{"id":"a9d72abc-ac61-4553-86bd-0a3bb96c0517","arxiv_id":"2505.14601","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":3.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"AnaST updates only the classifier of a frozen-feature deepfake source tracing model using recursive least squares, matching or exceeding exemplar-based continual learning baselines without replay buffers.","lead":"This paper applies an existing analytic class incremental learning recipe, essentially recursive least squares on a frozen feature extractor, to audio deepfake source tracing, so a system can learn new attack classes without storing old samples. A generalist might care because it promises privacy-preserving, memory-efficient updates for deepfake attribution models that must keep pace with new synthesis methods.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The claimed equivalence to joint training is untested: Eq. (4) minimizes least squares on frozen task-0 features, while the experimental joint-training baseline trains features end-to-end, so the residual gap is caused by feature quality, not by the incremental mechanism.","rationale":"The reader's weakest assumption identifies the same load-bearing concern: the frozen feature extractor must produce a representation in which future attack classes are linearly separable. I agree, and I have sharpened it into a precise comparison problem: the paper contrasts AnaST with an end-to-end joint-training upper bound, not with the analytic joint-training solution that Eq. (4) actually refers to. The recursive update itself is sound (Woodbury/RLS), so the interesting scientific question is whether the 3-19 point gaps are due to the fixed representation or to the incremental mechanism. The paper provides no evidence on this split because the matched baseline is absent. Also missing is the label-alignment procedure for growing the block-diagonal Y matrix, which is necessary for the proof of Eq. (7). Both issues are fixable with a baseline experiment and a written alignment rule; neither is fatal to the core idea. Thus the reader's CONDITIONAL verdict is appropriate, and my stress-test does not move it. I did not flag the equations as incorrect per se, because Eq. (7) is consistent with the standard RLS derivation if the bracket is read as horizontal concatenation; the paper's notation is simply garbled. The most concrete, decisive check is the analytic joint-training baseline, because it isolates the two competing explanations for the reported accuracy gap.","tokens_in":8893,"tokens_out":5932,"duration_ms":50723,"concrete_test":"Re-implement AnaST with the frozen task-0 feature extractor and fit one least-squares classifier jointly on the expanded features of all tasks (Eq. (5), no recursion). Compare its ACC/BWT to recursive AnaST on the ASVspoof, WaveFake, and multi-dataset splits. If the joint analytic baseline matches AnaST within numerical tolerance, the incremental solver is exact and any remaining gap to Table 1 'Joint' is due solely to the frozen representation; if it does not match, the recursive update loses information (label alignment error or numerical issue), which would invalidate the central claim.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that \"the classifier can reach the same output compared to joint training on all tasks\" is only valid for the least-squares objective in Eq. (4), where the expanded features F'_0:t-1 come from a frozen extractor. Under that objective, the recursive update in Eqs. (7)-(8) is a standard RLS/Woodbury identity and is mathematically exact. However, the experiments compare AnaST to a joint-training baseline that trains the whole network end-to-end on all tasks (Section 3.2), allowing the feature extractor to adapt to every class. These are different problems: the end-to-end baseline optimizes features for all tasks, while AnaST never changes its task-0 features. The accuracy gaps in Tables 1-2 (95.37 vs 91.68, 99.50 vs 87.85, 96.91 vs 77.85) therefore measure the cost of freezing the representation, not forgetting caused by the incremental update. The paper never reports a matched analytic joint-training baseline (frozen task-0 features plus a single least-squares fit on all tasks, Eq. (5)), so the \"same output\" claim is not empirically demonstrated. A second, smaller gap is that Eqs. (4)-(5) use a block-diagonal label matrix Y_0:t-1, but the paper never specifies how new class columns are aligned into W and y as the class count grows; without that alignment, the recursive update in Eq. (7) is not well-defined.