Pith. sign in

REVIEW 3 major objections 6 minor 35 references

SpeechVerifier: Robust Acoustic Fingerprint against Tampering Attacks via Watermarking

T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read SpeechVerifier claims that a watermarked speech file can verify its own integrity: a 256-bit fingerprint is embedded into the audio at publication time, then regenerated and compared with the decoded watermark by any verifier, with no…

desk verdict A promising fingerprint+watermark combination whose advertised security claim is broken by a re-embedding attack the paper never considers. read the letter →

arxiv 2505.23821 v2 pith:KMA7B5L7 submitted 2025-05-28 cs.CR cs.SDeess.AS

Lingfeng Yao , Chenpei Huang , Shengyao Wang , Junpei Xue , Hanqing Guo , Jiang Liu , Xun Chen , Miao Pan This is my paper
classification cs.CRcs.SDeess.AS
keywords speechtamperingdetectionaudiofingerprintingwatermarkingcontrastivelearningintegrityverificationdeepfakeself-containedHammingdistance
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

SpeechVerifier claims that a speech file can be made to carry its own integrity check: a 256-bit acoustic fingerprint is learned so that everyday transformations such as compression, re-encoding, resampling, and noise suppression leave it nearly unchanged, while malicious edits such as deletion, splicing, silencing, substitution, reordering, TTS synthesis, and voice conversion move it far away. That fingerprint is then embedded into the same audio by segment-wise watermarking. Verification regenerates the fingerprint from the published audio, decodes the watermark from the same audio, and compares the two bitstrings: a Hamming distance at or below a fixed threshold accepts the speech, otherwise it is rejected. The paper reports perfect or near-perfect separation on VoxCeleb and strong cross-corpus results on LibriSpeech, and argues this makes tamper-evident speech practical without any external reference recording or hash.

What carries the argument

The load-bearing object is the contrastively trained binary acoustic fingerprint: a 256-bit code produced from wav2vec 2.0 frame-level features, a BiLSTM with multiscale average pooling over phoneme-, word-, and phrase-scale windows of 20, 50, and 100 frames, self-attentive pooling, a projection head, and tanh/sign binarization. Contrastive learning makes this code insensitive to benign operations and sensitive to malicious ones. The second half of the mechanism is segment-wise watermarking: the audio and fingerprint are each cut into 16 segments, each 16-bit chunk is embedded through an Encodec-style watermark generator adapted from AudioSeal, and the public check is the Hamming distance between the regenerated code and the decoded payload.

What would settle it

Take a watermarked audio clip, apply any malicious operation the paper lists, then re-embed a freshly computed fingerprint using SpeechVerifier's own trained embedder and run the verification rule $d_H(b',\hat{b}) \le \theta$; if the tampered, re-watermarked file is accepted, the paper's central integrity claim is falsified, and the paper reports no experiment for this case.

Watch

Extended reading notes

Core claim

The central claim is that integrity verification can be reduced to a self-consistent bit comparison. The paper builds a binarized utterance fingerprint $b \in \{-1,+1\}^{256}$ whose contrastive training objective pulls benign variants close to the anchor and pushes malicious variants and unrelated utterances apart. At publication time the same $b$ is split into 16 chunks and embedded into the waveform by a watermark encoder; at verification time Path A recomputes $b'$ from the published audio and Path B decodes the embedded $\hat{b}$. The decision $d_H(b',\hat{b}) \le \theta$ with $\theta=42$ accepts or rejects. The paper's experiments show TPR 1.00 and FPR 0.00 for benign operations, and TNR 1.00 and FNR 0.00 for malicious operations on VoxCeleb, with slight degradation but still high AUC on LibriSpeech, and it outperforms passive deepfake detectors when 10 percent to 90 percent of speech is replaced by TTS segments.

Load-bearing premise

The integrity guarantee depends on the trained watermark embedder and the full fingerprint pipeline staying out of attackers' hands, because the paper compares two values both derived from the published audio and never states what an attacker is allowed to know or run.

