# An Audio Copy-Move Forgery Localization Model by CNN-Based Spectral Analysis
## 3 Experiments
### Robustness Analysis  
In real-world forensic scenarios, to conceal traces of forgery, forgers often apply common signal processing attacks to the forged audio, aiming to reduce the statistical differences between the forged segments and the original audio. These post-processing attacks make it more difficult to perceive whether the audio has been forged and increase the difficulty of detection and localization.  
This study trained and tested the model using five types of post-processing attacks, including noise addition, filtering, upsampling, downsampling, and MP3 compression, with specific parameter settings as described in Section 3.1. Table 5 presents the detection results of the proposed model against these five types of post-processing attacks. From the experimental results, it can be observed that, among the post-processing attacks, resampling  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & **DFT-PCC** & **C4.5-Tree** & **HIS-MSE-ER** & **PS-PCC** & **Our Model** \\ \hline Accuracy & 92.2 & 93.5 & 91.9 & 89.7 & 96.5 \\ Precision & 91.6 & 92.9 & 92.2 & 98.8 & 97.2 \\ Recall & 92.7 & 94.8 & 91.7 & 90.9 & 95.1 \\ F1-score & 92.3 & 93.4 & 91.9 & 89.8 & 96.1 \\ \hline \hline \end{tabular}
\end{table}
Table 4: The detection results of different methods (%).  
Figure 8: Accuracy line chart of forged segments with different durations (%).  
and MP3 compression have minimal impact on the detection and localization performance of the proposed model, while noise addition has a certain degree of influence on both detection and localization performance.  
The Mel-spectrograms generated from the same forged audio segment after undergoing different post-processing attacks are shown in Figure 9. It can be observed from the figure that noise significantly interferes with the spectral features of the audio, manifested as a noticeable blurring of the Mel-spectrogram generated from the forged audio after noise addition. This blurring effect allows the forged segments to be better concealed.  
The average accuracy of different methods against the five types of post-processing attacks is compared in Figure 10.  
Figure 10: The accuracy bar chart of detecting post-processing attacks by different methods (%).  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & \begin{tabular}{c} **Noise** \\ **Addition** \\ \end{tabular} & **Filtering** & \begin{tabular}{c} **Up** \\ **Sampling** \\ \end{tabular} & \
\begin{tabular}{c} **Down** \\ **Sampling** \\ \end{tabular} &
\begin{tabular}{c} **MP3** \\ **Compression** \\ \end{tabular} \\ \hline Accuracy & 92.1 & 95.5 & 97.3 & 96.8 & 96.2 \\ Precision & 91.8 & 95.2 & 97.2 & 94.9 & 97.4 \\ Recall & 92.6 & 94.2 & 95.1 & 94.3 & 93.5 \\ F1-score & 92.2 & 93.5 & 96.1 & 94.4 & 95.5 \\ \hline \hline \end{tabular}
\end{table}
Table 5: The detection results of different methods for for forged audio subjected to post-processing attacks (%).  
Figure 9: The Mel-spectrograms generated from forged audio subjected to various post-processing attacks.  
According to Figure 10, In the face of various post-processing attacks, the detection performance of the localization model consistently outperforms existing methods, with an average accuracy of 96%. Compared to DFT-PCC [6], C4.5-Tree [7], HIS-MSE-ER [9], and PS-PCC [11], it shows an improvement of over 7.0%. These experimental results demonstrate that the localization model exhibits better robustness than some existing methods, enabling it to better withstand common signal processing attacks.