Pith. sign in

REVIEW 6 minor 86 references

The paper maps deepfake speech defenses into three complementary techniques—source-side voice anonymization, passive detection, and proactive watermarking—and details the open challenges in each.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-04 23:42 UTC pith:BX6MQ7AB

load-bearing objection A clean, honest short overview of three deepfake-speech defense families; no new results, but a useful compact reference if the taxiomy holds up.

arxiv 2509.06361 v2 pith:BX6MQ7AB submitted 2025-09-08 eess.AS

Speaker Privacy and Security in the Big Data Era: Protection and Defense against Deepfake

Liping Chen , Kong Aik Lee , Zhen-Hua Ling , Xin Wang , Rohan Kumar Das , Tomoki Toda , Haizhou Li This is my paper
classification eess.AS
keywords voice anonymizationdeepfake speech detectionaudio watermarkingspeaker privacyspeech anti-spoofingadversarial perturbationself-supervised learningsynthetic speech security
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper is a short survey of the three technical lines that protect speakers against deepfake speech: voice anonymization, which hides or removes a speaker's voice attributes before they can be harvested; deepfake detection, which labels an utterance as human or synthetic at use time; and watermarking, which marks synthetic speech at generation time. It argues these are complementary—anonymization protects the source, detection is a passive filter, watermarking is a proactive marker—and that each line has its own unsolved problem: anonymization trades off privacy against naturalness, detectors can latch onto dataset-specific shortcuts, and watermarks are fragile under vocoders and codecs. The paper's contribution is its organizing taxonomy and identification of open challenges, not new experiments.

Core claim

The paper's central claim, stated as an overview, is that the defense space against deepfake speech is currently structured into protection and defense: voice anonymization stops speaker attributes from being extracted for synthesis; deepfake detection rejects synthetic speech before it acts; and watermarking carries a verifiable synthetic-origin signal inside generated audio. Within anonymization, it distinguishes synchronous methods that change what humans and machines hear from asynchronous methods that preserve human perception while confusing machine extractors, and it separates generative synthesis-based anonymization from adversarial perturbation. Detection is described as binary clas

What carries the argument

The organizing device is a three-way division plus two binary taxonomies. The three-way division locates each defense by where it intervenes: anonymization at the user/source end, detection at the authentication pipeline, watermarking at the generator. The anonymization taxonomy distinguishes synchronous versus asynchronous (whether human perception is altered) and generative versus adversarial (whether the output is synthesized speech or a perturbed original). The detection section centers on the feature-extractor-plus-classifier pipeline, with self-supervised features as the current front end. The watermarking taxonomy distinguishes post-processing versus collaborative embedding and evalua

Load-bearing premise

The paper assumes that its three categories—voice anonymization, deepfake detection, and watermarking—and the sub-divisions within them capture the whole current defense space, so an omitted approach or a mischaracterized cited result would make the overview incomplete.

What would settle it

If a large-scale replication of the cited asynchronous-anonymization results shows that human listeners can pick out the original speaker, or that machine extractors still identify them, at rates well above chance, the paper's core characterization of asynchronous anonymization fails. Alternatively, a literature audit finding a significant active defense that fits none of the three categories would falsify the overview's claim to cover the space.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • Anonymized speech that meets privacy-utility requirements can be inserted into existing speaker-verification pipelines as a pre-processing step.
  • Detection systems should be evaluated on multiple corpora from different sources, since single-corpus success can reflect shortcut learning rather than true generalization.
  • Watermarking must move from robustness to security: the next failure mode is an attacker overwriting a 'fake' watermark with a 'real' one, which requires embedding and authentication protocols.
  • The three techniques are not competitors; a deployed system will likely need anonymization to protect data at rest, detection to filter at run time, and watermarking to establish provenance at generation.
  • Because the fake/real boundary is equivocal for DNN-codec-processed and anonymized speech, binary detection may give way to source tracing and authentication paradigms.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If watermarking protocols are standardized, 'being synthetic' could become a verifiable attribute attached at generation time, shifting the focus from detecting fakes to proving provenance.
  • Asynchronous anonymization and collaborative watermarking may be complementary—one protects the source speaker, the other marks the synthesized output—but their interaction, such as whether the watermark survives anonymization, remains untested.
  • The shortcut-learning critique implies that detector benchmarks should deliberately include irrelevant artifacts, such as silence length, as sanity checks; a detector that relies on the silence region should be treated as not solving deepfake detection.
  • The equivocal boundary for codec-processed speech suggests regulators need a definition of synthetic speech that includes neural compression, otherwise watermarking and detection will disagree on the same file.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

