HomeVoice Detection › Deepfake Audio Detection

Deepfake audio detection — how it works, and where it breaks.

A technical treatment for people who need to understand the method before they trust the output: how spoofed speech is produced, what a countermeasure model actually learns, why in-dataset results routinely fail to survive contact with real-world audio, and how to read a score without over-reading it. If you want the practical consumer version instead, start with the voice detection overview.

Run a check on a recording Where detection fails ↓
Definitions

What counts as an audio deepfake.

The term covers several distinct attack classes with different signatures. A detector that handles one well may handle another badly, so it is worth knowing which you are dealing with.

Attack classHow it is producedWhat it leaves behind
Text-to-speech with a cloned voice A model is conditioned on a target speaker's samples and generates a waveform from text. The whole signal is synthesised. The most detectable class. Every part of the signal comes from a generative model, so vocoder artefacts, an over-regular noise floor and absent physical breath are all available as evidence.
Voice conversion A real recording of one speaker is transformed to carry another speaker's identity, keeping the original prosody and timing. Harder. Timing, breath and room noise are inherited from a genuine recording, so several of the strongest human-side cues are legitimately present.
Splicing and editing Genuine recorded fragments reassembled to imply something the speaker never said. Not synthesis at all. Every fragment is authentically human, so a spoof detector will typically call it human — correctly, and uselessly. Detecting this needs discontinuity and provenance analysis, not spoof detection.
Replay Genuine audio played through a speaker and captured again by a microphone. Adds real room acoustics on top of whatever it started as, which can push synthetic audio toward a human verdict. A recognised hard case in the anti-spoofing literature.
The class mismatch matters more than most people expect. If your actual concern is a spliced or misattributed recording rather than a synthesised one, a spoof detector is the wrong instrument and a confident "human" result will mislead you. Ask first which attack you are testing for.
Method

What a countermeasure model actually learns.

Audio anti-spoofing is a supervised binary classification problem. A model is trained on a corpus of genuine ("bona fide") and spoofed utterances and learns a decision function over some representation of the waveform. Three parts determine how well it works.

1. The front end

Early systems used hand-designed features chosen because they exposed vocoder behaviour — constant-Q cepstral coefficients, linear-frequency cepstral coefficients, and phase-derived features, since many synthesis pipelines reconstruct phase rather than preserving it. Contemporary systems more often operate on a raw waveform or a time-frequency representation, or on embeddings from a large self-supervised speech model pre-trained on unlabelled audio. The self-supervised route generalises better in published work, largely because the representation was not shaped by the spoof corpus.

2. The classifier

Typically a deep network over that representation — residual or graph-attention architectures are common in the literature — producing a scalar score. There is no interpretable rule inside; the model has learned a boundary between two distributions, which is why a result cannot be explained the way a fingerprint match can.

3. The threshold

The score becomes a decision only when compared against a threshold, and the threshold encodes a policy choice. Set it to catch more spoofs and you flag more genuine recordings; set it to protect genuine recordings and more spoofs pass. There is no setting that avoids both. Any product presenting a binary verdict has made this trade-off on your behalf, and it is fair to ask which way.

Why we return a score rather than a bare yes or no. The underlying quantity is continuous and the threshold is a policy, not a fact. Collapsing it to a verdict without the confidence beside it discards the part of the answer that tells you how much to trust it.

What our detector does

The TextSight AI Voice Detector submits your uploaded audio to a speech-deepfake detection model and returns an AI-likelihood score with a human-versus-synthetic verdict. It does not perform speaker verification — it will not tell you whether the voice belongs to a particular person — and it does not attempt source attribution. Audio is processed and discarded, never retained or used for training.

Evaluation

Reading accuracy claims in this field.

Most marketing numbers in audio deepfake detection are technically true and practically meaningless. Here is what the terms mean and what to ask about any figure you are shown.

EER — Equal Error Rate

The operating point where the false-acceptance rate equals the false-rejection rate. The standard headline metric in anti-spoofing. It compresses an entire trade-off curve into one number, which makes it comparable across systems and useless without the conditions attached.

t-DCF — tandem detection cost function

Used where a countermeasure sits in front of a speaker-verification system: it scores the combined pipeline rather than the detector alone, weighted by the cost of each error type. More faithful to a deployment where errors have asymmetric consequences.

