Audio Deepfake Detection Methods and Benchmarks

Text-to-speech and voice conversion systems leave fingerprints. Not obvious ones: subtle statistical irregularities in frequency distribution, waveform continuity, and spectro-temporal transitions that differ measurably from natural human speech. Modern synthesis architectures, particularly GAN-based and neural TTS systems, have closed most of the perceptible gap, replicating pitch, tone, and emotional cadence with enough fidelity that caller ID and simple authentication have become operationally insufficient.

Detection gets framed as binary classification: bona fide versus spoof. Two metrics dominate the literature. Equal Error Rate (EER) is the point where false acceptance and false rejection equalize; lower is better. Minimum Detection Cost Function (minDCF) weights the miss-versus-false-alarm trade-off according to application costs; lower is also better. Those two numbers are the entire vocabulary of benchmark comparison in this field.

The central tension shaping every architectural decision is generalization: a detector trained on known synthesis methods performs well against those methods and badly against novel ones. This is not a flaw in any specific implementation; it is the shape of the problem itself. Research and industry surveys indicate that organizations are increasingly pushing detection to the infrastructure layer rather than the perimeter, precisely because traditional identity verification cannot keep pace with current synthesis quality (Gartner, 2024; ASVspoof 5 overview paper, 2024).

Spectral Feature Methods: What LFCC, MFCC, and CQCC Can and Cannot Do

Three spectral representations anchor classical detection: Linear Frequency Cepstral Coefficients (LFCC), Mel Frequency Cepstral Coefficients (MFCC), and Constant Q Cepstral Coefficients (CQCC). These predate the deep learning era and remain relevant, though not in the way their original designers intended.

MFCC and LFCC have demonstrated effectiveness at identifying differences between bona fide and spoofed audio, particularly in RVC-style voice conversion scenarios, where generated samples approach genuine recordings closely enough to constitute a hard target. Their strengths are real: computationally lightweight, interpretable, and with failure modes that are thoroughly documented rather than mysterious.

These features are hand-crafted to capture known artifact patterns. When a novel synthesis algorithm does not produce those specific spectral signatures, the features have nothing to grab. They catalog past attacks. New attack surfaces walk straight past them.

No serious detection system in 2024 or 2025 deploys these methods alone. They appear as front-end components inside ensemble and fusion architectures, contributing one signal among several, and that is exactly where they belong.

End-to-End Deep Learning Architectures: RawNet2, AASIST, and How They Became the Field's Baseline

RawNet2 and AASIST are the standard entry points. If you are building an audio anti-spoofing system and have not benchmarked against both, you are not yet participating in the conversation.

AASIST, introduced at ICASSP 2022, is worth understanding structurally. The full name, Audio Anti-Spoofing using Integrated Spectro-Temporal Graph Attention Networks, is accurate if unwieldy. The graph attention mechanism matters because spoof artifacts are not localized: they manifest across time and frequency simultaneously rather than sitting in one bin or one time window. Purely spectral or purely temporal methods cannot capture cross-dimensional relationships; graph-based modeling can.

The canonical ASVspoof 5 baseline pairs a Wav2Vec 2.0 feature extractor with an AASIST classifier. That combination appears as the reference system in most 2024 and 2025 challenge papers, which is as clear a signal as the field ever gives about where consensus has landed.

Every end-to-end system trained on a fixed attack distribution shares the same limitation: poor generalization to synthesis methods outside that distribution. This is not a critique of AASIST specifically; it is a description of the structural problem that motivates everything in the sections below.

Self-Supervised Learning Front-Ends and Why WavLM Leads the Accuracy Rankings

Benchmarking across ten pretrained representations, including self-supervised models, speaker embedding models, and learnable front-ends, consistently finds that self-supervised learning models outperform everything else. WavLM leads the comparison (Tak et al., 2022; Wang et al., 2024).

SSL models learn speech representations from large unlabeled corpora, which means they capture a richer and more generalized acoustic space than models trained exclusively on labeled spoof and bona fide examples. When a novel synthesis method appears, an SSL front-end has more representational surface area to find what is wrong with it.

Concrete numbers: a late-fusion ensemble of four SSL-based models achieved an EER of 6.56% on one ASVspoof 5 evaluation set and 17.08% on the harder conditions set (ASVspoof 5 system description papers, 2024). That 17% figure is not a success story; it is a measurement of how much headroom the harder conditions create. Frozen Wav2Vec 2.0 yields an EER of 7.66% on ASVspoof 5. Training a learnable SSL front-end from scratch gives 21.67%. Frozen pre-training wins decisively in low-data regimes, which describes most real-world deployments.

On In-The-Wild benchmarks, SSL-AASIST systems reach a balanced accuracy of 0.810 and an EER of 8.42% (Yi et al., 2022). Across millions of daily voice interactions, an 8% error rate is a consequential operational number. The cost problem compounds the challenge: fully fine-tuning large SSL models is expensive. Parameter-efficient approaches like Low-Rank Adaptation with Mixture-of-Experts routing (MoLEx) reduce that burden without sacrificing accuracy, and they are a necessary direction for any system expected to run at infrastructure scale.

