---
title: 'ExplainFake-Bench: Forensic Deepfake Audio Analysis'
url: https://www.emergentmind.com/topics/explainfake-bench
type: topic
---

# ExplainFake-Bench: Forensic Deepfake Audio Analysis

Searching arXiv for the cited benchmark papers to ground the article in current sources.
ExplainFake-Bench denotes a benchmark-centric framing of explainable deepfake audio forensics built around FakeSound2, a benchmark for deepfake sound detection that extends evaluation beyond clip-level real/fake classification to localization, traceability, and generalization [2509.17162]. In this formulation, deepfake sound detection is treated not only as an identification problem, but as a forensic inference problem in which a system must determine how a manipulation occurred, where forged content is located in time, and from which generator or source the manipulated component originated. FakeSound2 operationalizes this view across six manipulation types and 12 sources, with explicit in-domain and out-of-domain evaluation designed to test whether detectors learn intrinsic forgery distributions rather than source-specific artifacts [2509.17162].

## 1. Conceptual scope and forensic rationale

FakeSound2 is designed to move deepfake sound detection beyond clip-level binary decisions by making models explain how, where, and from which source a manipulation occurs, and by testing whether those explanations and detections generalize to unseen generators [2509.17162]. The benchmark targets four pillars: explainability, localization, traceability, and generalization. Explainability concerns identifying the manipulation method among six categories and differentiating methods that may be acoustically similar, such as Generation and Editing. Localization concerns temporal localization of forged regions within an audio clip, especially for frame-wise manipulations in which only segments are edited or synthesized. Traceability concerns source attribution of the manipulated component to its generator or source model. Generalization concerns robustness under out-of-domain generators or models held out from training.

The benchmark’s design is motivated by the inadequacy of binary-only deepfake sound detection. Prior work largely treats deepfake sound detection as clip-wise real/fake classification, which lacks temporal granularity, does not explain the mechanism of falsification, and does not attribute origin [2509.17162]. In forensic settings, these omissions limit accountability and interpretability. A binary decision can indicate that a clip is forged, but it does not specify what was done to it, where it was altered, or which model family produced the manipulated component. FakeSound2 formalizes those additional requirements as first-class evaluation targets.

A plausible implication is that ExplainFake-Bench recasts trustworthy audio authentication as a structured multi-task problem rather than a single classification endpoint. In that sense, the benchmark aligns deepfake audio detection with forensic attribution and evidence localization, rather than with conventional anti-spoofing alone.

## 2. Dataset construction, sources, and annotation structure

The dataset is built from AudioCaps using a four-stage pipeline consisting of event localization, metadata processing via LLM, audio manipulation, and quality filtering [2509.17162]. Its reported scale is a training set of 369,929 samples and a test set of 5,553 samples. In the authors’ implementation, the test set is subdivided into 3,896 in-domain samples and 1,657 OOD samples for generalization benchmarking. The paper does not report clip durations, sampling rate, file formats, or a dedicated validation split.

The benchmark covers six manipulation types plus Genuine as the authentic class. Several are clip-wise, while others are frame-wise and therefore directly support localization.

| Type | Description | Granularity |
|---|---|---|
| Genuine | authentic audio clips with no manipulation | authentic |
| Generation | synthesize an entire clip conditioned on a caption | clip-wise |
| Editing | modify a given clip according to a target caption | clip-wise |
| Inpainting | reconstruct masked frames using a caption; forged segments are spliced back | frame-wise |
| Separation | remove events specified by a caption and splice remaining segments with genuine audio | frame-wise |
| Splicing | concatenate authentic clips guided by a caption to form a new sequence | frame-wise |
| Addition | insert an external audio segment into an original clip according to a textual description | frame-wise |

The source inventory spans 12 sources, of which 11 synthetic and 1 genuine are described, although only 11 are explicitly named in the metadata table [2509.17162]. Named sources include Affusion, AudioEditor, Tango2, AudioLDM2, LASSNet, FlowSep, X2Audio, Audit, MakeAnAudio, FakeSound, and genuine audio. The paper distinguishes seen and unseen sources. Affusion is seen for Generation and Inpainting; AudioEditor is seen for Editing; Tango2 and AudioLDM2 are seen for Inpainting; LASSNet is seen for Separation; FlowSep is unseen/OOD; X2Audio, Audit, MakeAnAudio, and FakeSound are listed as unseen or OOD examples. Genuine audio serves as the source for Splicing and Addition.

Labeling is split across temporal and clip-level targets. Localization labels are temporal boundaries for key sound events, obtained via a Text-to-Audio grounding model; frame-wise binary labels are used for training and evaluation in frame-wise tasks, and inpainting masks are also applied [2509.17162]. Traceability labels are clip-level labels for manipulation type and source attribution. Source attribution is treated as closed-set classification for in-domain sources, while OOD sources are excluded from source classification and reserved for generalization testing.

This annotation structure makes FakeSound2 unusual among audio deepfake resources. It couples event grounding, manipulation taxonomy, and source metadata in a way that supports segment-level localization and attribution simultaneously, rather than treating them as separate tasks.