In-domain versus cross-domain evaluation

In-domain means the test audio comes from the same corpus, generators and recording conditions as training. Cross-domain means it does not. The gap between the two is the single most important number in this field, and it is the one least often published.

Seen versus unseen attacks

Whether the generators producing the test spoofs appeared in training. Performance against unseen generators is what predicts real-world behaviour, because the models people actually encounter are usually newer than any detector's training set.

Public benchmark efforts — the ASVspoof challenge series being the best known — exist precisely because vendor-reported numbers are not comparable. They provide shared datasets, defined attack conditions and a common protocol. When you see an accuracy claim, the useful questions are: measured on what corpus, against which generators, under what channel conditions, at what false-positive rate, and was any of it unseen during training?

We do not publish a single accuracy percentage for our detector. Not because the number would be unflattering, but because a figure without the conditions attached is not information — and in this field it is routinely used to imply a reliability that does not survive contact with real audio. Our full position on accuracy is here.
Limitations

Where deepfake audio detection breaks down.

Stated plainly, because you cannot use a result responsibly without knowing this.

Generalisation to unseen generators

This is the central unsolved problem. A countermeasure learns the artefacts of the synthesis systems in its training data. New architectures and new vocoders leave different artefacts, and detection performance against them degrades — sometimes severely. Because generative speech models improve faster than detection corpora are rebuilt, every deployed detector is working against a moving target and is structurally behind it.

Channel and codec mismatch

A model trained on clean studio-quality corpora encounters audio that has passed through a telephone codec, a messaging app's Opus encoder, a social platform's transcoder, or several in sequence. Compression removes the high-frequency detail the model relies on and adds its own artefacts, which the model has no basis to distinguish from generation artefacts. This is why a WhatsApp voice note and a phone recording are materially harder cases than a clean file.

Short utterances

Scores from very short clips are unstable in both directions. There is simply not enough speech to establish the statistical regularities the decision rests on.

Adversarial and post-processing evasion

Detection scores can be manipulated by deliberate post-processing — added noise, filtering, resampling, or perturbations optimised against a specific model. Any detector should be assumed vulnerable to an adversary who knows it is there and cares enough to work around it. This matters most in exactly the high-stakes cases where you would most want to rely on it.

False positives on legitimate recordings

Genuine audio can score as synthetic. Heavy noise reduction, aggressive de-essing, pitch correction, a close-miced booth with an unusually low noise floor, or a synthesised-sounding but real delivery all push a genuine recording toward the spoof side. A person who habitually uses studio processing is more likely to be wrongly flagged than someone recording on a phone, which is an unfairness worth naming.

Splicing and context

As above: a recording can be entirely genuine audio and entirely misleading. Detection says nothing about whether a clip was taken out of context, edited between sentences, or attributed to the wrong occasion. Those are provenance questions, and they are frequently the ones that actually matter.

Practice

Getting a result worth having.

  1. Work from the least-processed copy. Trace the file back as close to its origin as you can. Each forward, download, platform upload and re-encode strips evidence, and none of it comes back.
  2. Preserve the original before you touch anything. Keep an untouched copy with its metadata and container intact. Do your trimming and converting on a duplicate. If this ever becomes a real dispute, the untouched file is the thing that matters.
  3. Isolate continuous single-speaker speech. Cut out music, crosstalk and long silences. A clean thirty-second segment beats five noisy minutes.
  4. Prefer lossless or high-bitrate formats. WAV or FLAC if you have them; MP3, M4A or OGG otherwise, up to 10 MB. Never re-encode a lossy file at a lower bitrate to fit the limit — trim its length instead.
  5. Test a known-genuine control. Run a recording of the same speaker that you are confident is real, captured under similar conditions. The comparison method tells you far more than an isolated score, because it partly cancels out channel effects.
  6. Record the conditions with the result. Duration, format, bitrate, provenance and how many hops it took to reach you. A score without that context is not reproducible and should not be cited.
Scope

This is not forensic evidence.

