Adaptive Compression and Targeted Perturbation: A Unified Framework for Generalized Audio Deepfake Detection

Jianqiao Cui; Haoxian Zhu; Hanbiao Meng; Yanghao Zhang

cs.SDOct 12, 2026

Adaptive Compression and Targeted Perturbation: A Unified Framework for Generalized Audio Deepfake Detection

Authors: Jianqiao Cui, Haoxian Zhu, Hanbiao Meng, Yanghao Zhang

Organizations: Imperial College London, London, UK · Taiyuan University of Technology, Taiyuan, China

Abstract

Existing audio deepfake detection (ADD) methods frequently exhibit limited generalization, as fixed bottleneck architectures fail to adapt to the heterogeneous information densities inherent in diverse spoofing artifacts. Moreover, standard augmentation often leads to a pathological robustness-accuracy trade-off. In this paper, we propose a unified ADD framework to address these challenges. Our approach integrates: (1) an Adaptive Audio Feature Integration (AAFI) module that dynamically selects optimal latent dimensions via a compression pool and a stochastic exploration mechanism, ensuring flexible representations across multiple types of dynamic attacks; and (2) a Mel-Band Adversarial Perturbation (Mel-BAP) strategy that applies targeted regularization in the mel-spectrogram domain to encourage the model to learn invariant decision boundaries. Extensive evaluations on benchmarks including ADD 2022, FakeOrReal, and In-the-Wild demonstrate that our model based on Whisper-small achieves a state-of-the-art average Equal Error Rate (EER) of 1.51%. Compared to existing SOTA models such as the 3-billion-parameter Resemble-Detect-3B-Omni, our framework reduces the parameter count by up to 91.6% while achieving a 60.7% improvement in average EER. In a separate cross-lingual evaluation, the Whisper-base configuration achieves EERs of 3.91-5.65% on five unseen languages. The framework also maintains strong resilience to real-world acoustic distortions. This work provides a scalable and efficient "plug-in" solution for enhancing trust and security in the audio Web ecosystem.

Figures & tables

Figure 1: Schematic of the robust audio forgery detection pipeline. Left: Mel-BAP generates band-selective perturbations via PGD as targeted adversarial regularization. Center: AAFI implements an adaptive information bottleneck, using a router to dynamically select compressed features from heterogeneous pools. Right: Fusion of multi-resolution features for sequence-to-sequence decoding.

Data Group	top- $k$ number				Whisper-base
Data Group	top-2	top-3	top-4	top-5	Whisper-base
TTS	3.91	0.85	0.83	0.99	1.18
VC	4.85	1.88	1.67	2.11	3.32
NV	8.44	3.44	3.50	4.34	6.07
Average	5.73	2.06	2.00	2.48	3.52

Table 1: Performance Comparison of Adaptive Routing (top-

k

) in the AAFI Module versus Whisper base. EER (%) results (lower is better).

Model	BD-EN	BD-CN	BD-UT	Average
w/o Mel-BAP	1.94	1.68	1.19	1.60
Mel-BAP Only	1.35	1.20	0.91	1.14
AAFI + Mel-BAP	1.01	0.82	0.53	0.79

Table 2: Ablation study on the effectiveness of Mel-BAP across SpeechFake BD subsets. Lower EER (%) indicates better performance.

Strategy	Frequency Band	Mel-bin Indices	Clean EER (%)
(a) Mel-BAP (Ours)	4–8 kHz	[60, 80]	0.91
(b) Full-band PGD	0–8 kHz	[0, 80]	1.15
(c) Low-band PGD	0–4 kHz	[0, 60]	1.28

Table 3: Ablation of adversarial frequency band constraints on the BD-UT dataset (Clean EER).

Model	w/o Mel-BAP		with Mel-BAP		Global Aug
Model	Clean	Attack	Clean	Attack	Clean	Attack
Base	1.19	3.57	0.91	2.44	2.33	4.68
Small	0.95	3.18	0.87	2.25	1.65	4.01

Table 4: Robustness comparison against standard augmentation under real-world distortions. EER (%) is reported on BD-UT.

