Source-linked AI summary
WaveFake: A Data Set to Facilitate Audio Deepfake Detection
Joel Frank, Lea Schönherr
TL;DR
Audio Deepfake detection has received less attention than image-domain detection despite documented harmful uses of generated voices. The paper reviews audio signal processing, releases a multilingual data set spanning multiple architectures, and provides baseline classifiers; its analyses find subtle generator differences, while robustness to common perturbations remains outside scope.
Problem
Audio Deepfake detection research has been comparatively neglected despite harmful uses of generated voice recordings.
Method
The paper reviews signal-processing techniques, constructs a data set of generated audio across languages and TTS architectures, and implements classifier baselines.
Results
The analyses find subtle differences between generators, and leave-one-out evaluation improves aEER from 0.062 to 0.058.
Takeaways & Limitations
The paper provides a starting point and reusable resources for investigating generated audio signals and comparing audio Deepfake detectors.
Takeaways & Limitations
The evaluation does not establish classifier robustness against adversarial attacks and common perturbations such as noise, room responses, or over-the-air settings.
Abstract
from arXiv · showhide
Deep generative modeling has the potential to cause significant harm to society. Recognizing this threat, a magnitude of research into detecting so-called "Deepfakes" has emerged. This research most often focuses on the image domain, while studies exploring generated audio signals have, so-far, been neglected. In this paper we make three key contributions to narrow this gap. First, we provide researchers with an introduction to common signal processing techniques used for analyzing audio signals. Second, we present a novel data set, for which we collected nine sample sets from five different network architectures, spanning two languages. Finally, we supply practitioners with two baseline models, adopted from the signal processing community, to facilitate further research in this area.
1 Introduction
The paper addresses the relative lack of audio Deepfake detection research by introducing signal-processing background, a multilingual multi-architecture data set, and classifier baselines.
- Audio Deepfake detection is important because generated voice recordings have enabled costly impersonation and other harmful uses.The paper cites a $243,000 loss from CEO impersonation and additional misuse cases.
- The paper reviews standard audio signal-processing techniques, including spectrograms, and surveys current generative models.
- The novel data set contains samples from multiple state-of-the-art architectures and supports comparisons across generated audio.The authors report subtle differences between generators and test transfer to completely novel phrases.
- Three classifiers adapted from signal-processing best practices provide baselines for future research.Neural networks performed better overall but were susceptible to changing settings; BlurIG supports prediction inspection.
2 Background
The background introduces speech-signal representations and the two-stage TTS pipeline, then situates audio Deepfake detection among generative-model and spoofing research.
- 2.1 Analyzing speech signals: Spectrograms represent a signal’s frequency information over time by windowing waveform frames, applying a window function, transforming with the DFT, and taking squared magnitudes.The representation indexes frames by t and DFT coefficients by k.
- 2.1 Analyzing speech signals: Mel spectrograms transform frequency using a nonlinear scale and triangular filters whose spacing becomes logarithmic in the frequency domain.The Mel scale reflects higher human resolution for lower frequencies.
- 2.1 Analyzing speech signals: MFCCs apply a DCT to logarithmic Mel-filtered signals, whereas LFCCs use a linear filterbank and retain more high-frequency information.
- 2.1 Analyzing speech signals: Delta and double-delta features augment MFCCs or LFCCs with first and second derivatives to represent temporal structure.The derivatives are commonly computed using a central-difference approximation with a user-defined window length.
- 2.2 Text-to-Speech models: Typical TTS systems map text to an intermediate representation and use a vocoder to convert that representation into raw audio.
- 2.2 Text-to-Speech models: TTS vocoders include autoregressive, flow-based, variational, diffusion, and GAN-based neural architectures.
- 2.3 Related Work: Prior Deepfake work focuses heavily on manipulated images and videos, while ASVspoof benchmarks related audio spoofing attacks.The paper positions its data set as complementary to ASVspoof training data and adopts one of its baseline models.
3 The data set
The data set contains generated speech clips from multiple architectures and two reference corpora, enabling controlled comparisons across models. The authors analyze architectural differences and release baseline-oriented resources for detection research.
- Data set composition: Ten sample sets cover seven LJSPEECH-based data sets and two JSUT-based data sets across MelGAN, PWG, MB-MelGAN, FB-MelGAN, HiFi-GAN, WaveGlow, and TTS.The TTS set uses a conformer to generate Mel spectrograms and a fine-tuned PWG model to produce final audio.
- Sampling procedure: The sampling procedure extracts Mel spectrograms from original audio and feeds them to the respective pretrained or publicly implemented models to recreate the reference distributions.For TTS samples, novel phrases from Common Voice are converted to Mel spectrograms before waveform generation.
