Deepfake voice: how cloned speech is made and how it is benchmarked

This page is part of the deepfake detection hub. It explains how the fakes are made and how the benchmark was run; the voice deepfake benchmarks page lists every ASVspoof edition and the in-the-wild audio sets side by side.

01What is a deepfake voice?

The ASVspoof organisers group speech attacks into four families: impersonation, voice conversion, text-to-speech synthesis and replay (arXiv 2210.02437). The first and last involve no synthesis: an impersonator is a human mimic, and a replay is a recording of the real speaker played back at a microphone. The middle two are what the word deepfake covers in audio. Text-to-speech, or TTS, generates a waveform from written text in a target voice; voice conversion, or VC, takes a recording of one speaker and re-renders it so that it sounds like another while keeping the words and timing.

The 2021 paper describes the new deepfake task as one in which "adversaries aim not to deceive an ASV system, but merely fabricate an utterance in the voice of a target speaker". That distinction matters for how detection is scored. In the older logical access task the fake is aimed at an automatic speaker verification system and the metric accounts for both the verifier and the detector; in the deepfake task there is no verifier, so the detector is judged alone.

02How is cloned speech made?

Modern TTS and VC systems share a two-stage structure. A front model predicts an intermediate acoustic representation, usually a spectrogram, from text or from the source speaker's recording, conditioned on an embedding of the target voice. A vocoder then turns that representation into a waveform. The ASVspoof 2021 organisers sort the vocoders behind their evaluation data into five categories, "traditional, neural autoregressive, neural non-autoregressive, waveform concatenation and unknown", because they expected detection performance to depend on the vocoder category more than on the individual system.

The evaluation set was built from "in excess of 100 different spoofing attack algorithms", contributed by the teams behind the ASVspoof 2019 database and by participants in the 2018 and 2020 Voice Conversion Challenges. The fakes therefore span many generator designs rather than one. Müller et al. (Interspeech 2022) open their study of the same field with the observation that "current text-to-speech algorithms produce realistic fakes of human voices" (arXiv 2203.16263), and their in-the-wild set shows how far those fakes have travelled: 37.9 hours of found recordings of celebrities and politicians, 17.2 hours of them deepfakes.

03How did ASVspoof 2021 benchmark detection?

The deepfake (DF) task evaluation data holds 14,869 bona fide and 519,059 spoofed trials. Every file was encoded and decoded with a lossy codec of the kind used for media storage, giving nine conditions: no codec, mp3 at low and high bitrate (about 80 to 120 and 220 to 260 kbps), m4a at low and high bitrate (about 20 to 32 and 96 to 112 kbps), ogg at low and high bitrate (about 80 to 96 and 256 to 320 kbps), and two transcoding chains, mp3 to m4a and ogg to m4a. The aim, in the paper's words, was to test detection of "compressed manipulated speech data of varying characteristics posted online".

Participants trained on the ASVspoof 2019 logical access data and submitted scores for a progress subset during the challenge and for the full evaluation set at the deadline. The primary metric for the DF task is the countermeasure equal error rate, the operating point at which the rate of fakes accepted equals the rate of genuine speech rejected; the metrics page on this site defines EER next to AUC and explains why ASVspoof's other tasks use the tandem detection cost function instead.

04What did the best systems score?

The best DF system, T23, scored an EER of 15.64 percent on the evaluation set; the two organiser baselines scored 22.38 percent (B04) and 23.48 percent (B03), and 18 of the 33 submitting systems beat the better baseline. The paper's main observation is the gap between the two subsets: 23 of 33 systems had EERs under 10 percent on the progress subset, and "while the best performing system even has an EER of less than 1%, all have EERs exceeding 15% for the evaluation set". The progress data came from the ASVspoof 2019 source only; the evaluation set added the Voice Conversion Challenge sources, and the detectors had tuned themselves to the first.

The top five systems were all ensembles, all used data augmentation, and all augmented with media codecs during training. After the challenge, with the evaluation keys released, the best published DF result fell to an EER of 2.85 percent. Both figures sit on the published results table with their conditions, because a 2.85 percent EER measured with knowledge of the test set is a different claim from a 15.64 percent EER measured blind.

05Which factors made fakes harder to detect?

Codec and vocoder both moved the error rate. For mp3, the higher bitrate gave a lower median EER than the lower one; for m4a and ogg the bitrate made little difference, and ogg produced lower EERs than mp3 or m4a at either setting. The two transcoding chains were only slightly harder than a single ogg pass, which the authors read as "some resilience to transcoding". Across sources, fakes from the Voice Conversion Challenge data were much harder than those from the ASVspoof 2019 source, and for any codec "both types of neural vocoders yield higher EERs than more traditional vocoders or waveform concatenation".

The abstract's summary is the one to quote: detection solutions "offer some resilience to compression effects, they lack generalization across different source datasets". The pattern is the same one the face detectors show on the cross-dataset drop by detector page, measured on a different modality with a different metric. Müller et al. add two findings from their uniform re-implementation of published detectors: using constant-Q or log spectrogram features instead of mel spectrograms "improves performance by 37% EER on average", and on found recordings the methods suffer a "performance degradation of up to one thousand percent" against their ASVspoof scores.

06What comes after ASVspoof 2021

ASVspoof 5 ran in two phases, with registration from 1 July 2023 and evaluation scores due in July 2024, and its workshop was held at Interspeech on 31 August 2024. Its Track 1 is stand-alone deepfake detection with a minimum detection cost function as the primary metric and EER reported alongside; Track 2 is spoofing-robust speaker verification. The design keeps the 2021 split between a detector judged alone and a detector judged with a verifier.

For a reader checking a recording rather than a benchmark, the lesson from these numbers is the same as for face video: a detector score is weak evidence on material that differs from its training distribution, and the in-the-wild audio results say how weak. The human or AI page covers what people can tell unaided, and the liveness detection page covers the capture-time checks that an identity system uses instead of a post-hoc detector.