Source-linked AI summary
UZH-CL at ArA-DF 2026: Prompt-Tuned Foundation Models and Track-Adaptive Score Fusion for Arabic Speech Deepfake Detection
Aref Farhadipour, Teodora Vukovic, Petr Motlicek
TL;DR
Arabic deepfake detection must generalize across regional dialects and acoustic channels. UZH-CL adapts a frozen speech foundation model with prompts and applies track-specific detector fusion, achieving lower EER than the XLS-R+AASIST baselines on both tracks.
Problem
Arabic speech deepfake detection must generalize across dialects and acoustic distortions, including compression, noise, reverberation, and transmission filtering.
Source: §1 · p. 1Method
The system freezes W2V-BERT-2.0, trains Wavelet Prompt Tuning prompts, aggregates layers with cross-layer attention and attentive-statistics pooling, and fuses complementary detectors by track.
Source: §1 · p. 1, §3.1 · p. 2Results
1.96% EER on Track 1 and 1.04% EER on Track 2, versus XLS-R+AASIST baselines of 14.54% and 27.11%, respectively (87% and 96% relative reductions).
Source: §5.1 · p. 4Takeaways & Limitations
Dialect and acoustic shifts favored different configurations: broad multi-window fusion for Track 1 and compact, channel-matched center-crop fusion for Track 2.
Source: §6 · p. 4Fusion uses transductive evaluation-set z-norm, so a file’s score depends on the rest of the batch; no inductive variant using development-set statistics is reported.
Source: §7 · p. 5
Abstract
from arXiv · showhide
Detecting synthetic and voice-converted speech remains difficult for low-resource languages with dialectal diversity, where systems must generalize across regional dialects and unseen acoustic channels. We present the UZH-CL submission to the ArA-DF 2026 Shared Task on Arabic speech deepfake detection, covering Track~1 (dialect generalization) and Track~2 (acoustic robustness). We freeze a W2V-BERT-2.0 backbone and adapt it with \emph{Wavelet Prompt Tuning}, updating under 1% of parameters, and aggregate multi-layer representations with cross-layer attention and a general attentive-statistics pooling head rather than a specialized graph backend. Complementary detectors are obtained by varying adaptation strategy, training data, augmentation, and encoder family. We find that the two shift types require different fusion regimes: a broad multi-window ensemble for dialect generalization, and a compact, channel-matched, center-crop ensemble for acoustic robustness. Official evaluation yields 1.96% EER on Track~1 (6th place) and 1.04% EER on Track~2 (3rd place), corresponding to 87% and 96% relative reductions over the XLS-R+AASIST baselines.
1 Introduction
Arabic speech deepfake detection must handle dialectal variation and acoustic distortions; UZH-CL combines parameter-efficient foundation-model adaptation with track-specific detector fusion.
1 Introduction
- Arabic speech spoofing detection must generalize across MSA and regional dialects while coping with codec compression, noise, reverberation, and transmission filtering.The ArA-DF 2026 task evaluates dialect generalization and acoustic robustness in separate tracks.Source: §1 · p. 1
- The system freezes W2V-BERT-2.0 and trains Wavelet Prompt Tuning prompts, updating less than 1% of the parameters.WPT prepends standard and Haar-wavelet prompts to each transformer layer; full fine-tuning on small in-domain data can overfit and overwrite pretrained features.Source: §1 · p. 1
- Rather than use a single SSL layer with AASIST, the system combines all transformer layers through cross-layer attention and attentive-statistics pooling.The approach retains a general pooling head instead of a specialized graph backend.Source: §1 · p. 1
- Detector fusion is tailored to each shift: Track 1 uses overlapping windows and more decorrelated detectors, while Track 2 uses a short center crop and fewer channel-augmented models.Complementary detectors vary in adaptation, training data, augmentation, and encoder family.Source: §1 · p. 1
2 Background and Task Setup
The paper situates its approach among SSL-based anti-spoofing and parameter-efficient adaptation methods, then describes the ArA-DF task and its evaluation baseline.
2 Background and Task Setup
- Speech anti-spoofing commonly pairs an SSL frontend with a graph backend such as AASIST, while full fine-tuning large SSL models is costly and prone to overfitting on small target datasets.The cited examples include wav2vec 2.0 and XLS-R frontends and AASIST backends.Source: §2 · p. 1
- Parameter-efficient methods insert trainable prompts into frozen transformer blocks, and WPT extends prompt tuning to speech using multi-resolution frequency subbands from discrete wavelet transforms.The passage cites prefix tuning, visual prompt tuning, and WPT as examples.Source: §2 · p. 2
- ArA-DF evaluates bonafide-versus-spoof classification on MSA and regional Arabic speech, with EER as its metric; the XLS-R+AASIST baseline scores 14.54% on Track 1 and 27.11% on Track 2.The task provides 22.5k labeled training and 21k labeled development utterances, with separate dialect-generalization and acoustic-robustness tracks.Source: §2 · p. 2
3 System Architecture
The system scores inputs with diversified detectors and combines their outputs using track-specific segmentation and late fusion.
