Pith. sign in

REVIEW 5 major objections 8 minor 2 cited by

Transferable Adversarial Attacks on Audio Deepfake Detection

T0 review · 5 major / 8 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that a transferable GAN-based attack can bypass state-of-the-art audio deepfake detectors while preserving the spoken content and the perceived quality of the audio.

desk verdict Plausible transferable attack on audio deepfake detectors, but the transcription-preservation claim is circular and the paper needs major revision. read the letter →

arxiv 2501.11902 v1 pith:MF2RVDE7 submitted 2025-01-21 cs.SD eess.AS

Muhammad Umar Farooq , Awais Khan , Kutub Uddin , Khalid Mahmood Malik This is my paper · ORCID
classification cs.SDeess.AS
keywords audiodeepfakedetectiontransferableadversarialattackGAN-basedtranscriptionintegrityperceptualsurrogatemodelsASVspoof2019black-boxtransferability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to show that state-of-the-art audio deepfake detectors can be defeated by adversarial examples that transfer across models. The authors build a generative adversarial network (GAN) whose generator turns a deepfake clip into an attacked clip that a frozen ensemble of surrogate detectors classifies as real, while a self-supervised speech model and a text embedder keep the words and the sound quality close to the original. On the ASVspoof2019 benchmark, they report detector accuracy falling from around 98% to 26% when the attacker knows the model, and smaller but still measurable drops when the attacker has partial or no knowledge. If the results hold, existing ADD systems are not yet robust to transferable attacks, and claimed detection accuracy overstates their protection in the wild.

What carries the argument

The load-bearing object is the generator network, trained against three frozen critics: a discriminator, an ensemble of surrogate ADD models, and a wav2vec-to-BERT transcription model. The generator loss is a weighted sum of four terms, $L_G = \lambda_1 L_{\text{Perceptual}} + \lambda_2 L_{\text{Forensics}} + \lambda_3 L_{\text{Transcription}} + \lambda_4 L_{\text{Adversarial}}$, where the perceptual term is L1 distance to the input, the forensics term is cross-entropy against the surrogate ensemble, the transcription term is $1 - \cos(f, f')$ between BERT embeddings of the original and attacked transcripts, and the adversarial term is the discriminator's fake loss. A residual connection scaled by a learned $\alpha$ plus high-pass filtering keeps the output close to the input while removing artifacts. The ensemble's diversity is what converts a single-model attack into a transferable one.

What would settle it

Run a word error rate comparison against ground-truth transcripts on the paper's released attacked samples: if words change while the reported text embedding similarity stays near 0.95–1.00, the transcription-preservation claim fails. A simpler version is to have listeners transcribe original and attacked clips; any systematic word substitutions would falsify the claim that the attack preserves semantic content.

Watch

Extended reading notes

Core claim

The paper's central claim is that a transferable GAN-based adversarial attack can bypass current state-of-the-art audio deepfake detectors while preserving the transcribed content and the perceived quality of the audio. The generator is trained with an ensemble of surrogate ADD models plus a wav2vec-based transcription module, so the resulting perturbations are not tuned to one detector's weights. In white-box settings, Res-TSSDNet accuracy on ASVspoof2019 falls from 98.46% to 26.33%, and the average white-box accuracy across the two surrogate models drops to 70.01%, 46.48%, and 67.80% on ASVspoof2019, In-the-Wild, and WaveFake, respectively; gray-box and black-box detectors also lose accuracy but less dramatically. The authors interpret these results as showing that current ADD systems are vulnerable to transferable, perceptually clean adversarial audio.

Load-bearing premise

The core claim rests on the assumption that cosine similarity between wav2vec+BERT embeddings of original and attacked transcripts faithfully measures whether the words stayed the same, an assumption the paper never checks against an independent word-error-rate score.

