Title: SLIM: Style-Linguistics Mismatch Model for Generalized Audio Deepfake Detection
Venue: NeurIPS 2024
Accepted: yes
Keywords: Deepfake detection

anti-spoofing

synthesized speech

generalization

explainability

self-supervised learning
Abstract: Audio deepfake detection (ADD) is crucial to combat the misuse of speech synthesized by generative AI models. Existing ADD models suffer from generalization issues to unseen attacks, with a large performance discrepancy between in-domain and out-of-domain data. Moreover, the black-box nature of existing models limits their use in real-world scenarios, where explanations are required for model decisions. To alleviate these issues, we introduce a new ADD model that explicitly uses the Style-LInguistics Mismatch (SLIM) in fake speech to separate them from real speech. SLIM first employs self-supervised pretraining on only real samples to learn the style-linguistics dependency in the real class. The learned features are then used in complement with standard pretrained acoustic features (e.g., Wav2vec) to learn a classifier on the real and fake classes. When the feature encoders are frozen, SLIM outperforms benchmark methods on out-of-domain datasets while achieving competitive results on in-domain data. The features learned by SLIM allow us to quantify the (mis)match between style and linguistic content in a sample, hence facilitating an explanation of the model decision.

SLIM: Style-Linguistics Mismatch Model for Generalized Audio Deepfake Detection

Abstract

Audio deepfake detection (ADD) is crucial to combat the misuse of speech synthesized by generative AI models. Existing ADD models suffer from generalization issues to unseen attacks, with a large performance discrepancy between in-domain and out-of-domain data. Moreover, the black-box nature of existing models limits their use in real-world scenarios, where explanations are required for model decisions. To alleviate these issues, we introduce a new ADD model that explicitly uses the S tyleLI nguistics M ismatch (SLIM) in fake speech to separate them from real speech. SLIM first employs self-supervised pretraining on only real samples to learn the style-linguistics dependency in the real class. The learned features are then used in complement with standard pretrained acoustic features (e.g., Wav2vec) to learn a classifier on the real and fake classes. When the feature encoders are frozen, SLIM outperforms benchmark methods on out-of-domain datasets while achieving competitive results on in-domain data. The features learned by SLIM allow us to quantify the (mis)match between style and linguistic content in a sample, hence facilitating an explanation of the model decision.

1 Introduction

The growing interest in generative models has led to an expansion of publicly available tools that can closely mimic the voice of a real person [73]. Text-to-speech (TTS) or voice conversion (VC) systems can now be used to synthesize a fake voice from only a few seconds of real speech recordings [72]. When these generation tools are used by bad actors, the generated fake human voices (hereinafter referred to as audio deepfakes ) can pose serious dangers. Examples include impersonation of celebrities/family members for robocalls [29], illegal access to voice-guarded bank accounts [14], or forgery of evidence in court [56]. Reliable audio deepfake detection (ADD) tools are therefore urgently needed.

State-of-the-art (SOTA) detection systems [81, 93] employ self-supervised learning (SSL) encoders as the frontend feature extractors, and append classification backends to map the high-dimensional feature representations to a binary real/fake decision [35, 93, 81]. Common SSL encoders for this task are the Wav2vec [7], WavLM [11], and HuBert [25], among others. These models are usually trained in a fully-supervised manner, with fake samples generated using off-the-shelf TTS/VC tools [34, 93, 12, 81, 52, 92, 28]. However, current ADD systems are known to underperform on deepfakes crafted by unseen generative models (i.e., unseen attacks ) [40, 51, 67, 93]. To tackle this issue, some works have focused on extracting more robust features from the input representation [26, 71, 92]. Additional improvements have been reported by finetuning the SSL frontend during downstream supervised training [71, 81, 44] and by increasing the diversity of labeled samples via data augmentation or continual training on vocoded data [70, 87, 82, 83]. While shown to be effective for in-domain deepfakes, frontend finetuning increases the cost of training drastically.

Additionally, outputs from existing ADD systems are hard to explain, i.e., it is unclear to a typical user why an ADD makes a certain prediction, which leads to lack of trust [93, 34]. For practical applications, it is crucial to understand what information the model is relying on to make decisions, and under which circumstances the model would fail to successfully detect deepfakes. A group of works uses explainable AI (xAI) methods [4] to interpret model decisions [21, 32, 36], but they mainly rely on post-hoc visualizations such as saliency maps, which are known to be sensitive to training set-ups [90] and can therefore be inconsistent. Other models focus on specific vocal attributes, such as breath [33], or vocal tract [10] to derive explanations. However, most of these interpretable attributes only account for a subset of deepfake-related characteristics, hence resulting in a large gap in detection performance compared to SOTA methods [93, 34]. We note that while 'interpretability/explainability' is often ambiguous [39], in this work we mean the model's ability to provide reasons for a certain prediction, e.g., a sample is likely fake because its style and linguistics representations are more misaligned than those of real samples (as will be shown in Section 4.2).

In this study, we propose a generalizable ADD model that explicitly explores the style-linguistics mismatch in deepfakes to separate them from real audios, and thereby facilitates an explanation on the model decision. We hypothesize that in real speech, a certain dependency exists between the linguistics information embedded in the verbal content and the style information embedded in the vocal attributes, such as speaker identity and emotion. To synthesize a deepfake audio, both TTS and VC systems artificially combine the verbal content with the vocal attributes of a target speaker, and thereby introduce an artificial style-linguistics dependency that would differ from the real speech. Our two-stage framework explicitly studies the Style-LInguistics Mismatch (SLIM) in the fake class to separate it from the real class. During Stage 1, the style-linguistics dependency in the real class is learned by contrasting the style and linguistic subspace representations and generating a set of dependency features from each subspace. The learned pairs of style and linguistics features are expected to be more correlated for real speech than for deepfake speech. In Stage 2, we employ supervised training, where we fuse the learned dependency features from Stage 1 with the original style and linguistic representations and train a light-weight projection head to classify the input representations as real or fake.

Our main contributions are summarized as follows:

We propose SLIM model, which leverages Style and LInguistics Mismatch in deepfakes to achieve better generalization to unseen attacks than existing models, and has interpretation capability.

SLIM outperforms existing SOTA methods on out-of-domain datasets ( In-the-wild , MLAAD ) while being competitive on in-domain datasets ( ASVspoof2019 , 2021 ). This is achieved without increasing the amount of labeled data or the added cost from end-to-end finetuning.

Unlike black-box ADD models, the style-linguistics features learned by SLIM can be used to interpret model decisions. We present analyses to show how the interpretation can be performed on a group level as well as on individual speech samples.

2 Related works

2.1 Audio deepfake detection

State-of-the-art ADD systems mainly rely on fully-supervised training, where the model architectures comprise of one or more speech SSL frontends and a backend classifier [93, 2, 45]. Guo et al. [23] developed a multi-fusion attentive classifier to process the output from a WavLM frontend; Yang et al. [92] fused outputs from multiple SSL frontends and reported improvements over using a single frontend. However, existing ADD systems experience severe degradation in performance when tested on unseen data [51, 67], which questions their applicability and trustworthiness for real-world scenarios. To address this issue, multiple works have explored methods to improve model generalizability. With added training cost, improvements have been reported when frontends are finetuned alongside the backend classifiers during downstream training [71, 81]. Further improvements were achieved with data augmentations such as RawBoost [70, 71] and neural vocoding [82]. More recent works also show that distilled student models can generalize better than large teacher models [43, 83]. Still, large discrepancies between in-domain and out-of-domain performance are common [93, 34].

In addition to generalization, existing ADD models also fall short on interpretability. Several studies have shown that current SOTA models may be focusing on artifacts introduced in the frequency

domain during voice synthesis and/or the artifacts in non-speech segments [67, 50, 40, 96]. While a line of work proposed to extract speech-related features, such as breath [33], vocal tract, and articulatory movement [10], the overall detection performance was inferior to SSL-based methods. Other works resort to xAI methods [4] for model interpretation, such as SHAP [21], GradCAM [32], and Deep Taylor [36]. However, these post-hoc analysis approaches are known to be sensitive to training set-ups [90] and therefore not viable for practical use. Both generalization and interpretability remain challenging issues for current ADD systems.

2.2 Style-linguistics modelling

One standard approach for modelling speech is to decompose it into two subspaces, style and linguistics. The former refers to short and long-term paralinguistic attributes, such as speaker identity, emotion, accent, and health state [65]. The latter corresponds to the verbal content of speech [31]. For representing style information, early works relied on handcrafted features, such as GeMAPS [19, 18]. Later studies showed improved performance by representations learned end-toend by deep neural networks (DNN), such as the x-vector [68] and ECAPA-TDNN embeddings [16]. Similarly, the linguistic representations follow a similar trend where DNN-based embeddings, such as Whisper [60], outperform handcrafted features for content-related tasks [17]. More recent studies have shown that style and linguistics information can be efficiently encoded together in the SSL representations [7, 11, 25]. To investigate how speech information is encoded in DNNs, a group of works conducted layer-wise analysis and showed that early to middle layers carry more style related attributes, such as speaker identity [5], emotion [63], and articulatory movement [13]; while later layers encode linguistics attributes, such as phonetic information and semantics [55, 66].

