ROBUST S POOFED S PEECH D ETECTION VIA T EMPORAL P YRAMID M ODELING
arXiv:2606.16837v1 [cs.CV] 15 Jun 2026
A P REPRINT Mahtab Masoudi Nezhad Lane Department of Computer Science and Electrical Engineering West Virginia University Morgantown, WV
Nima Karimian Bellini College of Artificial Intelligence, Cybersecurity and Computing University of South Florida Tampa, FL
June 16, 2026
A BSTRACT Spoofed speech detection is increasingly challenged by realistic synthesis, voice conversion, and replay attacks, with cross-dataset generalization remaining a major limitation. This work we propose a Temporal Pyramid Adapter that utilize parallel temporal convolutions with varying receptive fields to capture multi-scale spoofing cues, ranging from local artifacts to global prosodic irregularities. We also integrated self-supervised XLS-R representations combined with front-end adapters, including Mel, Sinc, and a Temporal Pyramid design for multi-scale temporal modeling. The proposed model is evaluated cross multiple benchmark including ASVspoof 2017, ASVspoof 2021 (DF/LA), PartialSpoof, DiffSSD, and multilingual HQ-MPSD datasets. Experimental results demonstrate that Temporal Pyramid model obtained AUC of 99.24% and a EER of 3.87% on the PartialSpoof database, which is significantly outperforming the base model and several SOTA baseline such as LCNNBLSTM (9.87% EER) and TRACE (8.08% EER). Additionally, multilingual evaluations confirm that while spoofing artifact are independent from language. While self-supervised representations improve robustness, performance degrades under domain and language shifts, highlighting the need for better adaptation and calibration strategies. Keywords Spoofed Speech Detection, Audio Deepfake Detection, XLS-R, Temporal Pyramid Adapter, Cross-Dataset Generalization, Multilingual Learning
1
Introduction
Automatic speaker verification systems are increasingly used in security-sensitive applications such as mobile authentication, banking, remote identity verification, and voice-controlled services Wu et al. [2015], Kamble et al. [2020], Tan et al. [2021]. These systems rely on the assumption that a speech signal contains reliable identity-related information from a genuine speaker. However, this assumption is increasingly challenged by spoofing attacks, where an adversary attempts to deceive the system using replayed speech, synthesized speech, or converted speech Almutairi and Elgibreen [2022], Yi et al. [2023]. Replay attacks use previously recorded genuine speech and play it back to the system, while text-to-speech Wu et al. [2026] and voice conversion Kinnunen et al. [2012] methods generate artificial speech that may resemble a target speaker. As these technologies improve, spoofed speech becomes more natural and harder to detect. The goal of spoofed speech detection is to distinguish bona fide human speech from spoofed or manipulated audio. Early spoof detection systems often relied on handcrafted acoustic features, such as cepstral coefficients or spectral descriptors Todisco et al. [2016b]. Although these features can capture certain artifacts, they may fail when attacks become more diverse or when the evaluation data differs from the training data. Modern deep learning approaches have improved performance by learning discriminative features directly from audio signals, but they still face major challenges when evaluated across different datasets, attack types, recording channels, and languages.
arXiv Template
A P REPRINT
A central difficulty in spoof detection is cross-dataset generalization. A model trained on one dataset may perform well in-domain but degrade when tested on another dataset because spoofing artifacts are not always consistent across corpora. For example, ASVspoof 2017 focuses on replay attacks Kinnunen et al. [2017], while DiffSSD focuses on synthetic speech from modern text-to-speech systems Bhagtani et al. [2024]. PartialSpoof introduces localized manipulations where only part of an utterance is spoofed, making detection more difficult than full-utterance classification Zhang et al. [2021c, 2023]. ASVspoof 2021 DF and LA further introduce large-scale evaluation conditions Yamagishi et al. [2021] that differ from older benchmark datasets. Because of these differences, a robust system must learn representations that capture general spoofing cues rather than dataset-specific artifacts. This work investigates using XLS-R, a large-scale self-supervised speech representation model Babu et al. [2022]. Self-supervised speech models are trained on large amounts of unlabeled speech and can learn general acoustic and linguistic representations. However, their performance for spoof detection can depend strongly on how the input waveform is represented. Therefore, we evaluate several front-end adapters before the XLS-R backbone. The base configuration passes the waveform directly to the model. The Mel adapter introduces a time-frequency representation. The Sinc adapter applies learnable frequency-aware filters. The Temporal Pyramid adapter uses parallel temporal convolutions with different receptive fields to capture multi-scale spoofing cues. This adapter-based framework is evaluated under cross-dataset conditions, including training on ASVspoof 2017 and testing on ASVspoof 2021 DF and LA, as well as training on PartialSpoof and testing on ASVspoof 2021 and DiffSSD. Beyond the challenge of language shift itself, a critical hurdle in multilingual spoof detection is the calibration of decision boundaries across diverse linguistic and acoustic domains. In this work, we have studied multilingual generalization using HQ-MPSD Li et al. [2025b] . In this setting, models trained on English speech are evaluated on different language such as English, Dutch, and Portuguese subsets. This allows us to examine whether spoofing artifacts learned in one language transfer to another language. Since spoof detection should ideally rely on manipulation artifacts rather than language-specific content, multilingual evaluation is important for understanding whether the learned representations are robust beyond a single linguistic domain. The contributions of this work are organized around these two experimental directions. First, we evaluate XLS-R with several front-end adapters and show that multi-scale temporal modeling improves AUC under cross-dataset transfer. Second, we analyze multilingual spoof detection using HQ-MPSD and show that strong ranking performance can transfer across languages, although partial manipulations remain challenging. Together, these experiments highlight the importance of transfer learning, front-end adaptation, and cross-domain evaluation for robust spoofed speech detection.
