SARA: Stress Test Reasoning in Audio Deepfake Detection

Binh Nguyen; Charles Fleming; Thai Le

REVIEW 5 major objections 5 minor 2 cited by

SARA: Stress Test Reasoning in Audio Deepfake Detection

T0 review · 5 major / 5 minor · reviewed 2026-08-03 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Reasoning helps some audio deepfake detectors and hurts others.

desk verdict Useful diagnostic framing and a real empirical pattern, but the headline tax/shield split is confounded by Qwen2-tailored data and the core metrics depend on an unspecified entailment function. read the letter →

arxiv 2601.03615 v2 pith:IJ4T2BDK submitted 2026-01-07 cs.CL cs.SDeess.AS

Binh Nguyen , Charles Fleming , Thai Le This is my paper · ORCID

classification cs.CLcs.SDeess.AS

keywords audiodeepfakedetectionlanguagemodelschain-of-thoughtreasoningadversarialattackscoherencecognitivedissonanceexplainableAIforensicanalysis

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that explicitness is not a free robustness upgrade: when audio language models are forced to reason out loud before judging deepfakes, the outcome splits. For models that hear acoustic detail well, the reasoning acts as a shield; for models with weaker perception, it becomes a tax that lets attacks succeed more often and even fabricates evidence for the wrong verdict. The paper also claims that the two attack families leave different reasoning signatures — acoustic attacks erode reasoning-verdict coherence, while linguistic attacks preserve coherence while raising attack success — and that coherence alone can flag perturbed audio (F1 0.78) without touching the raw signal. These findings matter because they reframe explainable deepfake detection: the explanation trace is not just a transparency add-on but a diagnostic signal that survives some failures.

What carries the argument

The load-bearing object is SARA, a three-tier audit built on a binary entailment function E(ri,c) that decides whether a reasoning aspect supports the final verdict. From E it derives cognitive coherence ΦCoh and, on wrong verdicts, cognitive dissonance ΨDiss; a companion perception score ΦPerc checks whether textual descriptions match ground-truth acoustic properties. Differential shifts ΔΦ/ΔΨ under perturbation sort failures into 'panic' (low coherence, high dissonance) and 'rationalization trap' (high coherence, low dissonance), and the text-only detection of attack traces rests on measured coherence.

What would settle it

Take a random sample of the reasoning traces, have humans label whether each reasoning aspect entails the verdict, recompute coherence and dissonance, and see whether the panic/rationalization split and the 0.78-F1 text-only detector survive. A second check: run the same detector on a held-out set of real-world perturbed audio; an F1 near 0.5 would refute the claim that coherence flags adversarial input without the raw signal.

Watch

Extended reading notes

Core claim

The central claim, in the authors' terms, is a bifurcation: explicit chain-of-thought reasoning lowers attack success for audio language models with strong acoustic perception (a shield) but raises it for weaker-perception models (a tax), which hallucinate coherent justifications for wrong verdicts. Across four open models, acoustic perturbations cut average reasoning-verdict coherence by 14.20% and raised dissonance, while linguistic attacks achieved higher success while keeping coherence high and dissonance near zero, a 'rationalization trap.' As a result, text-only analysis of the reasoning trace detected perturbed audio at 0.78 F1 even when the final label was wrong, and high dissonance

Load-bearing premise

Everything rests on the unspecified check that decides whether a reasoning statement actually supports the model's final verdict; if that check is biased or the model is grading itself, the coherence, dissonance, and alarm findings are not established.