Model ID	# Params	ADD 2022 (T1)	FakeOrReal	In-the-Wild	ASV2019	ASV2021 LA	Average
Literature and Commercial SOTA (Speech-DF-Arena 2025)
Resemble-Detect-3B-Omni [ 40 ]	3,000 M	9.96	2.34	1.35	2.53	3.02	3.84
DLMSL-SpeakSure-v0.1 [ 40 ]	658.6 M	15.14	0.27	1.28	0.04	0.08	3.36
Whispeak [ 40 ]	98.9 M	11.94	1.02	1.27	0.39	3.58	3.64
DF_Arena_1B_V_1 [ 41 ]	1,000 M	22.21	2.92	0.91	1.14	4.66	6.37
Momenta [ 40 ]	350 M	25.47	2.87	4.63	1.21	4.88	7.81

Table 5: Comprehensive Zero-shot EER (%) results across 29 systems. All models are evaluated without fine-tuning. The Average is recalculated based on five key benchmarks: In-the-Wild, ASV2019, ASV2021 LA, FakeOrReal, and ADD 2022 Track 1. Values in bold indicate the best results per column. Lower EER indicates superior performance.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Language	Whisper-base EER (%)		Improv. $\downarrow$
Language	w/o AAFI+BAP	w/ AAFI+BAP	Improv. $\downarrow$
Spanish (es)	7.11	5.65	1.46
French (fr)	5.17	3.92	1.25
Japanese (ja)	5.52	4.19	1.33
Italian (it)	4.66	3.91	0.75
Korean (ko)	4.50	4.02	0.48

Appendix

Table 6: Cross-lingual evaluation results on unseen languages (SpeechFake MD). EER (%) is compared between the baseline and our proposed method.

ID	Sub-ID	Model	Name	Training Data	$N_{c}$	SR	BPS
A	A1	SpeechTokenizer	16k	Librispeech	8	16	4
B	B1	HiFi-Codec	hifi_16k_320d	LibriTTS	4	16	2
	B2		hifi_16k_320d_large_uni	VCTK	4	16	2
	B3		hifi_24k_320d	AISHELL	4	24	3
C	C1	AudioDec	24k_320d	Valentini	8	24	6.4
D	D1	EnCodec	16k	Common Voice, DAPS	12	16	6

Appendix

Table 7: Details of adopted neural audio codec models.

A-F

represents different codec frameworks.

N_{c}

represents the number of codebooks, SR represents audio sampling rate (in kHz), and BPS represents bits per second.

Subset	Content	Number of Samples
Subset	Content	Real	Fake
BD-EN	English-only	64,000	1,128,882
BD-CN	Chinese-only	62,180	824,134
BD-UT	Unseen Techniques	37,854	50,000
BD-TTS	TTS-generated	126,180	1,014,107
BD-VC	VC-generated	126,180	535,205

Appendix

Table 8: Statistics of SpeechFake Bilingual Dataset (BD) Subsets.

Figure 2: Cross-testing results of anti-spoofing models on CodecFake test subsets. We report equal error rate (EER), where lower is better. Rows A-F6 are ADD whisper models trained on one training subset of CodecFake. Columns A-F6 indicate the specific CodecFake test subset evaluated.

Configuration	EER (%)	Utilization Entropy $\uparrow$
Baseline (w/o AAFI)	1.19	-
AAFI w/o Noise	1.05	0.74
AAFI w/ Noise	0.91	0.92

Appendix

Table 9: Ablation study of Gaussian noise in AAFI on the BD-UT dataset.

Number of PGD iterations	EER (%)	Estimated Training Time Increase
$K=0$ (Original in Table 4 )	0.95	-
$K=1$	1.02	$\sim$ 25%
$K=3$	0.89	$\sim$ 70%
$K=5$ (Our Setting)	0.87	$\sim$ 115%
$K=10$	0.86	$\sim$ 220%

Appendix

Table 10: Ablation study on the effect of PGD iteration number (

K

) in Mel-BAP on the BD-UT dataset.

