Pith. sign in

REVIEW 3 major objections 6 minor 25 references

A four-backbone ensemble of frozen speech encoders caught all unseen participant deepfakes and scored 0.9522 in the official ImageCLEF 2026 detection task; a sampling-rate shortcut contributed in a way the authors could not verify.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-04 20:38 UTC pith:JGLJCKQH

load-bearing objection Honest, unusually self-critical competition report, but the perfect participant-fake score is confounded by the §4.4 sample-rate heuristic and cannot carry the cross-generator claim. the 3 major comments →

arxiv 2608.01796 v1 pith:JGLJCKQH submitted 2026-08-03 cs.SD cs.CR

Multi-Backbone Self-Supervised Ensembles for Audio Deepfake Detection and a Cross-Track Analysis of Generation-Detection Asymmetry

Seunghyun Kim , Junghyun Kim , Jiyoung Woo This is my paper
classification cs.SD cs.CR
keywords audio deepfake detectionself-supervised learning ensemblemulti-backbone diversityarchitectural insurancegeneration–detection asymmetrytext-to-speech synthesissample-rate heuristicgeneralization to unseen generators
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper tries to establish a mechanism for audio deepfake detection: a four-backbone ensemble of frozen self-supervised speech encoders generalizes to unseen deepfake generators because its backbones occupy different 'representational regions' whose predictions are weakly correlated — what the authors call architectural insurance. On the official ImageCLEF 2026 detection evaluation, the ensemble scored 0.9522 and detected 100% of participant-generated deepfakes from generator families it had not been trained on. The paper pairs this with a first-place generation submission and reads the score gap as structural: a defender succeeds when any one of its backbones catches an artefact (OR-gate), while an attacker must simultaneously fool every backbone (AND-gate). A submission-time sample-rate rule — every file not at 16 kHz labeled fake — plausibly contributed to the perfect mark, and the paper cannot recompute the counterfactual without organizer ground truth. If the mechanism holds, detection systems should be engineered for backbone-region diversity, their gains measured on the hard-attack disagreement channel, and the 11.25% false-positive rate on genuine recordings is the principal open deployment challenge.

Core claim

v18d — four frozen self-supervised encoders (WavLM, XLS-R, ECAPA-TDNN, x-vector) — scored 0.9522 on the official detection evaluation and caught all unseen participant deepfakes. The paper claims this is architectural insurance: robustness comes from diversity across three backbone regions (WavLM; content-acoustic cluster; ECAPA-TDNN), not backbone count. The same geometry yields an OR-gate/AND-gate asymmetry between defender and attacker, quantified by the lowest cross-region correlation, r=0.522. Four candidate interventions failed; only backbone diversification raised the ceiling. A submission-time rule labeling every non-16 kHz file as fake contributed to the official mark.

What carries the argument

Architectural insurance — ensemble robustness from representational diversity across backbone regions, not backbone count — is the paper's central object. It is made measurable by a three-region geometry of pairwise prediction correlations on the hardest hybrid attack: Region 1 WavLM; Region 2 the tightly correlated content-acoustic cluster (XLS-R, HuBERT, Whisper, x-vector); Region 3 ECAPA-TDNN alone, at r=0.522 with WavLM, shown by a PCA-192 ablation to be representational rather than a dimensionality artefact. The OR-gate/AND-gate frame converts this into an asymmetry: a defender trips when any region detects, an attacker must pass all regions. A second mechanism carries the official scor

Load-bearing premise

The load-bearing premise is that every test file sampled at 22.05 or 24 kHz is a deepfake — the submission-time rule that labeled 12.5% of the official test set as fake — because the paper cannot verify how many of the organizers' genuine ground-truth recordings were stored at non-16 kHz rates; if a substantial share were, the perfect score on participant deepfakes and much of the 0.9522 reflect the rule, not the ensemble.

