Pith. sign in

REVIEW 5 major objections 4 minor 42 references

SHIELD: A Secure and Highly Enhanced Integrated Learning for Robust Deepfake Detection against Adversarial Attacks

T0 review · 5 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read SHIELD proposes a defense generator and triplet model that keeps audio deepfake detection above 98% accuracy under GAN-based anti-forensic attacks.

desk verdict SHIELD offers a plausible new defense idea for GAN-based anti-forensic attacks on audio deepfake detectors, but the headline numbers outrun the evidence: the 'mismatch' setting is a closed set of three known GANs, and the correlation premise at the core of the method is never measured. read the letter →

arxiv 2507.13170 v1 pith:2WC7YW6U submitted 2025-07-17 cs.SD cs.AIcs.CRcs.LGeess.AS

Kutub Uddin , Awais Khan , Muhammad Umar Farooq , Khalid Malik This is my paper · ORCID
classification cs.SDcs.AIcs.CRcs.LGeess.AS
keywords audiodeepfakedetectionanti-forensicattacksgenerativeadversarialnetworksdefensemodeltripletlearningcollaborativerobustnessvoicespoofing
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

SHIELD claims that adding a defense generative model in front of an audio deepfake detector exposes the trace left by GAN-based anti-forensic attacks, so that a detector can keep working even when an attacker has deliberately corrupted the fake audio. On three benchmark datasets, the paper shows that seven baseline detectors drop from roughly 95–99% accuracy to as low as 38–49% under three GAN attacks, while SHIELD holds match-setting accuracy at 98.13%, 98.58%, and 99.57%, and mismatch-setting accuracy at 98.78%, 98.62%, and 98.85%. The reason to care is practical: if SHIELD works as claimed, voice authentication and media-integrity systems have a defense against transferable generative attacks, not just against visible perturbations.

What carries the argument

The load-bearing machinery is the defense generator $G_D$ together with the triplet network. $G_D$ maps real audio $A_r$ to $A'_r = G_D(A_r)$ and attacked audio $A_{ad}$ to $A'_{ad} = G_D(A_{ad})$; the system concatenates the pairs $A_r A'_r$ and $A_{ad} A'_{ad}$ and trains a triplet model with margin ranking loss on them. The method relies on the hypothesis that the correlation between $A_r$ and $A'_r$ is low while the correlation between $A_{ad}$ and $A'_{ad}$ is high, because attacked audio and its reconstruction share generative signatures. The AF generator used for the attacks is trained with perceptual, adversarial, and surrogate losses against an ensemble of detectors.

What would settle it

Take any held-out split, compute the correlation or embedding distance between each input and its defense-generated reconstruction for real versus attacked audio, and check that the two distributions separate. Alternatively, ablate the defense generator and train the triplet model on the unpaired originals; if SHIELD's accuracy survives that ablation, the defense generator is not doing the claimed work.

Watch

Extended reading notes

Core claim

The paper's central claim is that running both real and GAN-attacked audio through a second generative model, the defense generator, exposes the attack's signature. Real audio and its reconstruction are asserted to be dissimilar, since the reconstruction carries the defense generator's own signature, while attacked audio and its reconstruction are asserted to be similar, since both carry generative signatures. The system concatenates each input with its reconstruction and trains a triplet network on those pairs, which recovers detection accuracy to 98% or higher on ASVspoof2019, In-the-Wild, and HalfTruth in both match settings, where attack and defense use the same generator, and mismatch settings, where they use different generators.

Load-bearing premise

The method stands on the assumption that real audio and its defense-generated reconstruction are consistently less correlated than attacked audio and its reconstruction; if that correlation gap is absent or flips, the concatenated pairs carry no reliable signal for distinguishing the two classes.

