Forensic Attribution of Cloned Voices to Source Models

Forensic attribution of cloned voices asks which model produced a recording. The strongest evidence comes from the acoustic traces that generators leave behind, especially vocoder artifacts. But finding a trace is only the start. Accountability depends on showing that it persists across speech content, survives forensic conditions, and identifies a source.

Why attribution is harder than detection, and why that gap matters

Detection separates natural speech from synthetic speech. Attribution must distinguish generators whose outputs may all pass convincingly as human.

Kaur’s ICFACT 2025 work looks at the forensic challenge of detecting AI-generated voices and shows how current tools fall short of what legal proceedings demand. In forensic, legal, and enterprise settings, an authenticity judgment cannot stand in for a defensible account of where audio came from. The two questions belong in the same investigation, but they are not interchangeable.

Why human listeners cannot substitute for machine attribution

A voice-cloning study undermined the “just listen carefully” approach: human perception failed as a front-line check, even though acoustic measurements exposed differences between cloned and natural voices. The clones were mathematically more rigid than they sounded. Their coefficient of variation across cepstral and formant features was consistently about half that of natural speakers, revealing a regularity that listeners missed.

Trained examiners achieved high accuracy through spectrogram-based visual analysis, yet disagreements between examiners raised inter-rater reliability concerns. Reliable attribution must therefore be machine-led, with its conclusions grounded in measurable acoustic structure.

What vocoder fingerprints are and why vocoders leave them

Neural vocoders leave passive acoustic fingerprints through the process of synthesizing speech. These traces arise intrinsically in the recording. They require no cooperation from the generating system. Characteristic spectral shaping and reconstruction artifacts can remain across different speech content, making the fingerprint a property of how the audio was made.

The vocoder’s contribution can be strong enough to mask the fingerprint of the acoustic model upstream in a pipeline text-to-speech system. That creates both an opportunity and a limit. A recognizable vocoder trace may support attribution at that layer without revealing every component responsible for the finished recording.

Residual analysis approaches this problem by looking for what remains after the speech contribution is accounted for. Conceptually, the speech estimate is subtracted from the recorded signal so that the leftover structure can be examined for synthesis artifacts. The exact subtraction procedure determines what that residual contains, so a leftover is not automatically a fingerprint. Univaso and San Segundo’s Frontiers in AI 2025 study explains why MFCC-based methods are insufficient as a universal anti-spoofing tool. Those features describe the vocal tract’s spectral envelope but miss the generator-specific synthesis artifacts that are needed for generalization.

The perceptible/imperceptible divide and what it means for attribution stability

Passive fingerprints do not all offer the same stability. Perceptible features, including emotional expression, are shaped by training objectives and can change with model updates. Imperceptible traces are not explicitly optimized away by those objectives and can persist across content and emotional variation.

Li, Sun, Benetos, Sisman, and Schuller’s 2026 Perceptible-Imperceptible Passive-fingerprint Diagnostic Protocol, or PIPDP, separates these layers experimentally. The researchers, affiliated with Imperial College London, Queen Mary University of London, Johns Hopkins University, and Technical University of Munich, studied ten speech generators and three attribution detectors. Perceptually transparent perturbations reduced attribution accuracy by up to 48.2% on HiggsAudioV3. By contrast, emotion-driven changes to perceptible fingerprints produced negligible accuracy variation on CosyVoice2. The contrast locates important attribution evidence below the level of audible expression.

It also exposes a qualification that cannot be wished away. Persistence across ordinary speech variation does not mean resistance to targeted interference. The experiment showed that inaudible cues could be both detected and suppressed without an apparent loss of audio quality. The design implication is to target imperceptible synthesis artifacts rather than emotional or prosodic features, while testing their resistance separately. PIPDP makes that distinction explicit where earlier work had neither separated the fingerprint types nor established persistence and content-independence.

Active watermarks as a parallel attribution track and their relationship to passive fingerprinting

Active watermarks take a different route to origin. A generating system deliberately embeds a mark that can later be tested, while a passive fingerprint exists whether the system wants it there or not. One is an issued credential, the other an involuntary trace. Their usefulness depends on different assumptions.

Google’s SynthID Audio, deployed across Gemini voice cloning, is designed to be imperceptible and to survive noise, MP3 compression, and speed changes. Google also launched SynthID Detector as a public verification portal for images, video, and audio. The voice-cloning workflow also uses C2PA credentials to add a provenance record that links the audio to the system that made it.

That route still depends on participation by the generator. A malicious actor using an unwatermarked model is outside the watermark system’s reach, regardless of how well the mark survives compression. Passive fingerprinting can cover systems that do not voluntarily add a mark. The approaches are complementary in coverage, but complementary does not automatically mean safe to combine during training.