Despite these approaches, it is unclear if completely disentangling style and linguistics information in speech is possible. Studies have shown that a certain dependency exists between these two subspaces: the link between emotional states and word choices [38], the relation between prosody and language understanding [15], and the impact of age on sentence coherence [58]. Effectively modeling both the independent and dependent aspects of style and linguistics in speech still remains a challenge.

3 Method

3.1 Motivation

For the majority of generative speech models, the style and linguistic subspaces are assumed to be independent of each other [73, 27, 78, 48]. For example, VC systems change the voice of an utterance by replacing the source speaker's embeddings with those of the target speaker [48, 78], assuming that these embeddings contain no linguistics information. Similarly, modern TTS systems rely on independently learned representations to model different speech aspects (e.g., text, speaker, emotion) to synthesize expressive speech [8, 16, 77]. Because of this disentanglement assumption, a mismatch likely exists between the style and linguistics information in TTS/VC speech that differentiates it from real speech. To study this hypothesis, we conduct a proof-of-concept experiment on a sample subset of ASVSpoof2019 [75]. Following previous research [61, 30, 54], we use canonical correlation analysis (CCA) to derive a subspace where the linear projections of the style and linguistics embeddings are maximally correlated for the real class. We choose the last layer output of pretrained wav2vec2-large-xlsr-53-english [22] for linguistics representation, and the pretrained ECAPA-TDNN embeddings [16] for style representation.

We randomly select 100 real speech samples from ASVspoof2019 [75] training set to fit 20-dim CCA features for both linguistics and style representations. We then apply the CCA projection to

200 audios from 5 unseen speakers and 6 TTS/VC systems, and compute the correlation values between these projected style and linguistics vectors to quantify the subpace similarities. Details of the tested TTS/VC systems can be found in Appendix A.1. Table 1 shows these results: A higher r is seen for the real samples, whereas significantly lower correlations are observed for both TTS and VC generated samples. Moreover, TTS-samples on average show lower r (0.228) than VC-samples (0.236), indicating that VC-samples are closer to real speech in terms of style-linguistics dependency. This could explain why VC samples were found to be more challenging to detect than TTS samples in the ASVspoof2019 challenge [40]. While our findings demonstrate the usefulness of CCA for validating the subspace mismatch, its limitations, such as that it only explores the linear composites of the variables [85], might make it sub-optimal to be used independently for deepfake detection. We therefore develop a detection framework that explicitly studies the style-linguistic mismatch and scales to larger amount of data.

3.2 Formulation of SLIM

Our two-stage Style-LInguistics Mismatch (SLIM) learning framework is outlined in Figure 1. The first stage operates on the real class only and employs self-supervised learning to build style and linguistic representations and their dependencies for real speech. In the second stage, a classifier is fit onto the learned representations via supervised training over deepfake datasets with binary (real/fake) labels.

Stage-1

Multi-source

Pretrained style

Compress

bonafide samples

encoder

Stage-1

cross

objective

Pretrained linguistic

Freeze

Compress

encoder

Finetune

Llinguistics

Stage-2

Pretrained style

ASP

encoder

+MLP

Labelled deepfake &

bonafide samples

Compress

Head

0

Compress

LBCE

1/0

Pretrained linguistic

ASP

Stage-2

encoder

+MLP

objective

3.2.1 Stage 1: One-class self-supervised contrastive training

The goal of the first stage is to learn pairs of dependency features from style and linguistics subspaces, which are expected to be highly correlated for real samples and minimally correlated for deepfakes. Since only real samples are needed, we incorporate other open-source speech datasets to diversify the style variations. Given a speech sample, we first extract the style and linguistics representations separately using pretrained networks. Since recent SSL models achieve superior performance on

multiple speech downstream tasks compared to conventional speech representations (e.g., ECAPATDNN) [7, 11, 25, 91, 57] we select a group of SSL models finetuned for paralinguistics and linguistics tasks as candidate encoders [20, 79, 57, 84, 6]. In addition, it has been shown that early to middle model layers carry paralinguistics information, while later layers encode linguistics content [54, 5, 37, 66]; we conducted thorough analyses to examine the cross-correlation between pretrained SSL model layers (Appendix A.2) and chose layer 0-10's output from Wav2vec-XLSR finetuned for speech emotion recognition to represent style, and layer 14-21's output from Wav2vec-XLSR finetuned for automatic speech recognition, to represent linguistics information.

Both style ( X S ) and linguistics ( X L ) embeddings are three-dimensional tensors ∈ R K × F × T where K denotes the transformer layer index, F denotes the feature size, and T denotes the number of time steps. These subspace embeddings are sent into compression modules C ( · ) , which average the transformer layer outputs and reduce the feature size from 1024 to 256 (more details in Appendix A.4). We refer to the output from the compression modules as dependency features: S f,t = C ( X S ) for style and L f,t = C ( X L ) for linguistics, and their temporally averaged versions are denoted ¯ S f and ¯ L f . These dependency features are learned by minimizing the self-contrastive loss L con , defined as:

L cross denotes the cross-subspace loss; L intra is the intra-subspace loss, defined in terms of L style and L linguistics (Figure 1); λ ∈ [0 , 1] is a hyperparameter that weighs the two loss terms, T is the number of time steps; and ∥ ( . ) ∥ 2 F is the Frobenius norm. The L cross term reduces distance between the compressed style and linguistic embeddings, while the L intra term reduces redundancy within the (temporally averaged) style and linguistic features by pushing off-diagonal elements to zero. The learned dependency features from Stage 1 can be used to quantify whether a mismatch exists between the style and linguistics of an audio. We further demonstrate this in Section 4.2.

3.2.2 Stage 2: Supervised training

The second stage of SLIM follows a standard supervised training scheme, where the dependency features and subspace representations are concatenated and fed into a classification head to predict a binary real/fake outcome. As shown in Figure 1, the subspace SSL encoders and compression modules are obtained from Stage 1 and are all frozen during Stage 2. Since the dependency features are specifically designed to capture the style-linguistics mismatch alone, we complement them with the original embeddings in order to capture other artifacts that can help separate real samples from the fake class. The original embedding's dimensions are reduced from 1024 to 256 through an attentive statistics pooling (ASP) layer and a multi-layer perceptron (MLP) network. The projected subspace embeddings when concatenated with dependency features result in 1024-dim vectors. The classification head consists of two fully-connected layers and a dropout layer. Binary cross-entropy loss is used to jointly train the ASP and MLP modules alongside the classification head.

4 Experiments

Based on the preliminary results from Section 3.1, we systematically assess the in-domain and cross-domain detection performance of SLIM using multiple datasets, and demonstrate how such framework would benefit the interpretation of model decisions.

4.1 Experimental set-up

Stage 1 training. Unlike benchmark models which are trained end-to-end in a supervised manner, our model relies on two-stage training where each stage requires different training data to avoid information leakage. Since only real samples are needed in Stage 1, we take advantage of open-source speech datasets by aggregating subsets from the Common Voice [3] and RAVDESS [41] as training data and use a small portion of real samples from the ASVspoof2019 LA train for validation. Both Common Voice and RAVDESS cover a variety of speaker traits. The former is a crowdsourced dataset collected online from numerous speakers with uncontrolled acoustic environments, while the latter is

an emotional speech corpus with large variations in prosodic patterns. Such data variety enables our model to learn a wider range of style-linguistics combinations.

Stage 2 training and evaluation. For a fair comparison with existing works, we adopt the standard train-test partition, where only the ASVspoof2019 logical access (LA) training and development sets are used for training and validation. For evaluation, we use the test split from ASVspoof2019 LA [75] and ASVspoof2021 DF [40]. ASVspoof2019 LA and ASVspoof2021 DF have been used as standard datasets for evaluating deepfake detection models, where real speech recordings originate from the VCTK and VCC datasets [89, 42, 94] and the spoofed ones are generated with a variety of TTS and VC systems. Compared to ASVspoof2019 LA , ASVspoof2021 DF contains more than 100 different types of generated speech in the evaluation set with a variety of different compression codecs. This provides a more challenging setting for testing generalization to unseen attacks and robustness to compression. In addition, we assess our model's generalizability on two more recent datasets: In-the-wild [51], and the English subset from MLAAD v3 [53]. In-the-wild consists of on audio clips collected from English-speaking celebrities and politicians, featuring more realistic and spontaneous speech samples. The English subset of MLAAD (hereinafter referred to as MLAAD-EN ) is a recent dataset with spoofed samples generated using state-of-the-art open-source TTS and VC systems (more details in Appendix A.3).

Metrics. Equal error rate (EER) is a standard metric for evaluating deepfake detection systems [75, 40]. It refers to the point in the detection error tradeoff curve where the false acceptance rate equals the false rejection rate; lower EER suggests better performance. We also report F1-beta scores ( β =1) to account for the class imbalance; higher F1 scores suggest better performance.