Editorial extensions

If this is right

  • On the three tested datasets, SHIELD keeps average accuracy above 98% against all three GAN attacks in both match and mismatch settings, whereas the same detectors fall below 60% on several attack-dataset pairs.
  • SHIELD improves over three earlier defense methods by roughly 13 to 45 percentage points in average detection accuracy on each dataset.
  • The mismatch results mean that a detector built this way does not need to know the exact GAN that produced the attack to remain effective across the three tested generators.
  • Because the attack transferred across seven baseline detectors and three datasets, the paper's implication is that the defense targets the general failure mode of generative AF attacks rather than one detector's specific weakness.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural next test, which the paper does not run, is to train the defense generator on only one or two GAN families and test against a fourth, held-out generative model family; the mismatch results suggest but do not prove such transfer.
  • If the correlation hypothesis holds more broadly, the same defense architecture could be applied to image or video deepfake detectors by replacing the audio generative model with a corresponding image or video model.
  • The paper reports only accuracy; measuring equal-error rate, calibration, or false-accept versus false-reject rates under attack would clarify whether the high accuracy reflects balanced detection or a bias toward one class.
  • The defense generator itself is a reusable component: the same $G_D$ could be swapped into existing detection pipelines without retraining the underlying deepfake detector, assuming the embedding network is kept.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 4 minor

Summary. The paper proposes SHIELD, a collaborative-learning defense for audio deepfake detection (ADD) against GAN-based anti-forensic (AF) attacks. SHIELD inserts a defense generative model (G_D) before the ADD stage, concatenates each input with its G_D reconstruction, applies a triplet model to embed the concatenated pairs, and trains a fully connected classifier on the embeddings. The authors evaluate on ASVspoof2019, In-the-Wild, and HalfTruth using three GAN attack generators (G1=UNet, G2=SEGAN, G3=OPGAN), reporting average accuracies of 98.13%/98.58%/99.57% in the match setting and 98.78%/98.62%/98.85% in the mismatch setting, compared with large accuracy drops for seven baseline ADD systems under the same attacks.

Significance. If the reported robustness transfers beyond the three attack generators tested, SHIELD would be a useful contribution to a relatively understudied problem: defending audio deepfake detectors against generative anti-forensic attacks. The paper is one of the first to target this specific threat model, and the attack evaluation in Table 1 is a useful vulnerability study for seven baselines across three datasets. However, the central claims currently rest on a single unmeasured correlation premise, a closed-set mismatch evaluation, and single-run accuracy numbers with no error bars or ablation controls. These gaps prevent the paper from supporting its stated conclusions as written.

major comments (5)
  1. [Section 3.1, Eqs. (2)-(3)] The load-bearing premise of SHIELD is that correlation between real audio Ar and its defense reconstruction A'_r is low, while correlation between attacked audio Aad and its reconstruction A'_ad is high because 'they share similar signatures.' This premise is asserted without any measurement or proof, and it is never isolated by an ablation that removes the defense generator. Since the classifier is trained on the concatenated pairs ArA'_r and AadA'_ad, all reported accuracy in Tables 2 and 3 depends on this premise. Please provide empirical correlation distributions for real and attacked samples, and add ablations that (i) classify Ar and Aad directly without G_D and (ii) replace the triplet model with a direct classifier on the concatenated features, so that the improvement can be attributed to the proposed collaborative mechanism.
  2. [Section 4.3.1, Table 3] The 'mismatch' setting is a closed set of six directed pairs among three architectures (G1, G2, G3), both of whose members are known during training. Section 4.2 states that training data from all three datasets are combined, so the model plausibly has access to all three attack families. This does not support the abstract's claim of robustness against 'transferable generative AF attacks.' Add a leave-one-out experiment in which one GAN family is withheld from all training (G_D, triplet model, and final classifier) and is used only to generate test attacks. If accuracy degrades in that setting, the transferability claim should be softened.
  3. [Section 3.2.2] The paper describes training losses for the attack generator G_A (Eqs. 4-8) but does not describe how the defense generator G_D is trained, which architecture it uses, or whether it shares weights with G_A. This is a reproducibility gap because G_D is the component that is supposed to expose AF signatures. Please specify G_D's architecture, objective function, training data, and any relationship to G1/G2/G3; without this, readers cannot reproduce or test the method.
  4. [Tables 2 and 3] All reported results are single-run aggregate accuracies with no error bars, confidence intervals, or significance tests. Since the headline differences (e.g., 30-45 point gains over the Table 4 baselines) could be affected by training variance, report the mean and standard deviation over at least three random seeds, and provide a statistical test for the main comparisons against the baselines.
  5. [Section 4.3.2] There is no comparison with a simpler defense, such as fine-tuning RawNet3 on AF-attacked samples. The attack drops RawNet3 to very low accuracies in some cells (e.g., 0.32 on ASVspoof2019 with G1), so a detector that simply retrains on the attacked distribution might recover much of the lost accuracy without G_D or the triplet model. Without this control, the reported gains cannot be attributed to collaborative learning. Add this baseline and report its match and mismatch results.
minor comments (4)
  1. [Eq. (11)] The margin ranking loss uses an unspecified y variable and sets margin m=0; clarify how anchors, positives, and negatives are sampled and why a zero margin is sufficient for the triplet model to learn discriminative embeddings.
  2. [Eq. (5)] Equation (5) uses A'_d, which is not defined anywhere; it should likely be A'_ad (the reconstruction of the attacked deepfake). Please correct the notation.
  3. [Abstract] The sentence 'The proposed AF significantly reduces the average detection accuracy...' reads as if the proposed method itself reduces accuracy; it should say the proposed AF attack or 'the proposed generative AF attack.'
  4. [Section 4.3.3] Table 4 compares with SENet, LCNN, and ABC-CapsNet, but the text does not describe how these defense mechanisms were implemented or trained for the AF setting. Provide protocol details or a citation to the exact configuration used.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the accuracy claims are empirical benchmark measurements, and no load-bearing step reduces to its own inputs.

