual vector quantizers to separate semantic tokens from acoustic tokens, then discards semantics for downstream detection (Li et al., 2024). Audity assumes that speech structure and generation artifacts are complementary and therefore uses an explicit dual-branch fusion architecture (Wang et al., 10 Sep 2025).

These representation choices reflect different assumptions. Binary detectors often seek generic spoof cues; source-verification models seek stable inter-sample traces; attribution models seek source-discriminative artifacts; privacy-preserving models explicitly remove semantics. A plausible implication is that ADV performance depends not only on model capacity but also on whether the chosen representation matches the forensic question being asked.

5. Metrics, benchmarks, and protocol design

The metric vocabulary of ADV is heterogeneous because the field spans detection, localization, verification, and attribution. For binary detection, the standard quantities are True Positives, False Positives, True Negatives, and False Negatives, from which FAR, FRR, and EER are defined. Deepfake Doctor states

$\tau$ 32

with EER at the operating point where FAR equals FRR, alongside AUC and AP (Klemt et al., 6 Jun 2025). Source verification additionally reports AUC and minDCF, while LAVA uses per-class Precision, Recall, F1, and Macro-F1 (Negroni et al., 20 May 2025, Pierno et al., 4 Aug 2025). FakeSound introduces segment-level F1 at $\tau$ 33 s and $\tau$ 34 ms resolutions and a composite score defined as $\tau$ 35 with $\tau$ 36 (Xie et al., 2024).

The dataset ecosystem is similarly diverse. FakeSound is built from AudioCaps and focuses on general audio inpainting and splicing (Xie et al., 2024). Source verification studies rely on MLAAD, ASVspoof 2019, TIMIT-TTS, and ADD 2023 (Negroni et al., 20 May 2025). LAVA is evaluated on ASVspoof2021, FakeOrReal, CodecFake, and a generalization test on unseen ASVspoof2019 LA samples (Pierno et al., 4 Aug 2025). SafeEar uses ASVspoof 2019 LA, ASVspoof 2021 LA, CVoiceFake, and LibriSpeech for adversarial ASR evaluation (Li et al., 2024). Cross-dataset audio-video studies consider DeepSpeak v1, FakeAVCeleb, and DFDC (Klemt et al., 6 Jun 2025, Wang et al., 2024).

Protocol design has become an explicit research topic because benchmark construction can dominate reported performance. DeepSpeak v1 uses per-identity splits to avoid speaker overlap, leave-one-manipulation-type-out method splits, family splits between Lip Synthesis and Face Animation, and cross-dataset transfer between DeepSpeak v1 and FakeAVCeleb (Klemt et al., 6 Jun 2025). FakeSound varies manipulated-region duration and switches from AudioLDM2 to unseen AudioLDM1 in the Test-Zeroshot split, exposing a controlled generalization axis (Xie et al., 2024). Retrieval-Augmented Detection prohibits fine-tuning on ASVspoof 2021 and uses ASVspoof 2019 only for training, making the 2021 sets pure test corpora (Kang et al., 2024).

A major benchmarking controversy concerns shortcuts. The leading-silence artifact in FakeAVCeleb demonstrates that a detector can achieve very high AUC while ignoring the actual acoustics of synthesis (Klemt et al., 6 Jun 2025). Another controversy concerns whether clean-data results predict resilience in operational settings. The adversarial benchmark shows that high clean-data AUC does not imply robustness under anti-forensic perturbations, especially PGD (Uddin et al., 8 Sep 2025). These results suggest that protocol realism, cross-domain evaluation, and artifact audits are essential components of ADV benchmarking rather than auxiliary checks.

6. Robustness, privacy preservation, and proactive authentication

Robustness against anti-forensic manipulation is a major weakness of current detectors. SHIELD studies generative anti-forensic attacks produced by GAN-based attack models and introduces a defense generative model $\tau$ 37 plus a triplet-based supervised embedding network built on RawNet3 (Uddin et al., 17 Jul 2025). The auxiliary generator reconstructs real and AF-attacked deepfakes, and the triplet model operates on concatenated input-output pairs $\tau$ 38 and $\tau$ 39. The paper reports that the proposed AF attacks reduce average detection accuracy from $\tau$ 40 to $\tau$ 41 on ASVspoof2019, from $\tau$ 42 to $\tau$ 43 on In-the-Wild, and from $\tau$ 44 to $\tau$ 45 on HalfTruth across three generative models. Under these attacks, SHIELD achieves average accuracy of $\tau$ 46, $\tau$ 47, and $\tau$ 48 in match settings, and $\tau$ 49, $\tau$ 50, and $\tau$ 51 in mismatch settings for the same three datasets (Uddin et al., 17 Jul 2025).

A broader benchmark confirms the scale of this vulnerability. Across twelve state-of-the-art detectors on five datasets, spectrogram-based methods outperform raw-waveform models on clean audio, with average AUC $\tau$ 52 versus $\tau$ 53 and average EER $\tau$ 54 versus $\tau$ 55 (Uddin et al., 8 Sep 2025). However, optimization-based AF attacks cause severe degradation. On average, FGSM reduces AUC from $\tau$ 56 to $\tau$ 57 and increases EER from $\tau$ 58 to $\tau$ 59, while PGD reduces AUC from $\tau$ 60 to $\tau$ 61 and increases EER from $\tau$ 62 to $\tau$ 63. Among the methods studied, ABCCapsNet and CORE show comparatively stronger resilience among spectrogram-based detectors, and RawNet3 and Res-TSSDNet among raw-waveform detectors (Uddin et al., 8 Sep 2025).