On Evaluating Quantum Kernel Robustness for Low-Resource Cross-Corpus Audio Deepfake Detection

Lisan Al Amin; Lei Zhang; Vandana P. Janeja

cs.SDSep 30, 2026

On Evaluating Quantum Kernel Robustness for Low-Resource Cross-Corpus Audio Deepfake Detection

Authors: Lisan Al Amin, Lei Zhang, Vandana P. Janeja

Organizations: University of Maryland, Baltimore County, Baltimore, Maryland, USA

Abstract

Synthetic speech detection is critical for audio security, but performance can degrade when labeled data are scarce and evaluation conditions differ from training. This study examines quantum kernel methods and lightweight neural models for cross-corpus audio deepfake detection under limited training data. We compare a Quantum Support Vector Machine (QSVM), a classical support vector machine (SVM), and a multilayer perceptron (MLP), all trained on frozen wav2vec 2.0 embeddings using a strict budget of 200 training samples. To match the qubit budget of near-term quantum hardware, embeddings are reduced to four dimensions using principal component analysis, and all models use the same reduced features. Experiments on ASVspoof 2019, ASVspoof 5, the ADD 2023 Challenge, and the In-the-Wild dataset show that under severe domain shift from ASVspoof 2019 to ADD 2023, the MLP degrades to near-random performance, with an area under the curve of approximately 50% and an equal error rate of 50.0%. In contrast, the QSVM maintains meaningful discrimination, achieving an area under the curve of 76.0% and an equal error rate of 27.0%. This advantage is not consistent across transfer directions. When trained on ADD 2023, the QSVM falls below chance on two of three transfers, while the MLP performs better. These results suggest that quantum kernel methods can be competitive under severe cross-corpus shifts and strict low-resource constraints, but do not provide a consistent advantage under near-domain transfer. We interpret these findings as an empirical characterization of quantum kernel inductive bias under distribution shift, rather than evidence of quantum advantage, since the four-qubit kernel can be simulated exactly on classical hardware.

Figures & tables

Fig. 1: Proposed Framework. Frozen wav2vec 2.0 features are reduced via PCA and passed to parallel back-ends.

Data	Model	Acc $\uparrow$	F1 (%) $\uparrow$	AUC $\uparrow$	EER $\downarrow$
ASV19	MLP	72.50 $\pm$ 4.47	70.40 $\pm$ 6.00	84.85 $\pm$ 2.73	24.00 $\pm$ 6.04
	SVM	75.50 $\pm$ 5.10	74.40 $\pm$ 6.00	81.60 $\pm$ 3.70	24.50 $\pm$ 5.10
	QSVM	78.50 $\pm$ 5.15	77.50 $\pm$ 5.00	84.90 $\pm$ 3.25	23.50 $\pm$ 6.82
ASV5	k-NN	86.00 $\pm$ 4.36	88.43 $\pm$ 5.16	94.40 $\pm$ 3.72	11.50 $\pm$ 5.83
	RF	87.00 $\pm$ 5.79	86.32 $\pm$ 6.50	94.00 $\pm$ 3.97	12.50 $\pm$ 5.48
	LR	88.00 $\pm$ 4.58	87.69 $\pm$ 5.11	94.95 $\pm$ 2.87	12.50 $\pm$ 5.48

TABLE I: In-Corpus Performance (Low-Resource). QSVM achieves the lowest EER (8.00%) on the modern ASVspoof 5 benchmark.

Model	EER (%) $\downarrow$	AUC (%) $\uparrow$	F1 Score $\uparrow$
MLP Baseline	16.00	89.05	0.746
Classical SVM (RBF)	19.00	85.72	0.772
QSVM	28.50	77.44	0.706

TABLE II: Legacy

\to

Modern Generalization. Classical back-ends lead under this near-domain shift. The QSVM’s advantage appears only under more severe shifts, discussed next.

Train	Test	MLP			SVM			QSVM
Train	Test	EER	AUC	Acc	EER	AUC	Acc	EER	AUC	Acc
ASV5	In-Wild	39.00	66.93	63.50	33.00	69.81	67.00	31.00	74.64	69.00
	ASV19	24.00	86.19	73.00	22.00	84.58	72.50	31.50	79.79	68.50
	ADD 2023	50.00	50.00	50.00	44.00	57.85	50.00	40.00	62.36	55.50
ASV19	ADD 2023	50.00	50.00	50.00	57.00	37.39	50.00	27.00	76.04	49.00
	In-Wild	38.00	66.21	58.50	34.50	69.52	59.50	40.50	65.59	59.50

TABLE III: Cross-Corpus Generalization. Under severe domain shift (e.g., ASV19

\to

ADD 2023), MLP degrades (AUC

\approx

50%) while QSVM retains discrimination (AUC 76%).

Panel of Figure 5 — Fig. 2: Robustness. QSVM (blue) shows improved robustness on (a) adversarial shifts and (b) noisy data relative to the classical SVM (orange) and the MLP baseline (green) under the same protocol.

Model	EER (%) $\downarrow$	ECE $\downarrow$
k-NN	11.50	0.0670
LR	12.50	0.1098
GB	13.00	0.1157
SVM	10.50	0.1252
RF	12.50	0.1691
QSVM	8.00	0.1542

TABLE IV: Calibration (ASVspoof 5). QSVM has best discrimination (lowest EER) but higher calibration error (ECE) than linear models.