Editorial extensions

If this is right

If the bifurcation is real, adding chain-of-thought prompting to an audio deepfake detector is not inherently safety-improving; it must be conditioned on the model's acoustic perception.
If coherence erosion under acoustic attacks is systematic, reasoning-verdict consistency can serve as a forensic red flag for manipulated audio even for models whose labels are wrong.
If linguistic attacks suppress dissonance, transcript-level perturbations are the more dangerous failure mode for explainable systems, since they produce confident, internally consistent wrong answers that an auditor would likely trust.
If coherence-based detection transfers beyond the test set, a lightweight text-only module could screen for adversarial audio without decoding the raw waveform, which is useful when the signal is unavailable or protected.
The coherence-dissonance tradeoff (r=-0.79) implies that current audio language models cannot simultaneously maximize logical explanation and anomaly signaling, so any deployment must choose which failure mode to tolerate.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Because the reasoning data were synthesized and filtered through a single model's outputs (the paper concedes this alignment), the shield/tax split may partly reflect training-data alignment rather than inherent model capability; testing on independently annotated reasoning traces would separate the two.
A testable extension the authors leave implicit: the 0.78 F1 coherence detector could be evaluated as a standalone pre-filter in a pipeline where the raw audio is encrypted or bandwidth-limited, where current binary detectors cannot operate.
If the entailment judge is replaced by human annotation and the coherence/dissonance rankings shift, the 'silent alarm' claim would need to be re-anchored; this is the natural next audit.
The framework's three axes could be applied to non-adversarial hard examples, such as genuine misclassifications from missing liveness cues, to see whether panic and rationalization are attack-specific pathologies or general failure modes.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague, quick read of arXiv:2601.03615. The useful core: SARA gives audio deepfake detection a three-layer audit—perception, coherence, dissonance—and the panic-versus-rationalization distinction is a genuine lens. The empirical split (acoustic attacks drop coherence, linguistic attacks keep coherence high while fooling the model) is plausible and is not in the cited ALLM4ADD or post-hoc explainability work. Tables 4 and 5 do show that pattern for these four models. That is a real contribution, and the authors are honest about several limits.

The soft spots, in order. The load-bearing one: coherence and dissonance are defined through an entailment function E(r_i,c) that is never specified or validated. Every central number—the 14.20% coherence drop, the silent alarm, the panic/rationalization taxonomy—flows through E, and the paper never says whether E is another LLM, the same ALM, or a template, nor how its error rate was checked. That is not cosmetic; the core measurement pipeline is unverifiable as written.

The stress-test concern also holds up. Appendix B.1 says the CoT training set was synthesized by GPT-5, then iteratively regenerated and majority-filtered by Qwen2-Audio until convergence. The authors themselves admit the dataset is highly aligned with Qwen2's processing style. So the RSN-vs-NON comparison is Qwen2 on in-distribution reasoning data versus other models on out-of-distribution reasoning data. The observed reasoning tax on gemma/phi/granite could simply be a data-alignment tax. Without a control—each model trained on its own self-generated traces, or all models on a model-agnostic dataset—the headline bifurcation is not established. The authors flag the confound but still draw the strong conclusion.

Smaller issues: the metadata abstract claims an F1=0.78 detection result that does not appear in the body, and the perception audit's ground truth is an LLM majority vote on N=100. Fine as a pilot, but weak as the basis for the perception scores in Figure 2.

Who this is for: people building LLM-based audio forensics or reasoning-robustness benchmarks. It deserves a serious referee—the framework is publishable as a diagnostic proposal, and the panic/rationalization split is worth testing under cleaner conditions. But as it stands, the central claim is conditional. I'd send it to review with the expectation that the authors operationalize E, add a self-generated reasoning control or soften the tax/shield claim, and reconcile the abstract F1 with the body. If they can do that, this becomes a solid paper; right now it is a promising one with a missing measurement core.

Referee Report

5 major / 5 minor

Summary. The paper introduces SARA, a diagnostic framework for evaluating the reasoning traces of Audio Language Models (ALMs) under adversarial attacks. It defines three audit dimensions — acoustic perception (Eq. 1), cognitive coherence (Eq. 2), and cognitive dissonance (Eq. 4) — and evaluates four open-source ALMs (Qwen2-Audio, Phi-4-multimodal, gemma-3n-E4B, granite-3.3-8b) fine-tuned with chain-of-thought (CoT) on ASVSpoof 2019. The models are tested under linguistic (TAPAS) and acoustic (CLAD-based) attacks. The central claims are (1) CoT acts as a "shield" for acoustically grounded models and a "tax" for others, (2) cognitive dissonance can serve as a "silent alarm" when the final verdict is wrong, and (3) acoustic and linguistic attacks induce distinct failure modes (panic vs. rationalization trap). The abstract also claims that coherence alone enables detection of perturbed audio with F1 = 0.78.