0 major / 6 minor

Summary. The paper is a concise survey of three families of techniques for protecting speaker privacy and defending against deepfake speech: voice anonymization, deepfake detection, and speech watermarking. It distinguishes protection (anonymization) from defense (detection and watermarking), and describes recent progress, representative challenge efforts (VoicePrivacy, ASVspoof, ADD), and open problems such as shortcut learning, explainability, task definition, and watermark robustness/security. The paper explicitly states that it is a short overview and that a more comprehensive version will follow.

Significance. If the survey's characterizations are accurate, the paper provides a useful, compact entry point to an active area, with balanced coverage of methods and limitations. Its strengths include explicit hedging (e.g., 'seem to be able to extract features'; collaborative watermarking 'seems to be more robust'), reliance on challenge results as anchors, and candid discussion of open problems (Sections III.B and IV.B) that many broader surveys omit. No novel technical claims or derivations are made; self-citations are used as pointers to original methods, not as grounds for derived conclusions, so I see no circularity. The main risk is the one the authors acknowledge: the taxonomy could become outdated or incomplete as the field evolves, but that is inherent to a survey and does not undermine the paper's stated purpose.

minor comments (6)
  1. [Abstract/§II] The term 'V oice' appears with a spurious space in multiple places (e.g., 'V oice anonymization' in the Section II heading and abstract, 'V oicePrivacy' in [36]). If this is a rendering artifact, please ensure the camera-ready PDF corrects it.
  2. [References] References [12] and [18] are the same paper ('Introducing the VoicePrivacy Initiative'). Merge or cross-reference to avoid duplication.
  3. [§III.B.3] Typo: 'that is not test' should read 'that is not tested' or 'that cannot be tested.' Also, 'unless we evaluate on all possible fake speech' is an absolutist formulation; consider 'unless we evaluate on a sufficiently broad and evolving set of attacks.'
  4. [§IV.B] Minor wording issues: 'under attacker' should be 'under attack' or 'by an attacker' in the sentence 'distorted by similar vocoder or codec during the transmission or under attacker.'
  5. [§III.B.1] Hyphenation of 'short-cut' vs. 'shortcut' is inconsistent; choose one form throughout.
  6. [§IV.A] The claim that collaborative watermarking allows extraction 'by the watermark detector (but not any other detector)' is stronger than the cited evidence directly supports; consider softening to 'not by the other detectors evaluated in the cited studies.'

Circularity Check

0 steps flagged

No significant circularity: the paper is a survey/overview with no derivation, fit, or prediction that reduces to its own inputs.

full rationale

This paper explicitly disclaims novelty: its stated goal is 'a short and concise overview of the three techniques, describing the methodologies, advancements, and challenges.' It contains no fitted parameters, no new equations, and no derived predictions. Claims about voice anonymization, deepfake detection, and watermarking are attributed to prior challenge results, surveys, and cited studies; even where the authors cite their own work (e.g., refs [28], [30]-[32], [35]), those citations function as pointers to externally reported experimental findings, not as an unverified premise used to force a conclusion. The paper also labels its own open issues (shortcut learning, task-definition ambiguity, watermark robustness/security, integration of techniques) rather than presenting them as solved. There is no step where an output equals an input by construction, no fitted value is renamed as a prediction, and no self-citation chain is invoked to forbid alternatives. The taxonomy and cited characterizations could be debated on completeness or accuracy grounds, but that is a correctness/coverage concern, not circularity. Accordingly, the appropriate score is 0.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 0 invented entities

As a review, the paper introduces no new parameters, entities, or derivations. Its only burden is the domain assumption that the surveyed techniques and taxonomies are representative and accurately described; this is standard for a survey.

axioms (1)
  • domain assumption The three techniques surveyed (voice anonymization, deepfake detection, watermarking) are the principal defenses, and the cited literature accurately represents their capabilities.
    The paper defines its scope around these three techniques in the Introduction and Sections II-IV without systematically comparing to alternatives; accuracy of the overview therefore depends on this representativeness.

