Recent advances in generative models have amplified the risk of malicious misuse of speech synthesis technologies, enabling adversaries to impersonate target speakers and access sensitive resources. Although speech deepfake detection has progressed rapidly, most existing countermeasures lack formal robustness guarantees or fail to generalize to unseen generation techniques. We propose PV-VASM, a probabilistic framework for verifying the robustness of voice anti-spoofing models (VASMs). PV-VASM estimates the probability of misclassification under text-to-speech (TTS), voice cloning (VC), and parametric signal transformations. The approach is model-agnostic and enables robustness verification against unseen speech synthesis techniques and input perturbations. We derive a theoretical upper bound on the error probability and validate the method across diverse experimental settings, demonstrating its effectiveness as a practical robustness verification tool.
Figures & tables
Transform
Parameters’ Space Θ
n
k
PCA
A(x)
p(x)
ε=10−5
ε=10−3
ε=10−2
ε=0.05
LPF
ωmax∈[2.5,3]kHz
500
40
0.9767
0.9833
0.9900
0.9900
0.0049
8.3⋅10−13
LPF
ωmax∈[2.5,3]kHz
1000
20
0.9767
0.9833
0.9900
0.9900
0.0048
2.0⋅10−11
HPF
ωmin∈[0.5,1]kHz
500
40
0.8433
0.8667
0.8733
0.8767
0.1070
7.5⋅10−7
HPF
ωmin∈[0.5,1]kHz
1000
20
0.8433
0.8667
0.8733
0.8767
0.1065
3.6⋅10−6
Background Noise
SNR∈[15,30]dB
500
12
0.3400
0.3467
0.3733
0.4300
0.1038
0.1687
Table 1: Robustness verification results against parametric input transformations. The desired confidence level is set to be α=10−6 .
Figure 1: Dependence of PCA on (m,n,k) for background noise perturbations with SNR∈[15,30] . The confidence level is set to α=10−6 . Curves sharing the same color correspond to an identical computational budget m , while line styles and marker types indicate variations in n and k , respectively.
Figure 2: Dependence of PCA on α for background noise perturbations with SNR∈[15,30] . m=6000,n=1000,k=6 are fixed.
Figure 3: Dependence of PCA on (m,n,k) for the gain adjustment transform with γ∈[−10,20]dB . The confidence level is set to α=10−6 . Curves sharing the same color correspond to the same augmentation budget m , while line styles and marker types indicate variations in n and k , respectively.
Figure 4: Dependence of PCA on α for the gain adjustment transform with γ∈[−10,20]dB . The values m=20000,n=1000,k=20 are fixed.
Figure 5: Dependence of PCA on (m,n,k) for the low pass filter with the cutoff frequency ωmax is randomly sampled from [2500,3000]Hz range. The confidence level is set to α=10−6 . Curves sharing the same color correspond to the same augmentation budget m , while line styles and marker types indicate variations in n and k , respectively.
Figure 6: Dependence of PCA on (m,n,k) for the pitch shift transform, ST ∈[−6,6] semitones. The confidence level is set to be α=10−6 . Curves sharing the same color correspond to the same augmentation budget m , while line styles and marker types indicate variations in n and k , respectively.
n
k
m
A(x)
p(x)
500
4
2000
4.7⋅10−3
1.3⋅10−3
1000
2
2000
4.8⋅10−3
2.3⋅10−3
2000
1
2000
4.6⋅10−3
5.0⋅10−3
500
10
5000
4.8⋅10−3
2.9⋅10−5
1000
5
5000
4.7⋅10−3
7.2⋅10−5
5000
1
5000
4.7⋅10−3
2.1⋅10−3
Table 2: Dependency of average probability of error p for different values (n,k,m), low pass filter, Θ=[2500,3000]Hz . The confidence level is set to α=10−6 .