full rationale

The central claim is an empirical robustness result measured on standard external benchmarks (ASVspoof2019, In-the-Wild, HalfTruth) with seven published baseline detectors. The match and mismatch accuracies in Tables 2 and 3 are obtained by training the triplet model and classifier on ground-truth-labeled pairs and testing on held-out portions; they are not computed from a fitted parameter or from the paper's assumptions, so they could in principle fail. The Section 3.1 correlation premise is asserted rather than measured and is never isolated by an ablation, but it is an unproven assumption rather than a circular one: the labels used for training come from the original real/fake ground truth, not from the asserted low/high correlation values. The mismatch evaluation is limited because it exhaustively tests six directed pairs among three fixed GAN architectures and therefore does not establish transferability to unseen generators; this is an external-validity gap, not a reduction of the output to the input. Self-citations (Refs. [27,28,29,32]) supply the AF attack-generation recipe; the defense result is not shown to be forced by those citations. No equation or definition in the paper equates a predicted quantity with a fitted input by construction.

Assumptions & free parameters 3 free parameters · 4 assumptions · 2 invented entities

The framework rests on a small number of hand-chosen hyperparameters and on three unproven domain assumptions: the correlation hypothesis, the representativeness of the three attack GANs, and the validity of the combined-training evaluation protocol. The defense generative model and the shared AF signature are introduced without independent evidence, making the empirical result hard to separate from the authors' own pipeline.

free parameters (3)
  • Triplet loss margin m = 0
    Set by hand in Sec 3.2.3 (Eq. 11) with no sensitivity analysis; it directly controls the required separation between positive and negative pairs.
  • Model training epochs = 50 for ADD and triplet, 30 for GANs
    Chosen as yielding the best performance in Sec 4.2; no early stopping or search details are given.
  • Learning rates and batch sizes = 0.0001; batch 256 for ADD, 32 for GAN and triplet
    Hand-chosen in Sec 4.2; no ablation or sensitivity study is reported.
assumptions (4)
  • ad hoc to paper The defense-generator correlation hypothesis: real audio and its G_D reconstruction have low correlation, while attacked audio and its G_D reconstruction have high correlation because they share generative signatures.
    Stated in Sec 3.1 without proof, measurement, or ablation; the SHIELD pipeline depends on this premise.
  • domain assumption The three fine-tuned GANs (UNet, SEGAN, OPGAN) are representative of transferable generative AF attacks.
    The abstract concludes robustness across 'various generative models' from evaluations with only these three GAN families; no broader attack zoo is tested.
  • domain assumption Combining the training partitions of ASVspoof2019, In-the-Wild, and HalfTruth and testing on their remaining partitions is a valid generalization protocol.
    Sec 4.2 states the data was combined to improve generalization but does not document the exact split or rule out overlap between training and test subsets.
  • domain assumption RawNet3 embeddings, after concatenation of original and reconstructed audio, preserve the correlation signal needed for triplet separation.
    RawNet3 is chosen for its high baseline accuracy (Sec 4.3.2), but the paper does not show that pair concatenation retains the hypothesized low versus high correlation structure.
invented entities (2)
  • Defense generative model (G_D)
    purpose: Reconstructs real and attacked audio so the detector can classify concatenated original-reconstruction pairs.
    Introduced by the authors as the core of SHIELD; the paper provides no external evidence that its reconstructions expose transferable AF signatures.
  • Shared generative AF signature
    purpose: The hypothesized common artifact shared by attacked audio and its defense-generated reconstruction, which the triplet model is supposed to exploit.
    Never measured or falsifiably specified; it is the conceptual load of Sec 3.1 and is asserted rather than demonstrated.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SHIELD: A Secure and Highly Enhanced Integrated Learning for Robust Deepfake Detection against Adversarial Attacks." pith.science (2026). https://pith.science/paper/2WC7YW6U