Editorial extensions

If this is right

  • Any published, watermarked speech can be checked by anyone who has the verifier, with no access to the original recording or an external hash service.
  • Platform-side compression, re-encoding, resampling, and noise suppression do not cause false alarms, so the protection survives normal sharing and redistribution.
  • Semantic and speaker-level edits are rejected even at small alteration ratios, with perfect rejection of deletion, splicing, silencing, substitution, reordering, TTS synthesis, and voice conversion reported on the in-domain test set.
  • Because synthetic TTS segments carry no valid watermark, even 10 percent substitution is detected, a regime where passive deepfake detectors degrade toward chance-level accuracy.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves the attacker model implicit; if the trained embedder were public, an attacker could tamper with a watermarked clip, recompute the fingerprint, and re-embed it, producing a consistent fingerprint-watermark pair that the Hamming-distance test would accept.
  • The 16-segment structure suggests a natural extension to tamper localization by checking each chunk's watermark separately, but the paper only reports whole-file accept or reject decisions.
  • A deployment would also need to bind the fingerprint to a claimed speaker or publication event, since the self-check alone cannot distinguish a legitimately watermarked original from an attacker's own watermarked speech.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. SpeechVerifier proposes a proactive speech-integrity verification pipeline. A wav2vec2.0 encoder followed by a BiLSTM, multiscale pooling, and attentive pooling is trained with a contrastive loss to produce 256-bit binary fingerprints that are intended to be robust to benign operations (compression, resampling, re-encoding, noise suppression) yet sensitive to malicious edits (deletion, splicing, silencing, substitution, reordering, TTS, voice conversion). The fingerprint is embedded into the audio with a segment-wise AudioSeal watermark, and verification compares the fingerprint re-extracted from the published audio against the watermark extracted from the same file via a Hamming-distance threshold. Experiments report near-perfect TPR/TNR on VoxCeleb and LibriSpeech, audio-quality metrics, ablations, and a deepfake-detection comparison against RawNet2 and AASIST.

Significance. If the protocol were sound, the self-contained verification property would be practically valuable, and the cross-domain results (LibriSpeech TPR 0.99, TNR 0.98 in Tables 1-2) plus the detailed implementation and audio-quality evaluation are genuine strengths. However, the central security claim rests on an unstated attacker capability model: the verification path has no secret inputs, and the embedder is a public model. Under the stated public-verification deployment, a re-watermarking attack breaks the scheme. The deepfake comparison is also not apples-to-apples because the substituted segments are unwatermarked. The paper does not ship code or proofs, and the in-domain separation is close to by construction; still, the core idea is salvageable with a keyed watermark and a proper threat model, so I recommend major revision rather than rejection.

major comments (3)
  1. [Section 4.3 and Algorithm 2] The verification decision has no secret input: both b' and b_hat are computed from the published audio, and Section 5.1/B.1 state that the watermark embedder is the publicly downloadable AudioSeal model. Since the fingerprint extractor must also be available to the public for the promised verification by the general public (Section 1, property (1)), an attacker can tamper with X̃ to X_t, compute b_t = sign(F(ε(X_t))) with the public extractor, embed b_t into X_t with the public AudioSeal embedder, and publish the result. Because the fingerprint is trained to be robust to small perturbations (Section 4.2 Step 3) and the watermark perturbation is small, verification on the re-watermarked file will satisfy dH(b', b_hat) ≤ θ. Sections 3-5 never specify an attacker capability model; Section 3.1 only lists parties. This is load-bearing: the claimed self-contained integrity verification cannot distinguish a legitimate published file from a re-watermarked tampered file. The authors must specify a private or keyed embedder or another secret, and evaluate the protocol under that threat model.
  2. [Section 5.4, Table 3] The deepfake detection experiment compares SpeechVerifier against RawNet2 and AASIST on substitutions where the deepfake segments are not watermarked. In SpeechVerifier's dual-path check, the watermark decoder applied to an unwatermarked substitute segment has no embedded payload to recover, so the Hamming distance is large for a reason unrelated to the fingerprint's sensitivity to tampering; the reported TPR=1.00, FPR=0.00 is therefore expected and does not demonstrate superiority as a deepfake detector. A fair comparison requires either watermarking the deepfake substitutes as well, or explicitly framing the comparison as a proactive watermarked pipeline versus passive detectors on unprotected audio.
  3. [Section 4.2, Eq. (1) and Tables 1-2] The in-domain evaluation is close to circular. The contrastive loss in Eq. (1) is exactly 'pull benign variants close and push malicious variants far', and the malicious and benign operations used for testing (Appendix A.2) are the same implementations used to generate training pairs. The reported AUC 1.00 on VoxCeleb therefore largely reflects the training objective rather than generalization to unseen tampering. The LibriSpeech cross-dataset results mitigate dataset overfitting but not operation overfitting, since the same operation scripts are applied. An operation-holdout evaluation (e.g., train without one attack family and test on it, or test on independently implemented codecs and editing tools) is needed to support the generalization claim.
minor comments (6)
  1. [Algorithm 1, line 21] The expression b ← sign(tanh(Proj(AttPool(F(ε(X̃)))))) uses X̃ before it has been constructed; it should be the original X (or the watermarked audio after line 28).
  2. [Abstract and Section 1] The name 'SpeechVerifer' is misspelled in the abstract and in the first sentence of Section 1; please correct it consistently to SpeechVerifier.
  3. [Section 5.1 and Table 6] The same operation is called 'Reencoding' in Table 4 and 'Recoding' in Table 6; please unify the terminology.
  4. [Section 4.2, Steps 1 and 5] The symbol T is used both for the number of frames in Step 1 and for the audio duration in Step 5; please disambiguate the notation.
  5. [Section 5.4 and Table 3] Table 3 changes the meaning of 'positive' to deepfake samples without restating the TP/FP definitions; please add explicit labels so that the metrics are unambiguous.
  6. [Section B.2] Please report confidence intervals or error bars for the TPR/TNR/AUC values, since 500 test utterances give small counts for extreme rates and the EER=0.00 entries would be more informative with variance estimates.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the fingerprint/watermark comparison is not equivalent to its inputs, and there is no load-bearing self-citation chain.