TTS model
n
k
δ
A
p
Pre-finetuning results
Vosk
5000
26
0.75
0.1352
3.37⋅10−17
Silero
650
20
0.5
0.5030
6.1⋅10−21
CosyVoice
500
40
0.9
0.5236
2.4⋅10−8
f5
10000
20
0.9
0.4019
2.6⋅10−25
ElevenLabs
500
6
0.5
0.3308
3.0⋅10−5
Table 3: Robustness verification results against TTS generators. Results are shown for the model before and after finetuning on these generators. The confidence level is set to be α=10−6 .
Figure 7: Verification condition result from Eq. ( 22 ) for the pre-finetuned f against Vosk TTS vs. various α and n given fixed m=130000 , δ=0.9 , and ε=0.1 .
VC model
n
k
PCA
A(x)
p(x)
ε=0.05
ε=0.10
ε=0.30
Pre-finetuning results
XTTSv2
100
50
0.92
0.94
1.00
0.0148
3.8⋅10−6
f5
500
10
0
0
0.24
0.4167
9.6⋅10−5
Post-finetuning results
XTTSv2
100
50
0.96
0.96
1.00
0.0078
4.1⋅10−6
Table 4: Robustness verification results against VC generators. Results are shown for the model before and after finetuning on these generators. Confidence level is set to α=10−4 , δ=0.5 .
Recent advances in text-to-speech and voice cloning make high-quality spoofing inexpensive and scalable, threatening voice authentication systems, especially automatic speaker verification (ASV). Existing defenses mainly address this threat through binary countermeasures (CMs) for deepfake detection or spoofing-aware speaker verification (SASV), where current systems are dominated by modular ASV-CM fusion and cascaded pipelines. Although large audio language models (LALMs) have shown promise on related audio tasks, including CM and ASV, their use for SASV remains unexplored, despite their capacity to produce natural-language rationales for auditing and robustness beyond discriminative predictions. This work systematically evaluates LALMs for SASV against conventional pipelines under zero-shot prompting, supervised adaptation, reasoning-oriented training, and reinforcement-learning-based optimization. Our results show that pretrained LALMs are near chance in the zero-shot setting, confirming that they are not natively suited to SASV, but that task-specific adaptation closes this gap. We further find that competitive SASV performance can be achieved through several distinct routes. These findings position LALMs as a promising and auditable foundation for unified SASV, while clarifying where conventional cascade systems still lead.
Provenance watermarking is increasingly treated as a safeguard for synthetic speech, whether built directly into speech-generation models such as Chatterbox, provided through dedicated techniques such as AudioSeal, or deployed by commercial platforms such as ElevenLabs. We identify a previously uncharacterized liability: when synthetic speech is watermarked and human speech is not, detectors trained alongside latch onto the watermark as a spurious "watermark => fake" shortcut. This single feature yields three coupled failures: generalization degradation (model performance deteriorates on unseen data), strip-to-evade (a watermarked fake escapes once unwatermarked), and mark-to-frame (watermarking a real voice flags it as fake). In a controlled white-box experiment, a watermark-trained detector shows all three (for example, mark-to-frame lifts Equal Error Rate from 16% to 75%). In a black-box test of a commercial API, we show that adding a watermark to real speech disguises it as fake. However, this shortcut is fixable: retraining with the watermark on both classes decorrelates it and restores clean behavior. We release experiment data as a paired clean-versus-watermarked corpus (WASP).
Modern LLM-driven text-to-speech (TTS) and voice conversion (VC) systems produce synthetic speech that differs from the generators represented in many legacy spoofing benchmarks. This mismatch creates a temporal generalization gap that can overestimate detector robustness under real-world post-processing conditions. We bridge this gap by introducing VoxENES 2026, a bilingual (English and Spanish) benchmark of 53,628 audio samples generated using 10 contemporary speech synthesis methods and evaluated under 10 standardized post-processing conditions. Using VoxENES 2026, we benchmark eight pretrained detectors without fine-tuning and observe substantial performance degradation: the best model achieves 28.98% EER overall, while most perform near or below random chance across modern generators and perturbations. Our results highlight the reliance on brittle artifacts in current detectors and establish VoxENES 2026 as a practical testbed for developing robust audio spoofing countermeasures.