@misc{pith2026250713170,
  author       = {Pith},
  title        = {Pith review of: SHIELD: A Secure and Highly Enhanced Integrated Learning for Robust Deepfake Detection against Adversarial Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2WC7YW6U}},
  note         = {Machine review of arXiv:2507.13170}
}
read the original abstract

Audio plays a crucial role in applications like speaker verification, voice-enabled smart devices, and audio conferencing. However, audio manipulations, such as deepfakes, pose significant risks by enabling the spread of misinformation. Our empirical analysis reveals that existing methods for detecting deepfake audio are often vulnerable to anti-forensic (AF) attacks, particularly those attacked using generative adversarial networks. In this article, we propose a novel collaborative learning method called SHIELD to defend against generative AF attacks. To expose AF signatures, we integrate an auxiliary generative model, called the defense (DF) generative model, which facilitates collaborative learning by combining input and output. Furthermore, we design a triplet model to capture correlations for real and AF attacked audios with real-generated and attacked-generated audios using auxiliary generative models. The proposed SHIELD strengthens the defense against generative AF attacks and achieves robust performance across various generative models. The proposed AF significantly reduces the average detection accuracy from 95.49% to 59.77% for ASVspoof2019, from 99.44% to 38.45% for In-the-Wild, and from 98.41% to 51.18% for HalfTruth for three different generative models. The proposed SHIELD mechanism is robust against AF attacks and achieves an average accuracy of 98.13%, 98.58%, and 99.57% in match, and 98.78%, 98.62%, and 98.85% in mismatch settings for the ASVspoof2019, In-the-Wild, and HalfTruth datasets, respectively.

Figures

Figures reproduced from arXiv: 2507.13170 by the authors.

Figure 1
Figure 1. Conceptual overview of the traditional ADD, AF at [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Proposed SHIELD architecture: (a) The deepfake au [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Training strategy of GAN-based models for generating [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Spectrogram visualization of deepfake and corresponding attacked samples generated by [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: t-SNE visualization of embeddings for HalfTruth [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

42 extracted references · 39 canonical work pages

  1. [1]

    Audio inpainting with gen- erative adversarial network

    Pirmin P Ebner and Amr Eltelt. Audio inpainting with gen- erative adversarial network. Audio and Speech Processing ,

    work page

  2. [2]

    Securing Social Media Against Deepfakes using Identity, Behavioral, and Geometric Signatures

    Muhammad Umar Farooq, Awais Khan, Ijaz Ul Haq, and Khalid Mahmood Malik. Securing social media against deepfakes using identity, behavioral, and geometric signa- tures. arXiv preprint arXiv:2412.05487, 2024. 2

    work page Pith review arXiv 2024

  3. [3]

    A Lightweight and Interpretable Deepfakes Detection Framework

    Muhammad Umar Farooq, Ali Javed, Khalid Mahmood Ma- lik, and Muhammad Anas Raza. A lightweight and in- terpretable deepfakes detection framework. arXiv preprint arXiv:2501.11927, 2025. 2

    work page Pith review arXiv 2025

  4. [4]