Editorial extensions

If this is right

  • White-box ADD systems are highly vulnerable: on ASVspoof2019, Res-TSSDNet drops from 98.46% to 26.33% accuracy after the attack.
  • Attack transfer is real across architectures and datasets: models never used in training, such as RawNet2, ResNet, and MS-ResNet, lose accuracy on In-the-Wild and WaveFake.
  • Transcription-based ADD systems that verify text are also bypassed because the attack keeps its transcript aligned with the original audio while flipping the detector's decision.
  • The reported PSNR (39–44 dB), SSIM (0.96–0.99), and text similarity (0.87–1.00) imply that the attacked clips are hard to distinguish from the originals by ear or by waveform inspection.
  • Gray-box robustness improves with larger model variants, so model capacity appears to matter for resisting transferable attacks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the embedding-similarity proxy is looser than true transcription, the attack may be changing words without the reported text-similarity metric catching it; a word-error-rate audit would settle this.
  • The same generator-plus-transcription recipe could be pointed at automatic speech recognizers or voice assistants, since any differentiable audio classifier can serve as the surrogate ensemble.
  • A practical defense could run a second, independent ASR model on the audio and reject clips whose transcript disagrees with the claimed one; this directly targets the transcription-preservation assumption.
  • The lack of improvement when moving from two to three surrogates hints that architectural diversity, not the raw number of surrogates, drives transferability.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 8 minor

Summary. The paper proposes a transferable GAN-based adversarial attack framework for audio deepfake detection (ADD). The framework uses an ensemble of surrogate ADD models, a discriminator, and a transcription model (wav2vec + BERT) with losses for perceptual quality, forensics, transcription, and adversarial objectives. The authors evaluate the attack on ASVspoof2019, In-the-Wild, and WaveFake datasets under white-box, gray-box, and black-box settings, reporting large accuracy drops in state-of-the-art ADD systems and claiming that the adversarial audio preserves transcription and perceptual integrity.

Significance. If validated, the attack would be a useful stress test for ADD robustness and would extend GAN-based adversarial attacks to the audio deepfake domain, particularly by targeting transcription-based detectors. The inclusion of three datasets and five target models is a positive breadth. The paper also makes an effort to analyze attack quality via PSNR, SSIM, and text similarity. However, the central claim of transcription preservation is currently supported only by a circular evaluation, and the training objective as written contains a likely error in the discriminator loss. The black-box cross-dataset results are suggestive but lack baselines, error bars, and implementation details. The contribution is therefore not yet established at the level required for publication.