full rationale

SpeechVerifier's claimed derivation chain is self-contained. The fingerprint is trained via the InfoNCE contrastive loss (Eq. 1) to keep benign variants close to the anchor and push tampered and unrelated variants away; Sections 5.1 and 5.2 then measure these properties on held-out utterances from VoxCeleb and LibriSpeech using the operation families of Appendix A.2. Although the operation families overlap with those used to generate training pairs, the test speakers and utterances are unseen, so the AUC/TPR/TNR numbers are empirical generalization measurements rather than logical consequences of the loss definition; a trained model could have failed to separate the operations on new data. The dual-path verification dH(b', b_hat) <= theta compares a fingerprint recomputed from the published audio with a watermark decoded from the same audio; the two codes are not identical by construction, since they come from different channels and diverge under content edits. No load-bearing self-citation appears: the watermark module is the external AudioSeal model, the feature encoder is pretrained wav2vec2.0, and the contrastive loss is standard InfoNCE; no uniqueness theorem or prior work by the present authors is invoked to force the design. The absence of a secret key in Algorithm 2 is a threat-model/security concern (an attacker who can re-run the public embedder can re-watermark edited audio), but that is a correctness risk, not a circular reduction of the claimed result to its inputs.

Assumptions & free parameters 4 free parameters · 4 assumptions · 1 invented entities

The system's headroom comes from imported blocks: wav2vec2 features, AudioSeal watermarking, and the VoxCeleb1/LibriSpeech corpora. The authors add a contrastive fingerprint, a decision threshold, hand-chosen pooling windows, a segment count, and an operation taxonomy. The most consequential assumption is unstated: that attackers cannot recompute and re-embed a fingerprint-watermark pair, which is what turns a watermark-consistency check into a security property. The claimed improvement over prior work should be read net of these choices.