Significance. If established, the framework would be a useful contribution: it shifts the robustness question from binary prediction to reasoning-level failure, proposes a novel 'silent alarm' concept, and distinguishes attack-specific pathologies. The paper uses a standard benchmark, open-source models, and reports detailed attack hyperparameters, and the ethics statement promises release of attack and audit code. However, the current evidence does not support the headline claims. The two central metrics depend on an unspecified entailment function, the main tax/shield comparison is confounded by Qwen2-tailored data synthesis, and the F1 claim in the abstract is absent from the body. The perception audit also uses a small, LLM-labeled sample. These issues are load-bearing for the manuscript's contributions as stated.

major comments (5)

[§3.3 Eq. (2) and §3.4 Eq. (4)] The coherence and dissonance metrics depend on an entailment function E(ri, c) that is never operationalized. The paper does not state what implements E (a separate judge LLM? the same ALM? a human template?), how it was validated, or its error rate. Without this, the quantitative values in Tables 2–7 and all conclusions about 'panic', 'rationalization trap', and 'silent alarm' are not interpretable. Please specify the implementation, report its agreement with human judgment, and show worked examples where E is not trivial.
[Appendix B.1 and §6.3] The RSN training data was generated by GPT-5, then iteratively regenerated by fine-tuning Qwen2-Audio and majority-voting with Qwen2-Audio. Therefore, Qwen2's RSN advantage and the other models' 'reasoning tax' may be an in-domain/out-of-domain artifact rather than a general property of CoT. The authors acknowledge this in B.1. A control is needed: e.g., train each model on its own self-generated traces, or train all models on a fixed model-agnostic reasoning corpus. Without such a control, the central tax/shield bifurcation as a function of acoustic perception is not established.
[Abstract and §5.3.2/§6.2] The abstract claims that coherence enables detection of perturbed audio with F1 = 0.78 'without accessing the raw acoustic signal', but no such experiment appears in the body. The 78.2% figure in Table 4 is a dissonance rate under one attack (gemma-3n, Shape Space), not a detection F1. Please add the detection experiment, or remove the claim. This is a direct discrepancy between the abstract and the results.
[§6.3 vs Tables 2 and 3] The 'Shield Effect' text says that for Qwen2 and Granite, CoT 'effectively lowers the Attack Success Rate (ASR)'. This is true only for linguistic attacks (Table 3). Under acoustic attacks, Table 2 shows the opposite: Qwen2 ASR rises from 36.6 to 45.7 and Granite from 34.4 to 49.7 when moving from NON to RSN. The paper should either restrict the shield claim to linguistic attacks or report an aggregation that explains the discrepancy. This directly affects Contribution 1.
[Appendix B.2 and §5.2/Fig. 2] The perception audit underpins the 'grounded vs ungrounded' explanation of the bifurcation, but its ground-truth labels come from majority vote of three frontier LLMs (Gemini-3-Pro, Gemini-3-Flash, GPT-5.2) on only N=100 samples. LLM self-labeling is not an independent oracle for acoustic properties, and the per-dimension scores in Fig. 2 are shown without confidence intervals. Please provide human-validated labels on a subset, or at least confidence intervals and inter-labeler agreement, and acknowledge the limitation more prominently in the main text.

minor comments (5)

[Abstract] 'beyondblack-box' and 'black-boxclassifiers' are missing spaces; the text should read 'beyond black-box' and 'black-box classifiers'.
[Fig. 3] The axis label renders as 'Cognitive Coherence ( Coh)%' and 'Cognitive Dissonance ( Diss)%' with broken spacing; fix the LaTeX/PDF output.
[Tables 1–3] Column headers like 'N ON' and 'RSN' appear with corrupted superscripts (e.g., 'Qwen2-Audio-7BN ON'). Please clean the table formatting.
[§4 Metrics] The definitions of OC and ASR should state the exact test set used for each attack condition; the discrepancy between Table 1 clean accuracies and Table 3 clean OC values (e.g., Qwen2 98.0 vs 67.4) is confusing and should be explained.
[Appendix B.1] The training set is heavily imbalanced (22,627 fake vs 2,481 real). The paper should report whether any class-balancing was applied and how this affects the real/fake F1 numbers in Table 1.

Circularity Check

2 steps flagged · score 6.0 of 10

Central 'tax vs shield' bifurcation is confounded by Qwen2-generated training traces; coherence-dissonance 'trade-off' is largely definitional.

fitted input called prediction [Appendix B.1; claimed in §1 and §6.3]
"we fine-tuned Qwen2-Audio on the current reasoning set and then utilized the model to re-generate reasoning traces for the entire training set ... Because the reasoning traces were optimized and filtered via Qwen2-Audio's internal representations, the resulting dataset is highly aligned with its specific processing style. Consequently, while general acoustic perception is increased across all models, the ultimate reasoning consistency is most robust in Qwen2-Audio, whereas other models like Phi-4 or Gemma may encounter a 'reasoning tax' due to this domain-specific data alignment."

