Temporal Anchors and Editing Sensitivity in Partial Speech Spoofing: A Controlled Study
Authors: Xiaosu Su, Yun Cao, Yiping Ni, Xiaowei Yi
Organizations: Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100085, China · School of Cyber Security, University of Chinese Academy of Sciences, Beijing 100085, China
Partial-spoof detectors must reject synthetic content while accepting benign edits. We diagnose temporal anchors and boundary-consistency training using frozen WavLM features, nonlinguistic unit controls, and source-locked evaluation. Genuine-genuine and genuine-fake splices contrast editing false alarms with synthetic-content misses; they do not isolate a unique causal artifact. With layer-6 features, phone units have higher PartialSpoof evaluation frame EER than soft frames (11.18% versus 9.59%). In 500 retrospective PS-eval cases, augmentation reduces genuine-splice false alarms; synthetic-core misses increase at 5% PS-development FPR but not demonstrably at 1%. A 200-case Llama A follow-up retains the false-alarm reduction but does not establish a miss-rate increase. Constructed-case ranking can improve while fixed-threshold misses rise. Consistency gives no uniform gain, and encoder-layer rankings change across corpora. We report frame and event localization with three seeds, including word units, and treat PS evaluation as retrospective. Audit code, selected training scripts, and result summaries are available at https://github.com/mysxs/partial-spoof-diagnostics.
Figures & tables
System
PS dev
PS eval
HAD test
Llama A
Llama B
WavLM final, hard frame
5.330±0.127
11.123±0.020
38.589±1.009
42.413±0.444
38.587±0.119
WavLM layer 6, hard frame
1.738±0.043
9.772±0.487
56.582±5.003
41.493±0.638
41.245±0.069
WavLM layer 12, hard frame
2.716±0.094
8.278±0.418
38.735±3.323
40.815±0.177
35.701±0.089
Released reCFPRF
—
9.826
14.862
41.673
40.512
Table 1: 20-ms frame EER (%). Probe rows give three-seed mean ± sample SD. Layer 6 is selected on PS development data; layer 12 is a reported comparison, not a target-selected replacement. Released reCFPRF has a different encoder/training recipe and is one checkpoint.
Arm
EER
Frame F1
Frame R
Event P
Event R
Event F1
Short R
Hard frame
11.123±0.020
85.945±0.010
82.420±0.341
47.472±0.973
66.763±0.931
55.479±0.505
60.957±1.788
Soft frame
11.326±0.132
85.657±0.135
82.267±0.556
47.242±0.777
63.565±0.325
54.199±0.572
53.984±0.629
Phone unit
11.237±0.224
86.030±0.314
83.904±0.817
57.944±1.735
43.823±0.697
49.888±0.394
15.694±1.375
Word unit
12.514±0.182
84.624±0.311
82.657±0.594
61.313±0.716
39.665±0.459
48.169±0.559
11.730±0.221
Table 2: Complete PS-eval localization audit from frozen final-layer predictions (three seeds; percentages, mean ± sample SD). Frame F1/recall use official 20-ms labels. Event P/R/F1 match predicted and original 10-ms reference spans at IoU ≥0.5 ; short R is recall for reference events shorter than 100 ms. PS eval is retrospective.
Prediction / context
Frame EER
Event F1
Short R
Hard frame
9.772±0.487
—
—
Soft frame
9.591±0.284
64.297±0.400
68.722±1.510
Phone-unit output
11.180±0.444
52.291±0.296
20.704±0.610
Frame + phone context
9.656±0.410
—
—
Frame + duplicated frame
9.928±0.541
—
—
Frame + fixed 80 ms
10.176±0.661
—
—
Table 3: Layer-6 PS-eval probes (three-seed mean ± SD, %). Event metrics audit the same soft-frame and phone-unit checkpoints at saved PS-dev thresholds; context arms were not audited.
Unit
Training
G
GG
GF
GF50
Frame
Original
2.89
25.63
8.98
7.18
Frame
Augment
2.38
5.48
22.31
20.72
Frame
+Consistency
3.23
6.41
20.52
19.60
Phone
Original
2.37
27.80
13.12
14.76
Phone
Augment
1.97
4.33
29.95
29.61
Phone
+Consistency
1.99
3.47
31.66
31.83
Table 4: Supplementary controls: 500 cases, 48 speakers, three-seed means (%), original dev-EER thresholds. G/GG: unedited/genuine-splice FPR; GF/GF50: raw/50-ms-smoothed synthetic-core FNR. Final-layer models; lower is better.