2
Methodology
The methodology for this paper is structured as a modular six-stage pipeline designed to enhance cross-dataset and multilingual robustness. As illustrated in the 1, the architecture leverages the large-scale self-supervised representations of the XLS-R Babu et al. [2022] model while investigating specialized front-end adapters to isolate manipulation artifacts. The system accepts raw audio of variable lengths which is initially resampled to 16 kHz. During the training phase, utterances are standardized to a fixed length of 64,600 samples, where longer signals are randomly cropped and shorter signals are repeat-padded and circularly shifted to preserve signal structure without introducing artificial silent regions. For evaluation, a chunked inference strategy is employed by dividing waveforms into overlapping segments and averaging the chunk-level logits to generate a final utterance-level spoof score, which improves the detection of localized artifacts. A central component of this framework is the evaluation of several front-end configurations, depicted in Stage 2 in Figure 1, to determine the most effective representation for spoof detection. The base configuration passes the raw waveform directly to the XLS-R backbone, whereas the Sinc adapter utilizes learnable, frequency-selective filters to focus on specific frequency bands. The Temporal Pyramid adapter employs parallel temporal convolution branches with varying receptive fields to capture information at multiple temporal scales, representing both minute local distortions and global prosodic irregularities. This specific configuration achieved the highest AUC in the DiffSSD-to-PartialSpoof transfer experiment. Other evaluated modules include the Res2Dilated adapter, which uses dilated convolutions to expand the receptive field, and the Mel adapter, which converts waveforms into log-Mel spectrograms to emphasize time-frequency energy patterns. The processed features are then fed into the XLS-R Feature Encoder, as shown in Stage 3 of 1, which produces a downsampled output that passes through L Transformer Encoder layers. To utilize these hidden states effectively, a layer attention and aggregation mechanism is applied. This process begins with mean-over-time temporal pooling for each layer, followed by the learning of attention weights α to prioritize layers PL containing the most relevant spoofing cues. These layers are fused into a unified representation Z = l=1 αl Zl , and a final statistics pooling step combines the mean and standard deviation to capture both static and dynamic acoustic characteristics. 2
arXiv Template
A P REPRINT
Figure 1: Overview of the proposed SLS architecture for spoofed speech detection, which utilizes an XLS-R selfsupervised backbone integrated with multiple front-end adapter options. The six-stage pipeline includes: (1) input preprocessing with standardized cropping and padding; (2) a selectable front-end adapter, such as the Temporal Pyramid or Sinc modules, to capture multi-scale or frequency-aware features; (3) the XLS-R feature and transformer-based backbone; (4) a layer attention and aggregation mechanism that calculates weighted averages across transformer layers; (5) a multi-layer classification head for score generation; and (6) the final output logit and performance metric calculation. The architecture concludes with a multi-layer classification head, identified as Stage 5 in 1, which incorporates batch normalization, SELU activations, and dropout for regularization. Two fully connected layers map the high-dimensional features to a 2-dimensional output followed by a LogSoftmax function to produce the final spoof score. This score represents the probability that the input is manipulated, and the model is rigorously evaluated across diverse benchmarks, including the multilingual HQ-MPSD dataset, using metrics such as EER and AUC to ensure robustness across different attack types and languages
3
Experimental Setting
The proposed framework utilizes a pre-trained XLS-R Babu et al. [2022] as the backbone for spoof detection, leveraging its large-scale multilingual self-supervised representations. To ensure consistent input dimensionality, raw waveforms are resampled to 16 kHz. During training, utterances are standardized to a fixed length of 64,600 samples. For utterances exceeding this length, we employ random cropping; shorter utterances are repeat-padded and circularly shifted before truncation. This preprocessing strategy preserves signal structure while avoiding the introduction of artificial silent regions. During evaluation, we utilize a chunked inference strategy for long utterances, where overlapping chunks are processed independently and their logits are averaged to produce a final utterance-level spoof score. This approach facilitates the detection of localized spoofing artifacts that may only manifest in specific segments of a recording. 3.1