major comments (5)
  1. [§3.4, Eq. (11)] The discriminator loss is written as LD = log(1 − D(A)) + log(1 − D(G(A'))). Under this objective, the discriminator is trained to assign the 'fake' label to both real audio A and generated audio G(A'). This is not the standard GAN minimax objective (which would be log D(A) + log(1 − D(G(A')))), and it would prevent the discriminator from learning a meaningful real-vs-fake decision. If this is a typographical error, the correct form must be given; if it is intentional, the rationale and training behavior need a detailed explanation. As written, the training procedure is not a valid adversarial game.
  2. [§4.3.2, Table 5 and §3.4, Eq. (8)] The 'Text Similarity' metric in Table 5 is exactly 1 − LTranscription, i.e., the same cosine similarity between wav2vec+BERT embeddings that is optimized as the training loss in Eq. (8). This makes the transcription-preservation claim circular: the evaluation metric is the training objective, so high values only indicate that the optimization succeeded, not that spoken content is preserved in an independent sense. Furthermore, Fig. 5 explicitly states that 'The attack is evident in the transcript texts' and highlights changes in transcripts before and after the attack. On In-the-Wild, the reported similarity is only 0.87, implying non-negligible transcript edits. An independent measure such as word error rate against ground-truth transcripts, or a listening study, is required to support the claim that the attack preserves semantic transcription content.
  3. [§4.2.1–4.2.3, Table 4, and §5] The numbers reported in the text and the conclusion are inconsistent with Table 4 and with the abstract. The text in §4.2.1 says the average white-box performance drop is about 57%, but Table 4's 'Average' row shows post-attack accuracies of 70.01, 46.48, and 67.80 for the three datasets, which are not drops; the conclusion then describes 'accuracy drops of 57%, 30.5%, and 6%' and 'up to 70%, 47%, and 68% on ASVspoof2019, In-the-Wild, and WaveFake datasets' as if the post-attack accuracies were drops. Additionally, the white-box results are obtained using the same surrogate models on which the generator was trained, so the accuracy collapse is expected and does not demonstrate transferability. The black-box results are the meaningful evidence, and they should be reported with confidence intervals, a clear definition of the reported percentage (absolute vs. relative drop), and a comparison to the baseline performance of the same models on clean data.
  4. [§4.2–§4.3, Tables 4 and 6] The experimental protocol omits essential details for reproducibility and fair comparison. There is no perturbation budget (e.g., maximum l_p norm or PESQ threshold), no number of independent runs or error bars, no description of how the test set is split for attack generation, and no inference-time query budget for the black-box scenario. No baseline attacks are evaluated: previous GAN-based attacks (e.g., Rabhi et al. [20]) and traditional perturbation methods are cited but not compared against. The reader therefore cannot judge whether the proposed attack is stronger than existing methods or whether the reported differences are statistically meaningful.
  5. [§3.4, Eq. (5)] The forensics loss is written as LForensics = − Σ_{i∈F} Σ_{j∈N} log F_i(G(A')). The notation is ambiguous: it is not clear what the inner sum over j ∈ N represents, and no target labels are specified. If this is intended to be a cross-entropy loss encouraging the generated audio to be classified as real by the surrogate models, the formula should be written explicitly with the true label convention (e.g., one-hot real labels for the fake class) or with a softmax/log-softmax formulation. The current expression is not precise enough to be implemented from the paper.
minor comments (8)
  1. [Throughout] There are many typographical and grammatical issues, including 'data sets' in the abstract, missing articles, and inconsistent capitalization. The paper would benefit from careful proofreading.
  2. [Table 2] The discriminator architecture table contains unclear entries such as '(64, prev)' and fractions like '4' in the kernel shape column; these should be replaced with explicit dimensions and stride/padding details.
  3. [§3.3.1] The generator's 'feature map reduction module' is described only as a 3×3 convolutional layer with stride 1 and Tanh activation; details on padding, stride, and how the output length L is preserved should be provided.
  4. [§3.4] The weighting coefficients λ1, λ2, λ3, and λ4 are introduced but their final values are not fully specified. Table 6 only varies λ2 in a limited range; the values of the other weights used in the main experiments should be stated.
  5. [§3.3.4] The paper uses 'Wave2Vec', 'Wave2Vec', and 'wav2vec' inconsistently, and the reference [1] is to wav2vec 2.0. The exact model version and configuration should be specified, as well as the BERT model used for text embedding.
  6. [Fig. 4] The figure's solid and dotted lines for forward pass and back-propagation are not clearly explained, especially for the transcription model loop. The reader cannot tell which gradients flow to the generator from the transcription loss.
  7. [§4.1] For each dataset, the number of samples used for training the generator and for evaluation is not reported. The paper should state the test split sizes and any filtering used.
  8. [References] Reference [21] is attributed only to 'N Reimers'; the correct citation for Sentence-BERT is Reimers and Gurevych (2019). Also, several URLs in footnotes are incomplete or may not resolve; please verify them.

Circularity Check

1 steps flagged · score 6.0 of 10

Transcription-preservation validation reuses the training objective: Table 5's Text Similarity is 1 − LTranscription (Eq. 8), so the headline 'preserves transcription' claim is supported only by construction; attack-transfer results remain non-circular.

  1. self definitional [Sec. 3.4 (Eq. 8), Sec. 4.3.2 (Table 5)]
    "LTranscription(f , f ′) = 1 − [f · f′ / (||f|| ||f′||)] (8) ... To evaluate the preservation of transcription accuracy, we compare the text embedding similarity between the input and attacked samples using cosine similarity. The results, presented in Table 5, demonstrate that the proposed adversarial attack maintains both the quality of the audio and the accuracy of its transcription."

    The generator's training loss includes LTranscription (Eq. 3), which by Eq. 8 minimizes exactly the quantity later reported as 'Text Similarity' in Table 5: the cosine similarity between wav2vec+BERT embeddings of the original and attacked transcripts. Because the reported validation metric is 1 − LTranscription, optimizing the loss forces this number upward, so Table 5 cannot independently confirm transcription preservation. No external check (e.g., word error rate or token edit distance) is provided, and Figure 5's own caption notes 'changes in the transcript before and after the attack are highlighted in yellow,' with In-the-Wild Text Similarity only 0.87.

