Recent advances in generative models have amplified the risk of malicious misuse of speech synthesis technologies, enabling adversaries to impersonate target speakers and access sensitive resources. Although speech deepfake detection has progressed rapidly, most existing countermeasures lack formal robustness guarantees or fail to generalize to unseen generation techniques. We propose PV-VASM, a probabilistic framework for verifying the robustness of voice anti-spoofing models (VASMs). PV-VASM estimates the probability of misclassification under text-to-speech (TTS), voice cloning (VC), and parametric signal transformations. The approach is model-agnostic and enables robustness verification against unseen speech synthesis techniques and input perturbations. We derive a theoretical upper bound on the error probability and validate the method across diverse experimental settings, demonstrating its effectiveness as a practical robustness verification tool.
Figures & tables
Transform
Parameters’ Space Θ
n
k
PCA
A(x)
p(x)
ε=10−5
ε=10−3
ε=10−2
ε=0.05
LPF
ωmax∈[2.5,3]kHz
500
40
0.9767
0.9833
0.9900
0.9900
0.0049
8.3⋅10−13
LPF
ωmax∈[2.5,3]kHz
1000
20
0.9767
0.9833
0.9900
0.9900
0.0048
2.0⋅10−11
HPF
ωmin∈[0.5,1]kHz
500
40
0.8433
0.8667
0.8733
0.8767
0.1070
7.5⋅10−7
HPF
ωmin∈[0.5,1]kHz
1000
20
0.8433
0.8667
0.8733
0.8767
0.1065
3.6⋅10−6
Background Noise
SNR∈[15,30]dB
500
12
0.3400
0.3467
0.3733
0.4300
0.1038
0.1687
Table 1: Robustness verification results against parametric input transformations. The desired confidence level is set to be α=10−6 .
Figure 1: Dependence of PCA on (m,n,k) for background noise perturbations with SNR∈[15,30] . The confidence level is set to α=10−6 . Curves sharing the same color correspond to an identical computational budget m , while line styles and marker types indicate variations in n and k , respectively.
Figure 2: Dependence of PCA on α for background noise perturbations with SNR∈[15,30] . m=6000,n=1000,k=6 are fixed.
Figure 3: Dependence of PCA on (m,n,k) for the gain adjustment transform with γ∈[−10,20]dB . The confidence level is set to α=10−6 . Curves sharing the same color correspond to the same augmentation budget m , while line styles and marker types indicate variations in n and k , respectively.
Figure 4: Dependence of PCA on α for the gain adjustment transform with γ∈[−10,20]dB . The values m=20000,n=1000,k=20 are fixed.
Figure 5: Dependence of PCA on (m,n,k) for the low pass filter with the cutoff frequency ωmax is randomly sampled from [2500,3000]Hz range. The confidence level is set to α=10−6 . Curves sharing the same color correspond to the same augmentation budget m , while line styles and marker types indicate variations in n and k , respectively.
Figure 6: Dependence of PCA on (m,n,k) for the pitch shift transform, ST ∈[−6,6] semitones. The confidence level is set to be α=10−6 . Curves sharing the same color correspond to the same augmentation budget m , while line styles and marker types indicate variations in n and k , respectively.
n
k
m
A(x)
p(x)
500
4
2000
4.7⋅10−3
1.3⋅10−3
1000
2
2000
4.8⋅10−3
2.3⋅10−3
2000
1
2000
4.6⋅10−3
5.0⋅10−3
500
10
5000
4.8⋅10−3
2.9⋅10−5
1000
5
5000
4.7⋅10−3
7.2⋅10−5
5000
1
5000
4.7⋅10−3
2.1⋅10−3
Table 2: Dependency of average probability of error p for different values (n,k,m), low pass filter, Θ=[2500,3000]Hz . The confidence level is set to α=10−6 .
TTS model
n
k
δ
A
p
Pre-finetuning results
Vosk
5000
26
0.75
0.1352
3.37⋅10−17
Silero
650
20
0.5
0.5030
6.1⋅10−21
CosyVoice
500
40
0.9
0.5236
2.4⋅10−8
f5
10000
20
0.9
0.4019
2.6⋅10−25
ElevenLabs
500
6
0.5
0.3308
3.0⋅10−5
Table 3: Robustness verification results against TTS generators. Results are shown for the model before and after finetuning on these generators. The confidence level is set to be α=10−6 .
Figure 7: Verification condition result from Eq. ( 22 ) for the pre-finetuned f against Vosk TTS vs. various α and n given fixed m=130000 , δ=0.9 , and ε=0.1 .
VC model
n
k
PCA
A(x)
p(x)
ε=0.05
ε=0.10
ε=0.30
Pre-finetuning results
XTTSv2
100
50
0.92
0.94
1.00
0.0148
3.8⋅10−6
f5
500
10
0
0
0.24
0.4167
9.6⋅10−5
Post-finetuning results
XTTSv2
100
50
0.96
0.96
1.00
0.0078
4.1⋅10−6
Table 4: Robustness verification results against VC generators. Results are shown for the model before and after finetuning on these generators. Confidence level is set to α=10−4 , δ=0.5 .