What would settle it

Inspect the sampling rates of the organizer ground-truth real files: if they are all or mostly 16 kHz, the sample-rate rule cannot explain the 11.25% false-positive gap and that explanation collapses. Directly re-scoring the official test set without the 22.05/24 kHz rule, using organizer ground truth, would quantify the rule's contribution to the 1.0000 and 0.9522 figures. Separately, running v18d against in-the-wild deepfakes — the paper's own stated falsification — would test whether architectural insurance survives outside the team's five internal fake variants.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • Ensembles should be built by screening candidate backbones for cross-region correlation: adding backbones from the tightly correlated content-acoustic cluster (r≈0.97) saturates, while adding an isolated region (r≈0.52) widens the disagreement channel that protects against hard hybrid attacks.
  • Evaluation should be reported on the hard-attack disagreement set, not just mean AUC: the ensemble's value concentrates in the roughly 1.5% of files where backbones disagree, mostly on the hardest multi-model hybrid.
  • The attacker's evasion problem is structurally harder than any single-detector metric suggests: to pass a multi-region defender, a generator must evade every region at once, so joint evasion rates should fall well below marginal ones.
  • Deployment of the v18d strategy requires knowing the sampling-rate distribution of genuine recordings: the rule that produced the perfect fake score also produced an 11.25% false-positive rate on previously unseen real data, the paper's stated principal open challenge.
  • A team's internal detector suite is not a reliable oracle for deployed detection: the generation submission the authors' own six-detector suite ranked as weakest (the reverberated entry) nonetheless ranked first in the official evaluation.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the OR/AND geometry is stable, each additional independent backbone region should multiply an attacker's required evasion effort, so the detection–generation score gap should widen as ensembles diversify — a measurable prediction for future multi-team competitions.
  • The official inversion of the generation-track ordering — a reverberated entry beating a cherry-picked hybrid — suggests deployed detectors respond to post-processing artifacts more than to vocoder fingerprints; the paper reports the observation without generalizing, and a detector-ecosystem study could test this directly.
  • The sample-rate heuristic is a warning about benchmark design: if future test sets include genuine multi-rate recordings, the same rule would cause a flood of false positives; releasing the without-rule official counterfactual would settle how much of the 0.9522 is heuristic versus ensemble.
  • The three-region geometry, if it generalizes, is a cheap design tool: measure a candidate backbone's correlation with existing regions before investing compute in ensembling it, turning backbone selection into a budgeted screening step.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper reports Team Go-To-Germany's participation in the ImageCLEF 2026 Audio Deepfake Detection and Generation tasks. For Detection, the system uses four frozen SSL backbones (WavLM-Large, Wav2Vec2-XLS-R-300M, ECAPA-TDNN, x-vector), logistic-regression heads, a weighted ensemble, a top-960 conservative threshold, and a hard sample-rate rule that labels every non-16 kHz file as fake. The official score is 0.9522, with 1.0000 on participant-generated deepfakes and 0.8875 on held-out organizer real data. For Generation, the authors describe a four-model TTS program; their official submission, an F5-TTS v1 baseline with a uniform reverberation pass, ranked first with a final score of 0.4304. The paper develops a cross-track asymmetry argument and an 'architectural insurance' hypothesis, supported by LOSO experiments, bootstrap intervals, PCA ablations, and pre-registered falsifications.

Significance. If the central robustness claim were cleanly established, the paper would make a noteworthy contribution: a reproducible multi-backbone SSL ensemble, honest reporting of negative results, bootstrap-verified margins, and a mechanistically framed cross-track comparison. The strength of the paper is its transparent description of what did not work and its explicit limitation sections. However, the headline claim of cross-generator generalization is currently confounded by the §4.4 sample-rate heuristic, so the significance is conditional on reframing and on obtaining additional evidence. The architectural-insurance hypothesis is plausible but remains a hypothesis rather than an established result.