full rationale

The attack-transfer part of the paper is not circular: the generator is trained on ensemble surrogates (Res-TSSDNet, Inc-TSSDNet), and black-box evaluation is performed on different models (RawNet2, ResNet, MS-ResNet), while cross-dataset results on In-the-Wild and WaveFake provide independent generalization evidence. White-box evaluation on the same surrogate models is definitionally appropriate for a white-box scenario, not a circularity. Self-citations in the references are contextual and not load-bearing. However, the paper's distinctive 'transcription preservation' claim is validated with the identical embedding-cosine objective used as the transcription loss (Eq. 8), so that part of the central claim reduces to its own training objective. Since the paper's headline novelty is the combination of bypassing ADD while preserving transcription and perceptual integrity, and the preservation evidence is self-referential, the circularity is partial rather than total. I therefore assign score 6.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The attack framework relies on three classes of unstated choices: manually tuned loss weights, the assumption that surrogate models trained on ASVspoof2019 transfer to other datasets, and the assumption that embedding-based text similarity captures transcription preservation. The most fragile is the last, since the same embedding is used for both training and evaluation.

free parameters (3)
  • Surrogate balancing weight λ2 = 0.0001 (selected; 0.1, 0.01, 0.001 tested)
    Eq. (3) defines four loss weights; only this 'surrogate balancing parameter' is varied in Table 6, and the final results use 0.0001 chosen by hand to trade off attack success and PSNR/SSIM.
  • Other loss weights λ1, λ3, λ4 = Not reported
    The paper does not state the fixed values of the perceptual, transcription, and adversarial loss weights, so the reported performance depends on unstated choices.
  • Number of surrogate models = 2 (paper text is inconsistent: Res-TSSDNet and Inc-TSSDNet vs MS-ResNet)
    Selected by comparing 2 vs 3 surrogates in Table 6; the choice is manual and affects the transferability results.
assumptions (3)
  • domain assumption Surrogate ADD models pretrained on ASVspoof2019 provide gradient signals that yield attacks transferable to other architectures and datasets.
    Section 3.3.3 assumes that the ensemble of surrogate models (Res-TSSDNet, Inc-TSSDNet, MS-ResNet) improves transferability; this is a standard but unproven assumption for audio.
  • domain assumption The wav2vec+BERT embedding cosine similarity is a valid measure of transcription integrity.
    Eq. (8) uses this similarity as the transcription loss, and Table 5 uses the same similarity as evidence of preservation; no external transcription accuracy metric is provided.
  • ad hoc to paper The GAN training objective as written in Eq. (1) and Eq. (11) is a correct and workable formulation.
    The discriminator loss in Eq. (11) appears inverted relative to the standard min-max game; the paper does not clarify, yet the reported attack success depends on a correctly trained discriminator.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Transferable Adversarial Attacks on Audio Deepfake Detection." pith.science (2026). https://pith.science/paper/MF2RVDE7

@misc{pith2026250111902,
  author       = {Pith},
  title        = {Pith review of: Transferable Adversarial Attacks on Audio Deepfake Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MF2RVDE7}},
  note         = {Machine review of arXiv:2501.11902}
}
read the original abstract

Audio deepfakes pose significant threats, including impersonation, fraud, and reputation damage. To address these risks, audio deepfake detection (ADD) techniques have been developed, demonstrating success on benchmarks like ASVspoof2019. However, their resilience against transferable adversarial attacks remains largely unexplored. In this paper, we introduce a transferable GAN-based adversarial attack framework to evaluate the effectiveness of state-of-the-art (SOTA) ADD systems. By leveraging an ensemble of surrogate ADD models and a discriminator, the proposed approach generates transferable adversarial attacks that better reflect real-world scenarios. Unlike previous methods, the proposed framework incorporates a self-supervised audio model to ensure transcription and perceptual integrity, resulting in high-quality adversarial attacks. Experimental results on benchmark dataset reveal that SOTA ADD systems exhibit significant vulnerabilities, with accuracies dropping from 98% to 26%, 92% to 54%, and 94% to 84% in white-box, gray-box, and black-box scenarios, respectively. When tested in other data sets, performance drops of 91% to 46%, and 94% to 67% were observed against the In-the-Wild and WaveFake data sets, respectively. These results highlight the significant vulnerabilities of existing ADD systems and emphasize the need to enhance their robustness against advanced adversarial threats to ensure security and reliability.

Figures

Figures reproduced from arXiv: 2501.11902 by the authors.