3 System Architecture
- Each detector adapts a frozen SSL backbone, aggregates layer representations, and outputs a scalar score before late fusion applies z-normalization and track-specific scoring.Track 1 uses multi-window averaging, while Track 2 uses a center crop.Source: §3 · p. 2
3.1 WPT Core Detector
- WPT adds standard and Haar-wavelet prompts to a frozen W2V-BERT-2.0 backbone, while cross-layer attention and attentive-statistics pooling aggregate its representations for binary classification.The pooling head uses DSU feature perturbation during training and class-weighted cross-entropy; the detector score is the bonafide logit minus the spoof logit.Source: §3.1 · p. 2
3.2 Detector Ensemble Diversification
- Detectors are diversified by adaptation strategy, encoder family, training-data composition, and augmentation.The set includes frozen WPT and partial fine-tuning, W2V-BERT, XLS-R, Dasheng, and Qwen3-Omni encoders, and official, expanded Arabic, and multilingual training pools.Source: §3.2 · pp. 2–3, Table 1 · p. 3
3.3 Track-Adaptive Scoring and Fusion
- Track 1 uses overlapping 4.04-second windows and up-weights complementary detectors, whereas Track 2 uses a center crop and a compact channel-matched core with auxiliary models at reduced weight.Scores are transductively z-normalized over the evaluation set; including track-mismatched detectors at full weight increased Track 2 EER.Source: §3.3 · pp. 3–4
4 Experimental Setup
The setup standardizes audio duration and trains WPT and partially fine-tuned models with distinct schedules; checkpoint and fusion choices use development data.
4 Experimental Setup
- Training audio is resampled to 16 kHz and padded or cropped to 64,600 samples, approximately 4.04 seconds.WPT models train for eight epochs; partially fine-tuned models train for four.Source: §4 · p. 4
- WPT training uses AdamW with a 10^-4 initial learning rate, batch size 8, 500-step warmup, and cosine decay; fine-tuned backbones use a 10^-5 learning rate.DSU probability is 0.5–0.7, and the pooling head uses a 5 × 10^-5 learning rate for partially fine-tuned models.Source: §4 · p. 4
- Checkpoints are selected by minimum official-development EER, except CDEV, which uses its final epoch; fusion weights and segment aggregation are selected using development cached scores and the dev-test leaderboard.These choices were made without final-test labels.Source: §4 · p. 4
5 Results and Discussion
The final fused systems outperform the official baselines, while cross-split results show that detector fusion and its strategy depend on the type of shift.
5.1 Official Submission Results
- 1.96% EER on Track 1 and 1.04% EER on Track 2, versus XLS-R+AASIST baselines of 14.54% and 27.11%, respectively.These correspond to 87% and 96% relative reductions.Source: §5.1 · p. 4
5.2 Per-Detector Cross-Split Analysis
- Fusion beats every constituent detector across all test splits; final-test 95% confidence intervals do not overlap the best single model on either track.Track 1 intervals are [1.88, 2.05] versus [2.90, 3.12], and Track 2 intervals are [0.97, 1.10] versus [1.33, 1.47].Source: §5.2 · p. 4
- W2V-BERT models consistently outperform alternative backbones, while Dasheng and Qwen3-Omni have stronger reported EERs on Track 2 than Track 1.The authors hypothesize that these general-audio spectrogram frontends preserve channel cues more than dialectal structure.Source: §5.2 · p. 4
- Base-detector test EERs rise to 2.76–17.32% from in-distribution development EERs of 0.04–1.37%, a 5–200× increase depending on model and shift.Source: §5.2 · p. 4
5.3 Asymmetric Fusion Dynamics
- Track 1 benefits from multi-window averaging and decorrelated detectors, whereas Track 2 favors center-crop scoring and a compact, channel-augmented core ensemble.Track 1 W2V-BERT models have correlations of r = 0.85–0.97 versus r = 0.46–0.62 for external-corpus models; on Track 2, full-weight auxiliaries increase variance, while w = 0.5 maintains performance under channel distortions.Source: §5.3 · p. 4
6 Conclusion
The UZH-CL systems use frozen W2V-BERT-2.0 with Wavelet Prompt Tuning and track-specific score fusion. Their results and preferred fusion configurations differ between dialect generalization and acoustic robustness.
6 Conclusion
- The systems reached 1.96% EER on Track 1 and 1.04% EER on Track 2 using frozen W2V-BERT-2.0 with Wavelet Prompt Tuning and track-specific score fusion.A broader multi-window fusion helped Track 1; a smaller channel-matched set with center-crop scoring helped Track 2.Source: §6 · p. 4
7 Limitations
The evaluation and reporting have several limits relevant to interpreting the results.
7 Limitations
- Fusion scores depend on the evaluation batch; inductive statistics, seed variance, deduplication against evaluation material, and secondary metrics are not reported.External-data models are included in Track 1 fusion, and close Track 1 EERs should not be read as stable without seed variance.Source: §7 · p. 5
8 Ethics Statement
The work presents a defensive Arabic speech deepfake detector and does not release a generation system.
8 Ethics Statement
- The work is a defensive Arabic speech deepfake detector, uses official task data and publicly cited corpora under their licenses, and does not attempt speaker re-identification.Reported EERs apply only to shared-task conditions and do not guarantee unconstrained robustness.Source: §8 · p. 5