PaperlayerView exact revision on arXiv

Source-linked AI summary

Detection-Guided Adaptive Purification with Diffusion Models for Robust Audio Deepfake Detection

Muhammed Salih Kayhan, Qiben Yan

arXiv:2610.10752v1cs.CRcs.SD

TL;DR

Audio deepfake detectors can be evaded by perturbations that suppress spoof cues, while fixed purification strength trades attack removal against preserving those cues. DGAP uses detector-score shifts after light purification to adapt purification strength per input. Across the evaluated detectors and attacks, it achieves the strongest overall defense performance while leaving benign inputs nearly unaffected and remaining effective under a defense-aware adaptive attack.

  • Problem

    Small perturbations can suppress acoustic cues and let manipulated utterances evade audio deepfake detectors, while fixed-strength purification trades removing perturbations against preserving subtle spoof evidence.

    Source: §I · p. 1

  • Method

    DGAP uses the detector’s score shift after light diffusion purification as a reference-free gate for deciding which inputs receive stronger purification, without retraining or modifying the detector.

    Source: §I · p. 2

  • Results

    Across three deepfake detectors and three adversarial attack settings, DGAP achieves the strongest overall defense performance, leaves benign inputs nearly unaffected, and remains effective under a defense-aware adaptive attack.

    Source: §I · p. 2, §VII · p. 11

  • Takeaways & Limitations

    The reported results support adaptive diffusion purification as a defense for fixed pretrained audio deepfake detectors under the evaluated perturbation attacks.

    Source: §VII · p. 11

    Under a defense-aware adaptive attack, an adversary can keep the score gap below the gating threshold and bypass strong purification.

    Source: §VI · p. 11

Abstract

from arXiv · show

Audio deepfake detectors remain vulnerable to adversarial perturbations that suppress the acoustic cues used for detection, allowing manipulated utterances to evade the detector. Although existing defenses can improve robustness, they require retraining the detector or introduce additional distortion. Diffusion-based purification instead leaves the pretrained detector unchanged, but existing methods use the same purification strength for all inputs, creating a trade-off between removing adversarial perturbations and preserving the subtle spoofing cues needed for detection. In this paper, we propose Detection-Guided Adaptive Purification (DGAP), a diffusion-based defense that adjusts purification strength per input. Building on the observation that a light purification perturbs the detector score of an adversarial input far more than that of a benign one, the framework uses the resulting score shift as a reference-free indicator of adversarial manipulation. Inputs with small shifts are passed unchanged, whereas flagged inputs undergo stronger purification before final detection. We evaluate the framework against three adversarial attack settings across three deepfake detectors, and compare it with nine existing defenses. Our results show that DGAP achieves the best defense performance across all detectors while leaving benign inputs nearly unaffected, and remains effective under the defense-aware adaptive attack.

I. INTRODUCTION

Audio deepfake detectors can be evaded by small perturbations that suppress spoofing cues, while fixed-strength purification trades attack removal against preserving those cues. DGAP uses detector-score shifts after light purification to gate stronger purification, and the paper reports the strongest overall defense performance across its evaluated detectors and attacks.

I. INTRODUCTION

  • Small, often imperceptible perturbations can suppress acoustic cues and make manipulated utterances appear bonafide, exposing a gap between benchmark accuracy and secure-deployment robustness.Audio authenticity also matters for trust and security in communication, identity verification, and voice-enabled services.Source: §I · p. 1
  • Fixed-strength purification trades removing adversarial perturbations against preserving subtle spoofing artifacts, motivating purification strength that adapts to each input..Source: §I · p. 1
  • DGAP compares detector scores before and after light purification as a reference-free gate, applying stronger purification to inputs with significant shifts while passing the others unchanged.The gate requires neither a clean reference nor knowledge of the attack.Source: §I · p. 2
  • DGAP uses diffusion-based purification with strength selected from the detector’s response, without modifying or retraining the pretrained detector.The framework is presented as an adaptive defense against adversarial perturbations.Source: §I · p. 2
  • Across three deepfake detectors and three white-box attack settings, DGAP achieves the strongest overall defense performance, leaves benign inputs nearly unaffected, and remains effective under a defense-aware adaptive attack.The comparison covers nine existing defenses.Source: §I · p. 2

II. RELATED WORK

Audio deepfake detection has progressed from hand-crafted representations and modular classifiers to end-to-end, graph-based, and pretrained-representation systems. Yet adversarial robustness and adaptive purification remain open challenges, particularly because purification must preserve subtle spoofing cues.