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes AnaST, an exemplar-free class incremental learning method for audio deepfake source tracing. The method pre-trains a RawNet2 feature extractor and a linear classifier on a first set of attacks with backpropagation, then replaces the classifier with an analytic least-squares classifier on randomly expanded features. For subsequent tasks, the feature extractor is frozen, and the classifier is updated recursively using a feature autocorrelation matrix, with the stated goal of reproducing the joint-training least-squares solution without storing past data. Experiments on ASVspoof 2019 LA and WaveFake in single- and multi-dataset settings report accuracies of 91.68%, 87.85%, and 77.85%, respectively, outperforming replay-free baselines and approaching (but not reaching) an end-to-end joint-training upper bound.","tokens_in":9268,"tokens_out":6299,"duration_ms":53046,"significance":"If the claimed equivalence were established, the approach would be valuable: it is exemplar-free, updates in one epoch, and has a memory footprint of just the autocorrelation matrix. The underlying recursive least-squares update follows from the Woodbury identity and is sound in principle. The paper is also the first to apply CIL to ST, and the experimental setup covers a realistic multi-dataset scenario. However, the significance is currently limited by the absence of a matched analytic joint baseline, the ambiguous recursive update, and the lack of uncertainty estimates; the empirical contribution is therefore suggestive rather than definitive.","major_comments":[{"comment":"The recursive weight update is garbled as printed. The expression cW(t)_cls = [ cW(t-1)_cls - R_t F^T_t F'_t cW(t-1)_cls R_t F'_t^T y_t ] has inconsistent dimensions (R_t F'^T F' is square, multiplied by W, then multiplied by R_t F'^T y_t) and does not correspond to the standard RLS update W_t = W_{t-1} + R_t F'^T (Y_t - F' W_{t-1}). The symbol F_t is used inconsistently with the expanded feature F'_t. Because Eqs. (7)-(8) define the algorithm, this needs to be corrected and verified, e.g., by a derivation or a numerical check that the recursion matches the closed-form solution in Eq. (5).","section":"Section 2.2.2, Eq. (7)"},{"comment":"The label alignment for new classes is unspecified. The paper states that Y_{0:t-1} is block-diagonal with y_i on the diagonal and that W has a column size proportional to task size, but it never describes how columns corresponding to new attack classes are appended to W or how Y_t is constructed when each task introduces new classes. Without this, the recursive update in Eq. (7) is not well-defined, because the dimensions of F'_t and Y_t relative to W are ambiguous. This is load-bearing for the claimed equivalence to joint training.","section":"Section 2.2.2, Eqs. (4)-(5)"},{"comment":"The central claim that the classifier can reach the same output as joint training is not tested against the correct baseline. The Joint Training baseline trains the entire network end-to-end on all tasks, which adapts the feature extractor to every class; AnaST uses a frozen task-0 feature extractor, so the two are solving different optimization problems. The accuracy gaps (e.g., 91.68 vs. 95.37 in Table 1) therefore conflate representation quality with forgetting. The authors should report an analytic joint-training baseline (frozen task-0 features plus a single least-squares fit on all tasks, Eq. (5)) to verify that the recursion actually reproduces the joint solution and to quantify the cost of freezing features.","section":"Section 3.2 and Tables 1-2"},{"comment":"The experimental results lack uncertainty quantification, and the hyperparameter gamma appears to be selected on the test split. The pre-training attack selection is random, but only one run is reported per setting, so the differences between methods (e.g., AnaST 87.85% vs. DER++ 81.10% on WaveFake) may be within run-to-run variability. The ablation in Table 3 changes gamma and reports test accuracy without a validation set, which risks optimistic bias. The authors should report means and standard deviations over multiple seeds and a clear train/validation/test split for hyperparameter selection.","section":"Section 3.2 and Table 3"}],"minor_comments":[{"comment":"The feature matrix is written as F_t in one place and F'_t in another within the same equation; use the prime consistently for the expanded feature matrix.","section":"Eq. (7)"},{"comment":"The sentence 'Suppose have access to datasets' is missing the subject 'we'.","section":"Section 2.2.2"},{"comment":"The notation for the cross-entropy loss is not fully specified: