TRACE: Training-Free Partial Audio Deepfake Detection via Embedding Trajectory Analysis of Speech Foundation Models

Awais Khan; Muhammad Umar Farooq; Kutub Uddin; Khalid Malik

cs.SDApr 1, 2026

TRACE: Training-Free Partial Audio Deepfake Detection via Embedding Trajectory Analysis of Speech Foundation Models

Authors: Awais Khan, Muhammad Umar Farooq, Kutub Uddin, Khalid Malik

Organizations: College of Innovation and Technology, University of Michigan-Flint, MI, USA

Abstract

Partial audio deepfakes, where synthesized segments are spliced into genuine recordings, are particularly deceptive because most of the audio remains authentic. Existing detectors are supervised: they require frame-level annotations, overfit to specific synthesis pipelines, and must be retrained as new generative models emerge. We argue that this supervision is unnecessary. We hypothesize that speech foundation models implicitly encode a forensic signal: genuine speech forms smooth, slowly varying embedding trajectories, while splice boundaries introduce abrupt disruptions in frame-level transitions. Building on this, we propose TRACE (Training-free Representation-based Audio Countermeasure via Embedding dynamics), a training-free framework that detects partial audio deepfakes by analyzing the first-order dynamics of frozen speech foundation model representations without any training, labeled data, or architectural modification. We evaluate TRACE on four benchmarks that span two languages using six speech foundation models. In PartialSpoof, TRACE achieves 8.08% EER, competitive with fine-tuned supervised baselines. In LlamaPartialSpoof, the most challenging benchmark featuring LLM-driven commercial synthesis, TRACE surpasses a supervised baseline outright (24.12% vs. 24.49% EER) without any target-domain data. These results show that temporal dynamics in speech foundation models provide an effective, generalize signal for training-free audio forensics.

Figures & tables

Figure 1: Overview of the TRACE pipeline. A raw waveform is passed through a frozen speech foundation model (WavLM-Large, layer 18). Frame embeddings are L2-normalized [ 36 ] onto the unit hypersphere, and the chord distance between consecutive projections forms the first-order dynamics sequence $\{\text{F1}_{t}\}$ . Closed-form statistics are extracted and linearly fused into a scalar detection score, which is orientation-calibrated and threshold to produce the final bonafide or spoof decision. No model parameters are updated at any stage.

Dataset	Split	Utterances			Total
Dataset	Split	BF	PF	FF	Total
PartialSpoof [ 43 ]	Train	2580	22800	—	25380
	Dev	2548	22296	—	24844
	Eval	7355	63882	—	71237
	Total	12483	108978	—	121461
HAD [ 40 ]	Train	26554	26539	—	53093

Table 1: Statistics of the four partial audio deepfake detection benchmarks used in this work. BF=Bonafide, PF=Partial fake and FF= Fully Fake.

System	Train	Res.	EER $\downarrow$	AUC $\uparrow$
CQCC-LCNN [ 40 ]	PS	20	27.17	—
LCNN-BLSTM [ 45 ]	PS	160	12.84	—
SELCNN-BLSTM [ 46 ]	PS	160	16.60	—
w2v2-large-5gMLP [ 43 ]	PS	160	9.24	—
S1 (L24,last)	—	20	16.37	0.91
S2 (L18,F1-rms)	—	20	11.08	0.95

Table 2: TRACE performance on PartialSpoof dataset.

System	Train	EER $\downarrow$	AUC $\uparrow$
HAD [ 40 ]
S1 (L24,last)	—	31.40	0.758
S2 (L18,F1-rms)	—	30.11	0.765
S3 (L18,F1-maxW)	—	25.62	0.821
Prop. (L18,F1-opt)	—	20.92	0.869
ADD 2023 [ 42 ]

Table 3: TRACE performance on HAD and ADD 2023.

Figure 2: Score distributions of TRACE across four benchmarks: (a) PartialSpoof, (b) HAD, (c) ADD 2023, (d) LlamaPartialSpoof. The consistent directionality across datasets confirms language and synthesis-method independence of the TRACE.

Spoof subset / System	Free EER $\downarrow$	Transfer EER $\downarrow$	AUC $\uparrow$
TRACE (Ours)
Crossfade partial-fake	16.12	16.12	0.915
Cut/paste + overlap-add	13.04	12.60	0.940
Fully-fake (TTS only)	45.45	46.06	0.572
Comparative SOTA (All spoof combined)
w2v2-Large-MultiRes [ 43 ]	47.49	-	-

Table 4: TRACE utterance-level EER (%) on LlamaPartialSpoof by spoof type. Free EER uses subset-optimal thresholds; Transfer EER applies PartialSpoof-dev-calibrated threshold. Fully-fake utterances contain no splice and are inherently harder to detect.

Figure 3: Cross-dataset generalization of TRACE: Transfer EER (hatched) vs Free EER (solid) across three out-of-domain test sets. LlamaPartialSpoof includes the supervised ps-train baseline (red dashed) for reference.

Figure 4: Encoder $\times$ statistic EER heatmap on PartialSpoof. F1 consistently outperforms F2 across all encoders. WavLM-Large + F1-std achieves the best EER (16.4%). Kurtosis-based features are unstable due to sensitivity to outliers.

Figure 5: Progressive improvement of TRACE on the PartialSpoof dataset. Horizontal dashed lines denote supervised baselines reported in [ 43 ] .