    What Does an Audio Deepfake Detector Focus on? A Study in the Time Domain

    Petr Grinberg, Ankur Kumar, Surya Koppisetti, and Gaurav Bharaj. What does an audio deepfake detector focus on? a study in the time domain. arXiv preprint arXiv:2501.13887,

    work page Pith review arXiv

  5. [5]

    Deep metric learning using triplet network

    Elad Hoffer and Nir Ailon. Deep metric learning using triplet network. In Similarity-based pattern recognition: third inter- national workshop, SIMBAD 2015, Copenhagen, Denmark, 8 October 12-14, 2015. Proceedings 3, pages 84–92. Springer,

    work page 2015

  6. [6]

    Holmes: health online model ensemble serving for deep learning models in intensive care units

    Shenda Hong, Yanbo Xu, Alind Khare, Satria Priambada, Kevin Maher, Alaa Aljiffry, Jimeng Sun, and Alexey Tu- manov. Holmes: health online model ensemble serving for deep learning models in intensive care units. In Proceed- ings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pages 1614–1624,

    work page

  7. [7]

    To- wards end-to-end synthetic speech detection

    Guang Hua, Andrew Beng Jin Teoh, and Haijian Zhang. To- wards end-to-end synthetic speech detection. IEEE Signal Processing Letters, 28:1265–1269, 2021. 2, 6, 7

    work page 2021

  8. [8]

    Ibm unveils ai model to detect deepfakes in media,

    IBM. Ibm unveils ai model to detect deepfakes in media,

    work page

Show all 42 references
  1. [9]

    Blind restoration of real-world audio by 1d operational gans

    Turker Ince, Serkan Kiranyaz, Ozer Can Devecioglu, Muhammad Salman Khan, Muhammad Chowdhury, and Moncef Gabbouj. Blind restoration of real-world audio by 1d operational gans. arXiv preprint arXiv:2212.14618, 2022. 7

    2022 arXiv

  2. [10]

    Pushing the limits of raw waveform speaker recognition

    Jee-weon Jung, You Jin Kim, Hee-Soo Heo, Bong-Jin Lee, Youngki Kwon, and Joon Son Chung. Pushing the limits of raw waveform speaker recognition. Proc. Interspeech, 2022. 6, 7, 8

    2022

  3. [11]

    Defense against adversarial attacks on audio deepfake detection.Interspeech,

    Piotr Kawa, Marcin Plata, and Piotr Syga. Defense against adversarial attacks on audio deepfake detection.Interspeech,

  4. [12]

    Bridging the spoof gap: A unified parallel aggregation network for voice presen- tation attacks, 2023

    Awais Khan and Khalid Mahmood Malik. Bridging the spoof gap: A unified parallel aggregation network for voice presen- tation attacks, 2023. 1

    2023

  5. [13]

    Securing voice biometrics: One-shot learning approach for audio deepfake detection

    Awais Khan and Khalid Mahmood Malik. Securing voice biometrics: One-shot learning approach for audio deepfake detection. In 2023 IEEE International Workshop on Informa- tion Forensics and Security (WIFS), pages 1–6. IEEE, 2023. 2

    2023

  6. [14]

    Spotnet: A spoofing-aware transformer network for effective synthetic speech detection

    Awais Khan and Khalid Mahmood Malik. Spotnet: A spoofing-aware transformer network for effective synthetic speech detection. In Proceedings of the 2nd ACM Interna- tional Workshop on Multimedia AI against Disinformation , pages 10–18, 2023. 2, 3

    2023

  7. [15]

    Battling voice spoofing: a review, com- parative analysis, and generalizability evaluation of state-of- the-art voice spoofing counter measures

    Awais Khan, Khalid Mahmood Malik, James Ryan, and Mikul Saravanan. Battling voice spoofing: a review, com- parative analysis, and generalizability evaluation of state-of- the-art voice spoofing counter measures. Artificial Intelli- gence Review, 56(Suppl 1):513–566, 2023. 1

    2023

  8. [16]

    Frame-to-utterance convergence: A spectra-temporal ap- proach for unified spoofing detection

    Awais Khan, Khalid Mahmood Malik, and Shah Nawaz. Frame-to-utterance convergence: A spectra-temporal ap- proach for unified spoofing detection. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 10761–10765. IEEE,

    2024

  9. [17]