The RSN condition is defined by traces that Qwen2-Audio was fine-tuned on and re-generated/filtered via majority voting. Measuring Qwen2's RSN performance against models tested on that same Qwen2-aligned data makes the 'shield' and 'tax' labels at least partly by construction. The paper itself concedes the tax may be due to this domain-specific data alignment. No control using model-agnostic or each model's own reasoning traces is reported, so the central bifurcation is not a clean test of explicit reasoning; it is a data-alignment confound presented as a reasoning property.
self definitional [Eq. (2), Eq. (4), §6.1]
"ΦCoh(ri) = 1/|D| Σ E(r_i^j, c^j) ... ΨDiss(ri) = 1/|DWrong| Σ_{X∈DWrong} (1−E(ri,c)) ... the inverse relationship between cognitive coherence and cognitive dissonance is statistically confirmed (r=−0.79, p<.001)."

ΨDiss is the average of (1−E) over wrong-verdict samples while ΦCoh is the average of E over the dataset; for any sample, E and 1−E are complementary. Thus the reported negative correlation and the 'panic' vs 'rationalization' quadrants are largely arithmetic consequences of defining both metrics from the same unvalidated entailment function, not an independent empirical trade-off. The statistical test re-discovers the complement relationship built into the metrics.

full rationale

Score 6: the central claim is partially reduced by construction. The strongest circularity is the RSN data synthesis loop: Qwen2-Audio generates, filters, and is fine-tuned on the reasoning traces, so its RSN advantage over Phi-4/Gemma is expected from data alignment, and the paper's own Appendix B.1 says the other models 'may encounter a reasoning tax due to this domain-specific data alignment.' This does not erase all empirical content—the evaluation uses an external benchmark (ASVSpoof 2019), external attack recipes (CLAD, TAPAS), and a within-model NON-vs-RSN comparison—but it means the headline tax/shield bifurcation is confounded exactly where the paper's explanation (acoustic grounding) is invoked. In addition, the coherence/dissonance 'trade-off' is largely a restatement of the complement of the entailment function E, and E itself is never operationalized; however, the latter is a validity gap rather than a distinct circular step. Self-citations to the authors' prior TAPAS attack are methodological, not load-bearing. No evidence of a fully circular derivation (the metrics are not simply equal to the training loss), so score is 6 rather than 8-10.

Assumptions & free parameters 4 free parameters · 5 assumptions · 1 invented entities

The framework's central claims rest on several external choices: the six-cue forensic taxonomy (from Warren et al. 2024), an unspecified entailment oracle E, LLM-majority acoustic ground truth, hand-set attack intensity ranges, and ASVSpoof labels. One invented construct — the 'silent alarm' — is claimed to support detection, but its independent evidence is absent.

free parameters (4)

Acoustic attack hyperparameter ranges = SNR U[15,25]dB (white), U[5,20]dB (environment); stretch ratios {0.90,0.95,1.05,1.10}; shift {1600,16000,32000} samples;
Chosen by hand in Appendix A.1; they define the attack strength, so coherence and ASR results are conditional on these ranges.
QLoRA rank/alpha/dropout = r=16, α=64, dropout 0.05, lr 1e-4, weight decay 0.1
Fine-tuning hyperparameters (App. A.2) that affect all models' reasoning behavior; results may not transfer to full fine-tuning or different LoRA ranks.
CoT data synthesis iterations and majority-vote size = 3 iterations, 3 paths, majority vote; final set 25,108 samples
Data construction choices (App. B.1) that determine the evaluation distribution; different sizes or iterations may change coherence baselines.
Perception audit sample count = N=100 (25 per failure/class cell)
Small hand-balanced audit set (App. B.2); perception scores have wide error bars and may not represent the full test distribution.