pith-pipeline@v1.3.0-alltime-deepseek · 10351 in / 8287 out tokens · 85779 ms · 2026-08-04T23:42:56.860537+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of Speaker Privacy and Security in the Big Data Era: Protection and Defense against Deepfake." pith.science (2026). https://pith.science/paper/BX6MQ7AB

@misc{pith2026250906361,
  author       = {Pith},
  title        = {Pith review of: Speaker Privacy and Security in the Big Data Era: Protection and Defense against Deepfake},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BX6MQ7AB}},
  note         = {Machine review of arXiv:2509.06361}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

In the era of big data, remarkable advancements have been achieved in personalized speech generation techniques that utilize speaker attributes, including voice and speaking style, to generate deepfake speech. This has also amplified global security risks from deepfake speech misuse, resulting in considerable societal costs worldwide. To address the security threats posed by deepfake speech, techniques have been developed focusing on both the protection of voice attributes and the defense against deepfake speech. Among them, the voice anonymization technique has been developed to protect voice attributes from extraction for deepfake generation, while deepfake detection and watermarking have been utilized to defend against the misuse of deepfake speech. This paper provides a short and concise overview of the three techniques, describing the methodologies, advancements, and challenges. A comprehensive version, offering additional discussions, will be published in the near future.

Figures

Figures reproduced from arXiv: 2509.06361 by Haizhou Li, Kong Aik Lee, Liping Chen, Rohan Kumar Das, Tomoki Toda, Xin Wang, Zhen-Hua Ling.

Figure 1
Figure 1. Figure 1: Illustrative example of applications for voice anonymization, deepfake detection, and watermarking techniques, shown in the grey boxes, [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

86 extracted references · 75 canonical work pages · 1 internal anchor

  1. [1]

    Recent advances in end-to-end automatic speech recognition,

    J. Li et al., “Recent advances in end-to-end automatic speech recognition,”APSIPA Transactions on Signal and Information Processing, vol. 11, no. 1, 2022

    2022

  2. [2]

    A deep learning ap- proaches in text-to-speech system: A systematic review and recent research perspective,

    Y . Kumar, A. Koul, and C. Singh, “A deep learning ap- proaches in text-to-speech system: A systematic review and recent research perspective,”Multimedia Tools and Applica- tions, vol. 82, no. 10, pp. 15 171–15 197, 2023

    2023

  3. [3]

    Speaker recognition based on deep learning: An overview,

    Z. Bai and X.-L. Zhang, “Speaker recognition based on deep learning: An overview,”Neural Networks, vol. 140, pp. 65–99, 2021

    2021

  4. [4]

    Neural codec language models are zero-shot text to speech synthesizers,

    S. Chen et al., “Neural codec language models are zero-shot text to speech synthesizers,”IEEE Transactions on Audio, Speech and Language Processing, vol. 33, pp. 705–718, 2025

    2025

  5. [5]

    CosyV oice 2: Scalable streaming speech synthesis with large language models,

    Z. Du et al., “CosyV oice 2: Scalable streaming speech synthesis with large language models,”arXiv, 2024. eprint: 2412.10117

    Pith/arXiv arXiv 2024

  6. [6]

    MegaTTS 3: Sparse alignment enhanced latent diffusion transformer for zero-shot speech synthesis,

    Z. Jiang et al., “MegaTTS 3: Sparse alignment enhanced latent diffusion transformer for zero-shot speech synthesis,”arXiv,

  7. [7]

    Naturalspeech 3: Zero-shot speech synthesis with factorized codec and diffusion models,

    Z. Ju et al., “Naturalspeech 3: Zero-shot speech synthesis with factorized codec and diffusion models,”Proc. International Conference on Machine Learning, 2024

    2024

  8. [8]

    General Data Protection Regulation,

    “General Data Protection Regulation,” 2016. [Online]. Avail- able: https://gdpr-info.eu/

    work page 2016

  9. [9]

    Interim Regulations for the Management of Generative Arti- ficial Intelligence Services

    “Interim Regulations for the Management of Generative Arti- ficial Intelligence Services. ”[Online]. Available: https://www. gov.cn/zhengce/zhengceku/202307/content 6891752.htm

    work page

  10. [10]

    Act on the Protection of Personal Information,

    “Act on the Protection of Personal Information,” 2003. [On- line]. Available: https://www.cas.go.jp/jp/seisaku/hourei/data/ APPI.pdf

    work page 2003

  11. [11]

