What's the Real: A Novel Design Philosophy for Robust AI-Synthesized Voice Detection

Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-04-06 09:37:51

Abstract: Voice is one of the most widely used media for information transmission in human society. While high-quality synthetic voices are extensively utilized in various applications, they pose significant risks to content security and trust building. Numerous studies have concentrated on fake voice detection to mitigate these risks, with many claiming to achieve promising performance. However, recent research has demonstrated that existing fake voice detectors suffer from serious overfitting to speaker-irrelative features (SiFs) and cannot be used in real-world scenarios. In this paper, we analyze the limitations of existing fake voice detectors and propose a new design philosophy, guiding the detection model to prioritize learning human voice features rather than the difference between the human voice and the synthetic voice. Based on this philosophy, we propose a novel fake voice detection framework named SiFSafer, which uses pre-trained speech representation models to enhance the learning of feature distribution in human voices and the adapter fine-tuning to optimize the performance. The evaluation shows that the average EERs of existing fake voice detectors in the ASVspoof challenge can exceed 20\% if the SiFs like silence segments are removed, while SiFSafer achieves an EER of less than 8\%, indicating that SiFSafer is robust to SiFs and strongly resistant to existing attacks.

Main paper: 
 related works 2.1 voice synthesis: 
 Voice synthesis can be divided into two categories: Text-to-Speech (TTS) and Voice Conversion (VC). TTS takes the text as input and generates the voice corresponding to the text. VC converts the timbre of the input voice to that of the target speaker.The traditional TTS approaches generate new speech by concatenating pre-recorded segments, resulting in low-quality and poor flexibility. Most of the TTS approaches in recent years are based on Deep Neural Networks (DNN) to generate high-quality speeches. In 2016, DeepMind proposed WaveNet [39] , which achieves powerful performance and gains widespread application. In 2017, Wang et al. [44] introduced Tacotron, an end-to-end TTS framework. Tacotron can directly map text to voice, but the performance is not as good as WaveNet's. Baidu proposed Deep Voice [4] , which requires fewer parameters and achieves faster generation. In 2018, Shen et al. [32] introduced Tacotron 2, which improves the model structure and gets better performance compared with Tacontron. In 2021, Weiss et al. [45] proposed Wave-Tacotron, which extends the Tacotron model by incorporating a normalizing flow into the autoregressive decoder loop. Jaehyeon et al. [24] proposed VITS by combining three technologies: conditional variational autoencoder, normalizing flows, and Generative Adversarial Network (GAN). It gets ideal performance in speed and stability. In 2023, Wang et al. [41] proposed VALL-E, which is the first large-model-based TTS approach. It has excellent performance and supports zero-shot TTS.Early VC approaches are usually implemented based on statistical transformation. The voice quality they generate is poor, and they require high-quality corpus data. In 2016, Hsu et al. [16] proposed a variational autoencoder-based VC approach that utilizes a display attribute vector to represent speaker information. In 2017, Kaneko et al. [20] proposed CycleGAN-VC, a GAN-based VC approach. In 2019, Kaneko et al. [21] proposed CycleGAN-VC2, which optimizes the adversarial loss and discriminator based on CycleGAN-VC.AI-synthesized voice detection approaches can be divided into four types: traditional features-based approaches, computer vision (CV)based approaches, End-to-End (E2E)-based approaches, and other approaches.Traditional features-based approaches transform the input voice to traditional voice feature representation, such as MFCC, and utilize the ML or DNN model to detect the AI-synthesized voice. In 2016, Tian et al. [37] compared the performance of six highdimensional features by using a simple DNN model. In 2018, TODISCO et al. [38] transformed the voice to Linear Frequency Cepstral Coefficients (LFCC) and MFCC. Subsequently, they employed a Gaussian Mixture Model (GMM) for detection. Alzantot et al. [3] integrated several traditional features and proposed a detection scheme based on ResNet.CV-based approaches are inspired by image recognition techniques. They first convert voice to image and then use deep-learning models designed for images to detect AI-synthesized voice. In 2019, Farid et al. [2] proposed the first CV-based approach which uses bispectral analysis to determine whether a sample is an AI-synthesized speech by Support Vector Machine (SVM). In 2021, Ballesteros et al.proposed Deep4SNet [6] . It converts voice data into a histogram and uses a back-end model based on a Convolutional Neural Network (CNN) for classification.E2E-based approaches have become the most popular approaches in AI-synthesized voice detection in recent years. They take raw voice data as input of the detection model and have no additional feature extraction. In 2020, Tak et al. proposed RawNet2 [35] , which employs a sinc convolution layer to extract voice features and several residual blocks for further feature processing. In 2021, Tak et al. [34] proposed RawGAT which is based on a graph attention network. In 2023, Ding et al. [11] introduced a speaker attractor multi-center one-class learning approach to detect AI-synthesized voice. Guo et al. [14] employed a speech representation model WavLM for detection.Some AI-synthesized voice detection approaches employ relatively rare technologies. In 2020, Wang et al. [42] proposed Deep-Sonar, which uses neuronal activity in an AI-based implementation of a speaker recognition system as a feature. In 2022, Blue et al. [7] used techniques from the field of articulatory phonetics for AI-synthesized voice detection. 