    Ro- bust deepfake audio detection via bi-level optimization

    Menglu Li, Yasaman Ahmadiadli, and Xiao-Ping Zhang. Ro- bust deepfake audio detection via bi-level optimization. In 2023 IEEE 25th International Workshop on Multimedia Sig- nal Processing (MMSP), pages 1–6, 2023. 3

    2023

  10. [18]

    Safeear: Content privacy-preserving audio deepfake detection

    Xinfeng Li, Kai Li, Yifan Zheng, Chen Yan, Xiaoyu Ji, and Wenyuan Xu. Safeear: Content privacy-preserving audio deepfake detection. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Se- curity, pages 3585–3599, 2024. 3

    2024

  11. [19]

    De- tecting deepfake voice using explainable deep learning tech- niques

    Suk-Young Lim, Dong-Kyu Chae, and Sang-Chul Lee. De- tecting deepfake voice using explainable deep learning tech- niques. Applied Sciences, 12(8):3926, 2022. 3

    2022

  12. [20]

    Does audio deep- fake detection generalize? Interspeech, 2022

    Nicolas M M ¨uller, Pavel Czempin, Franziska Dieckmann, Adam Froghyar, and Konstantin B¨ottinger. Does audio deep- fake detection generalize? Interspeech, 2022. 6

    2022

  13. [21]

    Segan: Speech enhancement generative adversarial network

    Santiago Pascual, Antonio Bonafonte, and Joan Serra. Segan: Speech enhancement generative adversarial network. Interspeech, 2017. 7

    2017

  14. [22]

    Audio-deepfake detection: Adversarial attacks and counter- measures

    Mouna Rabhi, Spiridon Bakiras, and Roberto Di Pietro. Audio-deepfake detection: Adversarial attacks and counter- measures. Expert Systems with Applications , 250:123941,

  15. [23]

    Defending against voice-based deepfake fraud attacks, 2024

    Reality Defender. Defending against voice-based deepfake fraud attacks, 2024. Accessed: 2025-06-03. 2

    2024

  16. [24]

    End-to-end anti-spoofing with rawnet2

    Hemlata Tak, Jose Patino, Massimiliano Todisco, Andreas Nautsch, Nicholas Evans, and Anthony Larcher. End-to-end anti-spoofing with rawnet2. In ICASSP 2021-2021 IEEE In- ternational Conference on Acoustics, Speech and Signal Pro- cessing (ICASSP), pages 6369–6373. IEEE, 2021. ...

    2021

  17. [25]

    Rawboost: A raw data boost- ing and augmentation method applied to automatic speaker verification anti-spoofing

    Hemlata Tak, Madhu Kamble, Jose Patino, Massimiliano Todisco, and Nicholas Evans. Rawboost: A raw data boost- ing and augmentation method applied to automatic speaker verification anti-spoofing. In IEEE International Conference on Acoustics, Speech and Signal Processing (ICASS...

    2022

  18. [26]

    Asvspoof 2019: Future horizons in spoofed and fake audio detection

    Massimiliano Todisco, Xin Wang, Ville Vestman, Md Sahidullah, H´ector Delgado, Andreas Nautsch, Junichi Yam- agishi, Nicholas Evans, Tomi Kinnunen, and Kong Aik Lee. Asvspoof 2019: Future horizons in spoofed and fake audio detection. arXiv preprint arXiv:1904.05441, 2019. 6

    2019 arXiv

  19. [27]

    Enhanced adversarial attack for avoidance of fake image detection

    Kutub Uddin and Byung Tae Oh. Enhanced adversarial attack for avoidance of fake image detection. Journal of Broadcast Engineering, 28(7):859–866, 2023. 5

    2023

  20. [28]

    Anti- forensic against double jpeg compression detection using adversarial generative network

    Kutub Uddin, Yoonmo Yang, and Byung Tae Oh. Anti- forensic against double jpeg compression detection using adversarial generative network. In Proceedings of the Ko- rean Society of Broadcast Engineers Conference, pages 58–

  21. [29]

    Analysis of generative adversarial network targeting anti-forensic in jpeg compressed domain