L_CE(y, f(x; W)) is written for a single sample, but the expectation is over a distribution; also, the tasks are indexed τ_1... in the text while the sum runs from t=0 to T, which is inconsistent.","section":"Section 2.1, Eq. (1)"},{"comment":"The hat notation for the estimated weight is rendered as 'cW' in the PDF; this should be typeset as \\hat{W} to avoid confusion with a variable named cW.","section":"Section 2.2.2"},{"comment":"The description 'we re-split entire ASVspoof 2019 LA into an 80:20 ratio' is ambiguous; the original dataset has train/dev/eval subsets, and the authors should specify how these were combined and whether the split is stratified by attack class.","section":"Section 3.1"}],"recommendation":"major_revision","confidential_remarks":"The paper has a sound underlying idea, but it is presented in a way that obscures the actual contribution. The garbled Eq. (7) and the missing label-alignment description are fixable, and adding a matched analytic joint baseline and error bars would substantially strengthen the empirical claims. I would like to see the revised version before making a final judgment, as the current version does not fully support the headline claim of equivalence to joint training."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: AnaST is a clean, useful application of the authors' earlier AnalyticKWS idea to audio deepfake source tracing. The algorithm itself is not new—RLS/Woodbury updates and random feature expansion are established—but the empirical study on ASVspoof 2019 LA, WaveFake, and a multi-dataset setting is the first in this subfield, and the results are meaningful. One-epoch, exemplar-free updates that beat replay-based DER++ without a buffer is a genuine finding worth knowing.\n\nWhat it does well: the problem framing is honest about privacy, on-device constraints, and growing class counts. The ablation on feature expansion and regularization is useful. The baselines are standard and the underlying RLS recursion is mathematically sound; it is not circular. Self-citation to AnalyticKWS is legitimate, not a flaw.\n\nSoft spots, in rough order:\n\n1. Eq. (7) is garbled as printed. The recursion is missing a plus term and should look like W_t = W_{t-1} + R_t F'_t^T (y_t - F'_t W_{t-1}). As written, the equation is not well-formed. One-line fix, but it should not have shipped.\n\n2. Label alignment is never specified. Equations (4)-(5) use a block-diagonal label matrix that grows with new classes, but the paper never says how new class columns are inserted or aligned with the rows of W. Without that, the incremental update is under-specified.\n\n3. The headline claim that the classifier reaches the same output as joint training is only true for the frozen-feature least-squares objective. Their joint-training baseline trains the network end-to-end on all tasks, so the gaps in Tables 1-2 mostly measure the cost of freezing the task-0 representation, not forgetting caused by the incremental mechanism. They should add the matched analytic baseline: frozen features plus a single least-squares fit on all tasks. I suspect AnaST would hold up, but the claim as stated is untested.\n\n4. Hyperparameters are tuned on test data and no error bars or multiple seeds are reported. For a paper selling efficiency, this is a minor but real weakness.\n\n5. Code is promised but not released. Given that the analytic update is the whole method, release matters.\n\nWho this is for: people working on audio deepfake attribution or exemplar-free continual learning for speech. It deserves a serious referee. With Eq. (7) fixed, label alignment specified, and the analytic joint baseline added, it would be a solid paper. My verdict is conditional, not negative.","headline":"A competent port of analytic class-incremental learning to audio deepfake source tracing, with a real empirical contribution, but the central 'same as joint training' claim is untested against a matched analytic baseline.","tokens_in":9736,"tokens_out":2093,"would_cite":true,"duration_ms":24408,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"AnaST learns new audio deepfake attacks incrementally in one epoch with no stored examples, substantially narrowing the gap to joint training.","keywords":["continual learning","class incremental learning","source tracing","audio deepfake detection","analytic learning","exemplar-free","catastrophic forgetting"],"falsifier":"Compute the classifier weight from the recursive update in Equation (7) and compare it with the batch least-squares solution on the union of all tasks' expanded features; if they differ by more than