Explicitly: a TextSight voice result is not forensic-grade audio authentication and must never be the sole basis for a disciplinary, employment, financial or legal decision. Where the stakes justify it, engage a qualified forensic audio examiner.

Forensic audio authentication is a distinct discipline. It examines chain of custody, container and encoding structure, metadata consistency, electrical network frequency where present, edit-point analysis and acoustic environment consistency — and it produces an opinion an examiner can defend under cross-examination, with stated methodology and stated uncertainty. An automated score does none of that. It is a triage instrument: it tells you a recording deserves attention.

Used that way it is genuinely valuable. A newsroom checking twenty submitted clips, a fraud team reviewing a month of flagged calls, a researcher sampling a corpus — all of them benefit from a fast signal that ranks what to look at first. The failure mode is treating the triage output as the finding.

What to pair it with

  • Provenance. Where did the file come from, who had it before, and does that chain hold up?
  • Container and metadata. Does the encoding match the device it supposedly came from?
  • Corroboration. Does anyone else confirm the event, and does anything else from the same occasion exist?
  • The subject. Ask the person whether they said it. Obvious, frequently skipped, often decisive.
FAQ

Technical questions.

What is an audio deepfake?
An audio deepfake is speech that was machine-generated or machine-modified to sound like a specific person, or like a plausible human speaker, without that person having said the words. It covers text-to-speech synthesis with a cloned voice, voice conversion that maps one speaker's recording onto another's identity, and edited or spliced speech assembled to imply something that was never said.
How does deepfake audio detection actually work?
A countermeasure model is trained on a corpus of genuine and spoofed speech and learns to separate them from acoustic evidence — spectral structure, phase behaviour, noise-floor characteristics and micro-timing. Modern systems typically operate over a spectrogram or a self-supervised speech representation rather than hand-designed features. The output is a score, which a threshold converts into a decision.
Why do audio deepfake detectors fail on real-world audio?
The dominant failure is distribution shift. A detector learns what the specific generators in its training set leave behind, plus the recording and codec conditions of that corpus. Real-world audio arrives from unseen generators through unseen channels — phone codecs, messaging-app compression, re-recording, social-media transcoding — and performance degrades substantially. Published results measured within a dataset routinely fail to transfer to audio collected elsewhere.
What is EER and why does it matter?
Equal Error Rate is the operating point at which the false-acceptance rate equals the false-rejection rate, and it is the standard headline metric in anti-spoofing research. It matters because it is a single number describing a whole trade-off curve, and it is only meaningful alongside the dataset, the attack types and the channel conditions it was measured on. An EER quoted without those conditions tells you very little.
Is a deepfake audio detector accepted as evidence in court?
No, and no consumer tool should be presented that way. Forensic audio authentication is a specialist discipline involving chain of custody, provenance analysis, container and encoding examination and an expert who can testify to the method. An automated detector result can indicate a recording is worth examining. It cannot substitute for that examination.
Does the detector work on replay attacks?
Replay — playing a genuine recording back through a speaker to a microphone — is a different problem from synthesis, and it is one of the harder ones. The re-recorded audio contains real acoustic evidence because it genuinely passed through a room and a microphone again. Treat a human verdict on possibly re-recorded audio with particular caution.
Can detection identify which model generated the audio?
Source attribution is an active research area and it is substantially harder than binary spoof detection. Our detector does not return it, and we do not display a guess. Any tool that names a specific vendor from audio alone should be asked what evidence that claim rests on and how it performs on generators released after it was trained.
What audio should I submit for the best result?
The least-processed copy you can obtain, containing continuous speech from a single speaker, in a lossless or high-bitrate format. Avoid re-encoded copies, screen recordings, clips assembled from multiple sources and audio with heavy background noise or music. Every processing stage between the original and your file removes evidence.
Related

More voice detection guides.

Check a recording, then verify it properly.

Three checks a day, free, no signup. Your audio is never stored.

Run a check All voice guides
Triage instrument, not forensic authentication · MP3 · WAV · M4A · OGG · FLAC · up to 10 MB