A. Audio Deepfake Detection

  • Audio deepfake detectors evolved from hand-crafted acoustic features and modular classifiers to end-to-end, graph-based, and self-supervised-representation approaches.Examples include RawNet2, RawGAT-ST, AASIST, and Wav2Vec 2.0, WavLM, and XLS-R.Source: A. Audio Deepfake Detection · p. 2
  • Small perturbations can mislead deepfake detectors, and their transfer across models suggests the vulnerability is not confined to one detector architecture.The cited work motivates defenses designed for adversarially manipulated deepfake audio.Source: A. Audio Deepfake Detection · p. 2

B. Adversarial Defenses and Purification

  • Adversarial training can improve resistance but may depend on training attacks, while input-detection methods flag adversarial samples without correcting the signal for downstream detection.These limitations matter when protecting fixed pretrained detectors against changing attack settings.Source: B. Adversarial Defenses and Purification · pp. 2–3
  • Purification can protect fixed detectors at test time, but fixed processing strength risks either leaving perturbations effective or distorting spoof evidence.Diffusion purification has mainly been studied for ASR in audio, where recovering intelligible speech may remove cues needed for spoof detection; detector-guided adaptive purification remains underexplored.Source: B. Adversarial Defenses and Purification · p. 3

A. Diffusion Models

The paper describes diffusion as progressive noising followed by learned reverse-time reconstruction. It presents continuous-time forward and reverse SDEs and uses a variance-preserving process to index and reverse noise levels.

A. Diffusion Models

  • The forward diffusion process progressively transforms a clean sample toward Gaussian noise, while a learned reverse process reconstructs it.The sample at noise level t is described by a marginal distribution p_t.Source: A. Diffusion Models · p. 3
  • The continuous-time forward process is an SDE on the horizon [0, 1], with drift coefficient f, diffusion coefficient g, and Wiener process w.The paper adopts a variance-preserving SDE with a linear noise schedule.Source: A. Diffusion Models · p. 3
  • The retention coefficient ᾱ_t decreases monotonically with t, indexing noise from near-complete signal retention toward near-Gaussian noise.The forward process also admits a closed-form perturbation kernel for obtaining a noised sample at level t.Source: A. Diffusion Models · p. 3
  • The reverse-time SDE is integrated from noise level t back to 0 to progressively denoise a sample toward the data distribution.Its reverse-time state is denoted x̂, and the reverse-time process uses a learned score approximation.Source: A. Diffusion Models · p. 3

B. Threat Model

The threat model considers an attacker perturbing an already-spoofed utterance to evade a fixed detector. The defense operates at input level and is expected to restore adversarial-spoof detection while preserving both spoof artifacts and bonafide speech.

B. Threat Model

  • The fixed pretrained detector maps a waveform to spoof and bonafide logits, with the bonafide score compared against an EER-selected threshold for classification.Scores at or above τ are classified as bonafide; lower scores are classified as spoof.Source: B. Threat Model · p. 3
  • The attacker adds a norm-bounded perturbation to an existing spoof waveform rather than synthesizing a new deepfake, while the defender has no test-time knowledge of attack type, norm, or budget.The stated threat model assumes white-box access to the detector; the defense-aware setting is examined separately.Source: B. Threat Model · p. 4
  • The defense is an input-level purification step that leaves the detector unchanged and must restore detection on adversarial spoofs while preserving spoof artifacts and bonafide speech..Source: B. Threat Model · p. 4

IV. METHODOLOGY

DGAP uses a light diffusion probe to identify inputs whose detector scores shift substantially, then applies stronger purification only to flagged inputs. Its spectrogram-based purifier retains phase for waveform reconstruction, while the per-input strength addresses the trade-off between removing perturbations and preserving spoof cues.

A. DGAP System Overview

  • DGAP probes each input with light purification, gates on the detector-score shift, and strongly purifies only flagged inputs before final detection.Inputs below the threshold pass unchanged, preserving detector cues; the pretrained detector is left unchanged.Source: A. DGAP System Overview · p. 4

B. Diffusion-Based Spectrogram Purification for Deepfake Detection

  • Purification operates on decibel-scaled magnitude spectrograms while retaining phase for waveform reconstruction.The spectrogram is divided into fixed-resolution time windows for independent purification and then reassembled.Source: B. Diffusion-Based Spectrogram… · pp. 4–5
  • The diffusion model is fine-tuned on spectrogram windows from both bonafide and spoofed utterances, rather than bonafide speech alone.Source: B. Diffusion-Based Spectrogram… · p. 5
  • At inference, a forward-noising step overwhelms small off-manifold perturbations and reverse diffusion regenerates each spectrogram window from the learned distribution.Purified windows are reassembled in temporal order, and the retained phase is used to reconstruct the waveform.Source: B. Diffusion-Based Spectrogram… · p. 5
  • Large diffusion noise levels remove more perturbation but may distort fine synthesis artifacts, whereas small levels preserve those artifacts but may leave perturbations intact.This strength trade-off motivates selecting purification level per input rather than fixing it across inputs.Source: B. Diffusion-Based Spectrogram… · p. 5