- Architectural analysis: Spectrogram analysis shows that all architectures differ from the original, with struggles at missing information and higher vocal frequencies; MelGAN and WaveGlow also show repeating horizontal patterns.These visual differences are generally inaudible when listening to the samples, and models using auxiliary frequency-domain losses do not appear to show the repeating pattern.
- Architectural analysis: Energy histograms have the same overall shape as LJSPEECH, but generated samples show apparent differences, especially in higher frequencies.The analysis plots average energy per frequency bin and the relative difference from the original data.
- Licensing and ethics: The released data set is distributed under CC-BY-SA 4.0, with the authors reporting licensing considerations for the JSUT corpus and research-purpose redistribution.LJSPEECH is public domain, while JSUT has a CC-BY-SA 4.0 license with redistribution restrictions noted by the authors.
4 Providing a baseline
The paper establishes baseline audio Deepfake detectors using GMM and RawNet2 models, evaluates them across in-distribution and out-of-distribution settings, and examines their generalization trade-offs. Results show architecture-dependent performance, with neural models generally stronger overall but more sensitive to changing conditions.
- Evaluation setup: The evaluation uses EER on 20% hold-out data and average EER across test sets to compare classifiers.EER equals the point where false acceptance and false rejection rates are equal; aEER averages EER across test sets.
- Baseline models: The baseline systems comprise LFCC/MFCC-based GMM classifiers and RawNet2 CNN-GRU models operating directly on raw audio.GMMs model real and generated distributions separately, while RawNet2 extracts speaker embeddings before classification.
- Single training set: FB-MelGAN provides the best single-training-set prior, achieving the lowest average EER of 0.062 across other data sets.The comparison trains a new GMM for each data set using LFCC features.
- Leave-one-out: Out-of-distribution performance improves in the GMM leave-one-out experiment, reducing aEER from 0.062 to 0.058, while FB-MelGAN remains important for JSUT generalization.MelGAN and MelGAN (L) remain challenging even when included in training.
- Leave-one-out: RawNet2 models can generalize when trained on multiple distributions, but some overfit and the best average model reaches a 13% false acceptance/false rejection rate.The improved average performance is traded against worse performance on the training data, which the paper calls unacceptable in real-life settings.
- Simulated phone recording: Phone simulation exposes a model-dependent robustness trade-off: GMM classifiers reach a highest EER of 0.003, whereas RawNet2 error rates rise substantially.The simulated evaluation covers JSUT data sets and the full TTS pipeline.
5 Discussion
The paper identifies important boundaries for interpreting its audio Deepfake results, including proxy-data evaluation, limited speaker variety, and untested adversarial conditions.
- Evaluating on realistic data: Realistic malicious audio data are difficult to obtain, so the study estimates real-world performance using proxy data.The authors argue that results might transfer because generated images are already used maliciously and audio Deepfakes may increase.
- Attribution analysis: Figure 4 attributes real-audio predictions using LFCC, delta, and double-delta features organized from lower to higher frequencies.Within each feature section, lower-frequency features appear at the bottom and higher-frequency features at the top.
- Variety of the data: The main corpus contains recordings from only one speaker, limiting the variety available for direct comparison.Comparisons with JSUT and TTS provide some observations about generalization, but broader scenario coverage is needed.
- Adversarial examples and perturbations: The classifiers were not evaluated for robustness against adversarial attacks or common perturbations such as noise, room responses, and over-the-air settings.The paper reports examining phone recordings but calls for broader robustness evaluation.
6 Conclusion
The paper presents a starting point for generated-audio research by combining signal-processing background, a multi-architecture dataset, model analysis, and baseline classifiers. Its security rationale favors open research because withholding defenses does not prevent eventual attacker adaptation.
- Conclusion: The paper introduces signal-processing techniques, feature representations, and a survey of current text-to-speech models as research background.This overview precedes the dataset and classifier contributions.
- Conclusion: The dataset contains samples from six state-of-the-art architectures across two languages, revealing subtle model-specific differences despite close approximation of training data.Frequency-spectrum and prosody analyses, including average energy per frequency, supported these findings.
- Conclusion: Neural-network classifiers performed better overall, whereas Gaussian mixture model classifiers were more robust.The classifiers were evaluated across different datasets and multiple settings.
- Open security research: The paper argues that releasing detection research is preferable to withholding it because attackers will eventually adapt to deployed defenses.This rationale is framed through the security community’s rejection of security through obscurity.
