A technical treatment for people who need to understand the method before they trust the output: how spoofed speech is produced, what a countermeasure model actually learns, why in-dataset results routinely fail to survive contact with real-world audio, and how to read a score without over-reading it. If you want the practical consumer version instead, start with the voice detection overview.
The term covers several distinct attack classes with different signatures. A detector that handles one well may handle another badly, so it is worth knowing which you are dealing with.
| Attack class | How it is produced | What it leaves behind |
|---|---|---|
| Text-to-speech with a cloned voice | A model is conditioned on a target speaker's samples and generates a waveform from text. The whole signal is synthesised. | The most detectable class. Every part of the signal comes from a generative model, so vocoder artefacts, an over-regular noise floor and absent physical breath are all available as evidence. |
| Voice conversion | A real recording of one speaker is transformed to carry another speaker's identity, keeping the original prosody and timing. | Harder. Timing, breath and room noise are inherited from a genuine recording, so several of the strongest human-side cues are legitimately present. |
| Splicing and editing | Genuine recorded fragments reassembled to imply something the speaker never said. | Not synthesis at all. Every fragment is authentically human, so a spoof detector will typically call it human — correctly, and uselessly. Detecting this needs discontinuity and provenance analysis, not spoof detection. |
| Replay | Genuine audio played through a speaker and captured again by a microphone. | Adds real room acoustics on top of whatever it started as, which can push synthetic audio toward a human verdict. A recognised hard case in the anti-spoofing literature. |
Audio anti-spoofing is a supervised binary classification problem. A model is trained on a corpus of genuine ("bona fide") and spoofed utterances and learns a decision function over some representation of the waveform. Three parts determine how well it works.
Early systems used hand-designed features chosen because they exposed vocoder behaviour — constant-Q cepstral coefficients, linear-frequency cepstral coefficients, and phase-derived features, since many synthesis pipelines reconstruct phase rather than preserving it. Contemporary systems more often operate on a raw waveform or a time-frequency representation, or on embeddings from a large self-supervised speech model pre-trained on unlabelled audio. The self-supervised route generalises better in published work, largely because the representation was not shaped by the spoof corpus.
Typically a deep network over that representation — residual or graph-attention architectures are common in the literature — producing a scalar score. There is no interpretable rule inside; the model has learned a boundary between two distributions, which is why a result cannot be explained the way a fingerprint match can.
The score becomes a decision only when compared against a threshold, and the threshold encodes a policy choice. Set it to catch more spoofs and you flag more genuine recordings; set it to protect genuine recordings and more spoofs pass. There is no setting that avoids both. Any product presenting a binary verdict has made this trade-off on your behalf, and it is fair to ask which way.
The TextSight AI Voice Detector submits your uploaded audio to a speech-deepfake detection model and returns an AI-likelihood score with a human-versus-synthetic verdict. It does not perform speaker verification — it will not tell you whether the voice belongs to a particular person — and it does not attempt source attribution. Audio is processed and discarded, never retained or used for training.
Most marketing numbers in audio deepfake detection are technically true and practically meaningless. Here is what the terms mean and what to ask about any figure you are shown.
The operating point where the false-acceptance rate equals the false-rejection rate. The standard headline metric in anti-spoofing. It compresses an entire trade-off curve into one number, which makes it comparable across systems and useless without the conditions attached.
Used where a countermeasure sits in front of a speaker-verification system: it scores the combined pipeline rather than the detector alone, weighted by the cost of each error type. More faithful to a deployment where errors have asymmetric consequences.
In-domain means the test audio comes from the same corpus, generators and recording conditions as training. Cross-domain means it does not. The gap between the two is the single most important number in this field, and it is the one least often published.
Whether the generators producing the test spoofs appeared in training. Performance against unseen generators is what predicts real-world behaviour, because the models people actually encounter are usually newer than any detector's training set.
Public benchmark efforts — the ASVspoof challenge series being the best known — exist precisely because vendor-reported numbers are not comparable. They provide shared datasets, defined attack conditions and a common protocol. When you see an accuracy claim, the useful questions are: measured on what corpus, against which generators, under what channel conditions, at what false-positive rate, and was any of it unseen during training?
Stated plainly, because you cannot use a result responsibly without knowing this.
This is the central unsolved problem. A countermeasure learns the artefacts of the synthesis systems in its training data. New architectures and new vocoders leave different artefacts, and detection performance against them degrades — sometimes severely. Because generative speech models improve faster than detection corpora are rebuilt, every deployed detector is working against a moving target and is structurally behind it.
A model trained on clean studio-quality corpora encounters audio that has passed through a telephone codec, a messaging app's Opus encoder, a social platform's transcoder, or several in sequence. Compression removes the high-frequency detail the model relies on and adds its own artefacts, which the model has no basis to distinguish from generation artefacts. This is why a WhatsApp voice note and a phone recording are materially harder cases than a clean file.
Scores from very short clips are unstable in both directions. There is simply not enough speech to establish the statistical regularities the decision rests on.
Detection scores can be manipulated by deliberate post-processing — added noise, filtering, resampling, or perturbations optimised against a specific model. Any detector should be assumed vulnerable to an adversary who knows it is there and cares enough to work around it. This matters most in exactly the high-stakes cases where you would most want to rely on it.
Genuine audio can score as synthetic. Heavy noise reduction, aggressive de-essing, pitch correction, a close-miced booth with an unusually low noise floor, or a synthesised-sounding but real delivery all push a genuine recording toward the spoof side. A person who habitually uses studio processing is more likely to be wrongly flagged than someone recording on a phone, which is an unfairness worth naming.
As above: a recording can be entirely genuine audio and entirely misleading. Detection says nothing about whether a clip was taken out of context, edited between sentences, or attributed to the wrong occasion. Those are provenance questions, and they are frequently the ones that actually matter.
Forensic audio authentication is a distinct discipline. It examines chain of custody, container and encoding structure, metadata consistency, electrical network frequency where present, edit-point analysis and acoustic environment consistency — and it produces an opinion an examiner can defend under cross-examination, with stated methodology and stated uncertainty. An automated score does none of that. It is a triage instrument: it tells you a recording deserves attention.
Used that way it is genuinely valuable. A newsroom checking twenty submitted clips, a fraud team reviewing a month of flagged calls, a researcher sampling a corpus — all of them benefit from a fast signal that ranks what to look at first. The failure mode is treating the triage output as the finding.
The non-technical version of the evaluation section — why a single accuracy percentage is the wrong thing to ask for.
See our position →Using a known-genuine control recording to partly cancel out channel effects. The most useful thing you can do with a binary detector.
Learn the method →The same argument applied to text detection — false positives, threshold policy and why no detector is proof.
Read the explainer →Three checks a day, free, no signup. Your audio is never stored.