How watermark-shortcut learning undermines detection built on marked audio

A detector trained on watermarked audio can learn the wrong lesson. Instead of learning synthesis artifacts, it may learn that a watermark predicts a particular class. Training can seem to succeed even though it relies on evidence that unwatermarked generators do not leave.

A corpus with a lot of marked audio may reward this shortcut, leaving the detector less able to handle a system that never embedded a mark. Watermark verification and fingerprint attribution therefore cannot be treated as independent successes merely because they appear as separate components. Their training data can entangle them.

Passive evidence has weaknesses of its own. Univaso and San Segundo document vulnerability to babble noise and signal saturation, which can suppress the subtle spectral artifacts used by fingerprint detectors. Xuanjun Chen et al.’s Interspeech 2025 work addresses source tracing for codec-based deepfakes because codec-based language models produce artifacts that earlier vocoder-fingerprint systems were not trained to recognize. Missing marks, damaged traces, and unfamiliar architectures each cause systems to fail in a different way. Solving one does not solve the others.

The closed-world generalization problem and what it takes to move beyond it

Most attribution models in use today work within a closed world. They identify vocoders represented during training but do not generalize to new ones without costly retraining. Their competence is bounded by the candidate set.

Univaso and San Segundo describe the continuing development of cloning algorithms as a reason reliable detection remains unresolved. Jin et al.’s RVCBench, published in 2026, broadens evaluation across modern audio generation models. It covers input sensitivity, generation stability, output resilience, perturbation robustness, and deepfake detectability. That wider view helps expose weaknesses that a single detection score can conceal, though benchmarking robustness is not itself open-world attribution.

ASVspoof 5 shows a related change in the field’s methods. Top performers have shifted toward self-supervised frontends, including WavLM- and wav2vec-2.0-based systems, to learn more generalizable representations than hand-engineered acoustic features. Fake-Mamba exemplifies the broader trend with an XLS-R frontend and a PN-BiMamba backend. Identifying a generator never seen during training is still largely unsolved, and better anti-spoofing results do not prove that source attribution can now do this.

What a forensically reliable attribution pipeline looks like in practice

Provenance and watermark checks run first, followed by a synthesis-artifact detector. Each output contributes evidence to an ensemble. A watermark result answers a question about deliberate marking, while the artifact detector examines the generating process, so neither should silently substitute for the other.

Kaur describes how forensic laboratories now use acoustic and spectrographic analysis and how those methods fall short of more efficient machine-learning approaches. Verma and Kumari’s SSRN 2026 study demonstrates the value of examining speech at several levels. Their framework moves from human perception, which is unreliable, through visual morphological analysis, which is accurate but depends on the examiner, to machine classification using MFCC and LPC features. The classifier achieved AUC 0.996 under speaker-level cross-validation. That result supports consistent, examiner-independent classification within the study.

The distinction also resolves an apparent contradiction about MFCCs. Features can help a classifier distinguish natural from cloned speech in a defined experiment without functioning as universal source fingerprints. A forensic pipeline should preserve that scope rather than promote a strong detection result into a stronger attribution claim. PIPDP points toward residual-energy and reproducibility analyses focused on imperceptible traces. These analyses test a different layer from emotionally or prosodically variable speech features.

At the platform level, API access, structured audio provenance, and transparent export pipelines are useful design criteria for attribution accountability. They support a system in which origin evidence has a defined place. The acoustic layer still has to withstand the conditions and attacks under which its conclusions will be used.

Where forensic attribution still falls short and what the field needs next

Closed-world attribution has made progress, but the unknown-generator problem remains a fundamental limit. As new architectures come out quickly, especially codec-LM systems, it gets harder to defend the assumption that the candidate set will stay fixed. An attribution tool cannot claim broader coverage merely because the available generators have changed. Its evidence must support the scope of its conclusion.

Adversarial suppression needs its own research even when the generator is familiar. PIPDP shows that audio can still sound as good even when the evidence used for attribution has been weakened. Univaso and San Segundo also identify the need for forensic systems that tolerate noise, channel mismatch, and signal clipping. Those conditions alter the signal from which the conclusion must be drawn.

Courtroom use adds the unresolved task of standardizing that conclusion. Inter-rater gaps in morphological analysis and spectrogram sensitivity to recording-channel artifacts complicate the presentation of high-accuracy results as unambiguous evidence. The research agenda therefore needs open-world attribution methods and adversarially robust detectors aimed at the imperceptible layer. It also needs forensic-condition benchmarks that go beyond LJSpeech and JSUT, together with evidentiary standards that courts can apply consistently. Those standards must make the boundary between a reproducible source trace and an unsupported source claim explicit.