floating-point error, the claimed equivalence to joint training is false. A task-ordering experiment that starts with a single attack family would also settle whether the frozen features generalize to very different generators.","tokens_in":8735,"feed_emoji":"🎙️","tokens_out":11716,"duration_ms":95769,"temperature":0.7,"pith_summary":"AnaST tackles audio deepfake source tracing in a class-incremental setting: a model that has learned to attribute speech to known synthesis systems must keep that ability while absorbing new attack classes. The paper's central claim is that this can be done without storing any previous samples: freeze the feature extractor after the first task, then update only the classifier with a closed-form recursive least-squares step in a single epoch, using a stored feature autocorrelation matrix to encode past information. On ASVspoof 2019 LA, WaveFake, and a combined multi-dataset test, the method reaches 91.68%, 87.85%, and 77.85% average accuracy with backward transfer of -3.1, -10.3, and -5.4 percentage points, while using no replay buffer. The practical point is that a deployed source-tracing model could be adapted to new generators quickly, privately, and with minimal memory, which matters for forensic and copyright use cases.","feed_headline":"AnaST learns new deepfake attacks in one epoch, no exemplars needed","feed_subtitle":"Frozen-feature analytic classifier hits 91.7% on ASVspoof source tracing with no stored examples.","key_machinery":"The load-bearing object is the feature autocorrelation matrix (FAuM), a recursively updated matrix $R_t$ that stores the inverse of the accumulated expanded-feature Gram matrix plus regularization, $\\left(\\sum_{i=0}^t F_i'^\\top F_i' + \\gamma I\\right)^{-1}$. Together with the classifier weight $\\hat{W}_{cls}^{(t)}$, it lets the analytic classifier be updated from only the new task's expanded features $F_t'$ and labels $y_t$, using a recursive identity that never touches past data. A random feature-expansion layer projects the frozen CNN embeddings into a higher-dimensional space before the least-squares fit, and the block-diagonal label matrix $Y_{0:t-1}$ encodes the growing class set; the recursive update is designed so that the analytic solution equals the joint-training solution over all tasks.","core_discovery":"AnaST claims that class-incremental learning for audio deepfake source tracing reduces to a linear-recursive problem once the acoustic feature extractor is fixed. After task 0 is trained with standard back-propagation and then frozen, the classifier is reframed as a least-squares layer: for each new task, the expanded features are passed through, the feature autocorrelation matrix is updated via a recursive formula, and the classifier weight is revised in closed form so that the output matches what joint training on all tasks would have produced. The paper reports average accuracies of 91.68% (ASVspoof 2019 LA), 87.85% (WaveFake), and 77.85% (multi-dataset), with backward transfer of -3.1, -10.3, and -5.4 percentage points and no exemplar buffer, compared with joint-training upper bounds of 95.37%, 99.50%, and 96.91%. The result is offered as the first class-incremental formulation for source tracing and as evidence that analytic learning can replace replay in this setting.","pith_inferences":["The same recursive analytic update applies to any attribution problem with a growing class set, such as voice-clone attribution or music synthesizer identification; the exemplar-free property is what makes that transfer attractive.","Because the feature extractor is frozen after task 0, the ceiling on accuracy is set by the quality of that one-time representation; no improvement to the incremental rule alone can fix a representation that fails to separate a future attack family.","An online deployment with asynchronous label arrivals would need an explicit rule for aligning the block-diagonal label matrix, a step the task-batched formulation leaves implicit."],"forward_implications":["Deployed source-tracing systems can be updated on new attack data alone, so forensic labs never need to retain or share the original training utterances.","Memory use stays bounded by the classifier weight and the feature autocorrelation matrix, making the method suitable for on-device or embedded deployment.","Each new task costs one epoch of classifier adaptation, so reaction time to a newly discovered deepfake generator drops to near-instant.","Within the fixed feature space, the incremental classifier should behave as if it had seen all previous tasks, keeping old attack classes recognizable.","The