Most people picture AI voice detection as a machine listening for the flat, metallic delivery of a 2010 satnav. That mental model is about eight years out of date, and it is the single biggest reason people misjudge what these tools can and cannot do.
Modern synthetic speech has breathing. It has filler sounds. It hesitates before a hard word, then pushes through it. Some engines will give you a small laugh if you ask for one. If a detector were listening for "does this sound like a robot", it would have stopped working around 2022.
So what is it actually doing?
Speech is a picture before it is a sound
The first thing that happens to your file is that it stops being audio.
A raw recording is a long list of amplitude values, tens of thousands of numbers per second of sound. That format is useless for pattern matching. So the audio gets cut into short overlapping windows, usually somewhere between 20 and 30 milliseconds each, and every window is run through a Fourier transform to work out which frequencies are present and how loudly.
Stack those windows side by side and you get a spectrogram. Time runs left to right, frequency runs bottom to top, and brightness shows energy. It looks like a weather map. Speech shows up as horizontal bands (the harmonics of your vocal folds), vertical smears where consonants burst, and dark gaps in the pauses.
From this point on, the detector is doing image work on a picture of your voice. That reframing matters, because it explains what the model can see. It is not evaluating whether the sentence was well delivered. It is looking for texture that human vocal tracts do not produce.
What a human throat cannot do
Real speech comes out of a physical system with physical limits. Air is pushed from your lungs past vocal folds that vibrate at a rate you can only partly control. That vibration is filtered by the shape of your throat, tongue, teeth and nasal cavity, all of which are moving continuously and none of which can teleport from one configuration to another.
Two consequences fall out of that, and detectors live on both.
The first is that human harmonics are messy in a specific way. Your vocal folds do not close cleanly and identically every cycle. There is jitter in the timing and shimmer in the amplitude, tiny irregularities that persist through a whole recording. Above roughly 6 kHz, real speech carries a thin haze of turbulent noise from air moving past teeth and lips. It carries almost no information, which is exactly why synthesis systems have historically been careless with it.
The second is phase. A spectrogram usually throws away phase information, meaning the relative timing alignment of each frequency component. Humans cannot hear phase directly in most conditions, so for decades audio engineering treated it as disposable. Neural vocoders, the component that turns a model's internal representation back into a waveform, have to reconstruct phase from scratch. Several popular vocoder families reconstruct it in ways that are internally consistent in a way that no real room and no real throat ever is.
That is the core of it. Detection is largely the search for reconstruction fingerprints: the traces left by the last stage of the generation pipeline, the part that had to invent a waveform.
Prosody carries a second, weaker signal
Beyond texture, there is rhythm.
Human speakers speed up when bored of their own sentence, slow down when they are choosing a word, put stress in places that depend on what they think the listener already knows. Pause lengths in natural conversation are wildly uneven, and a lot of them land in places that are grammatically strange but conversationally normal.
Synthetic prosody has improved enormously and I want to be honest that this is now a weak signal rather than a strong one. Current engines vary their pacing, and the better ones do it convincingly across a paragraph. But the variation still tends to come from a smaller distribution. Pause lengths cluster. Sentence-final pitch falls follow a narrower set of contours. A model trained on thousands of hours of both kinds of speech picks up on the narrowness even when a human listener cannot.
Prosody is the part I trust least in any detector, ours included. It is the first thing to break when the speaker is reading from a script, because a human reading aloud also flattens into a narrow distribution. That is a genuine, structural false-positive risk and anyone who tells you their tool is immune to it is selling something.
The lineage: this field came from banking, not media
Worth knowing, because it explains why the models look the way they do.
Long before anyone worried about deepfaked podcasts, banks and phone systems were using voice as an authentication factor, and attackers were trying to defeat it. That produced an academic subfield called anti-spoofing, along with a recurring challenge series called ASVspoof that ran from 2015 onward and published shared datasets of genuine and attacked speech.
The attacks in those datasets were replay attacks, older text-to-speech, and voice conversion. The countermeasure models that came out of the challenges, with names like RawNet2 and AASIST, learned to spot exactly the reconstruction artifacts described above. AASIST in particular works on the raw waveform with a graph attention structure that lets it weigh evidence across both time and frequency at once, rather than committing to a fixed spectrogram resolution up front.
When generative voice cloning arrived and became a consumer product, the media-verification world did not have to start from zero. It inherited a decade of anti-spoofing research. Our own detector sits in that lineage, running an AASIST-family anti-spoofing model rather than something invented from scratch for the deepfake news cycle.
