A Training-Free Proactive Defense Against Partial Speech Manipulation via Self-Embedding Steganography

Yigitcan Özer; Zhe Zhang; Wanying Ge; Xin Wang; Junichi Yamagishi

cs.SDAug 26, 2026

A Training-Free Proactive Defense Against Partial Speech Manipulation via Self-Embedding Steganography

Authors: Yigitcan Özer, Zhe Zhang, Wanying Ge, Xin Wang, Junichi Yamagishi

Organizations: National Institute of Informatics, Tokyo, Japan

Abstract

Partial deepfake speech, where only limited segments of an utterance are synthesized or manipulated, poses a significant challenge to existing deepfake detection systems. As the proportion of spoofed regions decreases, passive detectors become increasingly unreliable, and accurate detection and restoration remain challenging. In this paper, we revisit audio steganography from a new perspective and propose its use as a proactive defense against partially deepfaked audio. In particular, we consider a self-embedding strategy in which a clean speech signal embeds a compressed representation of itself, enabling post-hoc extraction of reference content. We demonstrate how existing audio steganography methods can be repurposed to support detection of partial deepfakes through codec-based restoration. Experiments on a benchmark dataset show that the proposed approach complements passive defenses. Remarkably, the proposed method operates without any training, providing a robust and data-efficient alternative for partial deepfake detection.

Figures & tables

Figure 1: Overview of the proposed self-embedding-based audio steganography framework against partial deepfake manipulation. Discrepancies between the received spoofed signal $\mathbf{\tilde{x}_{\mathrm{sp}}}$ and its reconstruction $R(\mathbf{\tilde{x}_{\mathrm{sp}}})$ enable detection while restoration is ensured through neural codec-based reconstruction.

Figure 2: Warping paths computed with dynamic time warping (DTW), left: the stego signal $\mathbf{\tilde{x}}$ and the reconstructed audio $R(\mathbf{\tilde{x}})$ , without no manipulation, right: the stego signal after manipulation ( $\mathbf{\tilde{x}_{\mathrm{sp}}}$ ) and the reconstructed audio ( $R(\mathbf{\tilde{x}_{\mathrm{sp}}})$ ) from the manipulated stego signal.

	Ours	LAV-DF [ 7 ]	LAV-DF+ [ 8 ]	ResNet [ 41 ]
Single-word swapping
GriffinLim [ 36 ]	9.95	50.17	49.90	47.46
HiFiGAN [ 37 ]	9.38	50.04	49.90	47.52
HNSincNSF [ 38 ]	9.52	50.10	49.90	46.97
HNSincNSFHiFi [ 39 ]	9.52	50.31	49.90	47.52
WaveGlow [ 40 ]	8.91	50.37	50.03	43.98

Table 1: Detection performance under the word-swapping attack, reported as EER (%). The pooled result is followed by results for each re-synthesis model. Lower EER values indicate better detection performance.

Figure 3: Score distributions computed via DTW-based dissimilarity metric ( $s_{\mathrm{DTW}}$ ) for authentic signals and single-word swap manipulations under various vocoder conditions.

Figure 4: Detection performance as a function of swapped-word duration. Each point reports the EER within a 0.1 s duration bin for different vocoders.

Explore similar work

TRACE: Training-Free Partial Audio Deepfake Detection via Embedding Trajectory Analysis of Speech Foundation Models
Apr 1, 2026Awais Khan, Muhammad Umar Farooq, Kutub Uddin +1Audio Deepfake Detection
College of Innovation and Technology, University of Michigan-Flint, MI, USA
Split and Conquer Partial Deepfake Speech
Apr 3, 2026Inbal Rimon, Oren Gal, Haim PermuterAudio Deepfake Detection ASVspoof
Ben Gurion University, Be’er Sheva, Israel · University of Haifa, Haifa, Israel
Boundary and Intra-Segment Learning for Partial Audio Deepfake Localization
Sep 22, 2026Zhe Ye, Xiangui Kang, Minhua Huang +3Audio Deepfake Detection Boundary-Aware Segmentation
Guangdong Key Lab of Information Security, School of Computer Science and Engineering, Sun Yat-sen University, China · Nanyang Technological University, Singapore · China Mobile Internet Corporation, China +1

Apr 1, 2026J/K move · Enter open · S save

TRACE: Training-Free Partial Audio Deepfake Detection via Embedding Trajectory Analysis of Speech Foundation Models

Awais Khan, Muhammad Umar Farooq, Kutub Uddin, Khalid Malik

College of Innovation and Technology, University of Michigan-Flint, MI, USA

Audio Deepfake Detection

Open paper AskPDF arXiv

Partial audio deepfakes, where synthesized segments are spliced into genuine recordings, are particularly deceptive because most of the audio remains authentic. Existing detectors are supervised: they require frame-level annotations, overfit to specific synthesis pipelines, and must be retrained as new generative models emerge. We argue that this supervision is unnecessary. We hypothesize that speech foundation models implicitly encode a forensic signal: genuine speech forms smooth, slowly varying embedding trajectories, while splice boundaries introduce abrupt disruptions in frame-level transitions. Building on this, we propose TRACE (Training-free Representation-based Audio Countermeasure via Embedding dynamics), a training-free framework that detects partial audio deepfakes by analyzing the first-order dynamics of frozen speech foundation model representations without any training, labeled data, or architectural modification. We evaluate TRACE on four benchmarks that span two languages using six speech foundation models. In PartialSpoof, TRACE achieves 8.08% EER, competitive with fine-tuned supervised baselines. In LlamaPartialSpoof, the most challenging benchmark featuring LLM-driven commercial synthesis, TRACE surpasses a supervised baseline outright (24.12% vs. 24.49% EER) without any target-domain data. These results show that temporal dynamics in speech foundation models provide an effective, generalize signal for training-free audio forensics.

Abstract

Explore similar work

TRACE: Training-Free Partial Audio Deepfake Detection via Embedding Trajectory Analysis of Speech Foundation Models

Split and Conquer Partial Deepfake Speech

Boundary and Intra-Segment Learning for Partial Audio Deepfake Localization