free parameters (4)
  • Decision threshold theta = 42
    Set on development data from public datasets (Section 5.1). The accept/reject boundary of the Hamming-distance rule depends entirely on it; its transfer to other corpora or codecs is not analyzed, and no sensitivity analysis is reported.
  • Multiscale pooling window sizes = 20, 50, 100 frames, stride 10
    Chosen by hand to approximate phoneme-, word-, and phrase-level durations (Appendix A.3). No ablation varies these sizes; the main ablation (Table 9) only removes multiscale pooling entirely.
  • Segment count N and payload size = 16 segments, 256 bits total (16 bits per segment)
    Chosen so AudioSeal's 16-bit payload capacity yields a 256-bit fingerprint (Section 5.1). The capacity-versus-robustness tradeoff of this choice is not explored.
  • Benign and malicious operation parameters = Alteration ratios 0.1, 0.3, 0.5; MP3 128 kbps; 16k to 8k to 16k resampling; +4 semitone pitch shift
    These implementation choices define the operation taxonomy on which all accuracy numbers depend (Appendix A.2); they are made by the authors, and results may not transfer to other attack implementations.
assumptions (4)
  • domain assumption wav2vec2.0 frame features preserve enough local acoustic structure that editing operations at phoneme/word/phrase scale produce detectable changes in pooled representations.
    Invoked in Step 1 and Step 2 (Section 4.2). The entire fingerprint pipeline rests on this; no analysis shows which feature layers are sensitive to which edits.
  • domain assumption AudioSeal's watermark remains decodable under the four benign operations and is corrupted by the listed malicious operations.
    Step 5 (Section 4.2) borrows AudioSeal [26] unmodified. Benign-acceptance and malicious-rejection results both presuppose this robustness profile; the paper reports no dedicated watermark-decoding error analysis per operation.
  • domain assumption A fingerprint trained on VoxCeleb1 speakers with 2-20s utterances transfers to other speakers and datasets (LibriSpeech) and to unseen codecs.
    The cross-domain evaluation (Tables 1 and 2) is the evidence for this; it is assumed for the deployment claim in Section 1 about the general public and social media platforms.
  • ad hoc to paper The attacker modifies the published watermarked audio but cannot recompute or re-embed the fingerprint-watermark pair.
    Unstated in Sections 3-5; the dual-path verification (Section 4.3) compares two codes both derived from the published file, so any party holding the extractor and embedder (which public verification implies) could re-watermark a tampered clip and pass the check.
invented entities (1)
  • Binary acoustic fingerprint carried as a self-contained watermark payload
    purpose: Enables integrity verification using only the published audio, without an original recording or external hash.
    The fingerprint is a learned construct validated only on the paper's own datasets and operation scripts; it makes no externally falsifiable prediction outside the paper's test protocol. Its existence as a useful code is evidenced only by the reported in-paper experiments.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SpeechVerifier: Robust Acoustic Fingerprint against Tampering Attacks via Watermarking." pith.science (2026). https://pith.science/paper/KMA7B5L7

@misc{pith2026250523821,
  author       = {Pith},
  title        = {Pith review of: SpeechVerifier: Robust Acoustic Fingerprint against Tampering Attacks via Watermarking},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KMA7B5L7}},
  note         = {Machine review of arXiv:2505.23821}
}
read the original abstract

With the surge of social media, maliciously tampered public speeches, especially those from influential figures, have seriously affected social stability and public trust. Existing speech tampering detection methods remain insufficient: they either rely on external reference data or fail to be both sensitive to attacks and robust to benign operations, such as compression and resampling. To tackle these challenges, we introduce SpeechVerifer to proactively verify speech integrity using only the published speech itself, i.e., without requiring any external references. Inspired by audio fingerprinting and watermarking, SpeechVerifier can (i) effectively detect tampering attacks, (ii) be robust to benign operations and (iii) verify the integrity only based on published speeches. Briefly, SpeechVerifier utilizes multiscale feature extraction to capture speech features across different temporal resolutions. Then, it employs contrastive learning to generate fingerprints that can detect modifications at varying granularities. These fingerprints are designed to be robust to benign operations, but exhibit significant changes when malicious tampering occurs. To enable speech verification in a self-contained manner, the generated fingerprints are then embedded into the speech signal by segment-wise watermarking. Without external references, SpeechVerifier can retrieve the fingerprint from the published audio and check it with the embedded watermark to verify the integrity of the speech. Extensive experimental results demonstrate that the proposed SpeechVerifier is effective in detecting tampering attacks and robust to benign operations.

Figures

Figures reproduced from arXiv: 2505.23821 by the authors.

Figure 1
Figure 1. System overview of the proposed SpeechVerifier. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Probability distributions: (a) wav2vec embedding similarity to the original audio under [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. A sketch of the proposed SpeechVerifier design including speech fingerprint generation [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (3 more)
Figure 5
Figure 5. Figure 5: t-SNE visualizations of speech samples: (a) before training; (b) after training. 5.4 Comparison with Other Deepfake Detection Methods We finally evaluate SpeechVerifier as a deepfake detector4 . Specifically, we compare SpeechVerifier with state-of-the-art methods incl…
Figure 6
Figure 6. Figure 6: Probability distributions: (a) MFCC embedding similarity to the original audio under [PITH_FULL_IMAGE:figures/full_fig_p014_6.png]
Figure 7
Figure 7. Figure 7: t-SNE visualizations of speech samples (after training). [PITH_FULL_IMAGE:figures/full_fig_p017_7.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