Benchmarks. We consider several SOTA models to benchmark against and broadly categorize them as follows, based on the training cost: (i) methods which freeze feature extraction frontends and finetune only the backend classifiers, and (ii) methods which finetune frontends together with the classifiers during supervised training. As benchmarks representing the former case, we consider Wav2vec-XLSR+LLGF (W2V-LLGF) [87], Wav2vec-XLSR+LCNN (W2V-LCNN) [87], six different models that share a similar backend classifier as SLIM (W2V/WLM/HUB-ASP), a model that fuses different SSL representations (SSL-fusion) [92], as well as three methods that do not rely on large SSL encoders, namely, LCNN [12], RawNet2 [69], and PS3DT [88]. For the end-to-end fine-tuning benchmarks, we consider the model in [44] with a backend classifier similar to SLIM's (W2V-ASP-ft), and the model in [70] with RawBoost augmentation and AASIST backend (W2VAASIST). Using frozen frontends, five variants of SLIM are considered, where the input at Stage 2 is: (i) only the style embedding, (ii) only the linguistics embedding, (iii) the combination of style and linguistics embeddings, (iv) only the style-linguistics dependency features, and (v) the fusion of style and linguistic embeddings and their dependency features. We emphasize that the original SLIM framework does not involve any finetuning of frontends, since the finetuning may change the disentanglement of style and linguistics embeddings and thus hamper model explainability. However, to compare with finetuned benchmarks, we include a variant of SLIM that finetunes all modules during Stage 2, noting that this would compromise the feature interpretation.

Implementation details. We implement our models using the SpeechBrain toolkit [62] v1.0.0. The hyperparameters used for Stage 1 and Stage 2 training are provided in Appendix A.7. When setting up our customized benchmark models, we followed consistent training recipes where only the model architectures were changed and the same data augmentation method was used. Each round of evaluation was repeated three times with different random seeds, and the mean values are reported. Unlike some previous works which limit the duration of test speech, we only applied amplitude normalization during evaluation and kept the full duration of all samples.

4.2 Experiment results

Detection performance. Table 2 summarizes the detection performance of all models and compares the number of trainable parameters. We discuss the models with frozen frontend here, and compare the models with finetuned frontend in Section. 4.3. ASVspoof2019 eval set contains 19 types of attacks, out of which 6 are seen during training. This makes it the simplest of the four test datasets. We see that a majority of the models achieve near-perfect performance, with several including SLIM reporting EER below 1%. As expected, degradation is seen when models are tested

on ASVspoof2021 , where the majority of attacks are unseen. Both W2V-LCNN and SLIM are top-performers, with no significant difference between the two. With the out-of-domain datasets ( In-the-wild and MLAAD-EN ), more severe degradation is observed, where the majority report EERs over 20%. SLIM, however, outperforms the others with EER of 12.9% and 13.5% on In-the-wild and MLAAD-EN , respectively. It should be noted that although ASVspoof2021 is often used as a standard dataset to evaluate model generalizability to unseen attacks [40], part of the real samples in ASVspoof2021 originate from the same dataset (the VCTK corpus [89]) as the ASVspoof2019 training data [75, 12, 69, 87, 81]. As a result, the real samples from ASVspoof2019 and ASVspoof2021 share a similar distribution, whereas the In-the-wild and MLAAD-EN samples share nearly no overlap with ASVspoof (further discussion in Appendix A.3). Generalization to In-the-wild and MLAAD-EN is therefore more challenging than to ASVspoof2021 . The large gains reported by SLIM demonstrates how the style-linguistics mismatch helps with generalization to unseen data.

In Table 2, we also demonstrate the benefits of introducing Stage 1 by considering features from SLIM variants as inputs to Stage 2: dependency features, the style and linguistics embeddings (Enc sty and Enc ling ), as well as their combination. The architecture of the classification head is kept the same, except for the number of neurons in the input layer. The dependency features outperform the rest on the two out-of-domain datasets, while the subspace embeddings perform better on ASVspoof2021 . Simply concatenating the style and linguistics embeddings does not yield significant improvements when compared to benchmark models. This suggests that the style-linguistics dependency may not be fully captured by supervised training methods without explicit guidance.

Style-linguistics mismatch of deepfakes. Figure 2 shows the distribution of cosine distances between the style and linguistics dependency features for the real and fake classes; larger distances indicate a higher mismatch. Since the distance values approximately follow a Gaussian distribution with unequal variances, we further conduct a Welch's t-test [1] to examine the statistical significance

of the difference between real and fake samples. For all three datasets, the average cosine distance is found to be significantly lower for real speech than for deepfake samples ( p < 1e -5 ). This further corroborates our hypothesis that a higher style-linguistics mismatch exists for fakes. On the other hand, the distance distributions of real and fake samples still share a large overlap, indicating that dependency features alone are not sufficient for perfectly discriminating between the two classes.

0

Class

Bonafide

Deepfake

Cosine distance

2

-3

一

4

一

5

9-

ASVspoof2021DF eval

In-the-wild

MLAAD-EN

Dataset

Analysis of style-linguistics dependency features. Table 2 demonstrates that style-linguistics dependency features can provide better generalizability than the subspace embeddings (Table 2 SLIM variants, rows 1-4). To examine these results, we first aggregate ASVspoof2021 , In-the-wild , and MLAAD-EN , and project the dependency features as well as the concatenated subspace embeddings to a 2-dim space using t-SNE for visualization (Figure 3). Since we use frozen frontends, the embeddings input to Stage 2 training are not affected by backpropagation. Ideal embeddings would exhibit maximal separation between the real and fake classes, while showing minimal shift within each class for different dataset distributions. In Figure 3, we see that the dependency features show larger discrimination between real and fakes (3(c) and 3(d)) than the concatenated subspace embeddings (3(a) and 3(b)), and also a smaller shift between datasets: fake and real samples from the same dataset (color) clusters have less overlap in distribution in the plots.

(a)

(b)

(c)

(d)

50

50

50

50

25

25

25

25

0

0

0

0

-25

-25

-25

-25

-50

-50

-50

-50

-50

0

50

-50

0

50

-50

0

50

-50

0

50

Interpretation of model decisions. Next, we perform a qualitative evaluation of the model decisions. Figure 4 shows the mel-spectrograms of four samples selected from In-the-wild . These four demonstrate typical acoustic characteristics that represent a larger group of recordings: (1) top-left is a fake sample with audible artifacts at high-frequency region; (2) top-right is a fake sample with unnaturally long pauses heard before and after the phrase 'but not'; (3) bottom left is a real sample

with an atypical speech style where the word pronunciations are elongated; (4) bottom right is a real speech recorded in a noisy condition. We find that among the top-performing systems shown in Table 2, only SLIM classified all four samples correctly (both frozen and fine-tuned versions; with all features), while others mostly failed on (2) and (4). Findings here suggest that SLIM provides guidance when abnormalities in style and linguistics occur. Such guidance can be complemented via post-hoc analysis tools such as human evaluations or saliency maps [4] for further interpretation.

Additionally, we note that the decisions made by dependency features and the original subspace representations are complementary to each other. Samples in the right column are correctly identified as fake by the dependency features but missed by the original subspace representations, and vice versa (left column missed by dependency features). These results corroborate with the nature of the two feature types. The dependency features are learned by modelling the general style-linguistics relationship seen in real speech, therefore samples with mismatched style-linguistics pattern are likely to be flagged as 'not real.' The original style and linguistics embeddings, on the other hand, are sensitive to signal artifacts, which could be the deepfake imperfections generated during speech synthesis [67], or the amount of background noise and device artifacts. By combining the two features, SLIM captures a variety of abnormalities and achieves improved classification.

High-frequencyartifacts

Abnormalrhythm

Theestablishmentprotecteditself

butnot

thecitizensofourcountry.

0

Q

FAKE

Pause

Pause

50

50

0

50

100

150

200

250

300

0

20

40

60

80

100

120

140

-60

-40

-20

0

20

-60

-40

-20

0

20

Atypicalstylepatterns:elongatedwords

Noisy condition

REAL

0

0

50

50

0

20

40

60

80

0

10

20

30

40

50

-40

-20

0

20

-60

-40

-20

0

20

4.3 Ablation studies

Effects of finetuning SSL frontend. From Table 2, we see that the frontend finetuning helps to further decrease the EER for SLIM. The finetuned version of SLIM performs better than the rest on In-the-wild and MLAAD-EN , while providing comparable performance on ASVspoof2019 and ASVspoof2021 . However, it should be noted that the interpretation of style-linguistics mismatch becomes difficult after finetuning, since the two subspace representations may no longer be maximally disentangled.

Effects of classification backend. In Stage 2, subspace representations are sent into ASP+MLP layers, which output 256-dim embeddings to fuse with the dependency features. Previous works have shown that different backend architectures may lead to a significant difference in the detection performance [81]. With the input fixed (dependency features and subspace embeddings), we find that removing the ASP and MLP layers degrades EER across the four datasets (Table 4, Appendix A.6), while using the LCNN [87] or LLGF [81] backends improves EER on ASVspoof2019 and ASVspoof2021 , but not on In-the-wild and MLAAD-EN .

Misclassifications made by SLIM. Westudied the misclassifications made by SLIM through a combination of qualitative analysis methods, such as listening tests, visualizations of mel-spectrograms, noise-level estimation, and prediction of number of speakers. In general, we found that shorter and low-quality samples, e.g., those with estimated Mean Opinion Score (MOS) lower than 2 (using NISQA [47]), as well as recordings with multiple speakers were more likely to be misclassified. While the former is a general challenge faced by all detection methods, the latter can be explained by

the design of SLIM, where the pretraining stage does not involve any multi-speaker samples. In a multi-speaker scenario (e.g., conversational speech), speech patterns from more than one speaker could lead to higher misalignment between linguistic content and speaker attributes, resulting in false alarms.