Dev 1%
Dev 5%
Unit
Training
GG–G
GF
GG–G
GF
Frame
Original
8.48
33.90
21.61
9.90
Frame
Augment
1.06
35.01
2.86
23.21
Frame
+Consistency
1.20
34.95
2.95
21.48
Phone
Original
8.68
47.64
22.97
15.72
Phone
Augment
0.65
49.48
2.03
32.21
Table 5: The same controls at dev-calibrated 1%/5% FPR thresholds (three-seed means, %). GG–G is genuine-splice FPR minus unedited genuine FPR; GF is synthetic-core FNR. Target-domain FPR is not fixed.
Partial audio deepfakes, where synthesized segments are spliced into genuine recordings, are particularly deceptive because most of the audio remains authentic. Existing detectors are supervised: they require frame-level annotations, overfit to specific synthesis pipelines, and must be retrained as new generative models emerge. We argue that this supervision is unnecessary. We hypothesize that speech foundation models implicitly encode a forensic signal: genuine speech forms smooth, slowly varying embedding trajectories, while splice boundaries introduce abrupt disruptions in frame-level transitions. Building on this, we propose TRACE (Training-free Representation-based Audio Countermeasure via Embedding dynamics), a training-free framework that detects partial audio deepfakes by analyzing the first-order dynamics of frozen speech foundation model representations without any training, labeled data, or architectural modification. We evaluate TRACE on four benchmarks that span two languages using six speech foundation models. In PartialSpoof, TRACE achieves 8.08% EER, competitive with fine-tuned supervised baselines. In LlamaPartialSpoof, the most challenging benchmark featuring LLM-driven commercial synthesis, TRACE surpasses a supervised baseline outright (24.12% vs. 24.49% EER) without any target-domain data. These results show that temporal dynamics in speech foundation models provide an effective, generalize signal for training-free audio forensics.
Awais Khan, Muhammad Umar Farooq, Kutub Uddin +1
College of Innovation and Technology, University of Michigan-Flint, MI, USA
Partial deepfake speech detection requires identifying manipulated regions that may occur within short temporal portions of an otherwise bona fide utterance, making the task particularly challenging for conventional utterance-level classifiers. We propose a split-and-conquer framework that decomposes the problem into two stages: boundary detection and segment-level classification. A dedicated boundary detector first identifies temporal transition points, allowing the audio signal to be divided into segments that are expected to contain acoustically consistent content. Each resulting segment is then evaluated independently to determine whether it corresponds to bona fide or fake speech. This formulation simplifies the learning objective by explicitly separating temporal localization from authenticity assessment, allowing each component to focus on a well-defined task. To further improve robustness, we introduce a reflection-based multi-length training strategy that converts variable-duration segments into several fixed input lengths, producing diverse feature-space representations. Each stage is trained using multiple configurations with different feature extractors and augmentation strategies, and their complementary predictions are fused to obtain improved final models. Experiments on the PartialSpoof benchmark demonstrate state-of-the-art performance across multiple temporal resolutions as well as at the utterance level, with substantial improvements in the accurate detection and localization of spoofed regions. In addition, the proposed method achieves state-of-the-art performance on the Half-Truth dataset, further confirming the robustness and generalization capability of the framework.
Inbal Rimon, Oren Gal, Haim Permuter
Ben Gurion University, Be’er Sheva, Israel · University of Haifa, Haifa, Israel
Recent studies on partial audio spoofing mainly focus on studio-recorded speech with temporal localization of spoofed segments. However, these studies often overlook realistic conditions where spoofed and bonafide segments simultaneously coexist across speech and environmental sound components. In this paper, we present PC-Mix, the first dataset for partial-component spoofing detection, where either or both audio components may be partially spoofed. In PC-Mix, bonafide and partially spoofed environmental-sound components are first constructed and mixed with speech signals from an existing partial-spoof dataset, producing audio in which either or both components may be locally manipulated. This design addresses two major gaps in existing partial spoofing benchmarks: the lack of realistic environmental sounds in speech partial spoofing scenarios and the absence of partial spoofing detection for environmental sound components. We further establish standardized evaluation protocols and design a joint learning framework to optimize spoofing detection across speech, environmental sound, and mixed audio. Experiments highlight the increased difficulty introduced by mixed conditions. The results demonstrate that training under matched target conditions is more effective than directly transferring models trained on speech or environmental sound components.
Zhenshan Zhang, Xueping Zhang, Linxi Li +2
Digital Innovation Research Center, Duke Kunshan University, Kunshan, China · OfSpectrum, Inc., Los Angeles, USA · School of Artificial Intelligence, The Chinese University of Hong Kong, Shenzhen, China