## 3. Task definitions and evaluation protocol

The benchmark defines three principal task families: localization, traceability, and generalization [2509.17162]. Localization takes an audio clip as input and requires frame-level counterfeit probabilities indicating where forged content occurs. These frame-wise predictions are also aggregated into clip-wise real/fake identification and segment boundaries. Predicted probabilities are median-filtered post hoc to stabilize segment boundaries. Segment-level \( \text{F1}_{\text{segment}} \), following ADD 2023 practice, is used to evaluate localization fidelity.

Traceability consists of two closed-set multi-class classification problems for in-domain evaluation: manipulation-type classification and source attribution [2509.17162]. Manipulation-type classification is always closed-set. Source attribution is also closed-set, but only for seen sources; it is not computed for OOD generators. This distinction is central to the benchmark’s forensic logic: an unseen generator may still be detectable as manipulated, yet not attributable under the benchmark’s source-classification protocol.

Generalization is evaluated through strict OOD source holding. OOD generators are never seen during training, and the benchmark reports results separately on 3,896 in-domain and 1,657 OOD samples [2509.17162]. Named OOD examples include X2Audio, Audit, MakeAnAudio, FlowSep, and FakeSound. The benchmark also stresses cross-source and cross-manipulation transfer by splicing forged segments onto genuine backgrounds in frame-wise tasks.

Leakage control is an explicit protocol component. OOD sources are kept completely unseen during training, and models are trained with default configurations of generators and then evaluated on held-out OOD generators [2509.17162]. This protocol is intended to reveal whether a detector has learned forgery distributions or has merely memorized generator fingerprints.

A plausible implication is that FakeSound2 separates “forgery recognition” from “generator memorization” more clearly than standard binary benchmarks. Strong in-domain identification therefore does not necessarily indicate robust forensic competence.

## 4. Metrics, losses, and baseline system

The benchmark reports clip-wise identification accuracy \( \text{Acc}_{\text{identify}} \), manipulation-type accuracy \( \text{Acc}_{\text{manipulation}} \), source attribution accuracy \( \text{Acc}_{\text{source}} \), and segment-level \( \text{F1}_{\text{segment}} \) [2509.17162]. Standard precision, recall, AUC, EER, IoU, and Dice are not reported.

For any classification task \(T\), accuracy is defined as
\[
\text{Acc}_T = \frac{\text{Number of correct predictions}}{\text{Total predictions}}.
\]

For localization, frame-wise predictions are grouped into segments and evaluated with segment-level F1:
\[
P = \frac{TP}{TP + FP}, \qquad
R = \frac{TP}{TP + FN}, \qquad
\text{F1}_{\text{segment}} = 2 \cdot \frac{P \cdot R}{P + R}.
\]
The paper states that exact matching criteria such as overlap thresholds are not specified and instead follow ADD 2023 practice [2509.17162].

Training uses binary cross-entropy for frame-level detection,
\[
\mathcal{L}_{\text{BCE}} = -\frac{1}{N} \sum_{i=1}^{N} \left[ y_i \log p_i + (1-y_i)\log(1-p_i)\right],
\]
where \(y_i \in \{0,1\}\) is the ground-truth frame label and \(p_i \in (0,1)\) is the predicted probability. Manipulation-type and source classification use cross-entropy,
\[
\mathcal{L}_{\text{CE}} = - \sum_{i=1}^{M} y_i \log p_i,
\]
where \(y_i\) is the one-hot label and \(p_i\) is the predicted probability for class \(i\). The total loss is the weighted sum
\[
\mathcal{L}_{\text{total}} = 0.5 \cdot \mathcal{L}_{\text{BCE}} + 0.01 \cdot \mathcal{L}_{\text{CE}}^{\text{manip}} + 0.01 \cdot \mathcal{L}_{\text{CE}}^{\text{source}}.
\]

The baseline architecture combines a frozen EAT self-supervised audio encoder with a hybrid temporal stack: a 12-layer ResNet flanked by CNN blocks, followed by a 2-layer Transformer encoder and a 1-layer bidirectional LSTM, adapted from Cai et al. for ADD 2023 [2509.17162]. Three linear heads predict frame-level counterfeit probabilities, manipulation type, and source attribution. Median filtering is applied to frame-level probabilities as post-processing. Training uses AdamW with learning rate \(10^{-3}\) for 10 epochs. Input features are EAT embeddings; explicit spectrogram parameters and audio sampling rate are not reported.

Explainability in the benchmark is operationalized through explicit manipulation-type and source classification, along with feature-space visualization used to qualitatively assess clustering of forged categories [2509.17162]. No saliency maps or gradient-based attribution methods are reported. This means that “explainability” is framed primarily as semantic categorization and source-level accountability rather than token- or frame-level attribution to learned model internals.

## 5. Empirical performance and observed failure modes

On the in-domain test set, the reported totals are \( \text{Acc}_{\text{manipulation}} = 72.15 \), \( \text{Acc}_{\text{source}} = 85.04 \), \( \text{Acc}_{\text{identify}} = 95.51 \), and \( \text{F1}_{\text{segment}} = 97.27 \) [2509.17162]. On the OOD set, the reported totals are \( \text{Acc}_{\text{manipulation}} = 41.82 \), \( \text{Acc}_{\text{identify}} = 83.95 \), and \( \text{F1}_{\text{segment}} = 79.25 \); \( \text{Acc}_{\text{source}} \) is not reported for OOD because unseen sources are excluded from source classification.

