GLAD: Global-Local Adaptive Detector for Robust Speech Deepfake Detection

Zelin Zhao; Guanjie Huang; Danny Hin Kwok Tsang; Li Liu

cs.SDSep 28, 2026

GLAD: Global-Local Adaptive Detector for Robust Speech Deepfake Detection

Authors: Zelin Zhao, Guanjie Huang, Danny Hin Kwok Tsang, Li Liu

Organizations: The Hong Kong University of Science and Technology (Guangzhou)

Abstract

Recent advances in AI-based speech synthesis have enabled highly realistic speech, increasing the importance of speech deepfake detection (SDD) in preventing misuse. While mainstream Self-Supervised Learning (SSL)-based detectors achieve strong performance, they suffer from poor generalization to unseen domains and often overlook fine-grained signal artifacts due to a bias towards global semantic consistency. In this paper, we conduct the first detailed empirical and visual analysis to validate these limitations explicitly. Our investigation reveals two critical architectural vulnerabilities: (1) a systemic failure to capture localized spoofing traces, and (2) a severe lack of adaptability to domain-driven shifts in SSL layer importance, rendering static aggregation strategies prone to overfitting. To address these vulnerabilities, we propose the Global-Local Adaptive Detector (GLAD). Specifically, to capture localized forgeries, GLAD employs a Hierarchical Global-Local (HGL) backbone that explicitly bridges the granularity gap by fusing global linguistic and acoustic features with fine-grained local signal details. To counter layer importance shifts in out-of-distribution (OOD) scenarios, we introduce a Hierarchical Adaptive Gating (HAG) mechanism that dynamically recalibrates layer-wise focus in a sample-specific manner. Finally, to address shortcut learning induced by environmental biases, we introduce SaniBoost, a composite data augmentation strategy for robust signal standardization and noise sanitization. Extensive experiments demonstrate that GLAD significantly outperforms state-of-the-art methods, particularly on unseen domain cases.The code will be released upon publication.

Figures & tables

Figure 1: Resolving the Fine-grained Forgery of SSL Detectors. Saliency map Simonyan et al. (2013) visualization on a partial spoof sample from Zhang et al. (2022) , where gray shaded areas denote the ground-truth spoofed regions. (A-B) The input waveform and spectrogram reveal high-frequency inconsistencies in the spoofed region. (C) The SSL baseline (XLS-R Zhang et al. (2024) ) overlooks the artifact region. (D) In contrast, our GLAD accurately pinpoints the local anomaly with a distinct saliency peak. This comparison highlights that our Global-Local design effectively compensates for the local insensitivity of pure SSL backbones.

Figure 2: Visualization of layer weight distributions of the same SSL models (WavLM Chen et al. (2022) ) using three different random seeds . Panels (A–B) display the weights with Sensitive Layer Selection (SLS) Zhang et al. (2024) , while Panels (C–D) are replaced by our proposed HAG. The solid lines (Red for 21DF, Blue for ITW) represent the weights assigned by the model only trained on the source domain (19LA), whereas the grey dashed lines indicate the oracle distributions derived from in-domain training (upper bound). The relatively high Dynamic Time Warping (DTW) scores in (A–B) reveal a significant misalignment between the static selection and the ideal layer preference. In contrast, the lower DTW scores in (C–D) demonstrate that HAG achieves a much tighter alignment with the oracle distribution, effectively adapting to cross-domain scenarios.

Figure 3: The overall architecture of the proposed GLAD framework from raw speech input to final classification. (a) The Saniboost data augmentation method. (b) The Hierarchical Global-Local Backbone (HGL) module. Here, $H_{s}$ , $H_{a}$ , and $\tilde{F}_{c}$ denote the representations extracted from the semantic SSL, acoustic SSL, and signal-level CNN encoders, respectively. $\hat{H}_{s}$ and $\hat{H}_{a}$ represent the Lingusitic-Acoustic Cross-Attention outputs where $H_{s}$ and $H_{a}$ serve as the Query, respectively. $F_{fused}$ refers to the linguistic-acoustic fused feature, $F_{refined}$ represents the refined fused feature, $F_{g}$ is the weighted refined fused feature, $F_{u}$ is the output of the Multi-Granularity Fusion, and $F_{final}$ denotes the final feature vector sent to the classifier. (c) The Hierarchical Adaptive Gating (HAG) module. $g_{s}$ , $g_{a}$ , $g_{sa}$ , and $g_{c}$ represent the learned gating values for different streams. $\alpha_{l}$ denotes the learnable weights for layer-wise weighted summation.