Dataset	Best combination	EER %	$\Delta$
PartialSpoof [ 43 ]	F1 ${}_{\text{maxW}}$ + F1 ${}_{\text{dt4}}$	8.08	$-$ 3.0 pp
HAD [ 40 ]	F1 ${}_{\text{maxW}}$ + F1 ${}_{\text{top5\%}}$ + F1 ${}_{\text{top2\%}}$	20.92	$-$ 9.2 pp
ADD 2023 [ 42 ]	F1 ${}_{\text{rms}}$ (single)	33.43	—
LlamaPS [ 24 ]	F1 ${}_{\text{std}}$ + F1 ${}_{\text{maxW}}$	19.82	$-$ 4.3 pp

Table 5: Best feature combinations per dataset (WavLM-Large, layer 18).

\Delta

is improvement over F1-rms baseline.

Figure 6: EER of all 43 feature statistics on PartialSpoof (WavLM-Large, layer 18), ranked from best to worst. F1-rms, F1-mean-abs, and F1-dt4-rms perform best (10.84–11.07%). Directional angle features are weak standalone but aid cross-domain generalization when fused with magnitude statistics. All F2 statistics score

\approx

50% EER and are omitted.

Figure 7: Per-layer EER of WavLM-Large on PartialSpoof (F1-rms statistic). Layer 18 achieves the minimum EER (11.07%). The final layer (layer 24) performs near chance due to semantic-level smoothing of acoustic discontinuities.

Encoder	Optimal layer	EER (%)
WavLM-Large	18	11.07
WavLM-Base	10	12.43
HuBERT-Large	16	14.82
Wav2Vec2-XLSR	20	19.31
Wav2Vec2-Base	9	21.14
Whisper-Base	4	27.83

Table 6: Optimal layer and EER per encoder (PartialSpoof, F1-rms statistic). WavLM models benefit most from intermediate-layer extraction.

Encoder	Feature	EER (%) $\downarrow$	AUC $\uparrow$
First-order dynamics (F1)
WavLM-Large	F1-std	16.37	0.912
HuBERT-Large	F1-std	22.88	0.852
Whisper-Base	F1-mean-abs	29.49	0.766
Whisper-Base	F1-rms	29.73	0.765
Whisper-Base	F1-std	33.24	0.725

Table 7: First-order (F1) vs second-order (F2) dynamics across encoders and statistics on PartialSpoof eval. F1 consistently outperforms F2 across all combinations, confirming that embedding transition rate carries the dominant forensic signal in frozen speech foundation model representations.

Explore similar work

GenTraceBench: A Benchmark for Tracing Audio Deepfakes Across Pre- and Post-training Stages
Sep 18, 2026Li Wang, Kunyu Feng, Wan Lin +7Audio Deepfake Detection TTS Evaluation
The Chinese University of Hong Kong, Shenzhen, China · Huawei Technologies Co., Ltd., China · Amphion Technology Co., Ltd., China
Supervised Post-training of Speech Foundation Models for Robust Adaptation in Speech Deepfake Detection
Jun 24, 2026Zihan Pan, Sailor Hardik, Jinyang WuSupervised Fine-Tuning Audio Deepfake Detection
Institute for Infocomm Research (I2R), Agency for Science, Technology and Research (A*STAR), 1 Fusionopolis Way, 138632, Singapore
Trajectory Dynamics in Self-Supervised Learning Latent Space for Audio Deepfake Detection
Aug 13, 2026Tomás Andrade WeberAudio Deepfake Detection Audio Classification
Barcelona Supercomputing Center (BSC), CASE Department, Plaza Eusebi Güell, 1-3, 08034 Barcelona, Spain

Sep 18, 2026J/K move · Enter open · S save

GenTraceBench: A Benchmark for Tracing Audio Deepfakes Across Pre- and Post-training Stages

Li Wang, Kunyu Feng, Wan Lin, Dekun Chen+6

The Chinese University of Hong Kong, Shenzhen, China · Huawei Technologies Co., Ltd., China · Amphion Technology Co., Ltd., China

Audio Deepfake Detection TTS Evaluation Speaker Verification

Open paper AskPDF arXiv

Modern text-to-speech (TTS) systems are rarely deployed as unchanged pre-trained models. They are often adapted through supervised fine-tuning (SFT) or preference optimization such as DPO and GRPO. This raises a practical question for audio deepfake forensics: do fingerprints learned from a foundation generator remain valid after adaptation? We present GenTraceBench, a controlled benchmark spanning five TTS architectures, 16 pre-/post-training variants, and 49,728 utterances generated with fixed texts and speaker prompts. Under a train-on-foundation, test-on-adapted protocol, we evaluate binary detection, closed-set attribution, and open-set verification. DPO and GRPO generally preserve fingerprints, whereas some SFT and pre-training-data changes cause substantial drift; effect sizes vary across three forensic backbones. Repeated training runs confirm the largest W2V-BERT attribution drop, while a data-mixture control with comparable speech quality shows that composition change need not cause drift. In W2V-BERT verification, multi-shot enrollment reduces EER for the SFT condition from 44.4% to 11.0%, whereas the SingNet-only condition remains at or above 45% EER.

Abstract

Explore similar work

GenTraceBench: A Benchmark for Tracing Audio Deepfakes Across Pre- and Post-training Stages

Supervised Post-training of Speech Foundation Models for Robust Adaptation in Speech Deepfake Detection

Trajectory Dynamics in Self-Supervised Learning Latent Space for Audio Deepfake Detection