Human speech production is constrained by physiology, giving rise to characteristic temporal structure on acoustic signals. We hypothesise that these constraints manifest as structured trajectory dynamics in the latent space of Self-Supervised Learning (SSL) models, and that synthetic speech violates them detectably. To test this hypothesis, we train a causal Long Short-Term Memory (LSTM) next-frame predictor on bonafide speech only (Stage 1), using the deepfake-specialised SSL backbone Wav2Vec2-Large-AntiDeepfake, and compare against a static global-average-pooling baseline using identical features, thus isolating the contribution of temporal modelling. A supervised Stage 2, which trains a Multi-Layer Perceptron on the frozen LSTM internal states using labelled data, is included to characterise the role of spoof supervision. Our system achieves competitive or state-of-the-art performance across six benchmarks: ASVspoof 2019/2021, Codecfake, In-the-Wild, MLAAD-EN, and Deepfake-Eval-2024, including best published EER on ASVspoof 2021 (0.75%) and, notably, Stage 1 trained on bonafide speech only surpasses the published supervised baseline from the same backbone on DE2024 (30.35%). On near-domain benchmarks, static and dynamic approaches perform comparably. On harder cross-corpus benchmarks with diverse synthesis methods, trajectory dynamics provide substantial gains, confirming that temporal physiological constraints carry detection signal beyond utterance-level statistics.
Figures & tables
Dataset
Bonafide
Spoof
Hours
ASVspoof 2019 train †
2,580
22,800
∼ 8
ASVspoof 2019 eval
7,355
63,882
∼ 28
ASVspoof 2021 eval
22,617
589,212
∼ 670
Codecfake §
20,000
140,000
∼ 160
In-the-Wild
11,816
19,963
∼ 38
MLAAD-EN ‡
69,855
116,000
∼ 220
TABLE I: Evaluation datasets. † Training set for Stage 1 (bonafide only) and Stage 2 (bonafide + spoof). ‡ MLAAD-EN v9 (en_US + en_UK); bonafide from M-AILABS. SLIM uses MLAAD-EN v3 (37,998 utterances). § ASVspoof 2019/2021, Codecfake, and MLAAD (spoof only) are in the backbone training data; only ITW and DE2024 are fully out-of-distribution.
Benchmark
Static
Stage 1
Stage 2
BreathNet [ 8 ]
QAMO [ 7 ]
SLIM [ 6 ]
NII-GAP † [ 5 ]
(ours)
ASVspoof 2019
1.51
2.57±0.12
1.11±0.10
0.23
—
0.30
—
ASVspoof 2021
0.98
1.88±0.05
0.75±0.10
1.87
1.54
3.60
—
Codecfake §
3.21
5.21±0.09
2.43±0.18
—
—
—
—
In-the-Wild
4.03
4.84±0.04
3.28±0.60
4.70
5.09
12.5
1.91
MLAAD-EN ‡
22.86
5.71±0.03
10.02±1.22
—
—
10.7
—
TABLE II: EER (%) comparison across benchmarks. Lower is better. Static uses the same AntiDeepfake backbone with global average pooling and is deterministic. Stage 1 and Stage 2 report mean ± std over 25 independent runs (5 Stage 1 seeds × 5 Stage 2 MLP runs). † NII-GAP: same backbone with GAP+FC and full spoof supervision [ 5 ] . ‡ MLAAD-EN v9 (185K utterances); SLIM uses v3 (38K). § ASVspoof 2019/2021, Codecfake, and MLAAD (spoof only) are in the backbone training data; only ITW and DE2024 are fully out-of-distribution. ∗ NII-GAP DE2024 uses whole-file inference.
Fig. 1: UMAP visualisation of AntiDeepfake embedding space (red: bonafide, grey: spoof) across six benchmarks in increasing order of difficulty (left to right). Bonafide/spoof overlap grows progressively from tight separation (ASVspoof 2019/2021, Codecfake) through partial overlap (In-the-Wild, MLAAD-EN) to near-complete mixing (DE2024), explaining the corresponding degradation of the static baseline and the growing advantage of trajectory dynamics.