Method	2021 LA		2021 DF	PartialSpoof	ITW	FoR
Method	EER (%) $\downarrow$	min t-DCF $\downarrow$	EER (%) $\downarrow$	EER (%) $\downarrow$	EER (%) $\downarrow$	EER (%) $\downarrow$
AASIST	12.82	0.5468	20.25	33.02	43.50	44.26
W2V2-ST	7.36	0.3769	8.13	10.96	18.67	8.98
AMSDF	2.00	0.2408	3.82	14.07	15.45	11.44
XLS-53 & LGF	6.53	0.3400	4.75	9.25	26.37	21.90
XLS-R & SLS	4.47	0.2907	2.30	8.28	7.38	5.15

Table 1: Performance comparison across multiple benchmarks, including ASVspoof 2021 LA/DF, PartialSpoof, and real-world scenarios (ITW and FoR). Lower values are better (

\downarrow

Figure 4: t-SNE visualization of feature embeddings obtained by GLAD. Orange denotes bona fide samples, and blue denotes spoofed samples (1000 samples per class).

Figure 5: Analysis of learned gating distributions on different sets. The plot displays the distributions of component gates and the final aggregated importance coefficient (red solid line). The distinct activation patterns across different datasets confirm that the HAG module dynamically reconfigures its attention to capture domain-specific forensic traces while suppressing irrelevant signals.

Method	21LA $\downarrow$	21DF $\downarrow$	ITW $\downarrow$
w/o HGL	3.13	1.99	9.91
w/o HAG	2.35	2.66	9.05
w/o Saniboost	4.62	2.47	6.44
GLAD	1.88	1.31	5.44

Table 2: Ablation study of main GLAD components on 21LA, 21DF, and ITW datasets (EER %).

Appendix figures & tables19 assets

Supplementary material from the paper’s appendix.

Appendix

Method	2021 LA EER $\downarrow$	2021 LA min-tDCF $\downarrow$	2021 DF $\downarrow$	PartialSpoof $\downarrow$	ITW $\downarrow$	FoR $\downarrow$
AASIST	$30.54\pm 15.44$	$0.8488\pm 0.2615$	$17.76\pm 2.24$	$35.92\pm 4.53$	$45.15\pm 2.63$	$32.77\pm 12.37$
W2V2-ST	$3.93\pm 3.02$	$0.2896\pm 0.0770$	$4.61\pm 3.05$	$28.18\pm 14.94$	$11.78\pm 6.00$	$8.33\pm 2.01$
AMSDF	$4.05\pm 1.78$	$0.2961\pm 0.0483$	$5.30\pm 1.44$	$14.74\pm 0.81$	$15.06\pm 2.08$	$18.40\pm 7.26$
XLSR-LGF	$10.85\pm 4.03$	$0.4168\pm 0.0679$	$5.74\pm 0.89$	$9.37\pm 0.22$	$23.31\pm 2.72$	$28.19\pm 5.99$
XLSR-SLS	$4.33\pm 0.31$	$0.2959\pm 0.0087$	$3.34\pm 1.23$	$12.11\pm 4.04$	$11.10\pm 5.15$	$11.83\pm 6.29$
XLSR-MultiConv	$9.06\pm 2.90$	$0.4131\pm 0.0732$	$6.92\pm 5.41$	$9.83\pm 3.00$	$14.45\pm 6.17$	$25.60\pm 2.75$

Appendix

Table 3: Performance stability comparison across different methods. Results are reported as mean

\pm

standard deviation over multiple random seeds. EER values are reported in %.