C. Detection-Guided Adaptive Gating

DGAP measures the detector-score shift after a light purification as a reference-free signal for adversarial manipulation. It calibrates a gate on benign inputs, passing unflagged inputs unchanged and strongly purifying flagged inputs.

C. Detection-Guided Adaptive Gating

  • The score gap is the detector-score shift induced by a light probe and is computed from detector outputs alone, without a clean reference.Source: C. Detection-Guided Adaptive Gating · pp. 5–6
  • A light probe attenuates representation-domain adversarial differences, which can appear after reconstruction as a detector-score change; benign inputs typically shift only slightly.For a successful attack, the probe score is expected to move back toward the spoof side.Source: C. Detection-Guided Adaptive Gating · p. 6
  • DGAP flags inputs whose score gap exceeds a threshold calibrated from benign utterances using the calibration-set mean and standard deviation.The operating point is controlled by γ.Source: C. Detection-Guided Adaptive Gating · p. 6
  • The probe level and stronger purification level are decoupled, and the unchanged detector evaluates either the strongly purified flagged input or the unchanged unflagged input.Source: C. Detection-Guided Adaptive Gating · p. 6
  • The development objective balances clean-data preservation against residual vulnerability on adversarial spoofs.Its first term penalizes benign-utterance degradation, while its second penalizes residual adversarial vulnerability.Source: C. Detection-Guided Adaptive Gating · p. 6

A. Experiment Settings

The evaluation uses three frozen pretrained detectors, white-box attacks, and the ASVspoof 2019 LA partition to compare defense performance using clean and adversarial EER.

A. Experiment Settings

  • Three pretrained detectors—AASIST, RawGAT-ST, and Res-TSSDNet—remain frozen throughout evaluation.AASIST and RawGAT-ST use graph attention on raw waveforms; Res-TSSDNet classifies waveform samples with a time-domain residual architecture.Source: A. Experiment Settings · p. 6
  • Three white-box attack settings comprise PGD-ℓ∞, PGD-ℓ2, and C&W, with attack success rates reported for undefended detectors.PGD budgets are fixed across detectors, while iteration counts are tuned per detector; Table I caption specifies that PGD iteration counts appear in parentheses.Source: A. Experiment Settings · p. 6, Table I · p. 7
  • Evaluation uses 600 correctly classified spoofed evaluation utterances and 500 development utterances, each paired with an equal number of bonafide utterances.The samples come from the ASVspoof 2019 LA partition; development data is used for parameter selection.Source: A. Experiment Settings · p. 7
  • The comparison includes transformation, noise, and diffusion defenses; EERclean measures clean discrimination and EERadv measures residual vulnerability under attack.DiffPure and WavePurifier purify every input at a fixed strength; lower EERadv with EERclean near its no-defense value captures the defense trade-off.Source: A. Experiment Settings · p. 7

B. Selecting the Purification Parameters

The authors select probe, purification, and gate parameters by minimizing a development objective. The observed trends favor light probing, stronger selective purification, and a gate threshold matched to score-gap separability.

B. Selecting the Purification Parameters

  • The development search jointly selects probe level tg, purification level tp, and gate coefficient γ by minimizing objective y.It searches 15 diffusion levels from 20 to 300 for tg and tp and γ from 0.5 to 3.0 in 0.01 intervals, with λ = 1.Source: B. Selecting the Purification Parameters · p. 7
  • Across detectors and attacks, relatively small probe levels minimize the objective because stronger probing modifies benign inputs and reduces score-gap contrast.Fig. 4(a) plots objective y against tg.Source: B. Selecting the Purification Parameters · p. 7, Figure 4 · p. 8
  • DGAP’s optimal purification level is stronger than the uniform baseline’s because the stronger level is applied only to inputs flagged by the gate.At larger tp, DGAP’s objective continues improving or remains stable, while the uniform baseline reaches its optimum at a lower level.Source: B. Selecting the Purification Parameters · p. 7, Figure 4 · p. 8
  • The optimal γ balances benign-input preservation against adversarial coverage, with more separable score gaps permitting a more conservative gate.Small γ may unnecessarily purify benign inputs; large γ may leave some adversarial inputs unpurified.Source: B. Selecting the Purification Parameters · p. 7

C. Main Results

DGAP achieves the best combined objective across the three detectors, while keeping benign inputs nearly unaffected. Its score-gap gate concentrates stronger purification on flagged inputs, though individual defenses can lead on some single-attack columns.