5 Limitations

Since our framework explicitly focuses on style-linguistics mismatch, it is possible that real speech samples with atypical style-linguistics dependency (e.g., dysarthric speech [59] or children speech) may be misclassified. With the rapidly growing number of speech datasets, one countermeasure is to conduct self-supervised pretraining on datasets with more diverse speech styles (e.g., [95]). Also, while we focused on English samples due to the scarcity of multilingual deepfake datasets at the time of writing, the proposed framework can be scaled to more languages with recent deepfake datasets, such as MLAAD-v4. Finally, although SLIM can benefit from frontend finetuning and more advanced backends, doing so would affect the feature interpretation and will require modifications to the training approach. We plan to explore these directions in the future.

6 Conclusion

We present SLIM, a new audio deepfake detection framework that explicitly models the stylelinguistics mismatch in speech to detect deepfakes. Without requiring a large amount of labeled data or the added cost of end-to-end finetuning on pretrained encoders, SLIM outperforms existing benchmarks on out-of-domain datasets, while being competitive on in-domain datasets. The learned style-linguistics dependency features are complementary to the individual pretrained style and linguistics subspace representations, and facilitate result interpretation by guiding our attention to where style-linguistics misalignment occurs, which can be further analyzed by a variety of qualitative studies.

References

Nor Aishah Ahad and Sharipah Soaad Syed Yahaya. Sensitivity analysis of welch'st-test. In AIP Conference proceedings , volume 1605, pages 888-893. American Institute of Physics, 2014.

Zaynab Almutairi and Hebah Elgibreen. A review of modern audio deepfake detection methods: Challenges and future directions. Algorithms , 15(5):155, 2022.

Rosana Ardila, Megan Branson, Kelly Davis, Michael Kohler, Josh Meyer, Michael Henretty, Reuben Morais, Lindsay Saunders, Francis Tyers, and Gregor Weber. Common voice: A massively-multilingual speech corpus. In Proceedings of the Twelfth Language Resources and Evaluation Conference , pages 4218-4222, 2020.

Alejandro Barredo Arrieta, Natalia Díaz-Rodríguez, Javier Del Ser, Adrien Bennetot, Siham Tabik, Alberto Barbado, Salvador García, Sergio Gil-López, Daniel Molina, Richard Benjamins, et al. Explainable artificial intelligence (xai): Concepts, taxonomies, opportunities and challenges toward responsible ai. Information fusion , 58:82-115, 2020.

Takanori Ashihara, Marc Delcroix, Takafumi Moriya, Kohei Matsuura, Taichi Asami, and Yusuke Ijima. What do self-supervised speech and speaker models learn? new findings from a cross model layer-wise analysis. arXiv preprint arXiv:2401.17632 , 2024.

Arun Babu, Changhan Wang, Andros Tjandra, Kushal Lakhotia, Qiantong Xu, Naman Goyal, Kritika Singh, Patrick von Platen, Yatharth Saraf, Juan Pino, et al. Xls-r: Self-supervised cross-lingual speech representation learning at scale. arXiv preprint arXiv:2111.09296 , 2021.

Alexei Baevski, Yuhao Zhou, Abdelrahman Mohamed, and Michael Auli. wav2vec 2.0: A framework for self-supervised learning of speech representations. Advances in neural information processing systems , 33: 12449-12460, 2020.

Alexei Baevski, Wei-Ning Hsu, Qiantong Xu, Arun Babu, Jiatao Gu, and Michael Auli. Data2vec: A general framework for self-supervised learning in speech, vision and language. In International Conference on Machine Learning , pages 1298-1312. PMLR, 2022.

Susan Baldwin. Compute canada: advancing computational research. In Journal of Physics: Conference Series , volume 341, page 012001. IOP Publishing, 2012.

Logan Blue, Kevin Warren, Hadi Abdullah, Cassidy Gibson, Luis Vargas, Jessica O'Dell, Kevin Butler, and Patrick Traynor. Who are you (i really wanna know)? detecting audio { DeepFakes } through vocal tract reconstruction. In 31st USENIX Security Symposium (USENIX Security 22) , pages 2691-2708, 2022.

Sanyuan Chen, Chengyi Wang, Zhengyang Chen, Yu Wu, Shujie Liu, Zhuo Chen, Jinyu Li, Naoyuki Kanda, Takuya Yoshioka, Xiong Xiao, et al. Wavlm: Large-scale self-supervised pre-training for full stack speech processing. IEEE Journal of Selected Topics in Signal Processing , 16(6):1505-1518, 2022.

Akash Chintha, Bao Thai, Saniat Javid Sohrawardi, Kartavya Bhatt, Andrea Hickerson, Matthew Wright, and Raymond Ptucha. Recurrent convolutional structures for audio spoof and video deepfake detection. IEEE Journal of Selected Topics in Signal Processing , 14(5):1024-1037, 2020.

Cheol Jun Cho, Peter Wu, Abdelrahman Mohamed, and Gopala K Anumanchipalli. Evidence of vocal tract articulation in self-supervised learning of speech. In ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 1-5. IEEE, 2023.

Joseph Cox. How i broke into a bank account with an ai-generated voice. https://www.vice.com/en/ article/dy7axa/how-i-broke-into-a-bank-account-with-an-ai-generated-voice , 2023. Accessed: 2024-04-30.

Anne Cutler, Delphine Dahan, and Wilma Van Donselaar. Prosody in the comprehension of spoken language: A literature review. Language and speech , 40(2):141-201, 1997.

Brecht Desplanques, Jenthe Thienpondt, and Kris Demuynck. Ecapa-tdnn: Emphasized channel attention, propagation and aggregation in tdnn based speaker verification. arXiv preprint arXiv:2005.07143 , 2020.

Amandeep Singh Dhanjal and Williamjeet Singh. A comprehensive survey on automatic speech recognition using neural networks. Multimedia Tools and Applications , 83(8):23367-23412, 2024.

Florian Eyben, Martin Wöllmer, and Björn Schuller. Opensmile: the munich versatile and fast open-source audio feature extractor. In Proceedings of the 18th ACM international conference on Multimedia , pages 1459-1462, 2010.

Florian Eyben, Klaus R Scherer, Björn W Schuller, Johan Sundberg, Elisabeth André, Carlos Busso, Laurence Y Devillers, Julien Epps, Petri Laukka, Shrikanth S Narayanan, et al. The geneva minimalistic acoustic parameter set (gemaps) for voice research and affective computing. IEEE transactions on affective computing , 7(2):190-202, 2015.

Zhiyun Fan, Meng Li, Shiyu Zhou, and Bo Xu. Exploring wav2vec 2.0 on speaker verification and language identification. Interspeech 2021 , 2021.

Wanying Ge, Jose Patino, Massimiliano Todisco, and Nicholas Evans. Explaining deep learning models for spoofing and deepfake detection with shapley additive explanations. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 6387-6391. IEEE, 2022.

Jonatas Grosman. Fine-tuned XLSR-53 large model for speech recognition in English. https:// huggingface.co/jonatasgrosman/wav2vec2-large-xlsr-53-english , 2021.

Yinlin Guo, Haofan Huang, Xi Chen, He Zhao, and Yuehai Wang. Audio deepfake detection with self-supervised wavlm and multi-fusion attentive classifier. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 12702-12706. IEEE, 2024.

Chin-Cheng Hsu, Hsin-Te Hwang, Yi-Chiao Wu, Yu Tsao, and Hsin-Min Wang. Voice conversion from non-parallel corpora using variational auto-encoder. In 2016 Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA) , pages 1-6. IEEE, 2016.

Wei-Ning Hsu, Benjamin Bolte, Yao-Hung Hubert Tsai, Kushal Lakhotia, Ruslan Salakhutdinov, and Abdelrahman Mohamed. Hubert: Self-supervised speech representation learning by masked prediction of hidden units. IEEE/ACM Transactions on Audio, Speech, and Language Processing , 29:3451-3460, 2021.

Jee-weon Jung, Hee-Soo Heo, Hemlata Tak, Hye-jin Shim, Joon Son Chung, Bong-Jin Lee, Ha-Jin Yu, and Nicholas Evans. Aasist: Audio anti-spoofing using integrated spectro-temporal graph attention networks. In ICASSP 2022-2022 IEEE international conference on acoustics, speech and signal processing (ICASSP) , pages 6367-6371. IEEE, 2022.

Navdeep Kaur and Parminder Singh. Conventional and contemporary approaches used in text to speech synthesis: A review. Artificial Intelligence Review , 56(7):5837-5880, 2023.

Awais Khan, Khalid Mahmood Malik, and Shah Nawaz. Frame-to-utterance convergence: A spectratemporal approach for unified spoofing detection. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 10761-10765. IEEE, 2024.

Kate Knibbs. Researchers say the deepfake biden robocall was likely made with tools from ai startup elevenlabs. https://www.wired.com/story/biden-robocall-deepfake-elevenlabs/ , 2024. Accessed: 2024-04-30.

Simon Kornblith, Mohammad Norouzi, Honglak Lee, and Geoffrey Hinton. Similarity of neural network representations revisited. In International conference on machine learning , pages 3519-3529. PMLR, 2019.