Train	Test	MLP	SVM	QSVM
ASV19	ADD 2023	$4.98\pm 0.02$	$13.0\pm 7.2$	$\mathbf{15.0\pm 4.5}$
ADD 2023	ASV19	$4.92\pm 0.60$	$15.0\pm 1.6$	$\mathbf{19.3\pm 7.4}$
ASV5	Wild	$8.75\pm 2.45$	$\mathbf{24.0\pm 5.0}$	$21.0\pm 4.0$

TABLE V: Security Operating Point (TPR @ 5% FPR). QSVM is strongest on adversarial shifts (between ASV19 and ADD) under this operating point.

Explore similar work

May 7, 2026cs.SD

Quantum Kernels for Audio Deepfake Detection Using Spectrogram Patch Features

Quantum machine learning has emerged as a promising tool for pattern recognition, yet many audio-focused approaches still treat spectrograms as generic images and do not explicitly exploit their time-frequency structure. We propose Q-Patch, a quantum feature map tailored to audio that encodes local time-frequency patches from mel-spectrograms into quantum states using shallow, hardware-efficient circuits with adjacency-aware entanglement. Each selected patch is summarized by a compact four-dimensional acoustic descriptor and mapped to a four-qubit circuit with depth at most three, enabling practical quantum kernel construction under near-term constraints. We evaluate Q-Patch on an audio spoofing detection task using a controlled, balanced protocol and compare it with size-matched classical baselines. Q-Patch improves discrimination between bona fide and spoofed samples, achieving an area under the receiver operating characteristic curve (AUROC) of 0.87, compared with 0.82 for a radial basis function support vector machine (RBF-SVM) trained on the same patch-level features. Kernel-space analysis further reveals a clear class structure, with cross-class similarity around 0.615 and within-class self-similarity of 1.00. Overall, Q-Patch provides a practical framework for incorporating time-frequency-aware representations into quantum kernel learning for audio authenticity assessment in low-resource settings.

Lisan Al Amin, Rakib Hossain, Mahbubul Islam +2

Potomac Quantum, USA · United International University, Dhaka, Bangladesh · University of Maryland, College Park, MD, USA +2

Audio Deepfake Detection Quantum Kernels Spectral Features Time-Frequency Quantum Machine Learning Audio Understanding

Ask PDF

Jun 17, 2026cs.SD

FlowFake: Liquid Networks for Audio Deepfake Detection

Audio deepfakes generated by neural text-to-speech and voice-cloning systems threaten speaker verification and public discourse at scale. The core challenge is cross-dataset generalization: detectors trained on one synthesis pipeline collapse on unseen forgeries. We argue that this failure is primarily because of structural synthetic speech artifacts which are multi-timescale trajectory anomalies. Though every existing detector aggregates a fixed-window frame statistics, this misaligns the architecture with the signal. We propose FlowFake, a Liquid Time-Constant (LTC) architecture whose hidden state evolves via a learned ODE, with per-neuron adaptive time constants simultaneously resolving spectral (10ms) and prosodic (2s) cues. At only 34K parameters FlowFake achieves formal BIBO stability and O(dt^4) integration error. On a four-dataset cross domain benchmark (ASVspoof2019-LA, FakeOrReal, InTheWild, MLAAD), FlowFake reaches 75.29% on ASVspoof2019 trained only on FakeOrReal and 79.97% trained only on MLAAD. It outperforms RawGAT-ST and Whisper-DF on every evaluated pair and matching SSL Wav2vec2 (300x larger) at 0.01% of its parameter count. The source code is available on : https://github.com/GhostRider2023/FlowFake

Shivaay Dhondiyal, Divyansh Sharma, Dinesh Kumar Vishwakarma

Delhi Technological University, New Delhi, India.

Neural Audio Speaker Fake News

Ask PDF

Jul 10, 2026cs.SD

What You Train Is What You Get: Gender Bias, Training Composition, and Post-Hoc Mitigation in Audio Deepfake Detection

Audio deepfake detection models determine whether speech is genuine or artificially generated, but high overall accuracy can mask substantial performance disparities across demographic groups. In this work, we investigate gender bias in audio deepfake detection using the ASVspoof5 dataset. We use ASVspoof5 under a controlled custom split designed to isolate gender-composition effects. We train attack-specific models on nine training sets with different gender compositions, ranging from female-only to male-only. We use a ResNet18 classifier with LogSpectrogram and WavLM-Base+ features, and we evaluated six post-hoc threshold calibration methods. Experimental results show that training data composition strongly predicts bias direction, with the underrepresented gender performing worse at test time. WavLM-Base+ features are shown to produce gender performance gaps 3.0 to 4.3 times larger than LogSpectrogram under identical training conditions, and balanced training is found to reduce LogSpectrogram bias but leave WavLM bias largely intact. Moreover, all six calibration strategies, including Oracle calibration with full test-set label access, leave the Equal Error Rate gap unchanged at 1.317 pp, confirming that threshold adjustment cannot correct underlying score distribution disparities. Overall, these findings suggest that gender fairness in audio deepfake detection must be addressed at training time, as post-hoc methods can only partially mitigate the resulting disparities

Aishwarya R. Fursule, Vamshi Nallaguntla, Shruti Kshirsagar +1

School of Computing, Wichita State University, Wichita, KS, USA · Institut national de la recherche scientifique (INRS–EMT), Montreal, QC, Canada · INRS-UQO Mixed Research Unit on Cybersecurity, Gatineau, QC, Canada

Audio Deepfake Detection Audio Understanding Gender Bias Training Data

Ask PDF