Emerging Architectures: Audio LLMs, Siamese CNNs, and Uncertainty-Aware Networks

The frontier architectures share a common logic: they are solving specific failure modes that baseline systems handle poorly, not replacing baseline systems outright.

Audio Large Language Models in zero-shot settings perform poorly at fake-versus-real discrimination. Asking a model to hold a moving decision boundary without any task-specific supervision is an unreasonable expectation. The ALLM4ADD framework addresses this by reformulating detection as audio question answering and applying supervised fine-tuning, which produces meaningful improvement, particularly in data-scarce scenarios.

A 2025 extension applies frequency-time reinforcement learning to audio LLMs, generating interpretable anomaly maps across time and frequency domains during inference. The accuracy improvement matters, but the interpretability matters more: a system that can show where in the signal it found the anomaly is one whose decisions can actually be audited. Regulated deployment environments require that. Benchmark papers rarely mention it.

The Siamese CNN approach, incorporating StacLoss and self-attention, works by comparing original and modified audio through dual convolutional branches. Single-input classifiers miss subtle manipulations because they have no reference point; the dual-input design provides one, and the results reflect that.

DPTFAN, the Dual-Path Time-Frequency Attention Network, introduces uncertainty modeling via Pythagorean Hesitant Fuzzy Sets to characterize ambiguous fake features dynamically. That formalism targets a specific failure mode: existing methods degrading under environmental noise and signal compression. Both conditions are ubiquitous in real-world audio and essentially absent from clean benchmark recordings.

None of these architectures yet carry ASVspoof-scale benchmark validation. Their value lies in targeted robustness for conditions the standard benchmarks do not test.

How Adversarial Attacks Expose the Fragility of Current Detection Systems

GAN-based adversarial attacks can reduce detection accuracy on systems like Deep4SNet to nearly zero (Kawa et al., 2023). A classifier that performs respectably on clean benchmarks can be functionally destroyed by an attacker who knows its architecture and applies perturbations accordingly. This is not a hypothetical; it is a documented finding.

ASVspoof 5 baseline systems make the severity concrete. Under adversarial conditions, minDCF values reached 0.865 for one attack type, 0.994 for another, and 1.0 for the most challenging variant (ASVspoof 5 evaluation plan and results, 2024). A minDCF of 1.0 is complete system failure. These numbers come from the field's own primary benchmark.

The attack surface is also wider than most deployment models assume. Adversarial examples can be embedded directly into audio files before distribution, meaning voicemails, podcast clips, pre-recorded announcements, and archived audio are all potential vectors. Defenders cannot scope their threat model to real-time streams alone.

No published system is comprehensively robust against adversarial manipulation. EER and minDCF on clean benchmark conditions are best-case figures, reported from a distribution that real-world adversaries have no obligation to respect.

Continual Learning as a Response to Detectors That Go Stale

A detection model trained on 2022 synthesis methods is not a useful tool against synthesis methods released in 2025. The majority of published detection systems are trained and evaluated on a fixed snapshot and implicitly treated as though that snapshot is durable.

RAIS, the Rehearsal with Auxiliary-Informed Sampling framework developed by researchers from CSIRO, Federation University Australia, and RMIT University, was designed specifically to address this. Published in late 2025, it enables detection models to update incrementally as new deepfake methods emerge, without catastrophic forgetting of previously learned patterns. The core insight is architectural: incremental learning, rather than periodic retraining from scratch, is the only strategy that treats the threat as dynamic.

If training data is always behind the attack frontier, as it structurally must be given the pace of synthesis model development, then performance on historical datasets systematically overstates real-world detection capability. Continual learning frameworks attempt to close that lag but do not eliminate it. The synthesis ecosystem moves faster than any single training cycle can track, and publication abstracts rarely acknowledge that uncomfortable fact.

The ASVspoof Challenge Series as the Field's Shared Measuring Stick

ASVspoof is why this field has coherent benchmarks at all. The last four editions have driven the majority of published innovation in spoofing detection, and ASVspoof 5, the 2024 edition, is the current reference point.

The structure of ASVspoof 5 reflects where the field's actual problems are. Track 1 covers deepfake detection; Track 2 covers spoofing-robust automatic speaker verification. Each track runs open and closed conditions. Bona fide utterances come from the MLS English database; spoofed utterances are generated using distinct TTS and voice conversion attack algorithms, with optional adversarial perturbation layered on top. An auxiliary set drawn from an additional 30,000 speakers is available for training speaker encoders in the open condition, which gives well-resourced teams a structural advantage the leaderboard does not annotate.

The top-performing closed-condition system used an ensemble combining waveform augmentation, mel-spectrogram augmentation, and vocoder synthesis, achieving a minDCF of 0.2660 for deepfake detection and a min a-DCF of 0.3173 for spoofing-robust ASV (ASVspoof 5 results paper, 2024). Those numbers define the current state of the art under controlled conditions; what they do not define is anything about real-world performance.

The ADD challenge series complements ASVspoof by covering manipulation types the main challenge sidesteps: low-quality fake audio, partially fake audio, and game-style detection scenarios where the task is catching manipulation embedded within otherwise genuine recordings.