Attack Method	Budget ( $\epsilon$ )	Baseline EER (%)	Ours (Full) EER (%)
No Attack (Clean)	-	1.19	0.53
PGD Attack ( $L_{\infty}$ )	0.002	11.42	3.81
CW Attack ( $L_{2}$ )	2.0	15.85	5.24
Adaptive PGD ( $L_{\infty}$ )	0.005	22.10	7.93

Appendix

Table 11: Test-time adversarial evaluation on the BD-UT dataset. EER (%) is reported.

Category	16/32-d	64-d	128/256-d
NV (High-fidelity)	8%	33%	59%
TTS (Standard)	64%	22%	14%
Noisy (SNR 10dB)	48%	35%	17%

Appendix

Table 12: Stratified analysis of AAFI routing distributions across varying attack types and severities.

Explore similar work

On the Robustness of Audio Deepfake Detection under Audio Watermarking
Aug 25, 2026Zi Qian Yong, Ajinkya Kulkarni, Julia Lau +4Audio Deepfake Detection Audio Watermarking
School of Information Technology, Monash University, Malaysia campus · Idiap Research Institute, Switzerland
Diffusion Reconstruction towards Generalizable Audio Deepfake Detection
Apr 29, 2026Bo Cheng, Songjun Cao, Xiaoming Zhang +3Audio Deepfake Detection OOD Generalization
Department of Electronic and Electrical Engineering, Southern University of Science and Technology, Shenzhen, China · Tencent Youtu Lab, China
SE-ADD: Self-Evolving Audio Deepfake Detection with Mistake-Driven Supervision
Sep 30, 2026Rong Wan, Wei Xie, Jiaxi Li +4Audio Deepfake Detection Self-Training for Language Models
University of Surrey · Guangxi University · Shenzhen University of Advanced Technology +1

Aug 25, 2026J/K move · Enter open · S save

On the Robustness of Audio Deepfake Detection under Audio Watermarking

Zi Qian Yong, Ajinkya Kulkarni, Julia Lau, Hwa Hui Tew+3

School of Information Technology, Monash University, Malaysia campus · Idiap Research Institute, Switzerland

Audio Deepfake Detection Audio Watermarking

Open paper AskPDF arXiv

Recent advances in generative audio models have enabled highly realistic synthetic speech, increasing the importance of reliable audio deepfake detection (ADD) systems. While prior studies have primarily focused on adversarially optimized perturbations, the robustness of ADD systems under realistic signal transformations remains insufficiently understood. In this work, we investigate the impact of audio watermarking on ADD systems by treating watermarking as a structured, non-adversarial perturbation rather than a conventional attack mechanism. Using a watermark-based evaluation framework built upon WavMark, we evaluate multiple self-supervised learning (SSL), Convolutional Neural Network (CNN) and Graph Neural Netrowk (GNN)-based ADD models across several benchmark datasets. Beyond conventional detection metrics, we further analyze watermark-induced representation shifts using Fréchet Distance, cosine similarity, and L2 distance in the embedding space. Experimental results reveal a strong dataset-dependent behavior: watermarking causes substantial performance degradation on ASVspoof 2021 LA and DF, while exhibiting limited impact on ASVspoof 2024, FoR, and ITW. Moreover, large embedding-space shifts are strongly associated with severe detection degradation, suggesting that watermark-induced perturbations can substantially alter the feature representations relied upon by current ADD systems. These findings demonstrate that benign signal transformations designed for content protection can expose previously overlooked robustness vulnerabilities in audio deepfake detection systems. Our code is available at https://github.com/ziqian0925/wm-ADD-robustness.git

Abstract

Explore similar work

On the Robustness of Audio Deepfake Detection under Audio Watermarking

Diffusion Reconstruction towards Generalizable Audio Deepfake Detection

SE-ADD: Self-Evolving Audio Deepfake Detection with Mistake-Driven Supervision