methodology 3.1 motivation: 
 Existing studies on AI-synthesized voice detection have reported ideal performance in their experiments, suggesting that accurate detection is achievable. However, recent researches [22, 25, 27] argues that existing fake voice detectors tend to overfit the SiFs, such as background noise, silence segments before and after human voice, etc. Researchers [15, 22, 25] have presented several novel SiF-based attacks to help AI-synthesized voices bypass detection, further emphasizing the limitations of existing detectors. These findings indicate that current fake voice detectors struggle to capture the essential differences between synthetic and human voices. Therefore, the challenge of AI-synthesized voice detection remains significant and far from resolved. The ultimate objective of AI-synthesized voice detection is to accurately distinguish all synthetic speech, regardless of the specific synthetic system used to generate it. However, there are two core difficulties in achieving this goal:(1) SiFs overfitting: Since there is a significant distinction between data collection and processing, certain SiFs between synthetic and human voices can have noticeable differences. Fake voice detectors are prone to overfit SiFs, which may seriously affect the usability and robustness of the detection in the real world. (2) Dataset limitation: Voice synthesis technology encompasses various methods and solutions. Synthetic voices generated by different voice synthesis systems may exhibit distinct feature distributions. Consequently, it is challenging for the datasets used in detection model training to encompass all types of synthetic voices. Fake voice detectors pay more attention to the difference between human voices and several specific types of synthetic voices, leading to diminished performance when encountering unfamiliar types of synthetic voices.The design of existing detectors concentrates on capturing the disparity between synthetic and human voices. It leads the detection model to explore prominently distinct features, making it prone to overfitting SiFs or excessively emphasizing specific spoof features. To address the challenges above, we introduce a new philosophy for designing AI-synthesized voice detectors in this paper. Our core idea is to encourage the detection model to prioritize learning the feature distribution of human voice. We aim to identify synthetic voices by assessing whether the input data feature distribution aligns with human voices. This paper presents an AI-synthesized voice detection framework named SiFSafer based on this philosophy. SiFSafer utilizes a self-supervised learning speech representation model to reinforce understanding of human voice feature distribution. Additionally, we employ a BiLSTM-based network to identify outlier points in the distribution that deviate from human voice patterns.We present the overview of the SiFSafer Framework in Figure 2 . SiFSafer accepts raw voice data as input. Initially, we employ two self-supervised speech representation models: the original model released by the authors and a fine-tuning model, in which the latter is adapted based on the original model during our training phase. These models serve as the upstream feature extractors to generate the representation map of the input. The output of the upstream feature extractor consists of the outputs from each transformer encoder layer.To enhance the feature representation capabilities of the representation map, we utilize a layer selection and fusion operation, which selects the output from specific layers and merges them into a unified representation. Following the fusion of the output using a linear layer to adjust dimensions, our approach employs a BiLSTMbased architecture to capture feature representations across frame levels comprehensively. Subsequently, SiFSafer integrates the outputs from the corresponding BiLSTM layer and maps it to the final output through a final linear layer.The dataset is the basis of deep learning model training. Several studies [29, 46] have explored a notable duration disparity in silence segments before and after human voice between spoof and genuine samples within the ASVspoof datasets, which are extensively utilized in AI-synthesized voice detection.As depicted in Figure 3 , bonafide samples and spoof samples generated via voice conversion-based algorithms exhibit pronounced silence segments before and after human voice. Conversely, spoof samples generated by TTS algorithms lack such silence segments. It will mislead detection models to utilize