Figure 1
Figure 1. [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Comparison of traditional and proposed adversarial at￾tacks in audio deepfake scenarios: (Top) Traditional adversarial attacks focus on inserting adversarial perturbations to deceive the model. (Bottom) Proposed adversarial attacks incorporate trans￾ferable perturbations while preserving transcription and perceptual integrity, deceiving both the model and forensic experts. works (GANs), can mislead ADD systems and c… view at source ↗
Figure 3
Figure 3. Illustration of adversarial attack approaches: (a) tradi￾tional GAN-based approach using a generator (G) and discrimi￾nator (D) to produce attack samples, (b) enhanced proposed ap￾proach integrating transcription modules with ADD and discrimi￾nator models to generate adversarial attacks. ferable [27] fashion. Zhang et al. [38] introduced the DeepFakeVox-HQ dataset to evaluate the robustness of ex￾isting ADD systems,… view at source ↗
Figures from the paper (1 more)
Figure 5
Figure 5. Figure 5: Visualization of fake samples labeled as S1, S2 and S3 and their corresponding attacked samples. 4.3.2 Quantitative Analysis To provide concrete evidence, we report the quantitative re￾sults, including peak signal-to-noise ratio (PSNR), struc￾tural similarity index mea…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Investigating Vulnerabilities and Defenses Against Audio-Visual Attacks: A Comprehensive Survey Emphasizing Multimodal Models

    cs.CR 2025-06 conditional novelty 4.0 of 10

    A survey that organizes audio and video AI security research into adversarial, backdoor, and jailbreak attacks, with extra attention to multimodal large language models.

  2. Unmasking Synthetic Realities in Generative AI: A Comprehensive Review of Adversarially Robust Deepfake Detection Systems

    cs.CR 2025-07 conditional novelty 3.0 of 10

    A systematic review of deepfake detection finds a pervasive lack of adversarial robustness evaluation across all modalities and calls for resilient, modality-agnostic detectors.

Reference graph

Works this paper leans on

42 extracted references · 28 canonical work pages · cited by 2 Pith papers

  1. [20]

    Audio-deepfake detection: Adversarial attacks and counter- measures

    Mouna Rabhi, Spiridon Bakiras, and Roberto Di Pietro. Audio-deepfake detection: Adversarial attacks and counter- measures. Expert Systems with Applications , 250:123941,

  2. [1]

    wav2vec 2.0: A framework for self-supervised learning of speech representations

    Alexei Baevski, Yuhao Zhou, Abdelrahman Mohamed, and Michael Auli. wav2vec 2.0: A framework for self-supervised learning of speech representations. Advances in neural infor- mation processing systems, 33:12449–12460, 2020. 6

    work page 2020

  3. [2]

    Deep4snet: deep learning for fake speech classification

    Dora M Ballesteros, Yohanna Rodriguez -Ortega, Diego Renza, and Gonzalo Arce. Deep4snet: deep learning for fake speech classification. Expert Systems with Applications, 184:115465, 2021. 2, 3

    work page 2021

  4. [3]

    Rawbmamba: End-to-end bidirec- tional state space model for audio deepfake detection

    Yujie Chen, Jiangyan Yi, Jun Xue, Chenglong Wang, Xi - aohui Zhang, Shunbo Dong, Siding Zeng, Jianhua Tao, Lv Zhao, and Cunhang Fan. Rawbmamba: End-to-end bidirec- tional state space model for audio deepfake detection. arXiv preprint arXiv:2406.06086, 2024. 3

    arXiv 2024

  5. [4]

    Securing social media against deepfakes using identity, behavioral, and geometric signa - tures

    Muhammad Umar Farooq, Awais Khan, Ijaz Ul Haq, and Khalid Mahmood Malik. Securing social media against deepfakes using identity, behavioral, and geometric signa - tures. arXiv preprint arXiv:2412.05487, 2024. 1

    arXiv 2024

  6. [5]

    Wavefake: A data set to facilitate audio deepfake detection

    Joel Frank and Lea Scho¨nherr. Wavefake: A data set to facilitate audio deepfake detection. arXiv preprint arXiv:2111.02813, 2021. 6

    arXiv 2021

  7. [6]

    Deepfake audio detection via mfcc features using machine learning

    Ameer Hamza, Abdul Rehman Rehman Javed, Farkhund Iqbal, Natalia Kryvinska, Ahmad S Almadhor, Zunera Jalil, and Rouba Borghol. Deepfake audio detection via mfcc features using machine learning. IEEE Access, 10:134018– 134028, 2022. 1, 3

    work page 2022

  8. [7]

    Holmes: health online model ensemble serving for deep learning models in intensive care units