Method	A07 $\downarrow$	A08 $\downarrow$	A09 $\downarrow$	A10 $\downarrow$	A11 $\downarrow$	A12 $\downarrow$	A13 $\downarrow$	A14 $\downarrow$	A15 $\downarrow$	A16 $\downarrow$	A17 $\downarrow$	A18 $\downarrow$	A19 $\downarrow$	EER $\downarrow$	min t-DCF $\downarrow$
TSSDN	1.43	0.75	0.02	1.75	0.06	0.18	0.06	0.11	2.05	1.25	6.01	1.14	1.44	1.62	0.0474
RawGAT-ST	0.11	0.30	0.04	0.16	0.09	0.19	0.07	0.07	0.14	0.27	0.53	0.1	0.23	1.15	0.0373
AASIST	0.80	0.44	0.00	1.06	0.16	0.31	0.91	0.1	0.15	0.65	0.72	1.52	3.40	0.62	1.13
LC-Res18	0.05	0.26	0.00	0.26	0.13	0.17	0.18	0.10	0.18	0.10	2.48	0.40	0.17	0.80	0.0210
W2V2-ST	0.06	0.06	0.02	0.40	0.10	0.14	0.00	0.06	0.24	0.06	0.37	0.84	0.35	0.25	0.0071
AMSDF	0.03	0.05	0.03	0.52	0.38	0.23	0.02	0.05	0.33	0.12	0.30	0.47	0.41	0.31	0.0097

Appendix

Table 4: Performance comparison on the ASVspoof 2019 LA evaluation set. Results are reported in terms of EER (%) and min t-DCF. GLAD achieves SOTA performance, demonstrating superior robustness across most individual attack types (A07–A19).

Model / Paper	Parameters / Backbone	21LA $\downarrow$	21DF $\downarrow$	ITW $\downarrow$	FoR $\downarrow$
AWaveFormer Wang et al. (2025)	634M, XLS-R + WavLM	2.33	3.63	10.25	5.15
Towards Generalisable and Calibrated Audio Deepfake Detection Pascu et al. (2024)	2.16B, XLS-R-2B	–	–	7.20	6.30
A Robust Audio Deepfake Detection System via Multi-view Feature Yang et al. (2024)	940M, XLS-R + WavLM + HuBERT	6.56	–	–	–
Comparative Analysis of ASR Methods for Speech Deepfake Detection Salvi et al. (2024)	769M, Whisper Medium	–	12.40	32.19	12.50
Comparative Analysis of ASR Methods for Speech Deepfake Detection Salvi et al. (2024)	1.55B, Whisper Large	–	11.68	30.40	5.08
ALLM4ADD Gu et al. (2025)	7.7B	–	–	26.99	–

Appendix

Table 5: Comparison with large-scale and multi-backbone speech deepfake detectors. Results are reported in EER (%). “–” denotes results not reported in the corresponding work. Despite using substantially larger models or multiple pretrained backbones, existing methods do not consistently outperform GLAD across cross-domain evaluation benchmarks.

	Frame AUPRC		IoU@GT		Segment Recall
# segments	XLS-R-SLS	GLAD	XLS-R-SLS	GLAD	XLS-R-SLS	GLAD
1	0.1734	0.2034	0.0822	0.0898	0.2360	0.3202
2	0.3025	0.3894	0.1636	0.2346	0.4022	0.5858
3	0.2224	0.2786	0.1135	0.1458	0.2545	0.3737
4	0.2072	0.2553	0.1050	0.1340	0.2232	0.3406
5	0.1590	0.2109	0.0801	0.1086	0.1743	0.2770

Appendix

Table 6: Attribution alignment on PartialSpoof utterances.

Figure 6: Visualization of layer importance distributions under different layer selection strategies across multiple random seeds. Panels (A–B) show the results obtained using Sensitive Layer Selection (SLS) Zhang et al. (2024) , while Panels (C–D) correspond to the proposed Hierarchical Adaptive Gating (HAG) mechanism. The solid curves (Red for 21DF and Blue for ITW) represent the adaptive layer importance learned by models trained on the source domain (19LA), whereas the grey dashed curves denote the oracle layer importance distributions derived from in-domain training (upper bound). The shaded regions indicate the standard deviation across different random seeds, reflecting the stability of the learned layer preferences. Compared with SLS, the proposed HAG in Panels (C–D) achieves substantially lower DTW distances and higher cosine similarities with the oracle distributions, demonstrating more stable and accurate cross-domain layer adaptation behavior.