35 extracted references · 28 canonical work pages

  1. [1]

    wav2vec 2.0: A framework for self-supervised learning of speech representations.Advances in Neural Information Processing Systems, 33:12449–12460, 2020

    Alexei Baevski, Yuhao Zhou, Abdelrahman Mohamed, and Michael Auli. wav2vec 2.0: A framework for self-supervised learning of speech representations.Advances in Neural Information Processing Systems, 33:12449–12460, 2020

    2020

  2. [2]

    Unsupervised speech recognition.Advances in Neural Information Processing Systems, 34:27826–27839, 2021

    Alexei Baevski, Wei-Ning Hsu, Alexis Conneau, and Michael Auli. Unsupervised speech recognition.Advances in Neural Information Processing Systems, 34:27826–27839, 2021

    work page 2021

  3. [3]

    Who are you (i really wanna know)? detecting audio {DeepFakes} through vocal tract reconstruction

    Logan Blue, Kevin Warren, Hadi Abdullah, Cassidy Gibson, Luis Vargas, Jessica O’Dell, Kevin Butler, and Patrick Traynor. Who are you (i really wanna know)? detecting audio {DeepFakes} through vocal tract reconstruction. In31st USENIX Security Symposium (USENIX Security 22), pages 2691–2708, 2022

    work page 2022

  4. [4]

    Yourtts: Towards zero-shot multi-speaker tts and zero-shot voice conversion for everyone

    Edresson Casanova, Julian Weber, Christopher D Shulby, Arnaldo Candido Junior, Eren Gölge, and Moacir A Ponti. Yourtts: Towards zero-shot multi-speaker tts and zero-shot voice conversion for everyone. InInternational Conference on Machine Learning, pages 2709–2720. PMLR, 2022

    work page 2022

  5. [5]

    Steven Davis and Paul Mermelstein. Comparison of parametric representations for monosyllabic word recognition in continuously spoken sentences.IEEE Transactions on Acoustics, Speech, and Signal Processing, 28(4):357–366, 1980

    1980

  6. [6]

    Edit detection in speech recordings via instantaneous electric network frequency variations.IEEE Transactions on Information F orensics and Security, 9(12):2314–2326, 2014

    Paulo Antonio Andrade Esquef, José Antonio Apolinário, and Luiz WP Biscainho. Edit detection in speech recordings via instantaneous electric network frequency variations.IEEE Transactions on Information F orensics and Security, 9(12):2314–2326, 2014

    work page 2014

  7. [7]

    Exploring wav2vec 2.0 on speaker verification and language identification

    Zhiyun Fan, Meng Li, Shiyu Zhou, and Bo Xu. Exploring wav2vec 2.0 on speaker verification and language identification. InProc. Interspeech 2021, pages 1509–1513, 2021

    work page 2021

  8. [8]

    Proactive detection of speaker identity manipulation with neural watermarking

    Wanying Ge, Xin Wang, and Junichi Yamagishi. Proactive detection of speaker identity manipulation with neural watermarking. InThe 1st Workshop on GenAI Watermarking, 2025. 18

    work page 2025

Show all 35 references
  1. [9]

    Make-an-audio: Text-to-audio generation with prompt-enhanced diffusion models

    Rongjie Huang, Jiawei Huang, Dongchao Yang, Yi Ren, Luping Liu, Mingze Li, Zhenhui Ye, Jinglin Liu, Xiang Yin, and Zhou Zhao. Make-an-audio: Text-to-audio generation with prompt-enhanced diffusion models. InInternational Conference on Machine Learning, pages 13916–13932. PMLR, 2023

    2023

  2. [10]

    Aasist: Audio anti-spoofing using integrated spectro-temporal graph attention networks

    Jee-weon Jung, Hee-Soo Heo, Hemlata Tak, Hye-jin Shim, Joon Son Chung, Bong-Jin Lee, Ha-Jin Yu, and Nicholas Evans. Aasist: Audio anti-spoofing using integrated spectro-temporal graph attention networks. InICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and...