the difference to distinguish the spoof samples and fail to learn other essential information. This work [15] demonstrates that existing fake voice detectors can be readily deceived by introducing silence segments to spoof samples. To enhance the robustness of SiFSafer, we remove the silence segments at the input stage to prevent potential overfitting. The primary objective of SiFSafer is to comprehensively capture the human voice's feature distribution and identify synthetic speech by detecting anomalies that deviate from this distribution. However, the limited size of existing datasets in fake voice detection poses a challenge in achieving this goal. To address this limitation, we leverage one of the most widely adopted pre-trained speech representation models, wav2vec2.0 XLS-R [5] , as the upstream feature extractor. This model comprises a convolutional neural network (CNN)-based feature extractor followed by a transformer-based [10, 40] feature encoder, trained on a massive dataset spanning 436k hours of speech data across 128 languages. The extensive training data enables the model to grasp genuine speech features effectively.To further optimize the performance of this upstream model, we insert the LoRA adapter [17] into the transformer encoder layers shown in Figure 2 to fine-tune the model in the training stage. To avoid overfitting, we just insert the adapter into the initial layers, which mainly focus on the shallow features of voices, and freeze the parameter weights after several epochs of training. Simultaneously, to preserve the genuine speech information learned during pretraining to the fullest extent possible, SiFSafer utilizes an original model without additional fine-tuning to extract features parallel with the fine-tuned model.The upstream feature extractor comprises multiple transformer encoder layers. In this architecture, the initial layers of the transformer encoder are responsible for extracting shallow feature information, while the subsequent layers delve deeper into the feature extraction process. Each layer takes the output of the preceding layer as input, enabling the model to progressively capture more abstract and intricate features of the input voice data.The difference in feature distribution between synthetic and human voices may appear in feature information at all levels. So, paying reasonable attention to different levels of feature information is essential. The wav2vec2.0 model employed in this study encompasses a 24-layer transformer encoder. For the fine-tuned model, we select the output of the first 12 layers of transformer encoders, where the adapters are inserted, to extract fine-tuned shallow features. For the original layers, we select the output of the last 12 layers. This selection includes the information from the initial layers of the original model as well, as each layer takes the output of the preceding layer as input. This design choice enables SiFSafer to obtain a more comprehensive range of feature information spanning from shallow to deeper levels.In the fusion process, the features selected from the output of the fine-tuned and original models are merged into two-dimensional feature maps respectively. For each one, let [𝑂 1 , 𝑂 2 , ..., 𝑂 𝑛 ] represent the feature information of n layers selected. We define a set of learnable weight values [𝑤 1 , 𝑤 2 , ...𝑤 𝑛 ]. The fusion process is as follows: EQUATIONThe downstream model captures the abnormal feature distribution from the fusion map, which is not similar to human voices. The fusion map can be viewed as a frame feature sequence. Initially, we utilize a linear layer to adjust the dimensions of features within each frame. Additionally, we apply the SeLU activation function to introduce non-linearity, thereby facilitating further fine-tuning of the upstream model. Subsequently, SiFSafer employs a two-layer BiLSTM network. This network architecture is adept at capturing cross-frame level feature clues by analyzing the sequential dependencies within the frame feature sequence.To ensure the ability to capture feature clues at different levels, the fine-tuned and original models are equipped with independent downstream models, each possessing the same structure. This design choice enables SiFSafer to maximize the extraction of valuable insights from both the fine-tuned shallow features and the deeper features of the original model. Both the two outputs of BiLSTM layers are combined through a weighted sum using a learnable weight factor 𝛼. Finally, a linear layer is applied to map the combined result to the final output. 
