VeriSpoof: Beyond Real or Fake with One Audio LLM

Yang Xiao; Ting Dang

eess.ASNov 3, 2026

VeriSpoof: Beyond Real or Fake with One Audio LLM

Authors: Yang Xiao, Ting Dang

Organizations: The University of Melbourne

Abstract

A speech deepfake detector estimates whether a recording is synthetic, but a forensic analyst also asks which system produced it, whether recordings share a source, and what evidence supports each conclusion. We present VeriSpoof, an audio language model that unifies five tasks with shared weights: deepfake detection, generator attribution (generator, acoustic model and vocoder), recording-condition analysis, synthesized-span localisation, and source verification. Each decision is supported by grounded rationales whose statements can be independently verified. Answers are scored by sentence likelihood, allowing detection and source verification to be thresholded without separate heads. Rationale statements can be checked against waveform measurements, span labels, or generator metadata. Counterfactual examples train decisions to follow the stated evidence. Across the 14 Speech-DF-Arena test sets, VeriSpoof-Plus achieves 2.14% pooled EER, ranking third of 28 systems and first among open-weight systems. VeriSpoof-Base, trained only on official training splits of eight corpora, achieves 4.43% EER, less than half that of the next open-weight detector. With the same weights, VeriSpoof-Plus verifies whether recordings from generators unseen in training share a source at 6.2% EER. Controlled studies show that the audio representation governs detection, the LLM governs recording comparison, and source supervision is necessary for neural-codec fakes. Statement-checkable rationales catch partial fakes missed by one-step answers (99.6% vs. 78.4% on PartialEdit) and determine decisions under edits unseen in training (99.5%). Training updates only 29.7M of 2.85B parameters, fitting a single 24 GB GPU with gradient checkpointing. We release both models, inference code, a demo, and VeriSpoof-Bench, the evaluation suite covering these questions.

Figures & tables

Figure 1: VeriSpoof at a glance. (a) Detection on the 14 test sets of Speech-DF-Arena [ 1 ] , pooled EER (one threshold over all sets, the board’s ranking); the public snapshot of 31 Oct 2026 with both VeriSpoof models inserted, top 11 shown. (b) The same weights decide whether two spoofed recordings come from the same generator, against a pair probe on the frozen anti-spoofing encoder DF-Arena-1B (§ 6.2 ). (c) Accuracy of the one-step answer and of the decision VeriSpoof-Base reaches after writing its rationale (§ 6.7 ). (d) Share of decisions that follow a localization replaced by its opposite, in a wording never used in training (§ 6.8 ).

Figure 2: One score versus checkable evidence on the same recording, in which one word of genuine speech was replaced by synthesized speech. Asked directly, the model judges the recording genuine (left). Asked to reason, VeriSpoof-Base states observations, a synthesized span and a source profile before deciding (right). Each statement is checked against a waveform measurement or a label (

\checkmark

holds,

\times

fails, – no label), and replacing the stated span by “none” flips the decision. Statements are abridged; the full output is in Figure 11 .

Figure 3: VeriSpoof. (1) An 8 s waveform, or two for a pair, enters (2) the Qwen3-ASR encoder, frozen apart from DoRA adapters. (3) Two learned mixes over its 25 layers feed (4) the audio tokenizer, which pools the recording into 16 utterance tokens and stacks pairs of frames with a text time marker every 0.8 s. (5) The prompt places the tokens of A, then those of B, before the question; (6) the frozen LLM with LoRA reads it and (7) returns a score, the log-likelihood difference of two answer sentences, a rationale whose decision comes last, or a per-token synthetic-speech profile. Grey: frozen; dark blue: trained by us, with the stages that train each part (PA: perception alignment, QT: forensic question tuning, RT: grounded rationale tuning).

Figure 4: Training data. VeriSpoof-Plus keeps everything VeriSpoof-Base is trained on and adds twelve more corpora, balanced over 211 spoof sources and 18 bona fide datasets. Grey: corpora with spoofed speech; purple: partial spoofs whose labelled spans train the rationales; blue: bona fide speech only. Bottom: training steps of the three stages, perception alignment (PA), forensic question tuning (QT) and grounded rationale tuning (RT), to scale.

Figure 5: Questions and their test sets. Columns on the left are test splits of corpora used in training; columns on the right are sets never used in training. Filled circle: generators seen in training; open circle: generators, a vocoder pairing or a whole corpus unseen in training; dashed square: copies with added noise, reverberation and codecs (aug.), recorded under a logged condition (cond.) or post-processed (+proc). Speech-DF-Arena adds 14 public sets, scored on their full protocols. Figure 10 shows each question with an example answer.