major comments (3)
  1. [§4.7, Eq. (2), Table 6] The central robustness claim is not supported by the reported evidence. The 1.0000 score on participant deepfakes is produced by the full submission pipeline, which includes the §4.4 hard rule labeling all 22.05/24 kHz files as fake. Table 6 explicitly states that the without-rule counterfactuals cannot be recomputed without organizer ground-truth, and §7.1 concedes that the 11.25% false-positive gap is 'within 0.0125' of the 12.5% non-16 kHz fraction. Therefore the sentence 'indicates that the v18d ensemble generalized to generator families it had not been trained against' is an overclaim. The authors should rephrase the claim to state what is actually known, and should present the official score as confounded unless organizer ground-truth is obtained.
  2. [§5.1 and §5.3] The cross-track asymmetry argument rests on the same confounded detection score. The 0.9522 vs. 0.4304 gap is not a clean comparison: the detection score partly reflects the sample-rate heuristic, and the generation score comes from an intentionally old F5-TTS baseline submitted before the authors' own four-model program. The 'OR-versus-AND' structural asymmetry and the phrase 'empirical estimate of the asymmetry' should be downgraded to a hypothesis consistent with the limited data, not a measured estimate. The authors already acknowledge N=1; they should also acknowledge the heuristic confound in this section.
  3. [§4.6, §6.2] The internal LOSO evidence does not repair the central claim. All LOSO AUCs are computed only on the team's own five fake variants, all generated by the same team, and they deliberately exclude the sample-rate rule. The three-region representational geometry is therefore an internal description of the authors' own generator set, not evidence of generalization to unseen generator families. The paper should explicitly state that the architectural-insurance mechanism is supported only for in-distribution, team-generated fakes, and that no claim about unseen competitors follows from §6.
minor comments (6)
  1. [Abstract and §4.7] The abstract repeats 'perfect accuracy (1.0000) on participant-generated deepfakes' without the caveat that this score includes the sample-rate rule. The caveat should appear in the abstract or the phrase should be qualified.
  2. [§4.4] The statement that non-16 kHz files are 'with high probability' competitor submissions is not quantified. A brief report of the sampling-rate distribution of the training/reference sets would strengthen this heuristic's motivation.
  3. [Figure 2] The text boxes say 'trip?' which appears to be a typo for 'trigger?'. Please correct.
  4. [§3.5 and §4.7] There are two 'Table 4' captions? Actually only one Table 4 appears in §3.5, but the text at the start of §4 says 'Table 4 juxtaposes the two entries,' which is clear. However, the table number is repeated in the narrative; renumber if needed.
  5. [§3.4, Table 3] The entries '~3.1' and '—' are informal and should be replaced with actual values or a consistent placeholder.
  6. [Overall] The phrase 'architectural insurance' is used very frequently. Consider defining it once and using 'the proposed mechanism' thereafter to improve readability.

Circularity Check

1 steps flagged

Central cross-generator robustness claim is partly true by construction: the §4.4 sample-rate rule labels 12.5% of the test set fake, and the official 1.0000 participant-fake score is read as ensemble generalization without the without-rule counterfactual.

specific steps
  1. fitted input called prediction [§4.4 (sample-rate heuristic), §4.7 (official results), §7.1 (limitations), Table 6]
    "We therefore applied a hard rule at submission time: every file with a sampling rate in {22,050,24,000} is labeled fake, which affects 1,440 files (12.5% of the test set). ... The score of 1.0000 on participant-generated deepfakes (weight 0.4) indicates that the v18d ensemble generalized to generator families it had not been trained against, which is the central robustness claim of this work; ... the same rule ... contributed to the 1.0000 on Participant Deepfake Weighted."

    The paper's headline robustness claim is that a perfect score on participant-generated deepfakes proves the v18d ensemble generalized to unseen generators. But the submission pipeline included a deterministic, model-free rule that labels every 22.05/24 kHz file as fake, and the rule was derived from the authors' own Generation-side artifacts (Insight E). Table 6 explicitly states that the without-rule counterfactual cannot be recomputed without organizer ground-truth, so the official score cannot separate files classified by the resampling rule from files actually detected by the four-backbone ensemble. §7.1 concedes the rule 'contributed to' the 1.0000 on the participant-fake partition. Thus, for an unknown but potentially substantial share of that partition, the perfect score is achieved

full rationale

The official ImageCLEF evaluation provides an external anchor, and much of the ablation work (§4.6, §6) is internally consistent and falsifiable on the team's own fakes. However, the central cross-generator claim—1.0000 on participant fakes demonstrates generalization to unseen generator families—is confounded by the §4.4 submission-time rule. Because the rule was motivated by the same team's generation artifacts and applied to 12.5% of all test files, and because the paper admits it 'contributed to' the perfect participant-fake score while being unable to compute the without-rule counterfactual, the official result cannot validate the ensemble's generalization. This is a fitted-input-called-prediction pattern: a heuristic derived from the authors' own data is folded into the submission, and the resulting score is then read as evidence for the very design that produced the heuristic. The rest of the paper's internal experiments (LOSO, three-region geometry, bootstrap intervals, pre-registered falsifications) are not circular, since they test claims on held-out speakers and distribution shifts without relying on the official score. Overall score 6: partial circularity in the central robustness claim, while substantial independent experimental content remains.