William A Kretzschmar. The linguistics of speech . Cambridge University Press, 2009.

Il-Youp Kwak, Sungsu Kwag, Junhee Lee, Youngbae Jeon, Jeonghwan Hwang, Hyo-Jung Choi, Jong-Hoon Yang, So-Yul Han, Jun Ho Huh, Choong-Hoon Lee, et al. Voice spoofing detection through residual network, max feature map, and depthwise separable convolution. IEEE Access , 2023.

Seth Layton, Thiago De Andrade, Daniel Olszewski, Kevin Warren, Carrie Gates, Kevin Butler, and Patrick Traynor. Every breath you don't take: Deepfake speech detection using breath. arXiv preprint arXiv:2404.15143 , 2024.

Menglu Li, Yasaman Ahmadiadli, and Xiao-Ping Zhang. Audio anti-spoofing detection: A survey. arXiv preprint arXiv:2404.13914 , 2024.

Yuang Li, Min Zhang, Mengxin Ren, Miaomiao Ma, Daimeng Wei, and Hao Yang. Cross-domain audio deepfake detection: Dataset and analysis. arXiv preprint arXiv:2404.04904 , 2024.

Suk-Young Lim, Dong-Kyu Chae, and Sang-Chul Lee. Detecting deepfake voice using explainable deep learning techniques. Applied Sciences , 12(8):3926, 2022.

Guan-Ting Lin, Chi-Luen Feng, Wei-Ping Huang, Yuan Tseng, Tzu-Han Lin, Chen-An Li, Hung-yi Lee, and Nigel G Ward. On the utility of self-supervised models for prosody-related tasks. In 2022 IEEE Spoken Language Technology Workshop (SLT) , pages 1104-1111. IEEE, 2023.

Kristen A Lindquist, Jennifer K MacCormack, and Holly Shablack. The role of language in emotion: Predictions from psychological constructionism. Frontiers in psychology , 6:121301, 2015.

Zachary C. Lipton. The mythos of model interpretability: In machine learning, the concept of interpretability is both important and slippery. Queue , 16(3):31-57, jun 2018. ISSN 1542-7730. doi: 10.1145/3236386.3241340. URL https://doi.org/10.1145/3236386.3241340 .

Xuechen Liu, Xin Wang, Md Sahidullah, Jose Patino, Héctor Delgado, Tomi Kinnunen, Massimiliano Todisco, Junichi Yamagishi, Nicholas Evans, Andreas Nautsch, et al. Asvspoof 2021: Towards spoofed and deepfake speech detection in the wild. IEEE/ACM Transactions on Audio, Speech, and Language Processing , 2023.

Steven R Livingstone and Frank A Russo. The ryerson audio-visual database of emotional speech and song (ravdess): A dynamic, multimodal set of facial and vocal expressions in north american english. PloS one , 13(5):e0196391, 2018.

Jaime Lorenzo-Trueba, Junichi Yamagishi, Tomoki Toda, Daisuke Saito, Fernando Villavicencio, Tomi Kinnunen, and Zhenhua Ling. The voice conversion challenge 2018: Promoting development of parallel and nonparallel methods. In The Speaker and Language Recognition Workshop , pages 195-202. ISCA, 2018.

Jingze Lu, Yuxiang Zhang, Wenchao Wang, Zengqiang Shang, and Pengyuan Zhang. One-class knowledge distillation for spoofing speech detection. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 11251-11255. IEEE, 2024.

Juan M. Martín-Doñas and Aitor Álvarez. The vicomtech audio deepfake detection system based on wav2vec2 for the 2022 add challenge. In ICASSP 2022 - 2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 9241-9245, 2022. doi: 10.1109/ICASSP43922.2022. 9747768.

Momina Masood, Mariam Nawaz, Khalid Mahmood Malik, Ali Javed, Aun Irtaza, and Hafiz Malik. Deepfakes generation and detection: State-of-the-art, open challenges, countermeasures, and way forward. Applied intelligence , 53(4):3974-4026, 2023.

Driss Matrouf, J-F Bonastre, and Corinne Fredouille. Effect of speech transformation on impostor acceptance. In 2006 IEEE international conference on acoustics speech and signal processing proceedings , volume 1, pages I-I. IEEE, 2006.

Gabriel Mittag, Babak Naderi, Assmaa Chehadi, and Sebastian Moller. Nisqa: A deep cnn-self-attention model for multidimensional speech quality prediction with crowdsourced datasets. Interspeech 2021 , 2021.

Seyed Hamidreza Mohammadi and Alexander Kain. An overview of voice conversion systems. Speech Communication , 88:65-82, 2017.

Masanori Morise, Fumiya Yokomori, and Kenji Ozawa. World: a vocoder-based high-quality speech synthesis system for real-time applications. IEICE TRANSACTIONS on Information and Systems , 99(7): 1877-1884, 2016.

Nicolas Müller, Franziska Dieckmann, Pavel Czempin, Roman Canals, Konstantin Böttinger, and Jennifer Williams. Speech is silver, silence is golden: What do asvspoof-trained models really learn? 2021 Edition of the Automatic Speaker Verification and Spoofing Countermeasures Challenge , 2021.

Nicolas Müller, Pavel Czempin, Franziska Diekmann, Adam Froghyar, and Konstantin Böttinger. Does audio deepfake detection generalize? Interspeech 2022 , 2022.

Nicolas M Müller, Philip Sperl, and Konstantin Böttinger. Complex-valued neural networks for voice anti-spoofing. arXiv preprint arXiv:2308.11800 , 2023.

Nicolas M Müller, Piotr Kawa, Wei Herng Choong, Edresson Casanova, Eren Gölge, Thorsten Müller, Piotr Syga, Philip Sperl, and Konstantin Böttinger. Mlaad: The multi-language audio anti-spoofing dataset. arXiv preprint arXiv:2401.09512 , 2024.

Ankita Pasad, Ju-Chieh Chou, and Karen Livescu. Layer-wise analysis of a self-supervised speech representation model. In 2021 IEEE Automatic Speech Recognition and Understanding Workshop (ASRU) , pages 914-921. IEEE, 2021.

Ankita Pasad, Bowen Shi, and Karen Livescu. Comparative layer-wise analysis of self-supervised speech models. In ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 1-5. IEEE, 2023.

Terry Pender. Ai threatens courts with fake evidence, uw prof says. https://www.jdsupra.com/ legalnews/ai-threatens-courts-with-fake-evidence-7371356/ , 2023. Accessed: 2024-0505.

Leonardo Pepino, Pablo Riera, and Luciana Ferrer. Emotion recognition from speech using wav2vec 2.0 embeddings. Interspeech 2021 , 2021.

Natalie Pereira, Ana Paula Bresolin Gonçalves, Mariana Goulart, Marina Amarante Tarrasconi, Renata Kochhann, and Rochele Paz Fonseca. Age-related differences in conversational discourse abilities a comparative study. Dementia & Neuropsychologia , 13:53-71, 2019.

Zhaopeng Qian, Kejing Xiao, and Chongchong Yu. A survey of technologies for automatic dysarthric speech recognition. EURASIP Journal on Audio, Speech, and Music Processing , 2023(1):48, 2023.

Alec Radford, Jong Wook Kim, Tao Xu, Greg Brockman, Christine McLeavey, and Ilya Sutskever. Robust speech recognition via large-scale weak supervision, 2022. URL https://arxiv.org/abs/ 2212.04356 .

Maithra Raghu, Justin Gilmer, Jason Yosinski, and Jascha Sohl-Dickstein. Svcca: Singular vector canonical correlation analysis for deep learning dynamics and interpretability. Advances in neural information processing systems , 30, 2017.

Mirco Ravanelli, Titouan Parcollet, Peter Plantinga, Aku Rouhe, Samuele Cornell, Loren Lugosch, Cem Subakan, Nauman Dawalatabad, Abdelwahab Heba, Jianyuan Zhong, et al. Speechbrain: A general-purpose speech toolkit. arXiv preprint arXiv:2106.04624 , 2021.

Alexandra Saliba, Yuanchao Li, Ramon Sanabria, and Catherine Lai. Layer-wise analysis of self-supervised acoustic word embeddings: A study on speech emotion recognition. arXiv preprint arXiv:2402.02617 , 2024.

Marc Schröder, Marcela Charfuelan, Sathish Pammi, and Ingmar Steiner. Open source voice creation toolkit for the mary tts platform. In 12th Annual Conference of the International Speech Communication Association-Interspeech 2011 , pages 3253-3256. ISCA, 2011.

Björn Schuller, Stefan Steidl, Anton Batliner, Felix Burkhardt, Laurence Devillers, Christian MüLler, and Shrikanth Narayanan. Paralinguistics in speech and language-state-of-the-art and the challenge. Computer Speech & Language , 27(1):4-39, 2013.

Jui Shah, Yaman Kumar Singla, Changyou Chen, and Rajiv Ratn Shah. What all do audio transformer models hear? probing acoustic representations for language delivery and its structure. arXiv preprint arXiv:2101.00387 , 2021.

Tsu-Hsien Shih, Chin-Yuan Yeh, and Ming-Syan Chen. Does audio deepfake detection rely on artifacts? In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 12446-12450. IEEE, 2024.

