CompSpoof: Component-Level Audio Anti-Spoofing

• The paper introduces a five-class benchmark and a separation-enhanced joint learning framework to independently model spoofing in speech and environmental sounds.
• CompSpoof defines component-level spoofing by distinguishing cases where only one audio component is manipulated, contrasting natural co-recordings with artificial mixtures.
• Empirical results reveal that joint learning markedly boosts F1 scores for mixed-content classes, outperforming traditional utterance-level classifiers.

CompSpoof is a component-level audio anti-spoofing problem setting, dataset, and learning framework in which authenticity is assigned not only to an utterance as a whole but separately to its constituent acoustic components, specifically speech and environmental/background sound (Zhang et al., 19 Sep 2025). It addresses a manipulation regime in which only one component may be forged while another remains genuine, a situation that departs from conventional anti-spoofing assumptions that an utterance or segment is entirely bona fide or entirely spoofed. In response, CompSpoof introduces a five-class benchmark and a separation-enhanced joint learning framework that first separates the mixture and then applies dedicated anti-spoofing models to each component, with joint optimization intended to preserve spoof-relevant information (Zhang et al., 19 Sep 2025).

1. Conceptual scope

CompSpoof defines Component-level audio Spoofing (Comp-Spoof) as a setting in which only specific components of an audio signal are forged, replaced, or generated while other components remain authentic (Zhang et al., 19 Sep 2025). The paper concentrates on two components, speech and environmental/background sound, and treats their authenticity states independently. This yields cases such as spoofed speech with genuine environment, genuine speech with spoofed environment, or simultaneous manipulation of both components (Zhang et al., 19 Sep 2025).

The defining claim is that conventional anti-spoofing datasets and methods are too coarse because they assign a single bona fide/spoofed label to an utterance or segment. Even prior partial spoofing work is framed primarily along the time axis, asking which temporal region is manipulated; CompSpoof instead asks which acoustic component in the mixture is manipulated (Zhang et al., 19 Sep 2025). In the paper’s formulation, this is the distinction between utterance-level authenticity and source-level authenticity within a composite scene.

A useful formalization given in the description is

$x = x^{\text{speech}} + x^{\text{env}},$

with separate component labels

$$y^{\text{speech}} \in \{0,1\}, \qquad y^{\text{env}} \in \{0,1\},$$

and a final utterance label derived from the pair together with whether the sample is an original recording or an artificial mixture (Zhang et al., 19 Sep 2025). This suggests a structured classification problem rather than a single binary decision.

2. Dataset design and label taxonomy

The CompSpoof dataset is presented as the first dataset for component-level audio anti-spoofing (Zhang et al., 19 Sep 2025). It contains five classes, each with 500 samples, for a total of 2,500 audio samples (Zhang et al., 19 Sep 2025). The class system distinguishes both authenticity combinations and the difference between natural co-recording and artificial mixing.

ID	Label	Brief description
0	original	Original bona fide speech with its corresponding naturally captured environment
1	bonafide_bonafide	Bona fide speech mixed with another bona fide environment
2	spoof_bonafide	Spoofed speech mixed with bona fide environment
3	bonafide_spoof	Bona fide speech mixed with spoofed environment
4	spoof_spoof	Spoofed speech mixed with spoofed environment

This taxonomy supports both five-class utterance classification and implicit component-level authenticity labels for speech and environment (Zhang et al., 19 Sep 2025). The framework later uses those component labels explicitly through separate speech and environment anti-spoofing branches.

The distinction between original and bonafide_bonafide is structurally important. The former corresponds to naturally co-recorded bona fide speech and environment, whereas the latter is an artificial mixture of genuine components that were not originally recorded together (Zhang et al., 19 Sep 2025). The paper treats this as part of the utterance-level label space, not merely as metadata.

The dataset is partitioned with stratified sampling into 70% train, 10% development, and 20% evaluation (Zhang et al., 19 Sep 2025). Audio durations range from 5 to 21 seconds (Zhang et al., 19 Sep 2025).