assumptions (5)

domain assumption The six-dimension forensic reasoning taxonomy (Prosody, Disfluency, Speed, Speaking Style, Liveliness, Quality) is a complete and correct cue space for audio deepfake detection.
Adopted from Warren et al. 2024 (§3.1); the whole perception and coherence audit is defined over these dimensions. If the taxonomy is incomplete, the metrics miss relevant reasoning.
ad hoc to paper An entailment relation E(r_i, c) exists and is correctly computed by some unspecified procedure, making coherence and dissonance meaningful.
Eqs. 2–4 treat E as an oracle without specifying its implementation; all central numbers assume it.
ad hoc to paper Ground-truth acoustic attributes for the perception audit are correctly determined by majority vote of Gemini-3-Pro, Gemini-3-Flash, and GPT-5.2.
Appendix B.2 uses frontier LLM labels as ground truth for acoustic properties; no human validation is provided beyond an assertion of consistency with acoustic baselines.
domain assumption ASVSpoof 2019 Logical Access labels are correct and representative of deepfake audio.
Used as evaluation ground truth for ALM verdicts; the paper's own Limitations acknowledge it is a controlled laboratory dataset.
domain assumption Re-synthesized TAPAS linguistic attacks preserve voice identity and modify only transcript complexity, so observed acoustic changes are caused by text perturbations.
The attack definition (App. A.1) assumes textual changes causally create prosodic/acoustic manifestations; if the TTS voice profiles introduce uncontrolled acoustic differences, the 'linguistic vs acoustic' contrast is contaminated.

invented entities (1)

Cognitive dissonance as a 'silent alarm' signal
purpose: Detect adversarial manipulation when the ALM's final verdict is wrong but its reasoning conflicts with that verdict
Defined as aggregation of 1−E over wrong verdicts (Eq. 4). The paper claims it flags up to 78.2% of successful attacks and enables adversarial-input detection (F1 0.78 in the metadata abstract), but no independent detection experiment is presented in the body, and the underlying E is unspecified.

how reviews work

0 comments

Cite this review

Pith. "Pith review of SARA: Stress Test Reasoning in Audio Deepfake Detection." pith.science (2026). https://pith.science/paper/IJ4T2BDK

@misc{pith2026260103615,
  author       = {Pith},
  title        = {Pith review of: SARA: Stress Test Reasoning in Audio Deepfake Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/IJ4T2BDK}},
  note         = {Machine review of arXiv:2601.03615}
}

read the original abstract

Audio Language Models (ALMs) offer a promising shift towards explainable audio deepfake detections (ADD), moving beyond \textit{black-box} classifiers by providing transparency to their predictions via reasoning traces. However, such reasoning may not support the model predictions, reflecting poor coherence, or, worse, may rationalize incorrect predictions with plausible but misleading explanation. Moreover, the behavior of ALM reasoning under adversarial attacks remains under-explored, raising questions about the practical reliability of such explanation capabilities. To address this gap, this study introduces \textbf{SARA} (\textbf{S}hift \textbf{A}nalysis of \textbf{R}easoning in \textbf{A}udio), a diagnostic framework that evaluates ALM reasoning across three dimensions: acoustic perception, reasoning-verdict coherence and dissonance. We test five open-source ALMs against both acoustic and linguistic adversarial attacks. We show that acoustic attacks significantly degrade reasoning-verdict coherence (average decrease of 14.20\%), frequently inducing internal logical conflicts. Conversely, linguistic attacks achieve higher attack success rates while maintaining reasoning coherence. We further demonstrate that the textual coherence of generated reasoning traces also serves as a latent indicator of adversarial inputs, enabling effective detection of perturbed audio (0.78 in F1) \textit{without accessing the raw acoustic signal}. These findings suggest that reasoning traces provide diagnostic utility that persists even when final classification outputs are compromised.

Figures

Figures reproduced from arXiv: 2601.03615 by the authors.

**Figure 2.** Perception scores (ΦP erc) across six forensic dimensions, comparing the baseline sensitivity of general-purpose ALMs (dashed lines) against models fine-tuned for audio reasoning (solid lines). signals into discrete textual tokens, often hallucinating artifacts in authentic speech to satisfy the explanation prompt. Qwen2-Audio is an outlier, maintaining resilience (98.0% → 98.2%) comparable to dedicated detectors… view at source ↗

**Figure 3.** The Coherence-Dissonance Trade-off. versely, acoustic attacks (crosses) force models into the panic response (low ΦCoh, high ΨDiss), where the perceptual disruption triggers high dissonance. While this high dissonance offers a "silent alarm" to human auditors, the accompanying coherence erosion means the model provides no logical justification for its correct detection, potentially hindering downstream analysis. 6… view at source ↗

Figures from the paper (5 more)

**Figure 4.** Figure 4: Mapping the Reasoning Landscape: (left, A) The coherence landscape ( [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