Audio deepfakes generated by neural text-to-speech and voice-cloning systems threaten speaker verification and public discourse at scale. The core challenge is cross-dataset generalization: detectors trained on one synthesis pipeline collapse on unseen forgeries. We argue that this failure is primarily because of structural synthetic speech artifacts which are multi-timescale trajectory anomalies. Though every existing detector aggregates a fixed-window frame statistics, this misaligns the architecture with the signal. We propose FlowFake, a Liquid Time-Constant (LTC) architecture whose hidden state evolves via a learned ODE, with per-neuron adaptive time constants simultaneously resolving spectral (10ms) and prosodic (2s) cues. At only 34K parameters FlowFake achieves formal BIBO stability and O(dt^4) integration error. On a four-dataset cross domain benchmark (ASVspoof2019-LA, FakeOrReal, InTheWild, MLAAD), FlowFake reaches 75.29% on ASVspoof2019 trained only on FakeOrReal and 79.97% trained only on MLAAD. It outperforms RawGAT-ST and Whisper-DF on every evaluated pair and matching SSL Wav2vec2 (300x larger) at 0.01% of its parameter count. The source code is available on : https://github.com/GhostRider2023/FlowFake
Partial audio deepfakes, where synthesized segments are spliced into genuine recordings, are particularly deceptive because most of the audio remains authentic. Existing detectors are supervised: they require frame-level annotations, overfit to specific synthesis pipelines, and must be retrained as new generative models emerge. We argue that this supervision is unnecessary. We hypothesize that speech foundation models implicitly encode a forensic signal: genuine speech forms smooth, slowly varying embedding trajectories, while splice boundaries introduce abrupt disruptions in frame-level transitions. Building on this, we propose TRACE (Training-free Representation-based Audio Countermeasure via Embedding dynamics), a training-free framework that detects partial audio deepfakes by analyzing the first-order dynamics of frozen speech foundation model representations without any training, labeled data, or architectural modification. We evaluate TRACE on four benchmarks that span two languages using six speech foundation models. In PartialSpoof, TRACE achieves 8.08% EER, competitive with fine-tuned supervised baselines. In LlamaPartialSpoof, the most challenging benchmark featuring LLM-driven commercial synthesis, TRACE surpasses a supervised baseline outright (24.12% vs. 24.49% EER) without any target-domain data. These results show that temporal dynamics in speech foundation models provide an effective, generalize signal for training-free audio forensics.
Awais Khan, Muhammad Umar Farooq, Kutub Uddin +1
College of Innovation and Technology, University of Michigan-Flint, MI, USA
Self-supervised learning (SSL) has transformed speech processing, with benchmarks such as SUPERB establishing fair comparisons across diverse downstream tasks. Despite it's security-critical importance, Audio deepfake detection has remained outside these efforts. In this work, we introduce Spoof-SUPERB, a benchmark for audio deepfake detection that systematically evaluates 20 SSL models spanning generative, discriminative, and spectrogram-based architectures. We evaluated these models on multiple in-domain and out-of-domain datasets. Our results reveal that large-scale discriminative models such as XLS-R, UniSpeech-SAT, and WavLM Large consistently outperform other models, benefiting from multilingual pretraining, speaker-aware objectives, and model scale. We further analyze the robustness of these models under acoustic degradations, showing that generative approaches degrade sharply, while discriminative models remain resilient. This benchmark establishes a reproducible baseline and provides practical insights into which SSL representations are most reliable for securing speech systems against audio deepfakes.
Hashim Ali, Nithin Sai Adupa, Surya Subramani +1
Electrical and Computer Engineering, University of Michigan, 4901 Evergreen Rd, Dearborn, MI 48128, USA