Synthetic speech detection benchmarks now report sub-1% error rates on some in-domain evaluations, yet performance degrades under unseen attacks, channel mismatch, and distribution shift. Based on a three-year effort with Phonexia, a commercial speaker-recognition vendor, we report barriers encountered while building and deploying a detector. Many public benchmarks are not licensed for commercial model development. Real inputs are not four-second clean clips but long, codec-degraded, sometimes partially synthetic recordings. And when a calibrated system returns a log-likelihood ratio of 2.5, no one can tell the customer what it means for their decision. Rather than proposing a new model, we connect these barriers to concrete research and coordination proposals: shared standards for commercially usable datasets, realistic deployment benchmarks, and scores that non-experts can act on. These observations come from one project and should be tested in other settings.
Figures & tables
System
Detection accuracy (seen attacks)
Detection accuracy (unseen attacks)
Balanced accuracy (seen attacks)
Balanced accuracy (unseen attacks)
[Company] v2
0.9135
0.9381
0.9383
0.9509
[Company] v3
0.9723
0.9760
0.9721
0.9745
Table 1: Illustrative internal results from two older [Company] detector versions on attacks labeled as seen and unseen. Detection accuracy is the weighted fraction of clips classified correctly, and balanced accuracy is the mean of the per-class accuracies. The underlying data and importance weights are proprietary; sample counts, exact test composition, operating thresholds, and uncertainty estimates are not available for publication. The table is therefore not intended as a reproducible benchmark, an absolute performance claim, or a comparison between detector versions. Its sole purpose is to show how a nominal seen/unseen split can overstate generalization: most of the “unseen” set came from the dev portions of the training corpora and contained new recordings of previously encountered attack types.
Experience (Sec.)
Unresolved community-level question
Actions
Data sourcing & provenance ( 3.1 )
Can a detector’s training data be verified and held to clean-sourcing standards when no one can audit a deployed model?
CR2, CO2
Data composition & drift ( 3.1 )
Which data does a detector actually need, how diverse must bona fide speech be, and how do we keep pace with drift?
CR1, CO1
Generalization ( 3.3 )
How do we know an evaluation tests genuinely unseen attacks and conditions, rather than familiar ones?
CM1
Metrics & comparability ( 3.3 )
What metrics and reporting make results meaningful at a deployment operating point, and comparable across conditions?
CM2, CO1
Score communication ( 3.4 )
How should a calibrated score become a decision, which a non-expert can act on and defend?
CM3
Deployment & defense ( 3.5 , 3.6 )
How should the field prepare for unseen attacks and define “fit for purpose” for consequential uses when customers lack representative data and deploy systems independently?
CO3, CO4
Table 2: From experience to roadmap. Each project observation (left) motivates a question for broader investigation (centre), which we map to proposed actions in Section 5.1 (right): CR = research, CM = method to develop and adopt, CO = coordination.
Advances in speech synthesis have made deepfake audio highly realistic. Earlier studies reported 70-80% human detection accuracy, but relied primarily on older synthesizers. We compare human detection for three selected voice synthesis tools released in 2019, 2022, and 2024 with 82 IT professionals, and benchmark humans against six pretrained detectors on the same material. For fully synthetic speech (full spoofs), the F1 score drops from about 90% for RTVC and YourTTS to 48% for ElevenLabs, although listeners were explicitly warned that deepfakes were present. For partial spoofing, where only one sentence of an utterance is altered, strict accuracy falls to 9%, and listeners classify the synthetic sentence as bona fide 77% of the time. Humans and detectors fail in complementary ways, and neither reliably localizes short manipulations. Additionally, listeners increasingly mislabel bona fide speech as fake, eroding trust in unmanipulated audio. These findings show that human perception alone is unreliable for the selected modern and partial-spoof conditions and motivate procedural verification, provenance, watermarking, and segment-level detection.
Provenance watermarking is increasingly treated as a safeguard for synthetic speech, whether built directly into speech-generation models such as Chatterbox, provided through dedicated techniques such as AudioSeal, or deployed by commercial platforms such as ElevenLabs. We identify a previously uncharacterized liability: when synthetic speech is watermarked and human speech is not, detectors trained alongside latch onto the watermark as a spurious "watermark => fake" shortcut. This single feature yields three coupled failures: generalization degradation (model performance deteriorates on unseen data), strip-to-evade (a watermarked fake escapes once unwatermarked), and mark-to-frame (watermarking a real voice flags it as fake). In a controlled white-box experiment, a watermark-trained detector shows all three (for example, mark-to-frame lifts Equal Error Rate from 16% to 75%). In a black-box test of a commercial API, we show that adding a watermark to real speech disguises it as fake. However, this shortcut is fixable: retraining with the watermark on both classes decorrelates it and restores clean behavior. We release experiment data as a paired clean-versus-watermarked corpus (WASP).
Recent advances in speech synthesis and voice conversion have greatly improved the naturalness and authenticity of generated audio. Meanwhile, evolving encoding, compression, and transmission mechanisms on social media platforms further obscure deepfake artifacts. These factors complicate reliable detection in real-world environments, underscoring the need for representative evaluation benchmarks. To this end, we introduce ML-ITW (Multilingual In-The-Wild), a multilingual dataset covering 14 languages, seven major platforms, and 180 public figures, totaling 28.39 hours of audio. We evaluate three detection paradigms: end-to-end neural models, self-supervised feature-based (SSL) methods, and audio large language models (Audio LLMs). Experimental results reveal significant performance degradation across diverse languages and real-world acoustic conditions, highlighting the limited generalization ability of existing detectors in practical scenarios. The ML-ITW dataset is publicly available.
Daixian Li, Jun Xue, Zhuolin Yi +4
School of Cyber Science and Engineering, Wuhan University