    Shenda Hong, Yanbo Xu, Alind Khare, Satria Priambada, Kevin Maher, Alaa Aljiffry, Jimeng Sun, and Alexey Tu - manov. Holmes: health online model ensemble serving for deep learning models in intensive care units. In Proceed- ings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pages 1614–1624,

    work page

Show all 42 references
  1. [8]

    To- wards end -to-end synthetic speech detection

    Guang Hua, Andrew Beng Jin Teoh, and Haijian Zhang. To- wards end -to-end synthetic speech detection. IEEE Signal Processing Letters, 28:1265–1269, 2021. 1, 3, 5, 7

    2021

  2. [9]

    Rawnet: Advanced end-to-end deep neural net- work using raw waveforms for text-independent speaker ver- ification

    Jee-weon Jung, Hee-Soo Heo, Ju-ho Kim, Hye-jin Shim, and Ha-Jin Yu. Rawnet: Advanced end-to-end deep neural net- work using raw waveforms for text-independent speaker ver- ification. arXiv preprint arXiv:1904.08104, 2019. 3, 5

    1904 arXiv

  3. [10]

    Aasist: Audio anti-spoofing using integrated spectro- temporal graph attention networks

    Jee-weon Jung, Hee-Soo Heo, Hemlata Tak, Hye -jin Shim, Joon Son Chung, Bong -Jin Lee, Ha -Jin Yu, and Nicholas Evans. Aasist: Audio anti-spoofing using integrated spectro- temporal graph attention networks. In ICASSP 2022 - 2022 IEEE International Conference on Acoustics, Spe...

    2022

  4. [11]

    Defense against adversarial attacks on audio deepfake detection

    Piotr Kawa, Marcin Plata, and Piotr Syga. Defense against adversarial attacks on audio deepfake detection. arXiv preprint arXiv:2212.14597, 2022. 3

    2022 arXiv

  5. [12]

    Specrnet: Towards faster and more accessible audio deepfake detection

    Piotr Kawa, Marcin Plata, and Piotr Syga. Specrnet: Towards faster and more accessible audio deepfake detection. In 2022 IEEE International Conference on Trust, Security and Pri - vacy in Computing and Communications (TrustCom), pages 792–799. IEEE, 2022. 3

    2022

  6. [13]

    Securing voice biometrics: One-shot learning approach for audio deepfake detection

    Awais Khan and Khalid Mahmood Malik. Securing voice biometrics: One-shot learning approach for audio deepfake detection. In 2023 IEEE International Workshop on Infor - mation Forensics and Security (WIFS), pages 1–6, 2023. 3

    2023

  7. [14]

    Spotnet: A spoofing-aware transformer network for effective synthetic speech detection

    Awais Khan and Khalid Mahmood Malik. Spotnet: A spoofing-aware transformer network for effective synthetic speech detection. In Proceedings of the 2nd ACM Interna - tional Workshop on Multimedia AI against Disinformation , pages 10–18, 2023. 3

    2023

  8. [15]

    Frame-to-utterance convergence: A spectra -temporal ap - proach for unified spoofing detection

    Awais Khan, Khalid Mahmood Malik, and Shah Nawaz. Frame-to-utterance convergence: A spectra -temporal ap - proach for unified spoofing detection. In ICASSP 2024 - 2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 10761–10765, 2024. 1

    2024

  9. [16]

    Battling voice spoofing: a review, com - parative analysis, and generalizability evaluation of state-of- the-art voice spoofing counter measures

    Awais Khan, Khalid Mahmood Malik, James Ryan, and Mikul Saravanan. Battling voice spoofing: a review, com - parative analysis, and generalizability evaluation of state-of- the-art voice spoofing counter measures. Artificial Intelli - gence Review, 56(Suppl 1):513–566, 2023. 1, 3

    2023

  10. [17]

    Spoof detection using voice contribution on lfcc features and resnet-34

    Khaing Zar Mon, Kasorn Galajit, Candy Olivia Mawalim, Jessada Karnjana, Tsuyoshi Isshiki, and Pakinee Aimma - nee. Spoof detection using voice contribution on lfcc features and resnet-34. In 2023 18th International Joint Symposium on Artificial Intelligence and Natural Languag...