Dataset	Dynamic	Target-domain Mean	$\Delta$ EER [95% CI]
21LA	5.3030	5.7285	+0.4255 [0.3268, 0.5223]
21DF	1.3108	1.4709	+0.1601 [0.1277, 0.2048]
ITW	5.4418	5.6195	+0.1777 [0.0592, 0.2877]

Appendix

Table 7: Gate intervention using the same trained GLAD checkpoint.

Dataset	Layer (%)	Stream (%)	Local (%)
21LA	61.2	55.9	98.6
21DF	66.0	74.0	99.8
ITW	82.2	65.0	98.1

Appendix

Table 8: Proportion of dynamic-gate variation remaining within bona fide and spoof classes. Higher values indicate that a larger fraction of gate variation occurs among utterances within the same class.

Measurement	Median [25th, 75th percentile]
Energy change below 500 Hz	$-40.07\;[-41.92,-38.64]$ dB
Energy change, 500–2000 Hz	$-13.04\;[-15.13,-10.97]$ dB
Energy change, 2000–4000 Hz	$+2.56\;[+2.31,+2.77]$ dB
Energy change, 4000–8000 Hz	$+3.43\;[+3.36,+3.47]$ dB
Spectral centroid change	$+2.63\;[+2.15,+3.19]$ kHz
RMS amplitude change	$-10.71\;[-13.16,-8.64]$ dB

Appendix

Table 9: Paired signal measurements on the fixed, speaker-balanced subset.

Measurement	Original	Forced SaniBoost	Change
Word errors / reference words	48/3523	132/3523	$+84$ errors
Corpus WER (%)	1.362	3.747	$+2.384$
Corpus CER (%)	0.611	1.957	$+1.346$
95% CI for the WER increase	$[+1.678,+3.126]$
Unchanged utterance-level WER	431/500 (86.2%)
Increased utterance-level WER	64/500 (12.8%)

Appendix

Table 10: Whisper large-v3 transcription analysis. WER and CER are corpus-level percentages. The WER difference is computed before rounding, and its brackets indicate a paired-bootstrap 95% confidence interval. The final three rows compare utterance-level WER before and after sanitization.

	Mean Paired Cosine		Linear CKA
Stage	$p=0$	$p=0.35$	$p=0$	$p=0.35$
WavLM	0.8965	0.8858	0.7522	0.6480
XLS-R	0.6896	0.8704	0.0877	0.6764
Cross-SSL	0.7325	0.8724	0.1327	0.6597
CNN	0.9783	0.9913	0.1794	0.1787
Multi-stream fusion	0.3095	0.9096	0.0407	0.3705

Appendix

Table 11: Representation agreement under the same forced-sanitization protocol. The two training settings differ in their ABFP probability,

p=0

p=0.35

Measurement	$\bm{p=0}$	$\bm{p=0.35}$
Original inputs classified as bona fide	498/500	499/500
Sanitized inputs classified as bona fide	278/500	500/500
Conditional bona fide retention	277/498	499/499
All predictions unchanged	278/500	499/500
Spoof $\rightarrow$ spoof	1	0
Spoof $\rightarrow$ bona fide	1	1

Appendix

Table 12: Prediction behavior under forced sanitization. All 500 inputs are bona fide. Both checkpoints use a bona fide probability threshold of 0.5.

Measurement	Result
Median paired speaker cosine	0.884
Interquartile interval	$[0.827,0.919]$
Mean paired speaker cosine	0.860

Appendix

Table 13: Speaker representation similarity between the original and forcibly sanitized utterances.