**Figure 5.** Figure 5: Reasoning as a Shield vs. Tax. Black lines are error bars indicating 95% Confidence Interval. • Synthetic Echo: A delayed superposition of the signal x(t) ← x(t) + α · x(t − δ). Delay δ is sampled between [1000, 2000] samples; strength α ∼ [0.2, 0.5]. A.2 Implementatio…

**Figure 6.** Figure 6: Chain-of-Thoughts prompt with step-by-step instructions [PITH_FULL_IMAGE:figures/full_fig_p015_6.png]

**Figure 7.** Figure 7: ASVSpoof 2019, a reasoning training example for a [PITH_FULL_IMAGE:figures/full_fig_p015_7.png]

**Figure 8.** Figure 8: ASVSpoof 2019, a reasoning training example for a [PITH_FULL_IMAGE:figures/full_fig_p015_8.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Large Audio Language Models for Spoofing-Aware Speaker Verification
cs.SD 2026-07 conditional novelty 6.0 of 10

Adapted LALMs can reach competitive spoofing-aware speaker verification (89.3% accuracy, 0.19 min a-DCF on an ASVspoof5 subset), though zero-shot performance is near chance.
JECA^2: Judgment-Explanation Consistent Adversarial Attack against Forensic Vision-Language Models
cs.CV 2026-05 unverdicted novelty 6.0 of 10

JECA^2 is a new white-box attack method using Grad-CAM-guided perturbations and prompt embedding optimization to achieve judgment-explanation consistent adversarial attacks on forensic VLMs.

Reference graph

Works this paper leans on

22 extracted references · 7 linked inside Pith · cited by 2 Pith papers

[1]

• White Noise:Gaussian noise added to the sig- nal

Background Noise Recipe (Anoise) This strategy tests the model’s ability to separate speech from interference. • White Noise:Gaussian noise added to the sig- nal. Signal-to-Noise Ratio (SNR) is sampled uniformlyU∼[15,25]dB. • Environmental Noise:Real-world back- ground audio (wind, footsteps, breathing, coughing, rain, clock ticks, sneezing) mixed with th...
[2]

• Time Stretch:The waveform is stretched or compressed without altering pitch using Phase V ocoding

Time & Pitch Recipe (Atime) This strategy targets temporal alignment and fre- quency perception. • Time Stretch:The waveform is stretched or compressed without altering pitch using Phase V ocoding. Ratios are sampled from {0.90×,0.95×,1.05×,1.10×}. • Time Shift:The audio is cyclically rolled along the time axis. Shift magnitudes are sampled from {1600,160...
[3]

InProceed- ings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 15752–15766, Suzhou, China

What you read isn’t what you hear: Linguistic sensitivity in deepfake speech detection. InProceed- ings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 15752–15766, Suzhou, China. Association for Computational Lin- guistics. S Sakshi, Utkarsh Tyagi, Sonal Kumar, Ashish Seth, Ramaneswaran Selvakumar, Oriol Nieto, Ramani Du...

2025
[4]

Mmau: A massive multi-task audio un- derstanding and reasoning benchmark.Preprint, arXiv:2410.19168. George Saon, Avihu Dekel, Alexander Brooks, Tohru Nagano, Abraham Daniels, Aharon Satt, Ashish Mit- tal, Brian Kingsbury, David Haws, Edmilson Morais, Gakuto Kurata, Hagai Aronowitz, Ibrahim Ibrahim, Jeff Kuo, Kate Soule, Luis Lastras, Masayuki Suzuki, Ron...

arXiv
[5]

Hemlata Tak, Jose Patino, Massimiliano Todisco, An- dreas Nautsch, Nicholas Evans, and Anthony Larcher

Granite-speech: open-source speech-aware llms with strong english asr capabilities.Preprint, arXiv:2505.08699. Hemlata Tak, Jose Patino, Massimiliano Todisco, An- dreas Nautsch, Nicholas Evans, and Anthony Larcher

arXiv
[6]

See our github for all 50+ questions

Quality:Are there audible digital artifacts, metallic ringing, or static? Does the audio con- tain natural environmental cues (reverb/reflec- tions)? Is the audio quality consistent from be- ginning to end? Note: Only a subset of the full bank is shown. See our github for all 50+ questions. C AI Assistants Usages During the preparation of this work, we ut...
[8]