David Snyder, Daniel Garcia-Romero, Gregory Sell, Daniel Povey, and Sanjeev Khudanpur. X-vectors: Robust dnn embeddings for speaker recognition. In 2018 IEEE international conference on acoustics, speech and signal processing (ICASSP) , pages 5329-5333. IEEE, 2018.

Hemlata Tak, Jee-Weon Jung, Jose Patino, Madhu Kamble, Massimiliano Todisco, and Nicholas Evans. End-to-end spectro-temporal graph attention networks for speaker verification anti-spoofing and speech deepfake detection. In ASVSPOOF 2021, Automatic Speaker Verification and Spoofing Countermeasures Challenge , pages 1-8. ISCA, 2021.

Hemlata Tak, Madhu Kamble, Jose Patino, Massimiliano Todisco, and Nicholas Evans. Rawboost: A raw data boosting and augmentation method applied to automatic speaker verification anti-spoofing. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 6382-6386. IEEE, 2022.

Hemlata Tak, Massimiliano Todisco, Xin Wang, Jee-weon Jung, Junichi Yamagishi, and Nicholas Evans. Automatic speaker verification spoofing and deepfake detection using wav2vec 2.0 and data augmentation. In The Speaker and Language Recognition Workshop (Odyssey 2022) . ISCA, 2022.

Xu Tan. Neural text-to-speech synthesis . Springer Nature, 2023.

Xu Tan, Tao Qin, Frank Soong, and Tie-Yan Liu. A survey on neural speech synthesis. arXiv preprint arXiv:2106.15561 , 2021.

Naftali Tishby, Fernando C Pereira, and William Bialek. The information bottleneck method. arXiv preprint physics/0004057 , 2000.

Massimiliano Todisco, Xin Wang, Ville Vestman, Md Sahidullah, Héctor Delgado, Andreas Nautsch, Junichi Yamagishi, Nicholas Evans, Tomi Kinnunen, and Kong Aik Lee. Asvspoof 2019: Future horizons in spoofed and fake audio detection. arXiv preprint arXiv:1904.05441 , 2019.

Markus Toman and Michael Pucher. An open source speech synthesis frontend for hts. In Text, Speech, and Dialogue: 18th International Conference, TSD 2015, Pilsen, Czech Republic, September 14-17, 2015, Proceedings 18 , pages 291-298. Springer, 2015.

Andreas Triantafyllopoulos and Björn W Schuller. Expressivity and speech synthesis. arXiv preprint arXiv:2404.19363 , 2024.

Andreas Triantafyllopoulos, Björn W Schuller, Gökçe ˙ Iymen, Metin Sezgin, Xiangheng He, Zijiang Yang, Panagiotis Tzirakis, Shuo Liu, Silvan Mertes, Elisabeth André, et al. An overview of affective speech synthesis and conversion in the deep learning era. Proceedings of the IEEE , 2023.

Nik Vaessen and David A Van Leeuwen. Fine-tuning wav2vec2 for speaker recognition. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 7967-7971. IEEE, 2022.

Aaron Van Den Oord, Sander Dieleman, Heiga Zen, Karen Simonyan, Oriol Vinyals, Alex Graves, Nal Kalchbrenner, Andrew Senior, Koray Kavukcuoglu, et al. Wavenet: A generative model for raw audio. arXiv preprint arXiv:1609.03499 , 12, 2016.

Xin Wang and Junichi Yamagishi. Investigating self-supervised front ends for speech spoofing countermeasures. arXiv preprint arXiv:2111.07725 , 2021.

Xin Wang and Junichi Yamagishi. Spoofed training data for speech spoofing countermeasure can be efficiently created using neural vocoders. In ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 1-5. IEEE, 2023.

Xin Wang and Junichi Yamagishi. Can large-scale vocoded spoofed data improve speech spoofing countermeasure with a self-supervised front end? In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 10311-10315. IEEE, 2024.

Yingzhi Wang, Abdelmoumene Boumadane, and Abdelwahab Heba. A fine-tuned wav2vec 2.0/hubert benchmark for speech emotion recognition, speaker verification and spoken language understanding. arXiv preprint arXiv:2111.02735 , 2021.

David Weenink. Canonical correlation analysis. In Proceedings of the Institute of Phonetic Sciences of the University of Amsterdam , volume 25, pages 81-99. University of Amsterdam Amsterdam, 2003.

Zhizheng Wu, Oliver Watts, and Simon King. Merlin: An open source neural network speech synthesis system. In 9th ISCA Speech Synthesis Workshop , pages 202-207, 2016.

Yuankun Xie, Haonan Cheng, Yutian Wang, and Long Ye. Learning a self-supervised domain-invariant feature representation for generalized audio deepfake detection. In Proc. INTERSPEECH , volume 2023, pages 2808-2812, 2023.

Amit Kumar Singh Yadav, Ziyue Xiang, Kratika Bhagtani, Paolo Bestagini, Stefano Tubaro, and Edward J Delp. Ps3dt: Synthetic speech detection using patched spectrogram transformer. In 2023 International Conference on Machine Learning and Applications (ICMLA) , pages 496-503. IEEE, 2023.

Junichi Yamagishi, Christophe Veaux, and Kirsten MacDonald. CSTR VCTK Corpus: English Multispeaker Corpus for CSTR Voice Cloning Toolkit, 2019.

Masahiro Yanagawa and Junya Sato. Seeing is not always believing: Discrepancies in saliency maps. Radiology: Artificial Intelligence , 6(1):e230488, 2023.

Shu-wen Yang, Heng-Jui Chang, Zili Huang, Andy T Liu, Cheng-I Lai, Haibin Wu, Jiatong Shi, Xuankai Chang, Hsiang-Sheng Tsai, Wen-Chin Huang, et al. A large-scale evaluation of speech foundation models. IEEE/ACM Transactions on Audio, Speech, and Language Processing , 2024.

Yujie Yang, Haochen Qin, Hang Zhou, Chengcheng Wang, Tianyu Guo, Kai Han, and Yunhe Wang. A robust audio deepfake detection system via multi-view feature. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 13131-13135. IEEE, 2024.

Jiangyan Yi, Chenglong Wang, Jianhua Tao, Xiaohui Zhang, Chu Yuan Zhang, and Yan Zhao. Audio deepfake detection: A survey. arXiv preprint arXiv:2308.14970 , 2023.

Zhao Yi, Wen-Chin Huang, Xiaohai Tian, Junichi Yamagishi, Rohan Kumar Das, Tomi Kinnunen, ZhenHua Ling, and Tomoki Toda. Voice conversion challenge 2020-intra-lingual semi-parallel and crosslingual voice conversion-. In Joint Workshop for the Blizzard Challenge and Voice Conversion Challenge 2020 . ISCA, 2020.

Chang Zeng, Xin Wang, Xiaoxiao Miao, Erica Cooper, and Junichi Yamagishi. Improving generalization ability of countermeasures for new mismatch scenario by combining multiple advanced regularization terms. arXiv preprint arXiv:2305.10940 , 2023.

Yuxiang Zhang, Zhuo Li, Jingze Lu, Hua Hua, Wenchao Wang, and Pengyuan Zhang. The impact of silence on speech anti-spoofing. IEEE/ACM Transactions on Audio, Speech, and Language Processing , 2023.

A Appendix

A.1 Details of generative models tested in the CCA analysis

Details on the systems tested in Table. 1 are as follows. A01 is a TTS model that uses Flite [76] that converts text into a sequence of linguistic features. A Hidden Markov Model (HMM) is then used to estimate the duration of phones. The acoustic features are predicted by an NN-based acoustic model, including MFCCs, F0, and voicing flags, which are input to the WaveNet vocoder [80] for waveform synthesis. A02 and A03 follows a similar linguistic-acoustic-vocoder pipeline as A01, where A02 uses the WORLD vocoder [49] and A03 relies on recipes from the Merlin toolbox [86]. A04 is a waveform concatenation TTS model based on the MaryTTS platform [64], a major difference between A04 and the previous three models is that A04 preserves the short-term acoustic features of the natural speech, which may make it more difficult to separate from real speech. A05 and 06 are VC models. A05 encodes the spectral features into speaker-independent embeddings using a VAE and decode them with a desired target speaker representation [24]. A06 relies on the source-filter modelling of speech where the conversion can be achieved by replacing the filters of the input signals by that of the target speaker [46]. The non-speech segments are kept intact during conversion.

A.2 Layer-wise analysis of pretrained SSL models

As mentioned in Section. 3.2.1, we use the Wav2vec-XLSR model finetuned for emotion recognition (Wav2vec-SER) and speech recognition (Wav2vec-ASR) tasks to extract the style and linguistics representations, respectively.

The style representation is based on the pretrained model obtained from https://huggingface. co/ehcalabres/wav2vec2-lg-xlsr-en-speech-emotion-recognition and the linguistics representation is based on the pretrained model obtained from https://huggingface.co/ jonatasgrosman/wav2vec2-large-xlsr-53-english . To obtain a maximal disentanglement between the two subspace representations, we calculate Spearman's rank correlation coefficient values between different layers from the two models to examine the layer-wise similarity. These correlation values and our final layer selection are demonstrated in Figure 5. Based on existing works, which showed how linguistics and paralinguistics information propagate through layers, we choose layer 0-10 from Wav2vec-SER backbone to represent style information, and layer 14-21 from Wav2vec-ASR backbone to represent linguistics information. The correlation values between these two groups are shown close to 0, indicating a better disentanglement.