The baseline is strongest on localization and binary identification. In-domain Generation reaches \( \text{Acc}_{\text{identify}} = 100.00 \) and \( \text{F1}_{\text{segment}} = 100.00 \); Editing reaches \(100.00\) and \(99.87\); Inpainting reaches \(100.00\) and \(99.53\) [2509.17162]. Separation, Splicing, and Addition are more difficult, with in-domain values of \(91.18/94.38\), \(94.17/92.63\), and \(82.53/84.37\) for \( \text{Acc}_{\text{identify}}/\text{F1}_{\text{segment}} \), respectively.

The most consequential limitation lies in explainability rather than detection. Editing is frequently misclassified as Generation: in-domain \( \text{Acc}_{\text{manipulation}} \) for Editing is \(0.00\), despite perfect localization and identification [2509.17162]. Source attribution is also uneven. Inpainting achieves in-domain \( \text{Acc}_{\text{source}} = 99.87 \), yet categories with similar generators or objectives exhibit entangled latent representations, such as Affusion versus AudioEditor. Feature visualization reportedly shows clear separation between genuine and forged audio, which supports high binary accuracy, but substantial overlap among certain forged categories, which undermines manipulation disambiguation and attribution [2509.17162].

OOD evaluation exposes pronounced generalization gaps. For OOD Generation, exemplified by X2Audio, \( \text{Acc}_{\text{manipulation}} \) drops to \(0.94\), while \( \text{Acc}_{\text{identify}} = 80.99 \) and \( \text{F1}_{\text{segment}} = 65.32 \) [2509.17162]. For OOD Separation with FlowSep, \( \text{Acc}_{\text{manipulation}} \) falls to \(7.83\), yet \( \text{Acc}_{\text{identify}} \) remains high at \(98.26\), indicating that the model can still localize edits while failing to explain their mechanism. OOD Inpainting retains relatively robust localization with \( \text{F1}_{\text{segment}} = 91.45 \) but shows reduced clip-wise identification at \(83.12\).

These findings support the benchmark’s central claim: existing systems can often detect that content is forged and localize where manipulation occurs, but they struggle to infer how it was manipulated and who or what generated it, particularly outside the training source distribution [2509.17162]. A plausible implication is that binary accuracy is a weak proxy for forensic reliability, because it can remain high even when manipulation semantics and provenance collapse.

## 6. Comparative position, limitations, and research directions

Within the landscape of forgery benchmarks, FakeSound2 is positioned against prior audio deepfake resources such as ASVspoof and ADD 2023, which emphasize binary anti-spoofing at the clip level or manipulation-region localization without comprehensive source attribution [2509.17162]. Its stated contributions are a multi-dimensional evaluation coupling localization with manipulation-type explainability and source traceability, a focus on general audio beyond speech, and explicit OOD testing with held-out generators.

A useful comparison can also be drawn to FakeBench for explainable fake image detection with large multimodal models [2404.13306]. FakeBench evaluates detection, reasoning, interpretation, and fine-grained forgery analysis using multimodal prompts and human-in-the-loop language annotations. FakeSound2 differs in modality and protocol, but both benchmarks move beyond binary authenticity judgments and treat explanation as a benchmarked capability rather than an auxiliary narrative [2404.13306]. This suggests a broader benchmark trend in synthetic media forensics: explanation is being formalized either through language-grounded forensic descriptions, as in FakeBench, or through manipulation-type and source attribution labels, as in FakeSound2.

The limitations reported for FakeSound2 are practical and methodological. Dataset metadata such as durations, sample rates, and file formats are not provided; the paper states 12 sources but lists 11 by name; source coverage remains only a subset of rapidly evolving audio generators; and quality filtering relies on CLAP caption-audio similarity, which could bias the data distribution or exclude difficult cases [2509.17162]. Robustness analyses for compression, noise, re-recording, and other domain shifts are not reported.

The future directions enumerated by the benchmark emphasize attribution methods that disentangle similar manipulation objectives and similar architectures, domain adaptation and invariance learning to reduce dependence on generator-specific artifacts, richer explainability that combines classification with saliency or causal explanation maps, and robustness studies under compression, noise, re-recording, and mixed-domain audio [2509.17162]. The paper also recommends strict exclusion of OOD sources from training, reporting in-domain and OOD metrics separately, use of the weighted multi-task loss, and inspection of feature-space visualizations to detect forged-category overlap.

Taken together, ExplainFake-Bench identifies a structural asymmetry in current deepfake audio systems: localization and binary identification are relatively mature, whereas manipulation disambiguation, provenance attribution, and cross-generator transfer remain unstable [2509.17162]. In forensic terms, the benchmark indicates that the field can often answer “fake” and sometimes “where,” but not yet reliably “how” or “from whom.”

Source: https://www.emergentmind.com/topics/explainfake-bench