evaluation: 
 Our evaluation aims to answer the following research questions:• RQ1: Can existing fake voice detectors work properly without silence segments before and after human voice? • RQ2: Whether SiFSafer can get better performance than existing fake voice detectors? • RQ3: Whether retraining the existing fake voice detectors without silence segments changes the result of the performance comparison in RQ2? • RQ4: Whether SiFSafer is robust to the attacks based on SiFs?This section will briefly introduce the implementation details of SiFSafer, baseline detector selection, and dataset selection in the experiments. Specific information is as follows:1) SiFSafer: The technical details of SiFSafer are shown in the Section 3. The optimizer utilized during training is "Adam, " with an initial learning rate set to 0.000001. For the fine-tuned model, we integrate the LoRA adapter into the initial 12 layers. To mitigate overfitting, we freeze the parameters of all LoRA adapters after 10 epochs.2) Baseline detectors: We selected six recent fake voice detectors published in top conferences or related challenges: RawNet2 [35] , RawGAT-ST [34] , AASIST [19] , MTLISSD [28] , SAMO [11] , FastAudio [12] , and two pre-train model-based approaches by Piotr et al. [23] , which serves as our baseline systems. RawNet2 serves as one of the baseline systems in ASVSpoof2021 [1] , and other systems have also demonstrated ideal performance on ASVspoof datasets. We acquired their implementations from open-source repositories provided by the respective authors. Initially, we intended to include DeepSonar, a neural network feature-based approach, as one of the baseline systems. However, due to the unavailability of open-source code from the authors and our unsuccessful attempts to reproduce their results, which significantly differed from their claims, we decided not to include it in our final selection. 3) Datasets: In this paper, we chose the ASVspoof2019 LA dataset as the training dataset for SiFSafer and all the baseline detectors. We selected three datasets for evaluation: ASVspoof2019 LA, ASVspoof2021 LA, and ASVspoof2021 DF. The specifics of these datasets are detailed in Table 1 .In this evaluation, we mainly answer RQ1, i.e., whether existing fake voice detectors work properly without silence segments before and after human voice. To evaluate the performance, we remove the silence segments before and after the human voice in all evaluation datasets using Sound eXchange (SoX), a cross-platform audio editing software. For baseline detectors, we use the respective authors' default parameters of training to retrain the models with the ASVspoof2019 LA dataset without any pre-processing because some of them do not provide pre-train parameters' weight. The evaluation results are shown in Table 2 . For the two pre-train model-based approaches by Piotr et al., we encountered unexpected performance results. Despite using the default parameters provided by the authors to retrain the models, we observed severe overfitting issues. Evidently, the performance significantly deteriorates in the dataset after removing silence segments, with all systems exhibiting a surprising degradation in performance. They all achieve EERs higher than 20%, indicating that they are unsuitable for real-world applications. It demonstrates that the silence segments are crucial in distinguishing fake voices for these systems. These systems are highly vulnerable to synthetic voice with no silence segments. To further analyze the factors contributing to the performance degradation of the baseline systems, we evaluate their performance on the ASVspoof2019 LA development set. The results are presented in Table 3 . The trend of performance change after removing silence segments is consistent with that observed on the evaluation set, but the performance degradation is relatively minor. We speculate that the better performance is because the spoofing algorithms present in the development set are consistent with those encountered during training. This further corroborates our hypothesis that the features specific to certain synthetic methods in the training set may contribute to overfitting.In this evaluation, we mainly answer RQ2, i.e., whether SiFSafer can perform better than existing fake voice detectors. We evaluate the SiFSafer and all the baseline detectors in ASVspoof2019 LA, ASVspoof2021 LA, and ASVspoof2021 DF datasets. All of the samples of the datasets are processed to remove the silence segments because detection based on silence segments has significant risks in real-world scenarios. To further analyze the performance of SiF-Safer, we also add a comparative detector comprising a wav2vec2.0 model identical to SiFSafer without fine-tuning and a downstream model proposed in this paper. The comparison result is shown in Table 4 . It is obvious that the performance of SiFSafer significantly outperforms that of the baselines. The average EER of most baseline detectors exceeds 20%, rendering them entirely unsuitable for real-world scenarios. In contrast, SiFSafer achieves an average EER of 7.41%. While the performance may not be optimal, it indicates that SiFSafer is suitable for real-world scenarios. The performance of the comparative detector is also better than all of the baselines, suggesting that our design approach of utilizing a speech representation model to enhance the learning of genuine speech is effective. The performance gap between the comparative detector and SiFSafer highlights that fine-tuning one of two identical upstream models can significantly enhance the detection performance of the detector.It should be noted that the performance of SiFSafer in the 2021 LA dataset is noticeably inferior compared to other datasets. To identify the reason, we