reported comparisons provide a first class-incremental benchmark for source tracing, with joint training as upper bound and fine-tuning as lower bound."],"supporting_citations":[{"why":"Supplies the analytic learning / recursive least-squares foundation that the AnaST update rule is built on.","marker":"[28]"},{"why":"Provides RawNet2, the end-to-end CNN backbone used as the frozen feature extractor.","marker":"[30]"},{"why":"Provides the ASVspoof 2019 LA dataset used for the single-dataset and multi-dataset evaluations.","marker":"[4]"},{"why":"Provides the WaveFake dataset used for the second single-dataset and multi-dataset evaluations.","marker":"[29]"},{"why":"EWC is the exemplar-free baseline that AnaST outperforms.","marker":"[15]"},{"why":"Prior binary continual-learning work for fake audio detection that the method extends to multi-class source tracing.","marker":"[20]"},{"why":"Rwalk is an exemplar-based baseline using a replay buffer, compared against AnaST.","marker":"[33]"},{"why":"DER++ is a strong exemplar-based baseline with rehearsal and distillation, compared against AnaST.","marker":"[34]"}],"fun_headline_variants":["AnaST: one-epoch attack learning without stored samples","Forgetful? Not AnaST: learns new attacks in one epoch","No exemplars, one epoch: AnaST traces new deepfakes","AnaST: analytic learning for new attacks, zero stored examples","One epoch per attack: AnaST beats replay with no memory"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method's guarantee depends on the feature extractor learned from the first task alone producing a representation in which every future attack class can be separated by a simple linear decision rule, even though that extractor is frozen and never sees the later attacks.","fun_headline_variants_meta":{"raw":{"variants":["AnaST: one-epoch attack learning without stored samples","Forgetful? Not AnaST: learns new attacks in one epoch","No exemplars, one epoch: AnaST traces new deepfakes","AnaST: analytic learning for new attacks, zero stored examples","One epoch per attack: AnaST beats replay with no memory"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000463,"raw_usage":{"total_tokens":2313,"prompt_tokens":941,"completion_tokens":1372,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":557,"completion_tokens_details":{"reasoning_tokens":1283}},"tokens_in":557,"tokens_out":1372,"duration_ms":10517,"temperature":1.0,"reasoning_tokens":1283,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T15:31:30.170960+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute the classifier weight from the recursive update in Equation (7) and compare it with the batch least-squares solution on the union of all tasks' expanded features; if they differ by more than floating-point error, the claimed equivalence to joint training is false. A task-ordering experiment that starts with a single attack family would also settle whether the frozen features generalize to very different generators.","supporting_citations":[{"cited_title":"Large scale incremental learning,","cited_arxiv_id":null,"evidence_quote":"Supplies the analytic learning / recursive least-squares foundation that the AnaST update rule is built on."},{"cited_title":"Dark experience for incremental keyword spotting,","cited_arxiv_id":null,"evidence_quote":"Provides RawNet2, the end-to-end CNN backbone used as the frozen feature extractor."},{"cited_title":"Dataset We used two datasets in our studies: ASVspoof 2019 LA [4] and WaveFake [29]","cited_arxiv_id":null,"evidence_quote":"Provides the ASVspoof 2019 LA dataset used for the single-dataset and multi-dataset evaluations."},{"cited_title":"Rainbow Keywords: Effi- cient incremental learning for online spoken keyword spotting,","cited_arxiv_id":null,"evidence_quote":"Provides the WaveFake dataset used for the second single-dataset and multi-dataset evaluations."},{"cited_title":"XLSR-Mamba: a dual-column bidirec- tional state space model for spoofing attack detection,","cited_arxiv_id":null,"evidence_quote":"Prior binary continual-learning work for fake audio detection that the method extends to multi-class source tracing."},{"cited_title":"Do you re- member? overcoming catastrophic forgetting for fake audio de- tection,","cited_arxiv_id":null,"evidence_quote":"Rwalk is an exemplar-based baseline using a replay buffer, compared against AnaST."},{"cited_title":"Blockwise recursive moore– penrose inverse for network learning,","cited_arxiv_id":null,"evidence_quote":"DER++ is a strong exemplar-based baseline with rehearsal and distillation, compared against AnaST."}],"review_version":1}