    2023

  11. [18]

    Does audio deep- fake detection generalize? arXiv preprint arXiv:2203.16263,

    Nicolas M Mu¨ller, Pavel Czempin, Franziska Dieckmann, Adam Froghyar, and Konstantin Bo¨ttinger. Does audio deep- fake detection generalize? arXiv preprint arXiv:2203.16263,

  12. [19]

    Cross-modal speaker verification and recognition: A multilingual perspective

    Shah Nawaz, Muhammad Saad Saeed, Pietro Morerio, Arif Mahmood, Ignazio Gallo, Muhammad Haroon Yousaf, and Alessio Del Bue. Cross-modal speaker verification and recognition: A multilingual perspective. In Proceedings of the IEEE/CVF conference on computer vision and pattern rec...

    2021

  13. [21]

    Sentence-bert: Sentence embeddings using siamese bert -networks

    N Reimers. Sentence-bert: Sentence embeddings using siamese bert -networks. arXiv preprint arXiv:1908.10084 ,

    1908 arXiv

  14. [22]

    Speaker recogni- tion in realistic scenario using multimodal data

    Saqlain Hussain Shah, Muhammad Saad Saeed, Shah Nawaz, and Muhammad Haroon Yousaf. Speaker recogni- tion in realistic scenario using multimodal data. In 2023 3rd International Conference on Artificial Intelligence (ICAI) , pages 209–213. IEEE, 2023. 3

    2023

  15. [23]

    End-to-end anti-spoofing with rawnet2

    Hemlata Tak, Jose Patino, Massimiliano Todisco, Andreas Nautsch, Nicholas Evans, and Anthony Larcher. End-to-end anti-spoofing with rawnet2. In ICASSP 2021-2021 IEEE In- ternational Conference on Acoustics, Speech and Signal Pro- cessing (ICASSP), pages 6369–6373. IEEE, 2021. ...

    2021

  16. [24]

    Constant q cepstral coefficients: A spoofing countermeasure for automatic speaker verification

    Massimiliano Todisco, He´ctor Delgado, and Nicholas Evans. Constant q cepstral coefficients: A spoofing countermeasure for automatic speaker verification. Computer Speech & Lan- guage, 45:516–535, 2017. 3

    2017

  17. [25]

    Asvspoof 2019: Future horizons in spoofed and fake audio detection

    Massimiliano Todisco, Xin Wang, Ville Vestman, Md Sahidullah, He´ctor Delgado, Andreas Nautsch, Junichi Yam- agishi, Nicholas Evans, Tomi Kinnunen, and Kong Aik Lee. Asvspoof 2019: Future horizons in spoofed and fake audio detection. arXiv preprint arXiv:1904.05441, 2019. 1

    2019 arXiv

  18. [26]

    Counter- act against gan-based attacks: A collaborative learning ap- proach for anti-forensic detection

    Kutub Uddin, Tae Hyun Jeong, and Byung Tae Oh. Counter- act against gan-based attacks: A collaborative learning ap- proach for anti-forensic detection. Applied Soft Computing, 153:111287, 2024. 4

    2024

  19. [27]

    A robust open-set multi-instance learning for defending adversarial attacks in digital image

    Kutub Uddin, Yoonmo Yang, Tae Hyun Jeong, and Byung Tae Oh. A robust open-set multi-instance learning for defending adversarial attacks in digital image. IEEE Trans- actions on Information Forensics and Security, 2023. 3

    2023

  20. [28]

    Anti- forensic against double jpeg compression detection using adversarial generative network

    Kutub Uddin, Yoonmo Yang, and Byung Tae Oh. Anti- forensic against double jpeg compression detection using adversarial generative network. In Proceedings of the Ko - rean Society of Broadcast Engineers Conference, pages 58–

  21. [29]

    Analysis of generative adversarial network targeting anti -forensic in jpeg compressed domain

    Kutub Uddin, Yoonmo Yang, and Byung Tae Oh. Analysis of generative adversarial network targeting anti -forensic in jpeg compressed domain. In International Workshop on Ad- vanced Imaging Technology (IWAIT) 2021 , volume 11766, pages 627–631. SPIE, 2021. 4

    2021

  22. [30]

    Fairseq s2t: Fast speech -to-text modeling with fairseq

    Changhan Wang, Yun Tang, Xutai Ma, Anne Wu, Sravya Popuri, Dmytro Okhonko, and Juan Pino. Fairseq s2t: Fast speech -to-text modeling with fairseq. arXiv preprint arXiv:2010.05171, 2020. 6

    2010 arXiv

  23. [31]