conducted further analysis on the evaluation data of SiFSafer in the ASVspoof2021 LA dataset, as depicted in Figure 4 . The performance in synthetic voices generated by A10 appears to be the poorest across all conditions. We hypothesize that this could be attributed to the high quality of this method, as similar performance is observed in other systems as well. Another clear trend is that the performance in C3 and C6 is worse than other conditions.Condition C3 entails transmission over a PSTN system in Spain, where codec conditions are uncontrollable and unknown [26] . Condition C6, on the other hand, features the lowest bitrate among all conditions, with both conditions utilizing an 8kHz sampling rate. We speculate that the complex transmission environment and poor voice quality may result in the loss of detailed features, thereby making the overall distribution of synthetic voice closer to genuine human voice. The result also means that SiFSafer performs better in most conditions than the average on the ASVspoof2021 LA dataset.Retraining (RQ3)In this evaluation, we mainly answer RQ3, i.e., whether retraining the existing fake voice detectors without silence segments changes the result of the performance comparison in RQ2. We removed the silence segments of the ASVspoof2019 LA dataset and proceeded to retrain all baseline detectors using this modified dataset and the same training parameters as Section 4.2. This step was taken to mitigate the risk of the model overfitting to the silence segments. Performance evaluation was conducted using the same datasets described in Section 4.3. The evaluation results in ASVspoof2019 are shown in Table 5 . The performance of the majority of baseline detectors has demonstrated significant improvement. This suggests that by removing the silence segments from the training dataset, the model is directed to pay more attention to the distinctions between synthetic and human speech, which might not have been effectively learned when utilizing the unprocessed dataset. However, it should be noted that the model's performance remains unsatisfactory despite the retraining efforts. The SiFSafer still has a very significant performance advantage. The performance evaluation of the baseline detectors after retraining using the ASVspoof2021 dataset is shown in Table 6 . The baseline detectors continue to exhibit poor performance, with SiF-Safer maintaining a clear lead in terms of performance. It is worth noting that Whisper-lcnn and Whisper-specrnet perform relatively well in the ASVspoof2021 DF dataset compared to those in other datasets. We infer the reason is that the pre-trained model Whisper has promising human voice modeling capabilities to help the detectors capture the features that do not belong to human speech in multiple spoof algorithms. The ASVspoof2021 DF dataset contains a more significant number of samples and spoof algorithms compared to the ASVspoof2019 LA dataset. The learning capability of Whisper regarding human voice features enables the detectors to perform better on the ASVspoof2021 DF dataset, even though it is overfitted on the ASVspoof 2019 LA dataset. Once again, the results indicate that solely focusing on the differences disparities between human and synthetic voice within a specific dataset will significantly constrain the capabilities of fake voice detectors. In this evaluation, we mainly answer RQ4, i.e., whether SiFSafer is robust to the attacks based on SiFs. We selected SiFDetectCracker [15] , the state-of-the-art attack approach against fake voice detectors that utilize SiFs, to evaluate the robustness of SiFSafer. We use the open-source code provided by the authors and default initial attack parameters for the implementation. The same method for sample selection, as described in their paper, is employed to obtain the test samples. Detectors of varying types exhibit different sensitivities to different SiFs. Therefore, we selected detectors employing diverse technical approaches to compare with SiFSafer. In this experiment, we selected a CV-based detector, Deep4SNet [6] , along with two end-to-end based detectors, RawNet2 and AASIST, as comparison detectors. RawNet2 is one of the baselines used in the ASVspoof2019 challenge, and AASIST exhibits the best performance in the experiments reported in the papers, corresponding to all baseline detectors. The evaluation result is shown in Table 7 . The attack success rate against all comparison detectors is higher than 50%, whereas it is 0% against SiFSafer. The average number of iterations for the comparison detectors is lower than 50, indicating that the attack can be completed with a small number of queries. The results indicate that SiFSafer exhibits excellent robustness against SiFs and can effectively defend against the most existing advanced attacks. 
conclusion: 
 In this paper, we analyze the limitations of existing fake voice detection designs and propose a new design philosophy aimed at directing the detection to focus more on learning the feature distribution of human speech. Based on this philosophy, we introduce a new fake voice detection framework named SiFSafer, which utilizes a pre-trained speech representation model to enhance the learning of human speech feature distribution. The evaluation demonstrates that existing fake voice detectors perform poorly when SiFs like silence segments are removed, while SiFSafer outperforms these existing detectors. The adversarial attack resistance capability evaluation also shows that SiFSafer exhibits excellent robustness against SiFs. SiFSafer's absolute performance still has significant room for improvement, particularly in handling low-quality speech. In future work, we aim to optimize the performance of SiFSafer further to address these limitations.  