    Personal Data Protection Act 2012,

    “Personal Data Protection Act 2012,” 2012. [Online]. Avail- able: https://sso.agc.gov.sg/Act/PDPA2012

    work page 2012

  12. [12]

    Introducing the voiceprivacy initiative,

    N. Tomashenko et al., “Introducing the voiceprivacy initiative,” Proc. Interspeech, 2020, pp. 1693–1697

    work page 2020

  13. [13]

    Audio deepfake detection: A survey,

    J. Yi, C. Wang, J. Tao, X. Zhang, C. Y . Zhang, and Y . Zhao, “Audio deepfake detection: A survey,”arXiv, 2023. eprint: 2308.14970

    Pith/arXiv arXiv 2023

  14. [14]

    Deep audio water- marks are shallow: Limitations of post-hoc watermarking tech- niques for speech,

    P. O’Reilly, Z. Jin, J. Su, and B. Pardo, “Deep audio water- marks are shallow: Limitations of post-hoc watermarking tech- niques for speech,”The 1st Workshop on GenAI Watermarking, 2025

    work page 2025

  15. [15]

    The analog voice privacy system,

    R. Cox, D. Bock, J. J. K. Bauer and, and J. Snyder, “The analog voice privacy system,”Proc. ICASSP, 1986, pp. 341–344

    work page 1986

  16. [16]

    Ana- log scramblers for speech based on sequential permutations in time and frequency,

    N. S. Jayant, R. V . Cox, B. J. McDermott, and A. Quinn, “Ana- log scramblers for speech based on sequential permutations in time and frequency,”Bell System Technical Journal, vol. 62, no. 1, pp. 25–46, 1983. 4 REFERENCES REFERENCES

    work page 1983

  17. [17]

    Analog voice privacy systems using TFSP scrambling: Full duplex and half duplex,

    R. V . Cox and J. M. Tribolet, “Analog voice privacy systems using TFSP scrambling: Full duplex and half duplex,”The Bell System Technical Journal, vol. 62, no. 1, pp. 47–61, 1983

    work page 1983

  18. [18]

    Introducing the voiceprivacy initiative,

    N. Tomashenko, B. M. L. Srivastava, X. Wang, E. Vincent, and et al, “Introducing the voiceprivacy initiative,”Proc. Inter- speech, 2020, pp. 1693–1697

    work page 2020

  19. [19]

    Speaker anonymization using x-vector and neural waveform models,

    F. Fang et al., “Speaker anonymization using x-vector and neural waveform models,”Proc. SSW10, 2019, pp. 155–160

    work page 2019

  20. [20]

    You talk too much: Limiting privacy exposure via voice input,

    T. Vaidya, M. Sherr, M. Todisco, A. Nautsch, and N. Evans, “You talk too much: Limiting privacy exposure via voice input,”IEEE Security and Privacy Workshops, 2019

    work page 2019

  21. [21]

    Speech sanitizer: Speech content desensitization and voice anonymization,

    J. Qian, H. Du, J. Hou, L. Chen, T. Jung, and X.-Y . Li, “Speech sanitizer: Speech content desensitization and voice anonymization,”IEEE Transactions on Dependable and Secure Computing, vol. 18, no. 6, pp. 2631–2642, 2021

    work page 2021

  22. [22]

    Speaker anonymisation using the McAdams coeffi- cient,

    J. Patino, N. Tomashenko, M. Todisco, A. Nautsch, and N. Evans, “Speaker anonymisation using the McAdams coeffi- cient,”Proc. Interspeech, 2021, pp. 1099–1103

    work page 2021

  23. [23]

    VoiceMask: Anonymize and Sanitize Voice Input on Mobile Devices

    J. Qian et al., “V oicemask: Anonymize and sanitize voice input on mobile devices,”CoRR, vol. abs/1711.11460, 2017

    work page internal anchor Pith review Pith/arXiv arXiv 2017

  24. [24]

    Hidebehind: Enjoy voice input with voiceprint unclonability and anonymity,

    J. Qian, H. Du, J. Hou, L. Chen, T. Jung, and X.-Y . Li, “Hidebehind: Enjoy voice input with voiceprint unclonability and anonymity,”Proc. the 16th ACM Conference on Embedded Networked Sensor Systems, 2018, pp. 82–94

    work page 2018

  25. [25]