Axiom & Free-Parameter Ledger

6 free parameters · 5 axioms · 1 invented entities

The central detection claim depends on the sample-rate heuristic and the internal fake pool as proxies for the unseen participant population. These are domain assumptions, not standard math. The architectural-insurance mechanism is supported only by internal measurements. The three-region taxonomy is an explanatory construct without independent evidence.

free parameters (6)
  • Ensemble weights (WavLM, XLS-R, ECAPA-TDNN, x-vector) = 0.30, 0.25, 0.225, 0.225
    Hand-tuned on internal LOSO validation; define the v18d detection score.
  • Top-960 conservative threshold = 960 lowest-ranked files labeled real
    Chosen from expected fake volume; transductive, uses test-set ranking (Section 4.6.3).
  • Non-16 kHz hard rule = 22.05 and 24 kHz labeled fake
    Set from test-set rate distribution and generation-side Insight E; affects 12.5% of test files and confounds the 1.0000 participant score.
  • v7b WavLM:XLS-R weighting = 0.6:0.4
    Intermediate tuned configuration used in internal experiments on the path to v18d.
  • SSL last-four layer averaging = layers 21-24
    Selected after layer-selection experiments (C1) showed last-four baseline matched or exceeded other layer choices.
  • Reverberation pass parameters (generation entry) = room_size=0.15, wet_level=0.08
    Chosen for the official generation submission as an anti-forensic probe; load-bearing for the generation first-place result.
axioms (5)
  • domain assumption The 12.5% of test files at 22.05/24 kHz are overwhelmingly participant submissions that did not resample
    Stated in Section 4.4; load-bearing for the sample-rate rule and the 1.0000 participant-deepfake score; not independently verified and possibly contradicted by the real-GT false-positive gap.
  • domain assumption The 2,400 self-generated fake utterances are representative of the participant deepfake population for LOSO evaluation
    Implicit throughout Sections 4.6 and 6; acknowledged as a limitation in Section 7.2.
  • domain assumption Pairwise probability correlations measured on the team's own hardest hybrid attack generalize to unseen participant attacks
    Basis of the architectural-insurance hypothesis (Sections 4.6.1 and 6.2); not validated on external corpora.
  • domain assumption The organizer-provided evaluation formulas and scores (Eq. 1, Eq. 2, Table 5) are accurate
    Final Scores are taken from the official evaluation release; the paper cannot recompute them without ground truth.
  • domain assumption Pretrained SSL backbones (WavLM, XLS-R, ECAPA-TDNN, x-vector) provide reliable, generalizable feature extractors
    Standard practice in the field; the paper relies on frozen pretrained weights without fine-tuning.
invented entities (1)
  • Three-region representational geometry (R1 WavLM, R2 content-acoustic cluster, R3 ECAPA-TDNN) no independent evidence
    purpose: Explanatory taxonomy for architectural insurance: ensemble value comes from region diversity, not backbone count
    The regions are a descriptive clustering of six backbones based on pairwise correlations measured on the team's own hybrid attack; the paper proposes TitaNet-Large as a future disconfirming test but provides no external validation.

pith-pipeline@v1.3.0-daily-deepseek · 19076 in / 16978 out tokens · 156977 ms · 2026-08-04T20:38:09.630114+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of Multi-Backbone Self-Supervised Ensembles for Audio Deepfake Detection and a Cross-Track Analysis of Generation-Detection Asymmetry." pith.science (2026). https://pith.science/paper/JGLJCKQH