: 
 synthesis approaches rely on old-style techniques such as splicing and editing, often resulting in a discernible smoothness that human listeners can distinguish. In recent years, the advancement of artificial intelligence (AI) has significantly enhanced the quality of synthetic voice [31-33, 36, 41, 44] , making them increasingly difficult to distinguish by human ears. Numerous incidents demonstrate that malicious actors have extensively exploited AI-synthesized voices to deceive authentication systems based on speaker verification, perpetrate telecom fraud, and even orchestrate political smear campaigns. In 2019, fraudsters utilized voice synthesis technology to convincingly mimic the voice of a CEO, successfully defrauding a substantial amount totaling over $243,000 [18] . Then, during the U.S. presidential election in New Hampshire in 2024, a significant number of voters received mysterious calls featuring a recording purportedly from U.S. President Biden, urging them not to vote in the state's primary. Subsequent investigation confirmed that the recording was generated using AI-synthesized voice [30] . These incidents underscore the abuse of voice synthesis technology for fraudulent and manipulative purposes, highlighting the urgent need for robust safeguards and countermeasures to mitigate such risks.In the past few years, there has been a significant increase in research efforts focused on detecting fake voices. Early research primarily focused on extracting traditional speech features such as Mel-Frequency Cepstral Coefficients (MFCC) and spectrum to detect fake voices [3, 13] . In recent years, end-to-end (E2E)-based approaches have gained prominence. These methods utilize deep neural network (DNN) models to extract speech features and distinguish synthetic speeches directly. Most of them assert that their proposed methods are highly effective and perform excellently in their evaluation experiments. Some even report Equal-Error Rates (EER) lower than 1%, which is remarkable. However, several studies [8, 29, 46, 47] have pointed out that the noticeable difference in silence segments before and after human voice presented in the ASVspoof datasets (the most widely used datasets in AI-synthesized voice detection) could make all detectors trained and evaluated on these datasets can easily detect spoof samples based on the silence segment alone. [9, 26, 43] . Recent research [15, 25] suggests that existing fake voice detectors exhibit serious robustness flaws and demonstrate significant fluctuations when applied to unfamiliar datasets. These studies indicate that the actual performance of existing fake voice detectors is not as excellent as portrayed in their experiments. They may pay excessive attention to the speakerirrelative features (SiFs) that are not relative to the expression of voice, such as silence segments before and after the human voice, leading to a failure to capture the fundamental and essential differences between the synthetic voice and human voice. Consequently, most existing fake voice detectors perform poorly when facing silence-free voices or unfamiliar datasets, indicating that they are unsuitable for deployment in real-world scenarios.The design objective of existing fake voice detectors is to discern the difference between synthetic voice and human speech. However, this often results in the detection model prioritizing the conspicuous differences between synthetic and genuine human voice in the training dataset. Consequently, the detector may become prone to overfitting, thereby disregarding the essential distinctions between synthetic voice and genuine human voice. In this paper, we propose a new philosophy for designing fake voice detectors, which aims to guide the detection model to learn what is "real" rather than the difference between the "real" and the "fake". We propose an AI-synthesized voice detection framework named SiFSafer, which employs the speech representation model as the upstream model to enhance the learning of genuine human voice feature distribution. We utilize a Bi-directional Long Short-Term Memory (BiLSTM) model to identify abnormal features that deviate from the genuine sample distribution to distinguish fake voices. We design a special upstream architecture comprising two identical speech representation models to optimize the detection performance. One model undergoes fine-tuning using adapter tuning, while the other remains an original model without fine-tuning, serving to mitigate model overfitting. Our main contributions are summarized as follows:• We are the first to discuss the limitations of existing design philosophy, which guides models to learn the difference between synthetic and genuine human voices. And then, we propose that paying more attention to learning what is "real" is much more effective. The rest of this paper is structured as follows: Section 2 provides a brief overview of related technologies, including voice synthesis and AI-synthesized voice detection. Section 3 explains the details of SiFSafer, the AI-synthesized voice detection framework proposed in this paper. Section 4 outlines several experiments we designed to evaluate the performance of SiFSafer and existing detectors. Finally, in Section 5, we present our conclusions. 