Dataset	Training condition	Original EER	Conflict EER	$\Delta$ EER
21LA	No augmentation	4.50	71.44	$+66.94$
	Without ABFP	2.41	11.52	$+9.11$
	Full SaniBoost	1.81	0.02	$-1.79$
21DF	No augmentation	2.41	64.59	$+62.18$
	Without ABFP	1.96	23.86	$+21.90$
	Full SaniBoost	1.20	0.04	$-1.16$

Appendix

Table 14: EER before and after the joint intervention at 5 dB SNR. The conflict set contains sanitized bona fide utterances and spoof utterances corrupted with environmental noise. EER is reported in %, and

\Delta

EER in percentage points.

Training condition	SNR (dB)	EER	$\Delta$ EER
21LA
No augmentation	10	63.43	$+58.93$
	5	71.44	$+66.94$
	0	74.46	$+69.96$
Without ABFP	10	10.15	$+7.74$
	5	11.52	$+9.11$

Appendix

Table 15: EER on the conflict set across different noise levels. EER is reported in %, and

\Delta

EER denotes the change from the corresponding original subset in percentage points.

Dataset	Observed $\Delta$ EER contrast	95% CI
21LA	$-10.90$	$[-11.56,-10.24]$
21DF	$-23.06$	$[-23.86,-22.14]$
ITW	$-19.54$	$[-20.58,-18.66]$

Appendix

Table 16: Full SaniBoost minus Without ABFP contrasts in

\Delta

EER. All values are in percentage points. Confidence intervals are obtained from 10,000 paired bootstrap resamples. This setting uses 5 dB SNR.

Method / Variant	21LA $\downarrow$	21DF $\downarrow$	ITW $\downarrow$
w/o L-A Cross-Attention	3.82	12.31	12.82
w/o Multi-Granularity Fusion	2.21	2.05	8.33
w/o Adaptive S-w Gating	2.26	1.71	7.67
w/o Refined L-w Aggregation	4.70	1.96	6.14
w/o Global-Local Modulation	2.37	1.66	6.19
w/ RawBoost	3.64	1.90	7.80

Appendix

Table 17: Ablation study on the internal core components of GLAD on 21LA, 21DF, and ITW datasets (EER %). The Adaptive S-w Gating denotes the Stream-wise Gating, and the Refined L-w Aggregation denotes the Refined Layer-wise Aggregation. The L-A Cross-Attention denotes the Linguistic-Acoustic Cross-Attention. The ABFP means adversarial bona fide purification. Asymmetric ABFP means using ABFP adversarial purification for both bona fide and spoof.

Ratio	DF EER $\downarrow$	LA EER/min t-DCF $\downarrow$	ITW EER $\downarrow$
0.05	1.94	1.65 / 0.2314	7.96
0.15	1.82	2.85 / 0.2550	6.47
0.25	1.91	5.33 / 0.3299	6.51
0.35	1.31	1.88 / 0.2359	5.44
0.45	2.28	2.61 / 0.2573	5.63
0.50	1.94	3.30 / 0.2719	6.97

Appendix

Table 18: Effect of different bona fide application ratios under a fixed 2000 Hz cutoff frequency. Results are reported using EER (%) and min t-DCF.

Cutoff Frequency (Hz)	DF EER $\downarrow$	LA EER/min t-DCF $\downarrow$	ITW EER $\downarrow$
0	1.59	3.96 / 0.2936	6.42
1000	1.92	2.74 / 0.2555	6.71
2000	1.31	1.88 / 0.2359	5.44
3000	2.01	3.55 / 0.2835	5.95
4000	1.69	4.40 / 0.3025	5.42
5000	1.87	4.09 / 0.2923	4.98

Appendix

Table 19: Effect of different high-pass filter cutoff frequencies under a fixed 0.35 application ratio. Results are reported using EER (%) and min t-DCF.