@misc{pith2026260801796,
  author       = {Pith},
  title        = {Pith review of: Multi-Backbone Self-Supervised Ensembles for Audio Deepfake Detection and a Cross-Track Analysis of Generation-Detection Asymmetry},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JGLJCKQH}},
  note         = {Machine review of arXiv:2608.01796}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

This paper describes the participation of team "Go-To-Germany" in the ImageCLEF 2026 Audio Deepfake Detection and Generation task. Our detection system, built on a four-backbone self-supervised learning (SSL) ensemble combining WavLM-Large, Wav2Vec2-XLS-R-300M, ECAPA-TDNN, and x-vector representations, achieved a final score of 0.9522 on the official ImageCLEF 2026 evaluation, with perfect accuracy (1.0000) on participant-generated deepfakes and 0.8875 on the held-out organizer ground-truth real data. For the Generation sub-task, our official team submission, an F5-TTS v1 baseline processed with a uniform reverberation pass and submitted as a deliberate anti-forensic probe, ranked first with a final score of 0.4304 (word error rate (WER) 4.99%, character error rate (CER) 2.07%); details of our four-model program (GLM-TTS, F5-TTS, XTTS v2, CosyVoice3), from which the official entry was drawn, appear in the paper. We present a cross-track analysis revealing a pronounced asymmetry: our detection system identifies 100% of participant-generated deepfakes, while our official generation entry, despite ranking first in the Audio Generation sub-task and evading 61.4% and 56.2% of participant and organizer detectors, attains a Final Score of 0.4304 against 0.9522 on the Detection side. We further report falsification-based ablation experiments (LOSO 56-speaker cross-validation, three-region backbone geometry, bootstrap confidence intervals, and PCA analysis) that motivate our architectural-insurance hypothesis for multi-backbone SSL ensembling. We complement these results with five cross-track insights and five pre-registered falsification experiments connecting generation-side evasion to detection-side design decisions, and we openly report an 11.25% false-positive gap on held-out organizer real recordings as the principal open challenge for deployment.

Figures

Figures reproduced from arXiv: 2608.01796 by Jiyoung Woo, Junghyun Kim, Seunghyun Kim.

Figure 1
Figure 1. Figure 1: Four-backbone SSL ensemble system for Audio Detection. Each frozen backbone produces utterance￾level embeddings independently; per-backbone logistic-regression classifiers are combined via weighted ensemble (𝑤 = 0.30, 0.25, 0.225, 0.225) to produce the final fake-probability. The top-960 ranking strategy (§4.6.3) maps the ranked probabilities to a binary CSV submission [PITH_FULL_IMAGE:figures/full_fig_p0… view at source ↗
Figure 2
Figure 2. Figure 2: Structural asymmetry between defender and attacker in a multi-backbone SSL ensemble. The defender succeeds when any single region (𝑅1 WavLM, 𝑅2 content-acoustic, 𝑅3 ECAPA-TDNN) detects an artefact (OR-gate), whereas the attacker must simultaneously evade every region (AND-gate). The measured inter-region correlation 𝑟(WavLM, ECAPA-TDNN) = 0.522 (§5.1) implies that joint evasion is substantially harder than… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

25 extracted references · 8 canonical work pages · 2 internal anchors

  1. [1]

    Stanciu, A

    D. Stanciu, A. Radu, R. Bolborici, M. Negru, A. Ene, V. Vasilescu, A.-A. Nicolae, B. Ionescu, L. Ştefan, M. Constantin, M. Dogariu, A. Andrei, Overview of imageclef 2026 deepfake task: Multimodal detection and generation of deepfakes, in: CLEF 2026 Working Notes, CEUR Workshop Proceedings, CEUR-WS.org, Jena, Germany, 2026

    work page 2026

  2. [2]

    Ionescu, H

    B. Ionescu, H. Müller, D. Stanciu, A. Radu, R. Bolborici, M. Negru, A. Ene, V. Vasilescu, A.-A. Nicolae, L. Ştefan, M. Constantin, M. Dogariu, A. Andrei, H. Damm, T. M. G. Pakull, A. Ben Abacha, A. García Seco de Herrera, C. M. Friedrich, R. Brüngel, L. Reinartz, H. Schäfer, C. S. Schmidt, B. Bracke, P. Nath, B. Eryılmaz, M. Hjuler, D. Fabre, C. Lemaire, ...