    A benchmark for multi-speaker anonymization,

    X. Miao, R. Tao, C. Zeng, and X. Wang, “A benchmark for multi-speaker anonymization,”IEEE Transactions on Informa- tion Forensics and Security, vol. 20, pp. 3819–3833, 2025

    work page 2025

  26. [26]

    V oiceCloak: Adversarial example enabled voice de-identification with balanced privacy and utility,

    M. Chen et al., “V oiceCloak: Adversarial example enabled voice de-identification with balanced privacy and utility,” 2, vol. 7, 2023, pp. 1–21

    work page 2023

  27. [27]

    UniAP: Protecting speech privacy with non- targeted universal adversarial perturbations,

    P. Cheng et al., “UniAP: Protecting speech privacy with non- targeted universal adversarial perturbations,”IEEE Transac- tions on Dependable and Secure Computing, vol. 21, no. 1, pp. 31–46, 2024

    work page 2024

  28. [28]

    Ad- versarial speech for voice privacy protection from personalized speech generation,

    S. Chen, L. Chen, J. Zhang, K. Lee, Z. Ling, and L. Dai, “Ad- versarial speech for voice privacy protection from personalized speech generation,”Proc. ICASSP, 2024, pp. 11 411–11 415

    work page 2024

  29. [29]

    Mitigating unauthorized speech synthesis for voice protection,

    Z. Zhang et al., “Mitigating unauthorized speech synthesis for voice protection,”Proc. the 1st ACM Workshop on Large AI Systems and Models with Privacy and Safety Analysis, 2024, pp. 13–24

    work page 2024

  30. [30]

    Any- to-any speaker attribute perturbation for asynchronous voice anonymization,

    L. Chen, C. Guo, R. Wang, K. A. Lee, and Z.-H. Ling, “Any- to-any speaker attribute perturbation for asynchronous voice anonymization,”IEEE Transactions on Information Forensics and Security, vol. 20, pp. 7736–7747, 2025

    work page 2025

  31. [31]

    Asynchronous voice anonymization using adversarial perturbation on speaker embedding,

    R. Wang, L. Chen, K. A. Lee, and Z.-H. Ling, “Asynchronous voice anonymization using adversarial perturbation on speaker embedding,”Proc. Interspeech, 2024, pp. 4443–4447

    work page 2024

  32. [32]

    Asynchronous voice anonymization by learning from speaker-adversarial speech,

    R. Wang, L. Chen, K. A. Lee, and Z.-H. Ling, “Asynchronous voice anonymization by learning from speaker-adversarial speech,”IEEE Signal Processing Letters, vol. 32, pp. 1905– 1909, 2025

    work page 1905

  33. [33]

    The V oicePrivacy 2024 Challenge evaluation plan,

    N. Tomashenko et al., “The V oicePrivacy 2024 Challenge evaluation plan,”arXiv, 2024. eprint: 2404.02677

    Pith/arXiv arXiv 2024

  34. [34]

    Privacy and utility of x-vector based speaker anonymization,

    B. M. L. Srivastava et al., “Privacy and utility of x-vector based speaker anonymization,”IEEE/ACM Transactions on Audio, Speech, and Language Processing, vol. 30, pp. 2383–2395, 2022

    work page 2022

  35. [35]

    Pseudo- speaker distribution learning in voice anonymization,

    L. Chen, W. Gu, K. A. Lee, W. Guo, and Z.-H. Ling, “Pseudo- speaker distribution learning in voice anonymization,”IEEE Transactions on Audio, Speech and Language Processing, vol. 33, pp. 272–285, 2025

    work page 2025

  36. [36]

    Overview of the voiceprivacy 2024 challenge,

    N. Tomashenko, “Overview of the voiceprivacy 2024 challenge,” 2024. [Online]. Available: https : / / www . voiceprivacychallenge.org/vp2024/docs/VPC-2024-.pdf

    work page 2024

  37. [37]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,”International Conference on Learning Representations, 2014

    work page 2014

  38. [38]

    Imperceptible black-box waveform-level adversarial attack towards automatic speaker recognition,

    X. Zhang, X. Zhang, M. Sun, X. Zou, K. Chen, and N. Yu, “Imperceptible black-box waveform-level adversarial attack towards automatic speaker recognition,”Complex & Intelligent Systems, vol. 9, no. 1, pp. 65–79, 2023

    work page 2023

  39. [39]

