With the advancements in AI speech synthesis, it is easier than ever before to generate realistic audio in a target voice. One only needs a few seconds of reference audio from the target, quite literally putting words in the target person's mouth. This imposes a new set of forensics-related challenges on speech-based authentication systems, videoconferencing, and audio-visual broadcasting platforms, where we want to detect synthetic speech. At the same time, leveraging AI speech synthesis can enhance the different modes of communication through features such as low-bandwidth communication and audio enhancements - leading to ever-increasing legitimate use-cases of synthetic audio. In this case, we want to verify if the synthesized voice is actually spoken by the user. This will require a mechanism to verify whether a given synthetic audio is driven by an authorized identity, or not. We term this task audio avatar fingerprinting. As a step towards audio forensics in these new and emerging situations, we analyze and extend an off-the-shelf speaker verification model developed outside of forensics context for the task of fake speech detection and audio avatar fingerprinting, the first experimentation of its kind. Furthermore, we observe that no existing dataset allows for the novel task of verifying the authorized use of synthetic audio - a limitation which we address by introducing a new speech forensics dataset for this novel task.
Figures & tables
Figure 1: We explore how state-of-the-art off-the-shelf speaker verification models can be leveraged for audio forensics tasks: real vs. synthetic speech detection, and the newly introduced avatar fingerprinting task [ 26 ] , applied to audio. Note that the facial image is shown just to signify that the input the system is human speech: our approach is purely audio-based.
Figure 2: Voice cloning generators require a short reference sample of a target voice (this is what the final output will sound like), and a driving audio speech (this is what the target voice will speak). If a person is using their own voice as driving and reference (target) audio, then the resultant generated audio is termed a “self-reenactment”: that is, the sound of the generated voice matches that of the driving audio. On the other hand, if one uses a different reference voice than that of the driving speaker, then the resultant generated audio is termed a “cross-reenactment”: that is, the sound of the generated voice is different than that of the driving speaker, and it seems like the target / reference voice is speaking the words of the driving speaker. Here, we show a case of self- and cross-reenactment of ID1.
Figure 3: We explore the performance of off-the-shelf speaker verification models on two tasks. First (a), we want to evaluate whether the learnt speaker representation can be leveraged for detecting real and synthetic audio of a speaker (regardless of whether the synthetic audio is self- or cross-reenacted). See Sec. 3.2 . Second (b), we want to explore whether the speaker representations can be used for audio avatar fingerprinting: that is, identifying if the speaker driving a synthetic audio is the authorized identity or not (Sec. 3.3 ).
Figure 4: We use a speaker verification model (TitaNet) to extract a speaker embedding for a given synthetic audio. To learn a speaker embedding that encodes the speaking style of the driving identity, we use an additive angular margin loss that clusters all the audio driven by ID1 to be closer and away from those driven by others.
Method
AUC
ClovaAI [ 16 ]
0.74
H/ASP [ 16 ]
0.85
ECAPA-TDNN [ 14 ]
0.79
POI-Forensics [ 11 ]
0.91
Ours
0.91
Table 1: Comparisons of synthetic speech detection task on InTheWild datasets [ 3 ] with other speaker verification methods. The numbers are cited from [ 25 ] .
Figure 5: Real vs fake test with vanilla TitaNet on NVFAIR
Figure 6: A preliminary analysis of a vanilla TitaNet for an avatar fingerprinting task.
Figure 7: A preliminary analysis of a vanilla TitaNet for an avatar fingerprinting task using only self-reenactment as authorized enrollment data
Figure 8: ROC curve of 6 held-out unseen identities from NVFAIR dataset using out-of-the-box TitaNet (a) and fine-tuned TitaNet (b)
Provenance watermarking is increasingly treated as a safeguard for synthetic speech, whether built directly into speech-generation models such as Chatterbox, provided through dedicated techniques such as AudioSeal, or deployed by commercial platforms such as ElevenLabs. We identify a previously uncharacterized liability: when synthetic speech is watermarked and human speech is not, detectors trained alongside latch onto the watermark as a spurious "watermark => fake" shortcut. This single feature yields three coupled failures: generalization degradation (model performance deteriorates on unseen data), strip-to-evade (a watermarked fake escapes once unwatermarked), and mark-to-frame (watermarking a real voice flags it as fake). In a controlled white-box experiment, a watermark-trained detector shows all three (for example, mark-to-frame lifts Equal Error Rate from 16% to 75%). In a black-box test of a commercial API, we show that adding a watermark to real speech disguises it as fake. However, this shortcut is fixable: retraining with the watermark on both classes decorrelates it and restores clean behavior. We release experiment data as a paired clean-versus-watermarked corpus (WASP).
Advances in speech synthesis have made deepfake audio highly realistic. Earlier studies reported 70-80% human detection accuracy, but relied primarily on older synthesizers. We compare human detection for three selected voice synthesis tools released in 2019, 2022, and 2024 with 82 IT professionals, and benchmark humans against six pretrained detectors on the same material. For fully synthetic speech (full spoofs), the F1 score drops from about 90% for RTVC and YourTTS to 48% for ElevenLabs, although listeners were explicitly warned that deepfakes were present. For partial spoofing, where only one sentence of an utterance is altered, strict accuracy falls to 9%, and listeners classify the synthetic sentence as bona fide 77% of the time. Humans and detectors fail in complementary ways, and neither reliably localizes short manipulations. Additionally, listeners increasingly mislabel bona fide speech as fake, eroding trust in unmanipulated audio. These findings show that human perception alone is unreliable for the selected modern and partial-spoof conditions and motivate procedural verification, provenance, watermarking, and segment-level detection.
Modern text-to-speech (TTS) systems are rarely deployed as unchanged pre-trained models. They are often adapted through supervised fine-tuning (SFT) or preference optimization such as DPO and GRPO. This raises a practical question for audio deepfake forensics: do fingerprints learned from a foundation generator remain valid after adaptation? We present GenTraceBench, a controlled benchmark spanning five TTS architectures, 16 pre-/post-training variants, and 49,728 utterances generated with fixed texts and speaker prompts. Under a train-on-foundation, test-on-adapted protocol, we evaluate binary detection, closed-set attribution, and open-set verification. DPO and GRPO generally preserve fingerprints, whereas some SFT and pre-training-data changes cause substantial drift; effect sizes vary across three forensic backbones. Repeated training runs confirm the largest W2V-BERT attribution drop, while a data-mixture control with comparable speech quality shows that composition change need not cause drift. In W2V-BERT verification, multi-shot enrollment reduces EER for the SFT condition from 44.4% to 11.0%, whereas the SingNet-only condition remains at or above 45% EER.
Li Wang, Kunyu Feng, Wan Lin +7
The Chinese University of Hong Kong, Shenzhen, China · Huawei Technologies Co., Ltd., China · Amphion Technology Co., Ltd., China