    work page 2026

  3. [3]

    Mittag, B

    G. Mittag, B. Naderi, A. Chehadi, S. Möller, NISQA: A deep CNN-self-attention model for multi- dimensional speech quality prediction with crowdsourced datasets, in: Proc. Interspeech 2021, 2021

    work page 2021

  4. [4]

    X. Wang, H. Delgado, H. Tak, J.-w. Jung, H.-j. Shim, M. Todisco, I. Kukanov, X. Liu, M. Sahidullah, T. Kinnunen, N. Evans, K. A. Lee, J. Yamagishi, ASVspoof 5: Crowdsourced speech data, deepfakes, and adversarial attacks at scale, in: ASVspoof Workshop, 2024. ArXiv:2408.08739

    Pith/arXiv arXiv 2024

  5. [5]

    Combei, A

    D. Combei, A. Stan, D. Oneata, H. Cucu, WavLM model ensemble for audio deepfake detection, in: ASVspoof Workshop, 2024. ArXiv:2408.07414

    Pith/arXiv arXiv 2024

  6. [6]

    Serrano, R

    P. Serrano, R. Duroselle, F. Angulo, J.-F. Bonastre, O. Boeffard, Improving out-of-domain audio deepfake detection via layer selection and fusion of ssl-based countermeasures, arXiv preprint arXiv:2509.12003 (2025)

    arXiv 2025

  7. [7]

    H. Gu, J. Yi, C. Wang, J. Tao, Z. Lian, J. He, Y. Ren, Y. Chen, Z. Wen, ALLM4ADD: Unlocking the capabilities of audio large language models for audio deepfake detection, in: ACM Multimedia,

    work page

  8. [8]

    Xu, et al., HoliAntiSpoof: Audio LLM for holistic speech anti-spoofing (2026)

    X. Xu, et al., HoliAntiSpoof: Audio LLM for holistic speech anti-spoofing (2026). ArXiv:2602.04535

    arXiv 2026

  9. [9]

    Singh, A

    R. Singh, A. Y. Nair, F. Palumbo, F. Barbaro, A. Dyka, L. Rachakonda, Audio deepfake detection in the age of advanced text-to-speech models (2026). ArXiv:2601.20510

    work page arXiv 2026

  10. [10]

    S. Chen, C. Wang, Z. Chen, Y. Wu, S. Liu, Z. Chen, J. Li, N. Kanda, T. Yoshioka, X. Xiao, J. Wu, L. Zhou, S. Ren, Y. Qian, Y. Qian, M. Zeng, F. Wei, WavLM: Large-scale self-supervised pre-training for full stack speech processing, IEEE Journal of Selected Topics in Signal Processing (2022). ArXiv:2110.13900

    arXiv 2022

  11. [11]

    W.-N. Hsu, B. Bolte, Y.-H. H. Tsai, K. Lakhotia, R. Salakhutdinov, A. Mohamed, HuBERT: Self- supervised speech representation learning by masked prediction of hidden units, IEEE/ACM Transactions on Audio, Speech, and Language Processing 29 (2021) 3451–3460. doi: 10.1109/ TASLP.2021.3122291, arXiv:2106.07447

    work page arXiv 2021

  12. [12]

    A. Babu, C. Wang, A. Tjandra, K. Lakhotia, Q. Xu, N. Goyal, K. Singh, P. von Platen, Y. Saraf, J. Pino, A. Baevski, A. Conneau, M. Auli, XLS-R: Self-supervised cross-lingual speech representation learning at scale, in: Interspeech, 2022. ArXiv:2111.09296

    Pith/arXiv arXiv 2022

  13. [13]

    H. Tak, J. Patino, M. Todisco, A. Nautsch, N. Evans, A. Larcher, End-to-end anti-spoofing with RawNet2, in: ICASSP 2021 – 2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2021, pp. 6369–6373. ArXiv:2011.01108

    work page internal anchor Pith review Pith/arXiv arXiv 2021

  14. [14]