3. Data sources and construction protocol

CompSpoof is assembled from multiple source corpora (Zhang et al., 19 Sep 2025). The paper specifies the following provenance:

• Bona fide speech: ASVspoof5 and CommonVoice
• Spoofed speech: ASVspoof5 and SSTC
• Bona fide environmental sound: VGGSound
• Spoofed environmental sound: VCapAV
• Original co-recorded bona fide audio: VGGSound

The generation pipeline proceeds by selecting speech clips with clear voice activity and environmental clips from diverse scenes such as indoor, street, and natural settings, then resampling all audio to 16 kHz (Zhang et al., 19 Sep 2025). For artificially mixed classes, the shorter signal determines the final duration and the longer signal is truncated. Speech and environmental sound are then mixed, and the environmental amplitude is adjusted to achieve a predefined SNR relative to speech (Zhang et al., 19 Sep 2025).

This construction deliberately exposes the benchmark to both speech spoofing and environmental spoofing. The paper does not treat background sound as a nuisance variable; it is itself a manipulable target. A plausible implication is that anti-spoofing systems that rely on global utterance statistics can confuse authentic and manipulated evidence when they coexist in the same mixture.

4. Separation-enhanced joint learning framework

The proposed method is a separation-enhanced joint learning framework built from four modules: a binary mixture detection model, a UNet-based separation network, a speech anti-spoofing model, and an environment anti-spoofing model (Zhang et al., 19 Sep 2025). The anti-spoofing branches are implemented with XLSR-AASIST, while the separator operates in the STFT domain (Zhang et al., 19 Sep 2025).

The first stage is a binary mixture detector that distinguishes $c_0$ from $c_{1,2,3,4}$, that is, original versus all other classes (Zhang et al., 19 Sep 2025). The second stage separates the mixture into estimated speech and environmental waveforms. Given mixed waveform $x$, its complex spectrogram is

$X(f,t) = \mathrm{STFT}(x).$

The separator predicts a complex speech mask $M_{\text{speech}}(f,t)$ and computes

$\hat{S}(f,t) = M_{\text{speech}}(f,t)\odot X(f,t),$

followed by

$\hat{x}^{\text{speech}} = \mathrm{ISTFT}(\hat{S}).$

The environmental component is formed from the residual

$r = x - \hat{x}^{\text{speech}}.$

With $$y^{\text{speech}} \in \{0,1\}, \qquad y^{\text{env}} \in \{0,1\},$$0 the magnitude spectrogram of the separated speech and $$y^{\text{speech}} \in \{0,1\}, \qquad y^{\text{env}} \in \{0,1\},$$1 the magnitude spectrogram of the residual, the dynamic scaling factor is

$$y^{\text{speech}} \in \{0,1\}, \qquad y^{\text{env}} \in \{0,1\},$$2

and the environment mask is

$$y^{\text{speech}} \in \{0,1\}, \qquad y^{\text{env}} \in \{0,1\},$$3

The estimated environment is then reconstructed from the masked residual-domain representation (Zhang et al., 19 Sep 2025).

The two component detectors are trained as binary classifiers with class groupings specified in the paper: the speech detector uses c13 vs c24, and the environment detector uses c12 vs c34 (Zhang et al., 19 Sep 2025). At inference, the binary outputs are combined with the mixture decision to recover the five-way label. The implied rule is: if the mixture detector predicts $$y^{\text{speech}} \in \{0,1\}, \qquad y^{\text{env}} \in \{0,1\},$$4, the output is original; otherwise the speech and environment decisions map to bonafide_bonafide, spoof_bonafide, bonafide_spoof, or spoof_spoof (Zhang et al., 19 Sep 2025).

The paper’s main methodological claim is that separation alone is insufficient because reconstruction-oriented separation can suppress forensic cues (Zhang et al., 19 Sep 2025). To counter this, the separator and the component detectors are trained jointly. A consistency term compares anti-spoofing outputs from reference and separated components: $$y^{\text{speech}} \in \{0,1\}, \qquad y^{\text{env}} \in \{0,1\},$$5 The overall objective is

$$y^{\text{speech}} \in \{0,1\}, \qquad y^{\text{env}} \in \{0,1\},$$6

with $$y^{\text{speech}} \in \{0,1\}, \qquad y^{\text{env}} \in \{0,1\},$$7 (Zhang et al., 19 Sep 2025).

5. Training protocol and implementation details

The baseline is a direct five-class extension of XLSR-AASIST (Zhang et al., 19 Sep 2025). The proposed framework keeps XLSR-AASIST for the mixture, speech, and environment branches, while adding the UNet separator (Zhang et al., 19 Sep 2025).