- Open security research: Kerckhoffs’s principle holds that an encryption scheme should remain secure when an adversary knows everything except the secret passphrase.The paper connects this principle to later formulations by Claude Shannon.
- Open security research: The paper uses AES as an example whose public specification can coexist with security dependent on keeping the password secret.It also notes that machine-learning adversarial-defense work evaluates against white-box attackers.
- Open security research: Security practice also publishes attack research so systems can be understood and protected, as illustrated by Meltdown, Spectre, and Google Project Zero disclosures.Project Zero’s 90-day disclosure deadline is described as encouraging faster vendor patch development.
B A note on licensing
The authors identify an unresolved licensing question for generated samples designed to resemble the original dataset closely.
- Licensing: Because the generated samples sound remarkably like the original data without being the original data, it is unclear whether the original license applies.The authors state that they could not find a satisfying answer during dataset collection.
C Training details
The training details specify optimization, preprocessing, feature extraction, and implementation settings for the GMM and RawNet2 baselines, while Table 6 defines the EER evaluation.
- Model training: GMMs use ten gradient-descent epochs, batch size 128, negative log-likelihood, and 128 diagonal-covariance mixture components.Leave-one-out experiments use 256 components to compensate for the more difficult task.
- Model training: RawNet2 training follows Tak et al.’s configuration and minimizes binary cross-entropy with Adam, learning rate 0.0001, and weight decay 0.0001.GMM training uses Adam with an initial learning rate of 0.001.
- Evaluation: Table 6 reports equal error rate for MFCC-based GMM classifiers across dataset subsets, with lower values indicating better performance.The table also reports average EER across all sets; EER ranges from 0.0 as best to 1.0 as worst.
- Preprocessing: Audio is resampled to 16kHz, silence longer than two seconds is removed, and raw-audio inputs are padded or trimmed to 4s.MFCC/LFCC extraction uses 20 features plus delta and double-delta features with parameters from Sahidullah et al.
- Implementation: The experiments use Ubuntu 18.04.5, an AMD Ryzen 7 3700X, an RTX 2080Ti, 64GB RAM, PyTorch 1.8.1, and torchaudio 0.8.1.Training ten epochs on 10,000 audio samples takes roughly half an hour.
D MFCC results
The MFCC evaluation found LFCC features superior and revealed that detection performance depends strongly on which generator architectures are represented in training.
- LFCC features strictly outperformed the commonly used MFCC features in the evaluation.
- 0.214 average EER made WaveGlow the strongest overall prior, alongside PWG at 0.241 and MB-MelGAN at 0.257.
- MelGAN and MelGAN (L) performed best on each other’s data sets, achieving 0.295 and 0.309, respectively.
- Performance for MelGAN and MelGAN (L) dropped to approximately 0.400 on other data sets, reaching 0.515 on WaveGlow.
- The best PWG and WaveGlow results were obtained by models trained on MB-MelGAN and FB-MelGAN, at 0.092 and 0.069, respectively.The authors hypothesize that the auxiliary loss makes these samples more similar to WaveGlow and PWG.
E Phone simulation results
The phone simulation experiment evaluates out-of-distribution models on three test sets, reporting Equal Error Rate for LFCC and RawNet2 systems.
- The experiment uses models from the out-of-distribution evaluation.
- The columns represent the left-out set for each model and measure performance on three test sets.
- Table 7 reports Equal Error Rate for the phone recording simulation using LFCC features.
- Table 8 reports Equal Error Rate for the phone recording simulation using RawNet2.
F Spectrograms
The spectrogram figures compare original training audio with outputs from multiple generative networks, emphasizing differences in higher frequencies and horizontal artifacts.
- The spectrograms compare an original LJSPEECH file with outputs from MelGAN, FB-MelGAN, MB-MelGAN, HiFi-GAN, WaveGlow, and PWG.The compared audio file is LJSPEECH 008-0217.
- Higher-frequency differences are especially visible across the training data and generative-network spectrograms.
- MelGAN and WaveGlow produce horizontal artifacts in the plotted spectrograms.
- Figure 12 shows average energy per frequency bin in dB and its difference from the original LJSPEECH data.
G Attribution
The attribution figures visualize classifier attention, while the accompanying filterbank figures show the triangular filters used for MFCC and LFCC feature computation.
- The attribution plots show spread-out MelGAN attention, a transition to narrow-band attribution, and balanced FB-MelGAN classifier attention.
- The filterbank visualization presents triangular filterbanks used to compute MFCC and LFCC features.
- Mel and linear filterbanks are shown as separate figures for comparing the two feature-processing choices.