 
 Appendix:  


Decision: This paper analyzes the limitations of existing AI synthetic speech detectors, highlighting their tendency to overfit speaker-irrelevant features (SiFs) in real-world scenarios, such as silent segments before and after human voice recordings. The reviewers' ratings are controversial, with half leaning toward the negative side and the other half toward the positive side. The positive reviewers acknowledge that this paper presents an interesting approach to prevent overfitting on SiFs and commend the thorough experiments provided. Conversely, the concerns raised by the negative reviewers seem somewhat inappropriate. For instance, they requested comparisons with a paper that was officially published after the submission deadline of this work.

Reviews: review: paper_summary: paper_summary: Thank you to all the authors for their efforts and for the opportunity to review the manuscript. In this paper, the authors first demonstrate that existing synthetic speech detection methods which perform well on ASVspoof datasets, show a decline in performance when speaker irrelevant features (SiFs), for example, silence regions are removed during evaluation. This is because they tend to overfit on SiFs during training instead of learning unique features of genuine human speech. A method called SiFSafer is proposed which is demonstrated to not overfit on SiFs, and shows good performance on ASVspoof datasets. Finally, it is shown that re-training existing baselines without silence segments does not restore their performance to the level with silence segments, proving the effectiveness of SiFSafer approach.
strength_weakness: strength_weakness: 1. The abstract and the introduction of the paper are well-written and clearly describe the background and motivation behind the problem statement. A minor comment - at least one example of SiFs should be included in the abstract, for example, silence regions. Without this, just from the abstract, it is unclear what kind of features are speaker-irrelative.
2. Removal of silence segments at the input stage to prevent overfitting
3. Combination of original and fine-tuned model considered during training
4. Experiments in the paper are organized well in the form of research questions. Exhaustive experiments support the hypothesis and demonstrate the effectiveness of the approach.
limitations: limitations: 1. Section 2.2 needs some additions. In CV-based approaches, besides using the word “image”, spectrograms and mel-spectrograms should also be briefly introduced, since they are the common image representations of audio.
2. There are some inconsistencies in Figure 1. Input for TTS Model should be text, which is shown as input for VC Model. Please correct/clarify why this is the case. Also, Figure 1 has not been referenced in text.
3. Reasons for selection of “wav2vec2.0 XLS-R” as the upstream model:  Were other architectures considered and compared to XLS-R? Is there any experimental evidence or theory behind the choice? This is important because XLS-R is computationally expensive with hundreds of million training parameters.
4. What are the values of alpha and 1-alpha. Is there an ablation which supports the choice of these values? It is important to include these hyperparameter choices in the manuscript to ensure reproducibility and also ensure the fact that neither of original or fine-tuned model dominates the other model.
5. Is there a reason behind selecting only 3 other baselines for comparison in Table 7 (Adversarial Attack Resistance Capability Evaluation)? How do other methods like Whisper-lcnn react to these kinds of adversarial attacks?
6. How does this method perform on the datasets which evaluate generalization performance, for example, In-the-Wild dataset?

There are minor typos in the paper which could be removed by another round of proof-reading:

1. Line 118 - The full stop before “[9, 26, 43]” is not required.
2. Line 193 - Tacotron needs to be spelt correctly.
3. Line 259 and 260 - “recent researches argues” should be “recent researches argue”.
4. ASVspoof is written as ASVSpoof2021 in Line 551.

Overall, the paper presents an interesting approach to prevent overfitting on SiFs. The experiments provided in the paper are thorough with some inconsistencies as described above. A proof-read is recommended to remove typos.
paper_summary: paper_summary: The paper presents a novel framework, SiFSafer, aimed at addressing the limitations of existing AI-synthesized voice detectors by focusing on learning human voice features rather than differences between human and synthetic voices. The author presents novel insights into the detection of AI-synthesized voice attacks, specifically targeting the robustness of this detection. The main contribution of this paper lies in the identification of previously overlooked aspects, such as the presence of silence segments in spoof samples created by voice conversion algorithms, which could mislead detection models. The authors have conducted extensive experiments and provided a detailed analysis of the results, demonstrating SiFSafer's robustness and superiority over existing detectors.
strength_weakness: strength_weakness: The paper introduces a new design philosophy that prioritizes learning genuine human voice features, which is a significant departure from existing methods that tend to focus on the differences between human and synthetic voices. The introduction of SiFSafer, which leverages pre-trained speech representation models and adapter tuning, is an innovative approach that shows promise in enhancing robustness against speaker-irrelative features (SiFs). The robustness against SiFs and resistance to adversarial attacks is a strong point.
limitations: limitations: 1. In the experimental design, the choice of comparison models mostly relies on RawNet front-end or manual features, which are significantly influenced by silence segments. The Whisper front-end also does not perform exceptionally. This suggests that the selected comparison models might not represent the SOTA methods, potentially inflating the effectiveness.