    Kutub Uddin, Yoonmo Yang, and Byung Tae Oh. Analysis of generative adversarial network targeting anti-forensic in jpeg compressed domain. In International Workshop on Ad- vanced Imaging Technology (IWAIT) 2021, pages 627–631. SPIE, 2021. 4

    2021

  22. [30]

    A robust open-set multi-instance learning for defending adversarial attacks in digital image

    Kutub Uddin, Yoonmo Yang, Tae Hyun Jeong, and Byung Tae Oh. A robust open-set multi-instance learning for defending adversarial attacks in digital image. IEEE Trans- actions on Information Forensics and Security, 2023. 2

    2023

  23. [31]

    Deep learning-based counter anti-forensic of gan-based attack in hevc compressed domain using coding pattern analysis

    Kutub Uddin, Yoonmo Yang, and Byung Tae Oh. Deep learning-based counter anti-forensic of gan-based attack in hevc compressed domain using coding pattern analysis. Ex- pert Systems with Applications, 233:120912, 2023. 2

    2023

  24. [32]

    Transferable adversarial attacks on 9 audio deepfake detection

    Muhammad Umar Farooq, Awais Khan, Kutub Uddin, and Khalid Mahmood Malik. Transferable adversarial attacks on 9 audio deepfake detection. arXiv e-prints, pages arXiv–2501,

  25. [33]

    Csi-net: Unified body characterization and action recognition

    Fei Wang, Jinsong Han, Shiyuan Zhang, Xu He, and Dong Huang. Csi-net: Unified body characterization and action recognition. arXiv preprint arXiv:1810.03064, 2018. 6, 7

    2018 arXiv

  26. [34]

    Abc- capsnet: Attention-based cascaded capsule network for au- dio deepfake detection

    Taiba Majid Wani, Reeva Gulzar, and Irene Amerini. Abc- capsnet: Attention-based cascaded capsule network for au- dio deepfake detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 2464–2472, 2024. 7, 8

    2024

  27. [35]

    Defense against adversarial attacks on spoofing countermea- sures of asv

    Haibin Wu, Songxiang Liu, Helen Meng, and Hung-yi Lee. Defense against adversarial attacks on spoofing countermea- sures of asv. In ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 6564–6568. IEEE, 2020. 2, 7, 8

    2020

  28. [36]

    Clad: Ro- bust audio deepfake detection against manipulation attacks with contrastive learning

    Haolin Wu, Jing Chen, Ruiying Du, Cong Wu, Kun He, Xingcan Shang, Hao Ren, and Guowen Xu. Clad: Ro- bust audio deepfake detection against manipulation attacks with contrastive learning. arXiv preprint arXiv:2404.15854,

    arXiv

  29. [37]

    A robust audio deepfake detection system via multi-view feature

    Yujie Yang, Haochen Qin, Hang Zhou, Chengcheng Wang, Tianyu Guo, Kai Han, and Yunhe Wang. A robust audio deepfake detection system via multi-view feature. InICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 13131– 13135....

    2024

  30. [38]

    Half-truth: A partially fake audio detection dataset

    Jiangyan Yi, Ye Bai, Jianhua Tao, Haoxin Ma, Zhengkun Tian, Chenglong Wang, Tao Wang, and Ruibo Fu. Half-truth: A partially fake audio detection dataset. Interspeech, 2021. 6

    2021

  31. [39]

    Audio deep- fake detection with self-supervised xls-r and sls classifier

    Qishan Zhang, Shuangbing Wen, and Tao Hu. Audio deep- fake detection with self-supervised xls-r and sls classifier. In Proceedings of the 32nd ACM International Conference on Multimedia, page 6765–6773, New York, NY , USA, 2024. Association for Computing Machinery. 3

    2024

  32. [40]

    I can hear you: Selective robust training for deepfake audio detec- tion

    Zirui Zhang, Wei Hao, Aroon Sankoh, William Lin, Emanuel Mendiola-Ortiz, Junfeng Yang, and Chengzhi Mao. I can hear you: Selective robust training for deepfake audio detec- tion. arXiv preprint arXiv:2411.00121, 2024. 3 10

    2024 arXiv

  33. [60]

    The Korean Institute of Broadcast and Media Engineers,

  34. [2024]

    Accessed: 2025-06-03. 2

    2025

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.