Zihan Yan, Hongxia Wang, Mingshan Du, and Rui Zhang

Fakesound2: A benchmark for explainable and generalizable deepfake sound detection.Preprint, arXiv:2509.17162. Zihan Yan, Hongxia Wang, Mingshan Du, and Rui Zhang. 2024. Temporal localization of deepfake au- dio based on self-supervised pretraining models and transformer classifier. In2024 9th International Con- ference on Cloud Computing and Big Data Ana...

arXiv 2024
[12]

• Volume Change:Amplitude scaling factor sampled uniformlyU∼[0.5,2.0]

Shape & Space Recipe (Ashape) This strategy manipulates the signal envelope and spatial characteristics. • Volume Change:Amplitude scaling factor sampled uniformlyU∼[0.5,2.0]. • Fade Effects:Application of linear, logarith- mic, exponential, or sine-based fade-in/fade- out envelopes. Fade duration is fixed up to 50% of the audio length. 11 /uni00000034/un...

2000

Show all 22 references

[13]

Learning rate is set to 1e-4 with a linear decay scheduler

Optimization:AdamW optimizer with β1 = 0.9, β2 = 0.95 . Learning rate is set to 1e-4 with a linear decay scheduler
[14]

4.Regularization:Weight decay of0.1

Batch Size:Global batch size of 16 (2 per device×gradient accumulation). 4.Regularization:Weight decay of0.1
[15]

The Low-Rank Adaptation (LoRA) hyperparam- eters were configured as follows: 1.Rank (r):16 2.Alpha (α):64 3.Dropout:0.05

Training Duration:Models are trained until convergence (variable epochs) without early stopping. The Low-Rank Adaptation (LoRA) hyperparam- eters were configured as follows: 1.Rank (r):16 2.Alpha (α):64 3.Dropout:0.05
[16]

American Female

Target Modules:Query, Key, Value, and Out- put projection layers ([q, k, v, o]_proj) A.3 Adversarial Attack Results A.3.1 Acoustic Adversarial Attacks Results Table 4 highlights the destabilizing effect of signal- level perturbations on the reasoning chain. We observe a distin...

2019
[17]

lending" (00:03) and the incorrect stress on

Prosody:Does the audio sound like a naturally produced human recording? Is the pitch contour flat and devoid of variation? Does the speaker’s 14 You are an expert in speech analysis in audio deepfake detection. Please analyze the speech under these criteria, then provide the c...

2019
[18]

Disfluency:Is the speech completely devoid of fillers or breathing pauses? Does the speaker exhibit natural fillers like ’um’ or ’uh’? Are there excessive or glitch-like repetitions of specific sounds? Do pauses occur at logical syntactic boundaries?
[19]

Speed:Is the overall speaking rate within a nat- ural range? Does the speaker maintain a rigid, machine-like consistency in speed? Does the tempo fluctuate erratically within a single sen- tence?
[20]

Speaking Style:Does the speaker articulate with unnatural, robotic precision? Does the de- livery sound like scripted ’read speech’? Are there instances of garbled or fractured articula- tion?
[21]

Liveliness:Are audible breathing sounds or nat- ural pauses present? Does the voice possess natural warmth versus a sterile quality? Does the audio sound unnaturally clean, as if in an acoustic void?
[2021]

Preprint, arXiv:2011.01108

End-to-end anti-spoofing with rawnet2. Preprint, arXiv:2011.01108. Hemlata Tak, Massimiliano Todisco, Xin Wang, Jee weon Jung, Junichi Yamagishi, and Nicholas Evans

2011 arXiv
[2022]

better be computer or i’m dumb

Automatic speaker verification spoofing and deepfake detection using wav2vec 2.0 and data aug- mentation.Preprint, arXiv:2202.12233. Kutub Uddin, Muhammad Umar Farooq, Awais Khan, and Khalid Mahmood Malik. 2025. Adversarial at- tacks on audio deepfake detection: A benchmark an...

2025 arXiv
[2024]

Anthony Cuthbertson

Qwen2-audio technical report.Preprint, arXiv:2407.10759. Anthony Cuthbertson. 2023. Ai clones child’s voice in fake kidnapping scam. https://www.independen t.co.uk/tech/ai-voice-clone-scam-kidnapp ing-b2319083.html. DeepSeek-AI, Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Son...

2023 arXiv
[2025]

Wanying Ge, Jose Patino, Massimiliano Todisco, and Nicholas Evans

Deepseek-r1: Incentivizing reasoning capa- bility in llms via reinforcement learning.Preprint, arXiv:2501.12948. Wanying Ge, Jose Patino, Massimiliano Todisco, and Nicholas Evans. 2024. Explaining deep learn- ing models for spoofing and deepfake detection with shapley additive...