    Jung, H.-S

    J.-w. Jung, H.-S. Heo, H. Tak, H.-j. Shim, J. S. Chung, B.-J. Lee, H.-J. Yu, N. Evans, AASIST: Audio anti-spoofing using integrated spectro-temporal graph attention networks, in: ICASSP 2022 – 2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2022, pp. 6367–6371. ArXiv:2110.01200

    Pith/arXiv arXiv 2022

  15. [15]

    Y. Chen, Z. Niu, Z. Ma, K. Deng, C. Wang, J. Zhao, K. Yu, X. Chen, F5-TTS: A fairytaler that fakes fluent and faithful speech with flow matching, arXiv preprint arXiv:2410.06885 (2024)

    Pith/arXiv arXiv 2024

  16. [16]

    Casanova, et al., XTTS: A massively multilingual zero-shot text-to-speech model, arXiv preprint arXiv:2406.04904 (2024)

    E. Casanova, et al., XTTS: A massively multilingual zero-shot text-to-speech model, arXiv preprint arXiv:2406.04904 (2024)

    Pith/arXiv arXiv 2024

  17. [17]

    Z. Du, Q. Chen, S. Zhang, K. Hu, H. Lu, Y. Yang, et al., CosyVoice: A scalable multilingual zero-shot text-to-speech synthesizer based on supervised semantic tokens, arXiv preprint arXiv:2407.05407 (2024)

    Pith/arXiv arXiv 2024

  18. [18]

    Panayotov, G

    V. Panayotov, G. Chen, D. Povey, S. Khudanpur, LibriSpeech: An ASR corpus based on public domain audio books, in: ICASSP, 2015, pp. 5206–5210. doi:10.1109/ICASSP.2015.7178964

    arXiv 2015

  19. [19]

    Radford, J

    A. Radford, J. W. Kim, T. Xu, G. Brockman, C. McLeavey, I. Sutskever, Robust speech recognition via large-scale weak supervision, in: ICML, 2023, pp. 28492–28518. ArXiv:2212.04356

    Pith/arXiv arXiv 2023

  20. [20]

    Desplanques, J

    B. Desplanques, J. Thienpondt, K. Demuynck, ECAPA-TDNN: Emphasized channel attention, propagation and aggregation in TDNN based speaker verification, in: Interspeech, 2020, pp. 3830–3834. doi:10.21437/Interspeech.2020-2650, arXiv:2005.07143

    Pith/arXiv arXiv 2020

  21. [21]

    Snyder, D

    D. Snyder, D. Garcia-Romero, G. Sell, D. Povey, S. Khudanpur, X-Vectors: Robust DNN embeddings for speaker recognition, in: ICASSP, 2018, pp. 5329–5333. doi:10.1109/ICASSP.2018.8461375

    arXiv 2018

  22. [22]

    Ravanelli, T

    M. Ravanelli, T. Parcollet, P. Plantinga, A. Rouhe, S. Cornell, L. Lugosch, C. Subakan, N. Dawalatabad, A. Heba, J. Zhong, J.-C. Chou, S.-L. Yeh, S.-W. Fu, C.-F. Liao, E. Rastorgueva, F. Grondin, W. Aris, H. Na, Y. Gao, R. De Mori, Y. Bengio, SpeechBrain: A general-purpose speech toolkit (2021). ArXiv:2106.04624

    Pith/arXiv arXiv 2021

  23. [23]

    N. M. Müller, P. Czempin, F. Dieckmann, A. Froghyar, K. Böttinger, Does audio deepfake detection generalize?, in: Interspeech, 2022. ArXiv:2203.16263 — In-the-Wild (ITW) corpus

    arXiv 2022

  24. [24]

    C. Gao, M. Postiglione, I. Gortner, S. Kraus, V. S. Subrahmanian, Perturbed public voices (P2V): A dataset for robust audio deepfake detection (2025). ArXiv:2508.10949

    Pith/arXiv arXiv 2025

  25. [25]

    Z. Yan, Y. Zhao, H. Wang, VoiceWukong: Benchmarking deepfake voice detection, in: USENIX Security Symposium, 2025. ArXiv:2409.06348

    work page internal anchor Pith review Pith/arXiv arXiv 2025