C. Main Results

  • At the selected probe level, benign score shifts are marginal while adversarial shifts are substantial, flagging over 90% of adversarial utterances and leaving most benign inputs unmodified.The benign and adversarial score-gap distributions have limited overlap.Source: C. Main Results · p. 8, Figure 5 · p. 9
  • Transformation defenses recover only partially and inconsistently, while fixed-strength diffusion baselines remain unable to reconcile robustness with clean-data preservation.The strongest transformation defense still leaves y at 9.58% on AASIST and 16.76% on RawGAT-ST; WavePurifier is marginally worse than DiffPure on two detectors and only slightly better on Res-TSSDNet.Source: C. Main Results · p. 8
  • DGAP lowers the combined objective y from DiffPure’s 12.56%, 11.26%, and 29.69% to 5.61%, 5.18%, and 21.65%, respectively.These are the best combined-objective results on all three detectors.Source: C. Main Results · p. 8
  • On Res-TSSDNet, individual single-attack columns are occasionally led by transformation defenses, but DGAP still achieves the best combined objective on this hardest detector to defend.QT is competitive under ℓ∞ and ℓ2 but reaches 54.29% under C&W and degrades EERclean to 8.33%.Source: C. Main Results · p. 9

D. Ablation Study

Under the adaptive BPDA+EOT attack, DGAP leads on RawGAT-ST and ranks second on AASIST, while the ablation shows gating can make an otherwise overly aggressive purification level useful. The adaptive attack can evade the gate by keeping the probe-induced score gap below its threshold.

D. Ablation Study

  • Gated purification at t_p achieves the lowest EERadv in every case, while applying t_p uniformly worsens EERadv in all nine cases and increases EERclean.The gate comparison holds purification strength constant and varies whether t_p is applied to every input or only flagged inputs.Source: D. Ablation Study · p. 9, Table III · p. 10

E. Adaptive Attack Evaluation

  • Under the adaptive attack, only 33.3% and 34.2% of adversarial utterances are flagged, versus 5.8% and 4.2% of benign inputs, as adversarial score gaps cluster below the threshold.The attack uses 20 PGD iterations and 8 EOT samples; the authors caution that more steps or samples may widen the gap from the non-adaptive setting.Source: E. Adaptive Attack Evaluation · pp. 9–10
  • Under adaptive BPDA+EOT, RawGAT-ST: our method has the best y, 14.17%, versus DiffPure’s 18.33% and the best transformation’s 15.83%; AASIST: QT leads at 20.00%, while our method ties BPF for second at 25.00%, ahead of DiffPure.Source: E. Adaptive Attack Evaluation · p. 9, Table IV · p. 10
  • The adaptive attack requires evading both the detector and the probe, making gate evasion DGAP’s principal failure mode in this setting.Flagged inputs receive stronger purification, but an input that evades the gate bypasses it.Source: E. Adaptive Attack Evaluation · p. 10

F. Time Budget Analysis

DGAP’s per-utterance cost combines a light probe for every input with stronger purification only for flagged inputs. The authors also identify gate evasion, computational cost, and the evaluation scope as limitations, while concluding that DGAP performs strongly across the evaluated detectors and attacks.

F. Time Budget Analysis

  • Benign inputs are rarely flagged, so their expected running time stays close to the probe alone; adversarial inputs, flagged in 90% or more of cases, also incur strong purification.The reported per-utterance times were measured on a single NVIDIA RTX A6000 GPU; expected time combines probe cost with strong-purification cost weighted by flag rate.Source: F. Time Budget Analysis · pp. 10–11, Table V · p. 11

VI. LIMITATIONS

  • The evaluation focuses on pretrained detectors and perturbation-based attacks; diffusion purification also remains computationally costly, and every input requires a light probe.Under a defense-aware adaptive attack, gate evasion can keep the score gap below threshold and bypass strong purification.Source: §VI · p. 11

VII. CONCLUSION

  • Across three detectors and three adversarial attack settings, DGAP achieves the strongest overall defense performance among the compared defenses while leaving benign inputs nearly unaffected.The pretrained detector is left unchanged, and DGAP remains effective under a defense-aware adaptive attack.Source: §VII · p. 11

Related papers

Loading 2610.10752v1…