Figure 6: Components. (a) Probes on frozen features of seven encoders (best single layer; same items for every encoder; * trained for anti-spoofing). (b) One factor changed at a time in how the encoder is used, LLM frozen: detection EER on ASVspoof 5 falls threefold, source verification (SV) stays flat. (c) Only the LLM changed: detection moves by 0.5 points, SV by 5.5; * hybrid linear attention. (a) uses an earlier protocol; Table 20 repeats it for two encoders on the current test sets.

Figure 7: Source supervision per test set (a) and per ASVspoof 5 attack (b; A17–A32 are the attack identifiers of the ASVspoof 5 evaluation set): EER without source questions minus EER with them (95% bootstrap intervals;

>0

: source questions help). Circles: same number of authenticity questions (B); squares: same number of training steps (B ′ ); shaded: the

\pm 0.5

equivalence margin.

Figure 8: Reasoning and faithfulness. (a) Accuracy of the one-step answer and of the decision after reasoning on the same 500 recordings per set ( VeriSpoof-Base ). (b, c) Share of decisions that follow a localization replaced by its opposite, without and with counterfactual training, for the edit form used in training (b) and a paraphrased form never seen in training (c).

Stage	Logged		Estimated
	released Base, no ckpt	micro-batch 32, ckpt	micro-batch 8, ckpt
Perception alignment	45.3	16.8	$\approx$ 9
Forensic question tuning	21.4	11.1	$\approx$ 7
Grounded rationale tuning	24.6	14.4	$\approx$ 8

Table 15: Peak GPU memory in training (GiB), global batch 32 throughout. Logged on one L40S: the runs of the released VeriSpoof-Base (no gradient checkpointing; micro-batch 32 in perception alignment, 8 with accumulation in the other stages), and runs of the same model and stages with gradient checkpointing at a micro-batch of 32. Estimated: micro-batch 8 with checkpointing, from the frozen weights (5.3 GiB), the adapter state (0.5 GiB) and the logged activation memory per example.

Rationale generation	per recording	speed-up
PyTorch, one recording at a time	2.24 s	1 $\times$
vLLM, one recording at a time	0.50 s	4.5 $\times$
vLLM, batch of 64	0.05 s	46 $\times$

Table 16: Rationale generation time of VeriSpoof-Base on one A100 GPU.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 9: VeriSpoof-Bench by group: items and subsets per group, and the metric of each group. Released with item lists, labels, prompts, scoring scripts and the per-item outputs of both models, without audio.

Corpus	License	Terms for our lists
ASVspoof 2019 LA	ODC-By 1.0	attribution
ASVspoof 2021 LA	ODC-By	attribution
ASVspoof 2021 DF	ODbL (Zenodo record) or ODC-By (asvspoof.org)	attribution; share-alike if ODbL
ASVspoof 5	ODC-By 1.0 (bona fide speech CC BY 4.0)	attribution
In-the-Wild	Apache-2.0 (distributor) or CC BY-SA 4.0 (authors’ card)	attribution; share-alike if CC BY-SA
SpoofCeleb	CC BY 4.0, gated	attribution

Appendix

Table 18: Licenses of the internal-suite corpora as stated by each distributor (checked 31 Oct 2026). We release lists, labels and scripts, not audio; each subset’s lists carry its corpus’ terms.

	VeriSpoof-Base	VeriSpoof-Plus
Encoder	Qwen3-ASR [ 33 ] , 8 s windows, 25 layers mixed by learned weights,
	DoRA [ 34 ] $r{=}16$ (PA only)
Tokenizer	16 utterance tokens, 52 frame tokens of 0.16 s, time markers every 0.8 s
LLM	MiniCPM5-2B [ 35 , 36 ] ,
	LoRA [ 37 ] $r{=}16$ , $\alpha{=}32$ , dropout 0.05 on q/k/v/o
Losses	cross-entropy; one-class authenticity loss (0.1); per-token head (0.3, RT)

Appendix

Table 19: Training settings. PA: perception alignment (tokenizer and encoder DoRA, LLM frozen); QT: forensic question tuning (LoRA and tokenizer, all perception questions); RT: grounded rationale tuning (rationales, counterfactual examples, replay). Task weights are sampling weights. Family: TTS or voice conversion; profile: the attribute classes of one recording’s source (generation method, acoustic modelling, waveform generation); authenticity pair: the authenticity of both recordings of a pair; attribute compatibility: whether two recordings from different systems share one attribute class; condition: recording condition. One-class loss: OC-softmax [ 38 ] on the pooled audio tokens, pulling bona fide speech towards a learned centre; per-token head: a genuine / synthesized classifier on the LLM’s hidden states of the frame tokens.

Figure 10: The questions. Each card gives the question template, an example answer of VeriSpoof-Base with the probabilities of its options, and the answer form. One-step answers are read as scores (orange card); rationales are written in fixed fields, abridged here.