Model	Total / Trainable Parameters (M)	Peak Training Memory (GiB)	FLOPs (G)	21LA EER (%) $\downarrow$	21DF EER (%) $\downarrow$	ITW EER (%) $\downarrow$
Naive dual-SSL + CNN fusion	633.89 / 633.89	15.58	375.01	$6.50\pm 0.38$	$3.57\pm 0.19$	$7.05\pm 0.91$
Static SLS + late fusion	633.90 / 633.90	15.76	375.02	$5.73\pm 0.50$	$3.23\pm 0.54$	$7.40\pm 3.00$
Generic cross-attention + SE	642.55 / 642.55	15.67	378.39	$4.42\pm 2.10$	$12.40\pm 12.19$	$23.69\pm 15.02$
Parameter-matched large MLP	662.24 / 662.24	15.89	375.10	$4.87\pm 1.34$	$2.74\pm 0.73$	$6.63\pm 0.84$
MFA-style pooling + late fusion	646.71 / 646.71	16.74	377.42	$6.00\pm 0.21$	$3.79\pm 0.87$	$8.27\pm 1.56$
GLAD	662.23 / 662.23	16.14	381.58	$\mathbf{2.70\pm 0.74}$	$\mathbf{1.53\pm 0.29}$	$\mathbf{5.91\pm 0.61}$

Appendix

Table 20: Capacity-controlled comparison of GLAD and five alternative fusion architectures. Detection performance is reported as mean

\pm

sample standard deviation of EER (%) over three random seeds (909, 1234, and 1235). All variants use the same backbones. Computational cost is reported in terms of parameter count, peak training memory, and FLOPs.

Explore similar work

Domain-Adaptive Dual-Gating Mixture of Experts for Generalizable Speech Deepfake Detection
Sep 27, 2026Siqing Qin, Zhe Li, Kong Aik Lee +1Domain-Adapted Diffusion Acoustic
Dept. of Electrical and Electronic Engineering, The Hong Kong Polytechnic University · Speech, Language, and Cognition Laboratory, The University of Hong Kong
Time-Frequency Consistency Learning for Robust Speech Deepfake Detection
Jul 20, 2026Jun Xue, Zhuolin Yi, Yanzhen Ren +6Audio Deepfake Detection Distortion
School of Cyber Science and Engineering, Wuhan University Wuhan, China · Wuhan University Wuhan, China · Tongji University ShanghaiU, China
Supervised Post-training of Speech Foundation Models for Robust Adaptation in Speech Deepfake Detection
Jun 24, 2026Zihan Pan, Sailor Hardik, Jinyang WuSpoofing Self-Supervised Speech Models
Institute for Infocomm Research (I2R), Agency for Science, Technology and Research (A*STAR), 1 Fusionopolis Way, 138632, Singapore

Sep 27, 2026, eess.ASJ/K move · Enter open · S save

Domain-Adaptive Dual-Gating Mixture of Experts for Generalizable Speech Deepfake Detection

Siqing Qin, Zhe Li, Kong Aik Lee, Man-Wai Mak

Dept. of Electrical and Electronic Engineering, The Hong Kong Polytechnic University · Speech, Language, and Cognition Laboratory, The University of Hong Kong

Domain-Adapted Diffusion Acoustic Experts

Open paper AskPDF arXiv

Recent advances in speech deepfake detection (SDD) have leveraged the Mixture of Experts (MoE) to enhance generalization capacity. However, existing gating networks often overlook the acoustic and temporal cues of deepfakes. In this work, we propose a novel domain-adaptive dual-gating MoE (DADGMoE) framework for SDD under unseen attack types and acoustic conditions. Our innovative dual-gating mechanism leverages Sinc-layer-based filters to process both low-level acoustic signals (raw waveforms) and high-level speech representations from a large self-supervised learning (SSL) model. It further incorporates domain prototypes to guide expert routing based on implicit deepfake patterns. The lightweight affine experts process the routed inputs. Experiments show that our DADGMoE significantly outperforms the baseline, achieving up to a 40.8% relative EER reduction on challenging out-of-dataset benchmarks. This framework demonstrates superior generalization capabilities and efficient design.

Abstract

Explore similar work

Domain-Adaptive Dual-Gating Mixture of Experts for Generalizable Speech Deepfake Detection

Time-Frequency Consistency Learning for Robust Speech Deepfake Detection

Supervised Post-training of Speech Foundation Models for Robust Adaptation in Speech Deepfake Detection