2024 arXiv
[2026]

She spoke clearly

Forensic deepfake audio detection using seg- mental speech features.Forensic Science Interna- tional, 379:112768. Wanqi Yang, Yanda Li, Yunchao Wei, Meng Fang, and Ling Chen. 2025. Speechr: A benchmark for speech reasoning in large audio-language models.Preprint, arXiv:2508.02...

2025 arXiv

Pith tools

Reviewed August 3, 2026 · model on record in the stance chip above.

[1] [1]

• White Noise:Gaussian noise added to the sig- nal

Background Noise Recipe (Anoise) This strategy tests the model’s ability to separate speech from interference. • White Noise:Gaussian noise added to the sig- nal. Signal-to-Noise Ratio (SNR) is sampled uniformlyU∼[15,25]dB. • Environmental Noise:Real-world back- ground audio (wind, footsteps, breathing, coughing, rain, clock ticks, sneezing) mixed with th...

[2] [2]

• Time Stretch:The waveform is stretched or compressed without altering pitch using Phase V ocoding

Time & Pitch Recipe (Atime) This strategy targets temporal alignment and fre- quency perception. • Time Stretch:The waveform is stretched or compressed without altering pitch using Phase V ocoding. Ratios are sampled from {0.90×,0.95×,1.05×,1.10×}. • Time Shift:The audio is cyclically rolled along the time axis. Shift magnitudes are sampled from {1600,160...

[3] [3]

InProceed- ings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 15752–15766, Suzhou, China

What you read isn’t what you hear: Linguistic sensitivity in deepfake speech detection. InProceed- ings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 15752–15766, Suzhou, China. Association for Computational Lin- guistics. S Sakshi, Utkarsh Tyagi, Sonal Kumar, Ashish Seth, Ramaneswaran Selvakumar, Oriol Nieto, Ramani Du...

2025

[4] [4]

Mmau: A massive multi-task audio un- derstanding and reasoning benchmark.Preprint, arXiv:2410.19168. George Saon, Avihu Dekel, Alexander Brooks, Tohru Nagano, Abraham Daniels, Aharon Satt, Ashish Mit- tal, Brian Kingsbury, David Haws, Edmilson Morais, Gakuto Kurata, Hagai Aronowitz, Ibrahim Ibrahim, Jeff Kuo, Kate Soule, Luis Lastras, Masayuki Suzuki, Ron...

arXiv

[5] [5]

Hemlata Tak, Jose Patino, Massimiliano Todisco, An- dreas Nautsch, Nicholas Evans, and Anthony Larcher

Granite-speech: open-source speech-aware llms with strong english asr capabilities.Preprint, arXiv:2505.08699. Hemlata Tak, Jose Patino, Massimiliano Todisco, An- dreas Nautsch, Nicholas Evans, and Anthony Larcher

arXiv

[6] [6]

See our github for all 50+ questions

Quality:Are there audible digital artifacts, metallic ringing, or static? Does the audio con- tain natural environmental cues (reverb/reflec- tions)? Is the audio quality consistent from be- ginning to end? Note: Only a subset of the full bank is shown. See our github for all 50+ questions. C AI Assistants Usages During the preparation of this work, we ut...

[7] [8]

Zihan Yan, Hongxia Wang, Mingshan Du, and Rui Zhang

Fakesound2: A benchmark for explainable and generalizable deepfake sound detection.Preprint, arXiv:2509.17162. Zihan Yan, Hongxia Wang, Mingshan Du, and Rui Zhang. 2024. Temporal localization of deepfake au- dio based on self-supervised pretraining models and transformer classifier. In2024 9th International Con- ference on Cloud Computing and Big Data Ana...

arXiv 2024

[8] [12]

• Volume Change:Amplitude scaling factor sampled uniformlyU∼[0.5,2.0]

Shape & Space Recipe (Ashape) This strategy manipulates the signal envelope and spatial characteristics. • Volume Change:Amplitude scaling factor sampled uniformlyU∼[0.5,2.0]. • Fade Effects:Application of linear, logarith- mic, exponential, or sine-based fade-in/fade- out envelopes. Fade duration is fixed up to 50% of the audio length. 11 /uni00000034/un...

2000