    Hear ”No Evil

    Abdullah et al., “Hear ”No Evil”, See ”Kenansville”: Efficient and transferable black-box attacks on speech recognition and voice identification systems,”IEEE Symposium on Security and Privacy (SP), 2021, pp. 712–729

    work page 2021

  40. [40]

    Adversarial attacks on GMM i-vector based speaker verification systems,

    X. Li et al., “Adversarial attacks on GMM i-vector based speaker verification systems,”Proc. ICASSP, 2020, pp. 6579– 6583

    work page 2020

  41. [41]

    A survey on speech deepfake detection,

    M. Li, Y . Ahmadiadli, and X.-P. Zhang, “A survey on speech deepfake detection,”ACM Computing Surveys, vol. 57, no. 7, pp. 1–38, 2025

    2025

  42. [42]

    ASVspoof 2015: The first automatic speaker verification spoofing and countermeasures challenge,

    Z. Wu et al., “ASVspoof 2015: The first automatic speaker verification spoofing and countermeasures challenge,”Proc. Interspeech, 2015, pp. 2037–2041

    work page 2015

  43. [43]

    McAfee,Beware the Artificial Impostor: A McAfee Cyberse- curity Artificial Intelligence Report, 2023

    work page 2023

  44. [44]

    Ad- vances in anti-spoofing: From the perspective of ASVspoof challenges,

    M. R. Kamble, H. B. Sailor, H. A. Patil, and H. Li, “Ad- vances in anti-spoofing: From the perspective of ASVspoof challenges,”APSIPA Transactions on Signal and Information Processing, vol. 9, e2, 2020

    work page 2020

  45. [45]

    A comparison of features for synthetic speech detection,

    M. Sahidullah, T. Kinnunen, and C. Hanilc ¸i, “A comparison of features for synthetic speech detection,”Proc. Interspeech, 2015, pp. 2087–2091

    work page 2015

  46. [46]

    End-to-end anti-spoofing with RawNet2,

    H. Tak, J. Patino, M. Todisco, A. Nautsch, N. Evans, and A. Larcher, “End-to-end anti-spoofing with RawNet2,”Proc. ICASSP, 2020, pp. 6369–6373

    work page 2020

  47. [47]

    Self-supervised speech representation learning: A review,

    A. Mohamed et al., “Self-supervised speech representation learning: A review,”IEEE Journal of Selected Topics in Signal Processing, vol. 16, no. 6, pp. 1179–1210, 2022

    work page 2022

  48. [48]

    Investigating Self-Supervised Front Ends for Speech Spoofing Countermeasures,

    X. Wang and J. Yamagishi, “Investigating Self-Supervised Front Ends for Speech Spoofing Countermeasures,”Proc. Odyssey, 2022, pp. 100–106

    work page 2022

  49. [49]

    Automatic speaker verification spoofing and deepfake detection using wav2vec 2.0 and data augmentation,

    H. Tak, M. Todisco, X. Wang, J.-w. Jung, J. Yamagishi, and N. Evans, “Automatic speaker verification spoofing and deepfake detection using wav2vec 2.0 and data augmentation,”Proc. Odyssey, 2022, pp. 112–119

    work page 2022

  50. [50]

    STC antispoofing systems for the ASVspoof2019 challenge,

    G. Lavrentyeva, S. Novoselov, A. Tseren, M. V olkova, A. Gorlanov, and A. Kozlov, “STC antispoofing systems for the ASVspoof2019 challenge,”Proc. Interspeech, 2019, pp. 1033– 1037

    work page 2019

  51. [51]

    Detecting spoofing attacks using VGG and SincNet: BUT-Omilia submission to ASVspoof 2019 chal- lenge,

    H. Zeinali et al., “Detecting spoofing attacks using VGG and SincNet: BUT-Omilia submission to ASVspoof 2019 chal- lenge,”Proc. Interspeech, 2019, pp. 1073–1077

    work page 2019

  52. [52]

    AASIST: Audio anti-spoofing using in- tegrated spectro-temporal graph attention networks,

    J.-w. Jung et al., “AASIST: Audio anti-spoofing using in- tegrated spectro-temporal graph attention networks,”Proc. ICASSP, 2022, pp. 6367–6371

    work page 2022

  53. [53]