This is also why detection quality is uneven across attack types in ways that look arbitrary from outside. A model trained heavily on one generation family may have seen very little of a newer one.
The failure that taught us the most
I want to describe a mistake we made, because it illustrates how these systems go wrong in ways that are invisible until you look.
An earlier version of our voice detector, internally textsight:voice-v1, produced scores that looked plausible in testing. Then real users started sending real voice notes, and the thing returned 99 and 100 percent AI on ordinary humans talking into their phones.
The model was not broken. It was answering a different question than the one we thought we had asked it. Its training had effectively taught it to separate speech from music, not AI speech from human speech. Clean, close-miked, compressed phone audio sat on the wrong side of that boundary. Every confident score it produced was confidently answering the wrong question.
We replaced it with the anti-spoofing model we run now. The lesson I took from it is that a detector returning high-confidence numbers tells you nothing about whether it is measuring the right thing. Confidence is a property of the model, not of reality.
Abstaining is a feature
Which brings me to the part of our pipeline I would defend hardest.
Before scoring, the clip goes through a quality gate. If there is not enough actual speech in it, if the recording is too quiet, or if it is simply too short, the detector declines to judge. It returns an uncertain verdict rather than a number.
That is not the model failing. It is the model refusing to guess, and it happens more often than you might expect. A seven-second clip with four seconds of background noise does not contain enough signal to support a claim in either direction. A tool that returns "82 percent AI" on that clip is generating a number, not measuring one.
Every score we return comes back as an AI score from 0 to 100, with the human score being exactly 100 minus that, plus one of three verdicts: human, AI, or uncertain. The uncertain bucket exists so that an abstention never quietly gets rounded into a clean answer. If the model has genuinely declined, you see that it declined.
I would apply this as a test to any detector you evaluate. Feed it something it should not be able to judge: three seconds of a cough, a clip that is mostly silence, a heavily distorted recording. If it comes back with a decisive percentage every single time, it does not have an abstain path, and you should treat all of its other numbers with the same suspicion.
Where detection genuinely struggles
Being specific about the weak spots is more useful than another paragraph of caveats.
Heavy compression. Every artifact described in the first half of this article lives in fine spectral detail. Lossy codecs are engineered to delete exactly the detail that human ears do not consciously register, which overlaps heavily with the evidence. A file that has been through several rounds of re-encoding, say recorded, uploaded, downloaded, forwarded, and screen-recorded, has had a lot of the evidence stripped out of it.
Narrowband phone audio. Traditional telephony throws away everything above roughly 3.4 kHz. A large share of the high-frequency evidence simply is not present in a phone recording. This is why live call detection is a much harder problem than file detection, and why I am wary of products that claim to do it casually.
Short clips. Under about ten seconds of continuous speech, the evidence base thins out fast. Statistical claims need samples.
Post-processing. Noise reduction, normalisation, de-essing, and mastering all reshape the spectrum. Someone who wants to defeat a detector and knows what they are doing has options, and honest vendors should say so.
Newer generation families. A model trained on the attacks of the last three years has an inherent lag against something released last month. This is structural to the field and no amount of marketing fixes it.
What it will not tell you
One claim I see repeatedly and want to argue against: naming the engine.
You will find tools that say a clip was made with a specific commercial voice product. We do not do that, and I do not believe the ones that do are on solid ground. The artifacts a detector picks up belong to vocoder architectures, and those architectures are shared, forked, fine-tuned, and swapped between products constantly. Several commercial engines have run on the same underlying family at different points. An attribution to a brand name is really an attribution to an architecture wearing a brand name, and the mapping between the two changes without notice.
So our output tells you whether the speech looks synthesised. Not who made it. That is a smaller claim, and it is the one the evidence supports.
How to use the number
Treat a voice detection result the way a doctor treats a single blood marker. It is evidence. It updates your belief. It does not close the question by itself.
If a clip scores high for AI and everything else about its provenance is clean, you have a genuine puzzle worth investigating. If it scores high and the file also arrived from an anonymous account, has metadata stripped, and cannot be corroborated by anyone, the detector is confirming a picture you already had. If it comes back uncertain, that is real information too: you now know that this particular clip cannot carry the weight you wanted to put on it, and you need a different kind of evidence.
The failure mode I worry about is not people distrusting detection. It is people trusting a percentage more than they trust the rest of the case in front of them. A number with two significant figures feels more solid than a judgement call, and it usually is not.
You can run a clip through our detector at the voice detector. Free checks are available without an account. Bring the original file if you have it, because as the compression section explains, every generation of re-encoding takes evidence away from the thing you are asking to be measured.
Try it on your own writing