What ASVspoof measures well is relative model performance on a controlled distribution. It does not measure, and does not claim to measure, generalization to unseen synthesis methods or real-world acoustic environments. Most leaderboard discussions treat that distinction as a footnote. It is not.

Where Benchmark Performance Falls Apart on Real-World Audio

Deepfake-Eval-2024 is the most instructive data point in recent literature on this question. The benchmark comprises 45 hours of video, 56.5 hours of audio, and nearly 2,000 images sourced from 88 websites across 52 languages, collected from social media and detection-platform users during 2024 (Yan et al., 2024). By construction, it is a sample of what deepfake content in the wild actually looks like, which makes it categorically different from anything synthesized in a lab.

When state-of-the-art open-source models trained on prior benchmarks are evaluated on Deepfake-Eval-2024, audio model AUC drops 48% compared to earlier benchmark performance. Video drops 50%, images 45% (Yan et al., 2024). The entire detection field overfits to benchmark distributions.

Commercial models and models fine-tuned directly on Deepfake-Eval-2024 outperform off-the-shelf alternatives. Neither class reaches the accuracy of human deepfake forensic analysts. That finding is more interesting than most of the EER tables in the literature. It suggests the gap is not purely a data or architecture problem; something about how trained human analysts reason about audio artifacts is not yet captured by any feature extraction pipeline.

The diversity of the dataset is what does the exposing. Fifty-two languages, 88 source websites, acoustic conditions that lab-synthesized datasets cannot approximate. Most training sets are English-dominant and clean. That mismatch between training distribution and deployment distribution is the mechanism behind the performance collapse. EER and minDCF scores on ASVspoof rank competing systems against each other reasonably well; as predictors of what those systems will do against real-world traffic, they are unreliable.

The Dataset Gap: Why Training Coverage Determines Detection Ceiling

The most historically influential datasets in this field are English-language and lab-synthesized. Real-world audio involves codec compression, background noise, mixed acoustic environments, multiple languages, and synthesis methods that postdate the dataset's collection. The distance between those two descriptions is the distance between benchmark performance and deployment performance.

The field has recognized this, somewhat belatedly. Notable releases in 2024 and 2025 include DeepFakeVox-HQ, which provides hundreds of thousands of English samples at high quality; VoiceWukong, which covers English and Chinese; MADD, a multilingual dataset spanning TTS and voice conversion; and XMAD-Bench, covering multilingual TTS and vocoder synthesis. The scale and linguistic scope of these releases reflect a belated consensus that monolingual English benchmarks are no longer sufficient.

A practitioner building a detection pipeline needs training coverage that matches the synthesis methods and languages present in their specific deployment environment. No single dataset currently covers all major synthesis methods, languages, and acoustic conditions simultaneously. Ensemble data strategies, combining multiple datasets to approximate the real distribution, are the current best practice, which is another way of saying the current best practice is still a workaround.

ElevenLabs, which operates multilingual synthesis at scale, treats language coverage as a first-class requirement. The detection side of the field needs to operate with the same assumption: the deployment environment is not English, and it is not a lab.

What Deploying Detection at the Infrastructure Level Actually Requires

Deploying audio deepfake detection as an infrastructure component rather than a research artifact means confronting several constraints simultaneously. Most published systems are designed with one or two of them in mind.

The architectural stack at deployment typically involves acoustic signal processing at ingestion, an SSL-based feature extraction front-end, a classifier, and a decision layer feeding into downstream authentication or flagging workflows. Each component introduces latency. In a live voice authentication context, latency is not an abstraction; it is the reason production engineers approach benchmark papers with a specific kind of skepticism that the benchmark papers have not yet earned their way past.

Computational cost is real and consistently underweighted in research framing. Fully fine-tuned large SSL models are expensive to run at production scale. Parameter-efficient approaches exist and matter, but they require engineering investment that benchmark papers almost never account for. The gap between a model achieving a strong EER in an offline evaluation and that same model running within acceptable latency bounds on production infrastructure is a gap no leaderboard illuminates.

Adversarial robustness must function as a design constraint, not an evaluation afterthought. Systems deployed in financial services, government communications, or enterprise authentication will face adversarial inputs from actors who know detection is present. A system validated only on clean benchmarks is, for those environments, essentially unvalidated.

Continual updating is operationally necessary. The synthesis landscape evolves faster than any static deployment can track. RAIS-style continual learning, or equivalent incremental update mechanisms, are not research curiosities; they are the difference between a system that degrades transparently and one that degrades silently while still returning confident outputs.

Multilingual coverage is not optional for most real-world deployments. The 52-language distribution in Deepfake-Eval-2024 is a closer approximation of global voice traffic than any English-only benchmark. A system that performs well in English and fails elsewhere is an English-language detection system, whatever its documentation claims.

EER numbers are lower than they were three years ago. Architectures are more sophisticated. Datasets are more representative. That is real progress. But a system trained on yesterday's attacks, validated on controlled benchmarks, and deployed against an adversarially evolving real-world distribution is not a solved problem. It requires constant maintenance, the unglamorous kind, and the literature has very little interest in that part.