    XLSR-Mamba: A Dual-Column Bidi- rectional State Space Model for Spoofing Attack Detection,

    Y . Xiao and R. K. Das, “XLSR-Mamba: A Dual-Column Bidi- rectional State Space Model for Spoofing Attack Detection,” IEEE Signal Processing Letters, vol. 32, pp. 1276–1280, 2025. 5

    work page 2025

  54. [54]

    ASVspoof 5: Crowdsourced speech data, deep- fakes, and adversarial attacks at scale,

    X. Wang et al., “ASVspoof 5: Crowdsourced speech data, deep- fakes, and adversarial attacks at scale,”ASVspoof Workshop 2024, 2024, pp. 1–8

    work page 2024

  55. [55]

    Yi et al.,ADD 2023: The second audio deepfake detection challenge, 2023

    J. Yi et al.,ADD 2023: The second audio deepfake detection challenge, 2023. eprint: 2305.13774

    Pith/arXiv arXiv 2023

  56. [56]

    MLAAD: The Multi-Language Audio Anti-Spoofing Dataset,

    N. M. M ¨uller et al., “MLAAD: The Multi-Language Audio Anti-Spoofing Dataset,”Proc. IJCNN, 2024, pp. 1–7

    work page 2024

  57. [57]

    Codecfake: An initial dataset for detecting llm- based deepfake audio,

    Y . Lu et al., “Codecfake: An initial dataset for detecting llm- based deepfake audio,”Proc. Interspeech, 2024, pp. 1390– 1394

    work page 2024

  58. [58]

    SpoofCeleb: Speech Deepfake Detection and SASV In The Wild,

    J.-w. Jung et al., “SpoofCeleb: Speech Deepfake Detection and SASV In The Wild,”IEEE Open Journal of Signal Processing, vol. 6, pp. 68–77, 2025

    work page 2025

  59. [59]

    Shortcut Learning in Binary Classifier Black Boxes: Applications to V oice Anti-Spoofing and Biometrics,

    M. Sahidullah, H.-j. Shim, R. G. Hautam ¨aki, and T. H. Kin- nunen, “Shortcut Learning in Binary Classifier Black Boxes: Applications to V oice Anti-Spoofing and Biometrics,”IEEE Journal of Selected Topics in Signal Processing, pp. 1–16, 2025

    work page 2025

  60. [60]

    Speech is silver, silence is golden: What do ASVspoof-trained models really learn?

    N. M ¨uller, F. Dieckmann, P. Czempin, R. Canals, K. B¨ottinger, and J. Williams, “Speech is silver, silence is golden: What do ASVspoof-trained models really learn?”Proc. ASVspoof challenge workshop, 2021, pp. 55–60

    work page 2021

  61. [61]

    Arena,Speech arena: Speech deepfake leaderboard, 2025

    S. Arena,Speech arena: Speech deepfake leaderboard, 2025. [Online]. Available: https : / / huggingface . co / spaces / Speech - Arena-2025/Speech-DF-Arena

    work page 2025

  62. [62]

    Stop explaining black box machine learning models for high stakes decisions and use interpretable models instead,

    C. Rudin, “Stop explaining black box machine learning models for high stakes decisions and use interpretable models instead,” Nature Machine Intelligence, vol. 1, no. 5, pp. 206–215, 2019

    work page 2019

  63. [63]

    Towards explainable spoofed speech attribution and detection: A probabilistic approach for characterizing speech synthe- sizer components,

    J. Mishra, M. Chhibber, H.-j. Shim, and T. H. Kinnunen, “Towards explainable spoofed speech attribution and detection: A probabilistic approach for characterizing speech synthe- sizer components,”Computer Speech & Language, vol. 95, p. 101 840, 2026

    work page 2026

  64. [64]

    ALLM4ADD: Unlocking the Capabilities of Audio Large Language Models for Audio Deepfake Detection,

    H. Gu et al., “ALLM4ADD: Unlocking the Capabilities of Audio Large Language Models for Audio Deepfake Detection,” Proc. ACMMM, 2025

    work page 2025

  65. [65]

    HiFi-GAN: Generative adversar- ial networks for efficient and high fidelity speech synthesis,