For separation, the system uses STFT-domain complex spectrograms with audio sampled at 16 kHz, window size 64 ms, and hop length 16 ms (Zhang et al., 19 Sep 2025). Separation-based methods process audio in 4-second windows with 2-second hop (Zhang et al., 19 Sep 2025). Segment predictions are aggregated to the file level by majority voting (Zhang et al., 19 Sep 2025).

Optimization uses Adam with learning rate

$$y^{\text{speech}} \in \{0,1\}, \qquad y^{\text{env}} \in \{0,1\},$$8

for the separator and

$$y^{\text{speech}} \in \{0,1\}, \qquad y^{\text{env}} \in \{0,1\},$$9

for the anti-spoofing models (Zhang et al., 19 Sep 2025). In the joint framework, models are trained independently for the first 4 epochs and then jointly from epoch 5 onward (Zhang et al., 19 Sep 2025). The paper does not describe additional data augmentation beyond resampling, mixing, SNR control, and chunking.

The evaluation metrics differ from common ASV anti-spoofing practice. Whereas many speech spoofing studies emphasize EER and t-DCF (Kinnunen et al., 2020), CompSpoof reports Precision, Recall, and F1 at file level for the five-class task, together with segment-level Precision, Recall, and F1 for speech and environment anti-spoofing (Zhang et al., 19 Sep 2025).

6. Empirical results, significance, and relation to adjacent work

The experimental comparison includes three systems: the utterance-level Baseline, the Separation-Enhanced Framework (SEF) without joint learning, and SEF+JL with joint learning (Zhang et al., 19 Sep 2025). On the eval set, overall F1 is 0.827 for the Baseline, 0.668 for SEF, and 0.908 for SEF+JL (Zhang et al., 19 Sep 2025). On the dev set, the corresponding F1 scores are 0.840, 0.705, and 0.912 (Zhang et al., 19 Sep 2025). The central empirical conclusion is therefore twofold: naive separation degrades performance, but separation with joint learning outperforms the direct utterance-level classifier.

Per-class eval F1 further localizes the gains (Zhang et al., 19 Sep 2025). For the Baseline, the paper reports 0.980 for original, 0.843 for bonafide_bonafide, 0.745 for spoof_bonafide, 0.829 for bonafide_spoof, and 0.738 for spoof_spoof. For SEF+JL, the corresponding numbers are 0.990, 0.899, 0.871, 0.905, and 0.874 (Zhang et al., 19 Sep 2025). The most important improvements occur in the mixed-content classes where only one component is spoofed. That pattern supports the paper’s core premise that component-wise modeling is necessary when authentic and manipulated evidence coexist in the same recording.

Segment-level results reinforce the same interpretation. On the CompSpoof eval set, speech anti-spoofing improves from F1 = 0.720 without joint learning to F1 = 0.863 with joint learning, while environment anti-spoofing improves from F1 = 0.718 to F1 = 0.849 (Zhang et al., 19 Sep 2025). The paper also notes that environment anti-spoofing remains weaker than speech anti-spoofing, suggesting that an XLSR-AASIST-based environment detector may not be ideal (Zhang et al., 19 Sep 2025).

CompSpoof occupies a specific position within a broader shift from utterance-level to more structured spoof analysis. In speech anti-spoofing, datasets such as LlamaPartialSpoof stress fully and partially fake speech and show that current fake speech detection systems struggle to generalize to unseen scenarios, with best performance reported as 24.49% equal error rate (Luong et al., 2024). That line of work localizes manipulations in time and semantics; CompSpoof instead localizes authenticity across simultaneous acoustic components (Zhang et al., 19 Sep 2025). A plausible implication is that future anti-spoofing benchmarks may need to consider both axes jointly: temporal partial spoofing and component-level spoofing.

The paper also exposes several limitations. The dataset scale is 2,500 samples, the component taxonomy is restricted to speech and environment, and many classes are formed by artificial mixing rather than by naturally edited recordings (Zhang et al., 19 Sep 2025). The method itself depends on separation quality, and the poor performance of SEF shows that component extraction can damage spoof evidence if it is optimized only for reconstruction (Zhang et al., 19 Sep 2025). Even so, CompSpoof establishes a distinct research program: anti-spoofing in composite audio scenes, where authenticity is a property of individual sources rather than only of the utterance.