89028970

W2V-SER

1.0

0.8

0.6

W2V-ASR

0.4

0.2

802

JL

W2V-SER

W2V-ASR

A.3 Dataset details

Table 3 describes the details of datasets used for Stage 1 and Stage 2 training and evaluation. Figure 6 shows the projected WavLM embeddings for real and fake samples from the four employed datasets using t-SNE. We choose WavLM since it is the top-performing model in the single-encoder category (Table 2). For both classes, an overlap can be seen between ASVspoof2019 and ASVspoof2021 samples, while samples from In-the-wild and MLAAD-EN can be separated nearly perfectly. This corroborates with the results reported in Table 2 where all employed ADD systems trained on ASVspoof2019 perform better on ASVspoof2021 than In-the-wild and MLAAD-EN .

Stage 2 datasets

Real

Fake

In-the-wild

In-the-wild

ASVspoof2019

ASVspoof2021

*ASVspoof2019

MLAAD

MLAAD

ASVspoof2021

A.4 Details of the compression module

Figure 7 shows the architecture of the compression module. The input is first passed through a pooling layer to obtain an average of different SSL layer outputs. Since the goal of compression modules is to project the original style/linguistics embeddings to a subspace where the compressed embeddings can be maximally correlated, we use bottleneck layers to remove the redundant information that is not shared across the two subspaces. Similar to the design of an autoencoder [74], the bottleneck layer first compresses the feature dimension from 1024-dim to 256-dim, then recovers it back to 1024-dim. In practice, we found using only one bottleneck layer is enough to obtain meaningful compressed representations. A projection head is applied at the end to reduce the final output dimension to 256.

10

11

12

XF,T

{256,T}

MLP

Head

LeakyReLU

Dropout

{1024,T}

MLP

{256,T}

Dropout

Bottle

N*

LeakyReLU

neck

BatchNorm

{256,T}

MLP

{1024,T}

Pooling

↑

XK,F,T

{23,1024, T}

A.5 PyTorch implementation of the Stage 1 training objective

Algorithm 1 shows a PyTorch-style implementation of the Stage 1 training objective, which minimizes the cross-subspace distance loss and an intra-subspace redundancy loss. The subspace embeddings are first normalized across the whole batch before passing into the loss calculations. We experimented with two types of distance for the cross-subspace loss: Euclidean and Cosine distance. While no significant difference is found when comparing the performance achieved by the two, the former provides slightly better results, hence is adopted as the final distance measure.

Algorithm 1: PyTorch-style code for the Stage 1 loss function

Input: x style , x linguistic Output: L stage 1 // Normalize embeddings from both subspaces 1 batch_size = xstyle.shape[0] 2 xstyle_norm = torch.nn.BatchNorm1d(xstyle, affine=False) / batch_size 3 xlinguistic_norm = torch.nn.BatchNorm1d(xlinguistic, affine=False) / batch_size // Computation of cross-subspace loss 4 D = torch.linalg.norm(xstyle_norm - xlinguistic_norm, ord='fro') 5 D = torch.pow(D, 2) // Computation of intra-subspace redundancy loss 6 vlinguistic = torch.mm(xlinguistic_norm.T, xlinguistic_norm ) 7 Clinguistic = torch.linalg.norm(vlinguistic-torch.eye(vlinguistic.shape[-1])) 8 Clinguistic = torch.pow(Clinguistic, 2) 9 vstyle = torch.mm(xstyle_norm.T, xstyle_norm) Cstyle = torch.linalg.norm(vstyle-torch.eye(vstyle.shape[-1])) Cstyle = torch.pow(Cstyle, 2) // Final loss term Lstage1 = D + λ (Cstyle +Clinguistic )

A.6 Performance comparison of different backend classifiers

Table 4 shows the performance obtained when the ASP+MLP layers are swapped with other layer choices.

A.7 Hyperparameters and computation resources

Table 5 describes the optimal hyperparameters and architecture details of SLIM used for Stage 1 and Stage 2 training. The hyperparameter names of the data augmentation modules can be found in SpeechBrain v1.0.0 . Experiments were conducted on the Compute Canada cluster [9] with a total of four NVIDIA V100 GPUs (32GB RAM).

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: The contributions and scope of our study are listed at the end of Section 1, and summarized in the abstract. The experimental results in Section 4 support our claims.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: We discuss the limitations of our work in Section 5 and in parts of Section 4.3. In Section 2, we also present gaps in the literature and the resulting limitations.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory Assumptions and Proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: We take an experimental approach to validate our hypothesis on stylelinguistics mismatch in deepfake audios. Details on the motivation and the experiments are presented in Section 3.1. The training objectives of our framework are detailed in Section 3.2.1, Equations 1 and 2.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental Result Reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: Our proposed framework is described in detail in Section 3. We also provide details regarding model architecture and its implementation (Appendix A.4, A.5), pseudocode of the training objective (Appendix A.5), and hyperparameters used for obtaining the reported performance (Appendix A.7).

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility.

In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: All datasets employed in this study are publicly available (Appendix A.3). While the training script and model weights are not explicitly released, we provided sufficient details in Section 3 and Appendix A to faithfully reproduce and verify our results.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental Setting/Details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: The training and test procedures are detailed in Section 4.1. The data splits are provided in Appendix A.3. The hyperparameters are listed in Appendix A.7.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment Statistical Significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [Yes]

Justification: We conducted statistical significance tests for our experiments. The details can be found in Section 3.1 and Section 4.2.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments Compute Resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: The computational resources are described in Appendix A.7.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code Of Ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: Authors have reviewed and respect NeurIPS Code of Ethics.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader Impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [Yes]

Justification: As described in Section 1, our proposed framework is designed to detect deepfake audios, hence our work can be used for positive societal impacts. We have also presented limitations in Sections 4.3 and 6 to scope-limit the scenarios in which our framework can be used.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: The paper poses no such risks.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: The employed datasets, code, and model backbones are all properly cited (Sections 3, 4.1, 4.1). The URLs for obtaining pretrained models are also provided (Appendix A.2).

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New Assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [NA]