    2022

  3. [11]

    V oice spoofing countermeasures: Taxonomy, state-of-the-art, experimental analysis of generalizability, open challenges, and the way forward.arXiv preprint arXiv:2210.00417, 2022

    Awais Khan, Khalid Mahmood Malik, James Ryan, and Mikul Saravanan. V oice spoofing countermeasures: Taxonomy, state-of-the-art, experimental analysis of generalizability, open challenges, and the way forward.arXiv preprint arXiv:2210.00417, 2022

    arXiv

  4. [12]

    Audio splicing detection and localization based on acquisition device traces

    Daniele Ugo Leonzio, Luca Cuccovillo, Paolo Bestagini, Marco Marcon, Patrick Aichroth, and Stefano Tubaro. Audio splicing detection and localization based on acquisition device traces. IEEE Transactions on Information F orensics and Security, 18:4157–4172, 2023

    2023

  5. [13]

    A structured self-attentive sentence embedding.arXiv preprint arXiv:1703.03130, 2017

    Zhouhan Lin, Minwei Feng, Cicero Nogueira dos Santos, Mo Yu, Bing Xiang, Bowen Zhou, and Yoshua Bengio. A structured self-attentive sentence embedding.arXiv preprint arXiv:1703.03130, 2017

    2017 arXiv

  6. [14]

    CRC press, 2018

    Alfred J Menezes, Paul C Van Oorschot, and Scott A Vanstone.Handbook of applied cryptog- raphy. CRC press, 2018

    2018

  7. [15]

    V oxceleb: A large-scale speaker identification dataset.Interspeech 2017, 2017

    Arsha Nagrani, Joon Son Chung, and Andrew Zisserman. V oxceleb: A large-scale speaker identification dataset.Interspeech 2017, 2017

    2017

  8. [16]

    Wavenet: A generative model for raw audio.arXiv preprint arXiv:1609.03499, 2016

    Aaron van den Oord, Sander Dieleman, Heiga Zen, Karen Simonyan, Oriol Vinyals, Alex Graves, Nal Kalchbrenner, Andrew Senior, and Koray Kavukcuoglu. Wavenet: A generative model for raw audio.arXiv preprint arXiv:1609.03499, 2016

    2016 arXiv

  9. [17]

    Representation learning with contrastive predictive coding.arXiv preprint arXiv:1807.03748, 2018

    Aaron van den Oord, Yazhe Li, and Oriol Vinyals. Representation learning with contrastive predictive coding.arXiv preprint arXiv:1807.03748, 2018

    2018 arXiv

  10. [18]

    Detecting splicing in digital audios using local noise level estimation

    Xunyu Pan, Xing Zhang, and Siwei Lyu. Detecting splicing in digital audios using local noise level estimation. In2012 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 1841–1844. IEEE, 2012

    2012

  11. [19]

    Librispeech: an asr corpus based on public domain audio books

    Vassil Panayotov, Guoguo Chen, Daniel Povey, and Sanjeev Khudanpur. Librispeech: an asr corpus based on public domain audio books. In2015 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 5206–5210. IEEE, 2015

  12. [20]

    Deep voice 3: Scaling text-to-speech with convolutional sequence learning

    Wei Ping, Kainan Peng, Andrew Gibiansky, Sercan O Arik, Ajay Kannan, Sharan Narang, Jonathan Raiman, and John Miller. Deep voice 3: Scaling text-to-speech with convolutional sequence learning. InInternational Conference on Learning Representations, 2018

    2018

  13. [21]

    Ai is spawning a flood of fake trump and harris voices

    The Washington Post. Ai is spawning a flood of fake trump and harris voices. https://www.washingtonpost.com/technology/interactive/2024/ ai-voice-detection-trump-harris-deepfake-election/ , 2024. Accessed: 2025-04- 22

    2024

  14. [22]

    Authenticity verification of audio signals based on fragile watermarking for audio forensics.Expert systems with applications, 91:211–222, 2018

    Diego Renza, Camilo Lemus, et al. Authenticity verification of audio signals based on fragile watermarking for audio forensics.Expert systems with applications, 91:211–222, 2018

    2018

  15. [23]

    Fact check: Video does not show joe biden making trans- phobic remarks

    Reuters. Fact check: Video does not show joe biden making trans- phobic remarks. https://www.reuters.com/article/fact-check/ video-does-not-show-joe-biden-making-transphobic-remarks-idUSL1N34Q1IW/ ,

  16. [24]

    Perceptual evaluation of speech quality (pesq)-a new method for speech quality assessment of telephone networks and codecs

    Antony W Rix, John G Beerends, Michael P Hollier, and Andries P Hekstra. Perceptual evaluation of speech quality (pesq)-a new method for speech quality assessment of telephone networks and codecs. In2001 IEEE International Conference on Acoustics, Speech, and Signal Processing...