2. The manuscript could benefit from a deeper analysis of why certain spoofing algorithms, like A10, are more challenging for SiFSafer.
3. There is a lack of discussion on the explainability and interpretability of SiFSafer's decisions. 
4. There is a concern that the model may still be prone to overfitting, particularly given that it is trained on datasets that may not fully represent the diversity of real-world voice data.
paper_summary: paper_summary: This manuscript analyzes the limitations of existing AI synthetic speech detectors and points out that they are prone to overfitting speaker irrelevant features (SiFs) in real-world scenarios, such as the silent segments before and after the human voice. 
The author proposes a new design philosophy that guides detection models to prioritize learning human speech features rather than differences between human voice and synthetic speech. Evaluation on the ASVspoof dataset shows that SiFSafer exhibits robustness to SiFs and strong resistance to existing attacks, with an average equal error rate (EER) of less than 8% compared to existing detectors in the absence of SiFs (such as silent segments).
strength_weakness: strength_weakness: 1: The perspective of analyzing speaker-irrelated features is interesting.

2: The SiFSafer framework exhibits better performance and robustness compared to existing detectors after removing irrelevant features of specific speakers (such as silent segments), indicating that it can work more reliably in real-world applications.
limitations: limitations: 1: I have some concerns about the fairness of the experiment, as removing silent segments from the voice itself is a forgery process, which may undermine the continuity of the signal and lead to misclassification by the model. If the author can clarify or prove it, I will modify my rating.

2: In the evaluation of adversarial sample defense performance, the author only compared it with SiFDetectCracker and lacked comparisons with traditional adversarial attacks such as MIFGSM、Malafide、VMI-FGSM, or universal attack[1].

3: The author lacks comparison with some advanced works, such as [2], which are based on self supervised large models and have better performance on the in-the-wild dataset.

[1]Xie Y, Shi C, Li Z, et al. Real-time, universal, and robust adversarial attacks against speaker recognition systems[C]//ICASSP 2020-2020 IEEE international conference on acoustics, speech and signal processing (ICASSP). IEEE, 2020: 1738-1742.

[2]Yang Y, Qin H, Zhou H, et al. A robust audio deepfake detection system via multi-view feature[C]//ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2024: 13131-13135.
paper_summary: paper_summary: This paper analyzes the limitations of existing fake voice detectors. It proposes a novel AI-synthesized voice detection framework named SiFSafer, which uses pre-trained speech representation models to enhance the learning of feature distribution in human voices and the adapter fine-tuning to optimize the performance. The motivation behind the paper is commendable, focusing more on detecting speech content than the silence segments. However, the comparisons made in the experimental section are unfair, so I am inclined to reject this paper.
strength_weakness: strength_weakness: This paper proposes a new philosophy for designing fake voice detectors, which aims to guide the detection model to learn what is "real" rather than the difference between the "real" and the "fake." Besides, it proposes a new end-to-end fake voice detection framework named SiFSafer to counter the SiF-driven attacks. SiFSafer utilizes finetuned speech representation models and BiLSTM to detect fake voices effectively.
limitations: limitations: 1. The paper claims to be the first to discuss the limitations of existing philosophy in the contributions but states in the abstract that previous work overfits speaker-irrelevant features. I think this is a significant contradiction.
2. I believe the experiments related to RQ2 are unfair. Your overall comparison should not be based on a dataset with all silence segments removed. Instead, the experimental results for RQ2 should be derived from the original dataset. Furthermore, your results lack the performance metrics of your method on the original dataset.
3. Section 4.5 employs adversarial examples which use the SiFs to attack. Logically, this attack targets the silences and background noise. I am puzzled by these results because your model does not specifically defend against it. Are you comparing your model's performance on data where silence has been removed against a baseline on data that includes silence segments? This may explain the discrepancies in the experimental outcomes.
4. There is considerable redundancy in the data presented in Tables 2, 4, and 5. I suggest the authors need to rethink and rewrite the experimental section to address this issue.