Justification: The paper does not introduce new assets.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and Research with Human Subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposed a new approach named Style-Linguistic Mismatch (SLIM) for generalizable audio deepfake detection. The authors claimed that a certain dependency between linguistic information and style information can generalize well for audio anti-spoofing tasks. Additionally, the proposed method can also explain the final decision of the deep learning model. In order to prove the claim, a proof-of-concept experiment was conducted to show that real audio has a higher correlation coefficient between linguistics and style in Table 1. Based on this, the authors proposed a two-stage learning framework. In the first stage, the dependency is captured by two compression modules based on SSL features. In the second stage, a simple projection head is trained on the combination of the extracted dependency with the SSL features. \n\nThe authors conducted sufficient experiments to demonstrate the generalization ability of the proposed method. Two in-domain evaluation datasets and two out-domain evaluation datasets were used for this point. Besides, the performance beats several SOTA baseline methods on these datasets, enhancing the reliability of this work. The authors also provided enough analysis and visualization to prove their hypothesis. \n\nOverall, it is a good paper for generalizable audio deepfake detection task.\n\nSTRENGTHS:\n1. Explicitly explored the dependency between style and linguistics for audio deepfake detection\n2. Pay attention to interpretable and generalizable audio deepfake detection simultaneously, which is novel to the community.\n3. Good performance was shown in the experiments, especially significantly improving the performance on the out-domain datasets, which is quite crucial for anti-spoofing tasks.\n\nWEAKNESSES:\n1. The first training stage adopts an idea from an abnormal detection task, in which only real audio (normal data) was used for training. However, the real normal data is of a much larger order of magnitude than that used in the experiment. These corner cases should be considered in the work.\n\nQUESTIONS:\nI am curious whether the author applied their method to other unseen attacking scenarios. For example, in [1], the author proposed a new unseen scenario, where some audio genres in the evaluation dataset are not presented in the training dataset. I think if the author can provide some results on this scenario, it would be more convincing for their proposed method.\n\n[1] Zeng, Chang, et al. \"Improving Generalization Ability of Countermeasures for New Mismatch Scenario by Combining Multiple Advanced Regularization Terms.\" arXiv preprint arXiv:2305.10940 (2023).\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-09"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper suggests a novel method for detecting synthesized speech. Namely, the framework introduced in the paper allows the detection of a statistically significant mismatch between the style (i. e. paralinguistic attributes) and linguistic characteristics of synthesized speech samples, which helps to differentiate them from the real speech samples. The framework is based on frozen pre-trained SSL encoders and relatively small learnable parts that make the experiments computationally feasible for a small cluster.\n\nThe authors compare their method with several baselines, and it outperforms SoTa model in a cross-domain setup.\n\nSTRENGTHS:\n- The idea of the proposed method is non-trivial and allows us to better understand the differences between real and synthesized speech.\n- The proposed method outperforms SoTa on out-of-domain data and is on par with SoTa on in-domain data.\n- The evaluation is good, and the method is compared with a number of very decent baselines.\n- The paper is well-written and easy to follow.\n\nWEAKNESSES:\n- The Analysis section is somewhat limited (especially the \"Interpretation of model decisions\" part). The authors claim that the success of their method is connected with very particular artifacts in synthesized speech; however, this point is weakly supported since only four small cherry-picked correctly classified examples were provided (see the \"Questions\" part).\n\nQUESTIONS:\nQuestions:\n\n- Is the confidence of your detector connected with the severity of the artifacts in the synthesized speech samples? Do the mel spectrograms of the most confidently correctly detected synthesized samples contain the most clearly visible artifacts?\n- Which types of TTS models are easier to detect, and which are harder to detect by your method?\n- You provided examples of correctly classified speech samples. What about incorrectly classified ones? Can you share an explanation or guess what are the peculiarities of these \"complicated\" samples that prevent them from being correctly classified by your method?\n- Do you plan to upload your code to Git Hub?\n\nSuggestions for the current paper:\n- I suggest adding the visual analysis of mel spectrograms of the **incorrectly** classified speech samples to the paper.\n\nSuggestions for future research:\n- Your current research makes a step forward toward more explainable synthesized speech detection. Another step in the same direction was made in Topological Data Analysis for Speech Processing by Tulchinskii et al. (2023). They have shown that synthetic and real speech samples can be separated using the barcodes of the attention maps of the HuBERT model. The sum of the bars in the barcode for real speech is bigger than the sum of bars in the barcode for the synthesized speech - at least on some attention heads of the HuBERT. It would be interesting to investigate in more detail, how the topological characteristics (i. e. barcodes or other characteristics) of the speech embeddings are connected with the linguistic and paralinguistic properties of the speech.\n\nLIMITATIONS:\nThe authors addressed the limitations adequately.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-12"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\n\"SLIM: Style-Linguistics Mismatch Model for Generalized Audio Deepfake Detection\" describes a motivation and systematic approach to  disentangling different components of speaking characteristics, in order to perform audio deepfake detection. This paper demonstrates a working 2-stage training pipeline, numerous ablations, and metrics over several English language focused datasets. In addition, qualitative demonstrations of the space of features learned and used by the model form a study which backs the philosophical approach of the paper with regard to disentangling stylistic characteristics of real speakers, in order to have a generalized defense against audio deepfakes.\n\nSTRENGTHS:\nThe overall approach taken here is useful, the problem is relevant, and the overall experiments cover a portion of the necessary ground to match the claims. \n\nQualitative studies both in the main body of the paper, and the appendix are generally interesting and it is worth considering if these experiments can be fit into the unified paper \"flow\" for this publication, especially given final conclusion writing. Overall ablation study and description of methods are well done, and form a high quality \"core\" to the paper. Architecture figures and ablation tables are both outstanding in terms of clearly communicating approach, and variations in the results. Use of open source toolkits, and sharing of hyperparameters should help reproducibility.\n\nWEAKNESSES:\nThe portion of the title \"... Generalized Audio Deepfake Detection\" claims a robust and general method for \"audio deepfake detection\". However, there are a broad range of prosodic styles from people with impaired speech, new learners of languages, children developing their ability to communicate and so on.\n\nFor a paper about generalized deepfake detection, where such detection keys particularly on the prosody of at least one example, I would like to see a larger study and example of voices in-the-wild, as opposed to the current examples which seem to be reasonably fluent speakers and performers, who may have \"trained\" speech patterns by and large. This is despite the use of the \"in-the-wild\" dataset, which doesn't seem truly wild in terms of robustness testing. Defense approaches should have some example study and discussion of False Positives beyond pure metrics (though the metrics discussions here are well done) - particularly when out-of-domain speaking patterns may have heavy overlap with \"deepfake\" data and the features used for classification, demonstrated as part of the paper. The examples in Figure 4. along with accompanied writing are a start down this road but not sufficient.\n\nMozilla Common Voice has a decent amount of this type of truly-in-the-wild speech for some qualitative study, and there are existing papers which use the same dataset for few-and-zero-shot TTS and voice conversion. The \"in-the-wild\" dataset here seems to largely focus on imitative TTS and voice conversion, and their \"real\" counterparts, which would generally point to celebrities, politicians and other public figures who (very likely) do not have the types of speech patterns mentioned previously. Though dysarthric speech is mentioned briefly in the limitations section, the issues which crop up from study of dysarthric speech are also found to some extent in many \"typical\" speakers as well, in more subtle ways so directly addressing this with some examples would strengthen the core claim of the paper in regards to \"generalized detection\".\n\nMLAAD is multilingual, but some details of the dataset construction lead to limitations in its testing (outside the scope of this paper, beyond the continued critique that broader datasets and synthetic generation methods are needed to test generalization). However, here only the EN subset appears to be used - which again reduces the claims from the title since it means the bulk of testing is on English locales. This is not a problem in terms of the experiments, but the writing and claims of the paper should be limited around this fact. Additionally, these are speech deepfakes not the broader category of \"audio\" per-se, so maybe some further adjustment is warranted, though other papers in this subarea tend to use \"audio deepfake\" to describe speech deepfakes.\n\nAs it stands, the examples shown do not convince me that the \"attacks\" used here are sufficiently high-quality to claim a generalized defense, though the developed method seems to perform well on the datasets used, and the overall scientific study (though limited) is well done.\n\nQUESTIONS:\nWhat are the systems tested in Table 1? Either by name, or citation? What is the source of the speakers? If these have PII, a description of the speakers broad categorizations is sufficient. If pulled from an existing dataset, speaker ids would be good. As it stands this table is largely uninformative, without any material information beyond a general design motivation for follow-on work (since CCA shows some behavior differences between methods).\n\nGiven the importance of both sample rate and noise in audio, it would be very useful to test this approach under those forms of degradation - e.g. does the method scale down to data of narrow bandwidth, at low samplerate or under the presence of additive noise / background sound (such as music, crowd noise, applause, and so on). The prosodic example may hold under reasonable conditions, but how many detections are relying on prosodic features versus simpler acoustic artifacts? Figure 2. hints at this to some extent, but some explicit description and study would be useful.\n\nGenerally the data examples shown are extremely noisy, and the synthesis methods are not particularly high quality. Testing on both clean audio, and higher quality synthesis, as well as under controlled degradations could raise my score. After all it is plausible an attacker may use telephony as a transmission channel - especially if the degradations imposed by the channel give the attacker a further advantage.\n\nAs a general direction - it may be useful to directly answer some of the questions posed by the titles of the citations in this paper e.g. \"Does audio deepfake detection generalize?\" - the claim here being \"yes\", but demonstrations being limited to existing datasets rather than further tests with recently developed technologies / APIs and so on. \"Does deepfake detection rely on artifacts?\" - the claim here is also (somewhat) \"yes\", which hurts the counterclaim of being generalized to some degree, unless these artifacts are general across a broad swath of methods, which would be a surprising finding given existing demonstrations.\n\nThe primary concern in order to raise my score would be a more proper scoping of the generalization claims, and the domain claims around this method given limitations of the testing datasets. The conclusion also discusses a fair bit about qualitative analyses which are largely relegated to the appendix, so there is further mismatch between the chosen title and the final claim.\n\nLarger and more diverse datasets (multi-lingual being one option, more unusual speaker styles would be another), or more particularly use of a variety of recent, high performing methods would raise my score if the writing is mostly unchanged. Some of these methods may only be available by API, which is unfortunate but perhaps necessary - additionally TortoiseTTS and spinoffs should have specific, stronger synthesis exemplars than those demonstrated, especially under the assumption an attacker may be doing manual selection given a corpus of intermediate generations to choose the best final result.\n\nLIMITATIONS:\nThe authors have addressed some limitations of their work, however this review is partly hinging on the gap between claims, and the effective limitations and demonstrated results. More writing on the limitations, and particularly potential harms of deploying unbalanced \"defense\" methods in terms of accessibility would be beneficial.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-18"}

comments: SUMMARY:
This paper proposes a new method for audio deepfake detection by first employing self-supervised pre-training on real samples only and then used to do real/fake classification. The proposed method achieves SOTA performance in both within-domain and cross-domain scenarios.

STRENGTHS:
1. The proposed technique is sound and reasonable. Learning the correlation between style and linguistics for detecting deepfakes makes sense to me.

2. The comprehensive ablation studies in Table 2 further verify the effectiveness of the proposed method.

3. The analysis (Interpretation of model decisions) and visualization (Mel-spectrograms) are reasonable.

WEAKNESSES:
1. The idea of capturing the mismatch between style and linguistics is promising, but it's unclear how this mismatch correlates with deepfake samples. More intuitive illustrations and examples are needed to better validate this motivation.

2. In Figure 2 (training framework for ADD), the source of supervision for style and linguistics is not apparent. How do you ensure that each encoder learns the corresponding features? Additionally, how do you achieve perfect disentanglement between the style and linguistics encoders?

3. It appears that the latest dataset used is ASVspoof2021, which is quite old. Why not incorporate more recent and advanced deepfake datasets for evaluation?

QUESTIONS:
See the Weaknesses part.

LIMITATIONS:
I did not see any obvious limitations for this work. It is a fairly good paper but not very impressive to me.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2024-07-25