    Fully automated end-to-end fake audio detection

    Chenglong Wang, Jiangyan Yi, Jianhua Tao, Haiyang Sun, Xun Chen, Zhengkun Tian, Haoxin Ma, Cunhang Fan, and Ruibo Fu. Fully automated end-to-end fake audio detection. In Proceedings of the 1st International Workshop on Deep - fake Detection for Audio Multimedia, pages 27–33, 2022. 3

    2022

  24. [32]

    To-rawnet: improving rawnet with tcn and orthogonal regularization for fake audio detection

    Chenglong Wang, Jiangyan Yi, Jianhua Tao, Chuyuan Zhang, Shuai Zhang, Ruibo Fu, and Xun Chen. To-rawnet: improving rawnet with tcn and orthogonal regularization for fake audio detection. arXiv preprint arXiv:2305.13701,

    arXiv

  25. [33]

    Csi-net: Unified body characterization and action recognition

    Fei Wang, Jinsong Han, Shiyuan Zhang, Xu He, and Dong Huang. Csi-net: Unified body characterization and action recognition. arXiv preprint arXiv:1810.03064, 2018. 5, 7

    2018 arXiv

  26. [34]

    Asvspoof 2019: A large-scale public database of syn- thesized, converted and replayed speech

    Xin Wang, Junichi Yamagishi, Massimiliano Todisco, He´ctor Delgado, Andreas Nautsch, Nicholas Evans, Md Sahidullah, Ville Vestman, Tomi Kinnunen, Kong Aik Lee, et al. Asvspoof 2019: A large-scale public database of syn- thesized, converted and replayed speech. Computer Speech ...

    2019

  27. [35]

    Clad: Ro- bust audio deepfake detection against manipulation attacks with contrastive learning

    Haolin Wu, Jing Chen, Ruiying Du, Cong Wu, Kun He, Xingcan Shang, Hao Ren, and Guowen Xu. Clad: Ro- bust audio deepfake detection against manipulation attacks with contrastive learning. arXiv preprint arXiv:2404.15854,

    arXiv

  28. [36]

    A light cnn for deep face representation with noisy labels

    Xiang Wu, Ran He, Zhenan Sun, and Tieniu Tan. A light cnn for deep face representation with noisy labels. IEEE trans- actions on information forensics and security, 13(11):2884– 2896, 2018. 3

    2018

  29. [37]

    Asvspoof 2021: accelerating progress in spoofed and deep - fake speech detection

    Junichi Yamagishi, Xin Wang, Massimiliano Todisco, Md Sahidullah, Jose Patino, Andreas Nautsch, Xuechen Liu, Kong Aik Lee, Tomi Kinnunen, Nicholas Evans, et al. Asvspoof 2021: accelerating progress in spoofed and deep - fake speech detection. In ASVspoof 2021 Workshop - Automa...

    2021

  30. [38]

    I can hear you: Selective robust training for deepfake audio detec- tion

    Zirui Zhang, Wei Hao, Aroon Sankoh, William Lin, Emanuel Mendiola-Ortiz, Junfeng Yang, and Chengzhi Mao. I can hear you: Selective robust training for deepfake audio detec- tion. arXiv preprint arXiv:2411.00121, 2024. 3

    2024 arXiv

  31. [39]

    Fake speech detection using residual network with transformer encoder

    Zhenyu Zhang, Xiaowei Yi, and Xianfeng Zhao. Fake speech detection using residual network with transformer encoder. In Proceedings of the 2021 ACM workshop on information hiding and multimedia security, pages 13–22, 2021. 3

    2021

  32. [40]

    An end -to-end multi -module audio deepfake gen - eration system for add challenge 2023

    Sheng Zhao, Qilong Yuan, Yibo Duan, and Zhuoyue Chen. An end -to-end multi -module audio deepfake gen - eration system for add challenge 2023. arXiv preprint arXiv:2307.00729, 2023. 3, 5

    2023 arXiv

  33. [41]

    A trans- ferable anti-forensic attack on forensic cnns using a genera- tive adversarial network

    Xinwei Zhao, Chen Chen, and Matthew C Stamm. A trans- ferable anti-forensic attack on forensic cnns using a genera- tive adversarial network. arXiv preprint arXiv:2101.09568,

    arXiv

  34. [60]

    The Korean Institute of Broadcast and Media Engineers,

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.