Panel of Figure 11 — Figure 11: Verbatim outputs of VeriSpoof-Base with their checks.

Audio Deepfake Detection

Audio deepfake detection identifies synthetic, cloned, or manipulated speech and other audio to support authentication and media forensics.

See all 207 papers

Aug 20, 2026

Tracking the Trend in How Speech Synthesizers Deceive People

Advances in speech synthesis have made deepfake audio highly realistic. Earlier studies reported 70-80% human detection accuracy, but relied primarily on older synthesizers. We compare human detection for three selected voice synthesis tools released in 2019, 2022, and 2024 with 82 IT professionals, and benchmark humans against six pretrained detectors on the same material. For fully synthetic speech (full spoofs), the F1 score drops from about 90% for RTVC and YourTTS to 48% for ElevenLabs, although listeners were explicitly warned that deepfakes were present. For partial spoofing, where only one sentence of an utterance is altered, strict accuracy falls to 9%, and listeners classify the synthetic sentence as bona fide 77% of the time. Humans and detectors fail in complementary ways, and neither reliably localizes short manipulations. Additionally, listeners increasingly mislabel bona fide speech as fake, eroding trust in unmanipulated audio. These findings show that human perception alone is unreliable for the selected modern and partial-spoof conditions and motivate procedural verification, provenance, watermarking, and segment-level detection.

Milan Šalko, Anton Firc, Kamil Malinka +4

Audio Deepfake Detection Audio Deepfake Detection Robustness TTS Synthesis

Ask PDF

Jun 17, 2026

FlowFake: Liquid Networks for Audio Deepfake Detection

Audio deepfakes generated by neural text-to-speech and voice-cloning systems threaten speaker verification and public discourse at scale. The core challenge is cross-dataset generalization: detectors trained on one synthesis pipeline collapse on unseen forgeries. We argue that this failure is primarily because of structural synthetic speech artifacts which are multi-timescale trajectory anomalies. Though every existing detector aggregates a fixed-window frame statistics, this misaligns the architecture with the signal. We propose FlowFake, a Liquid Time-Constant (LTC) architecture whose hidden state evolves via a learned ODE, with per-neuron adaptive time constants simultaneously resolving spectral (10ms) and prosodic (2s) cues. At only 34K parameters FlowFake achieves formal BIBO stability and O(dt^4) integration error. On a four-dataset cross domain benchmark (ASVspoof2019-LA, FakeOrReal, InTheWild, MLAAD), FlowFake reaches 75.29% on ASVspoof2019 trained only on FakeOrReal and 79.97% trained only on MLAAD. It outperforms RawGAT-ST and Whisper-DF on every evaluated pair and matching SSL Wav2vec2 (300x larger) at 0.01% of its parameter count. The source code is available on : https://github.com/GhostRider2023/FlowFake

Shivaay Dhondiyal, Divyansh Sharma, Dinesh Kumar Vishwakarma

Delhi Technological University, New Delhi, India.

Audio Deepfake Detection Cross-Domain Generalization ASVspoof Audio Deepfake Detection Robustness

Ask PDF

Jul 30, 2026

Teffic-Audio: Tell Fact from Fiction

Speech deepfake detection has expanded in scope with increasingly heterogeneous spoofing mechanisms, including speech synthesis, voice conversion, vocoder reconstruction, and neural-codec resynthesis. The resulting spoofing artifacts can be further shaped by variability in source speech, recording environments, and transmission channels. This variability makes robust generalization across heterogeneous conditions a central requirement for practical detection systems. This report presents Teffic-Audio, a general speech deepfake detection system designed for comprehensive evaluation environment. Teffic-Audio adopts a straightforward detector architecture consisting of a Conformer-based speech encoder, multi-head attentive statistics pooling, and a binary classifier. Rather than relying on additional architectural complexity, the system improves generalization through its training recipe, which integrates multi-source data, attack- and source-balanced sampling, and diverse audio augmentation. Trained only with open-source data, Teffic-Audio achieves a pooled EER of 1.454% on the 14 test sets of Speech-DF-Arena, outperforming all currently public systems on the leaderboard. It also obtains the lowest EER on five individual test sets and shows a favorable performance-complexity trade-off compared with larger leading systems. Overall, Teffic-Audio provides a strong and practical reference system for general speech deepfake detection.

Wan Lin, Li Wang, Jindong Wang +2

Amphion Team

Audio Deepfake Detection Domain Generalization Audio Deepfake Detection Robustness

Ask PDF

Abstract

Audio Deepfake Detection

Explore similar work

Tracking the Trend in How Speech Synthesizers Deceive People

FlowFake: Liquid Networks for Audio Deepfake Detection

Teffic-Audio: Tell Fact from Fiction