    2001

  17. [25]

    Audio authenticity: Detecting enf discontinuity with high precision phase analysis

    Daniel Patricio Nicolalde Rodríguez, José Antonio Apolinario, and Luiz Wagner Pereira Bis- cainho. Audio authenticity: Detecting enf discontinuity with high precision phase analysis. IEEE Transactions on Information F orensics and Security, 5(3):534–543, 2010

    2010

  18. [26]

    Proactive detection of voice cloning with localized watermarking

    Robin San Roman, Pierre Fernandez, Hady Elsahar, Alexandre Défossez, Teddy Furon, and Tuan Tran. Proactive detection of voice cloning with localized watermarking. InProceedings of the 41st International Conference on Machine Learning, pages 43180–43196, 2024

    2024

  19. [27]

    Watermarking-based digital audio data authentication

    Martin Steinebach and Jana Dittmann. Watermarking-based digital audio data authentication. EURASIP Journal on Advances in Signal Processing, 2003:1–15, 2003

    2003

  20. [28]

    A short-time objective intelligibility measure for time-frequency weighted noisy speech

    Cees H Taal, Richard C Hendriks, Richard Heusdens, and Jesper Jensen. A short-time objective intelligibility measure for time-frequency weighted noisy speech. In2010 IEEE International Conference on Acoustics, Speech and Signal Processing, pages 4214–4217. IEEE, 2010

    2010

  21. [29]

    End-to-end anti-spoofing with rawnet2

    Hemlata Tak, Jose Patino, Massimiliano Todisco, Andreas Nautsch, Nicholas Evans, and Anthony Larcher. End-to-end anti-spoofing with rawnet2. InICASSP 2021-2021 IEEE Interna- tional Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 6369–6373. IEEE, 2021

    2021

  22. [30]

    Audit: Audio editing by following instructions with latent diffusion models.Advances in Neural Information Processing Systems, 36:71340–71357, 2023

    Yuancheng Wang, Zeqian Ju, Xu Tan, Lei He, Zhizheng Wu, Jiang Bian, et al. Audit: Audio editing by following instructions with latent diffusion models.Advances in Neural Information Processing Systems, 36:71340–71357, 2023

    2023

  23. [31]

    Tacotron: Towards end-to-end speech synthesis.Interspeech 2017, page 4006, 2017

    Yuxuan Wang, RJ Skerry-Ryan, Daisy Stanton, Yonghui Wu, Ron J Weiss, Navdeep Jaitly, Zongheng Yang, Ying Xiao, Zhifeng Chen, Samy Bengio, et al. Tacotron: Towards end-to-end speech synthesis.Interspeech 2017, page 4006, 2017

    2017

  24. [32]

    Asvspoof 2021: accelerating progress in spoofed and deepfake speech detection.arXiv preprint arXiv:2109.00537, 2021

    Junichi Yamagishi, Xin Wang, Massimiliano Todisco, Md Sahidullah, Jose Patino, Andreas Nautsch, Xuechen Liu, Kong Aik Lee, Tomi Kinnunen, Nicholas Evans, et al. Asvspoof 2021: accelerating progress in spoofed and deepfake speech detection.arXiv preprint arXiv:2109.00537, 2021

    2021 arXiv

  25. [33]

    Detecting digital audio forgeries by checking frame offsets

    Rui Yang, Zhenhua Qu, and Jiwu Huang. Detecting digital audio forgeries by checking frame offsets. InProceedings of the 10th ACM Workshop on Multimedia and Security, pages 21–26, 2008

    2008

  26. [34]

    Digital multimedia audio forensics: past, present and future.Multimedia Tools and Applications, 77:1009–1040, 2018

    Mohammed Zakariah, Muhammad Khurram Khan, and Hafiz Malik. Digital multimedia audio forensics: past, present and future.Multimedia Tools and Applications, 77:1009–1040, 2018. 20

    2018

  27. [2023]

    Accessed: 2025-04-22

    2025

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.