    J. Kong, J. Kim, and J. Bae, “HiFi-GAN: Generative adversar- ial networks for efficient and high fidelity speech synthesis,” Proc. NeurIPS, vol. 33, 2020, pp. 17 022–17 033

    work page 2020

  66. [66]

    Spoofprint: A new paradigm for spoofing attacks detection,

    T. Chen and E. Khoury, “Spoofprint: A new paradigm for spoofing attacks detection,”Proc. SLT, 2021, pp. 538–543

    work page 2021

  67. [67]

    Source tracing of audio deepfake systems,

    N. Klein, T. Chen, H. Tak, R. Casal, and E. Khoury, “Source tracing of audio deepfake systems,”Proc. Interspeech, 2024

    work page 2024

  68. [68]

    A new approach to voice authenticity,

    N. M. M ¨uller et al., “A new approach to voice authenticity,” Proc. Interspeech, 2024, pp. 2245–2249

    work page 2024

  69. [69]

    Secure spread spectrum watermarking for images, audio and video,

    I. J. Cox, J. Kilian, T. Leighton, and T. Shamoon, “Secure spread spectrum watermarking for images, audio and video,” Proc. IEEE International Conference on Image Processing, vol. 3, 1996, pp. 243–246

    work page 1996

  70. [70]

    Detecting voice cloning attacks via timbre watermarking,

    C. Liu, J. Zhang, T. Zhang, X. Yang, W. Zhang, and N. Yu, “Detecting voice cloning attacks via timbre watermarking,” Proc. Network and Distributed System Security Symposium, 2023

    work page 2023

  71. [71]

    Wavmark: Watermarking for audio generation,

    G. Chen, Y . Wu, S. Liu, T. Liu, X. Du, and F. Wei, “Wavmark: Watermarking for audio generation,”arXiv, 2023. eprint: 2308. 12770

    work page 2023

  72. [72]

    Twenty years of digital audio watermarking—a comprehensive review,

    G. Hua, J. Huang, Y . Q. Shi, J. Goh, and V . L. Thing, “Twenty years of digital audio watermarking—a comprehensive review,” Signal processing, vol. 128, pp. 222–242, 2016

    work page 2016

  73. [73]

    Watermarking as communications with side information,

    I. J. Cox, M. L. Miller, and A. L. McKellips, “Watermarking as communications with side information,”Proceedings of the IEEE, vol. 87, no. 7, pp. 1127–1141, 1999

    work page 1999

  74. [74]

    An efficient watermarking algorithm for digital audio data in security applications,

    M. Yamni et al., “An efficient watermarking algorithm for digital audio data in security applications,”Scientific Reports, vol. 13, no. 1, p. 18 432, 2023

    work page 2023

  75. [75]

    Y . Wen, A. Innuganti, A. B. Ramos, H. Guo, and Q. Yan,SoK: How robust is audio watermarking in generative AI models?

    work page

  76. [76]

    Maskmark: Robust neuralwatermarking for real and synthetic speech,

    P. O’Reilly, Z. Jin, J. Su, and B. Pardo, “Maskmark: Robust neuralwatermarking for real and synthetic speech,”ICASSP, 2024, pp. 4650–4654

    work page 2024

  77. [77]

    Proactive detection of voice cloning with localized watermarking,

    R. S. Roman, P. Fernandez, A. D ´efossez, T. Furon, T. Tran, and H. Elsahar, “Proactive detection of voice cloning with localized watermarking,”Proc. ICML, 2024

    work page 2024

  78. [78]

    An Audio Watermarking Algorithm Based on Adversarial Perturbation,

    S. Wu, J. Liu, Y . Huang, H. Guan, and S. Zhang, “An Audio Watermarking Algorithm Based on Adversarial Perturbation,” Applied Sciences, vol. 14, no. 16, p. 6897, 2024,ISSN: 2076- 3417

    work page 2024

  79. [79]

    Collaborative watermarking for ad- versarial speech synthesis,

    L. Juvela and X. Wang, “Collaborative watermarking for ad- versarial speech synthesis,”Proc. ICASSP, 2024, pp. 11 231– 11 235

    work page 2024

  80. [80]

    Audio codec augmentation for ro- bust collaborative watermarking of speech synthesis,

    L. Juvela and X. Wang, “Audio codec augmentation for ro- bust collaborative watermarking of speech synthesis,”Proc. ICASSP, 2025

    work page 2025

Showing first 80 references.