Front-end Adapter Configurations
To investigate the impact of input representation on XLS-R performance, we evaluate several front-end adapters: Base Configuration: This setup passes the raw waveform directly to the XLS-R convolutional feature encoder without an additional adapter, serving as a baseline for end-to-end representation learning. Mel Adapter: This module transforms the raw waveform into a log-Mel spectrogram representation, which is subsequently processed by a convolutional refinement module Tran et al. [2024]. The transformation begins with a Short-Time Fourier Transform (STFT) to decompose the signal into the time-frequency domain. The resulting linear 3
arXiv Template
A P REPRINT
frequency bins are mapped onto the Mel scale, defined by m = 2595 log10 (1 + f /700), which emphasizes the lower frequency regions where human speech energy is most concentrated while compressing higher frequencies often associated with synthetic artifacts. A logarithmic compressor is applied to the filterbank outputs to normalize dynamic range and mimic human loudness perception. This representation is then processed by a 2D convolutional module that acts as a learned feature extractor, identifying spectral "textures" such as vertical streaks indicative of temporal glitches or horizontal discontinuities typical of low-quality vocoders Tran et al. [2024]. By focusing the model on perceptually relevant energy patterns, the Mel adapter provides a structured inductive bias that improves generalization across datasets—such as the transition from replay-heavy ASVspoof 2017 to the synthetic speech in DiffSSD—by discouraging the backbone from overfitting to raw waveform noise. Sinc Adapter: The Sinc adapter utilizes learnable frequency-selective filters to process the raw waveform, implementing the SincNet architecture proposed by Ravanelli and Bengio Ravanelli and Bengio [2018]. Unlike standard convolutional layers where all filter weights are learned independently, Sinc-based filters are mathematically constrained to function as parameterized band-pass filters. Each filter is defined by only two learnable parameters: the low and high cutoff frequencies (f1 and f2 ). This formulation provides a strong inductive bias, forcing the model to focus on specific frequency regions that may contain critical artifacts introduced during the speech synthesis or replay process. Technically, the time-domain filter g[n, f1 , f2 ] is computed as the difference between two low-pass sinc functions: g[n, f1 , f2 ] = 2f2 sinc(2πf2 n) − 2f1 sinc(2πf1 n). This parameterization significantly reduces the number of parameters in the front-end, which can mitigate overfitting to dataset-specific noise patterns and improve the extraction of physically meaningful acoustic features. However, the effectiveness of the Sinc adapter in cross-dataset transfer depends on whether the artifacts in the training distribution (e.g., ASVspoof 2017) align with the spectral characteristics of the target distribution (e.g., ASVspoof 2021). If the learned filter bank becomes overly specialized to narrow frequency bands present only in the training set, performance may degrade during transfer to unseen spoofing conditions. Temporal Pyramid Adapter: To address the non-stationary nature of spoofing artifacts, which often manifest across varying temporal scales, this adapter employs a hierarchical multi-resolution feature extraction architecture Fei et al. [2026]. The design is motivated by the fact that manipulation cues can range from micro-scale phase discontinuities (millisecond-level) to macro-scale prosodic unnaturalness (sentence-level). The adapter processes the input through N parallel temporal convolutional branches, where each branch i utilizes a unique kernel size ki ∈ {k1 , k2 , . . . , kn } to establish a specific temporal receptive field. Technically, the operation can be defined as: Y = Concat(fk1 (X), fk2 (X), . . . , fkn (X)) (1) where fki represents the convolutional operation with kernel size ki . The short-range branches utilize small kernels to isolate high-frequency “glitches" or spectral discontinuities typical of diffusion-based or neural Text-to-Speech (TTS) models. Conversely, long-range branches utilize expansive kernels to integrate information across wider temporal windows, enabling the detection of global irregularities in speech cadence and prosody that signal a lack of natural linguistic flow. By fusing these parallel representations, the adapter provides the downstream XLS-R backbone with a rich, scale-invariant feature set. This multi-scale approach significantly enhances robustness in cross-dataset scenarios, as evidenced by the Temporal Pyramid adapter achieving the highest Area Under the Curve (AUC) in the DiffSSD-to-PartialSpoof transfer task, effectively identifying localized spoofed segments within otherwise bona fide utterances.. 3.2
Cross-Dataset Training Settings
The XLS-R SLS framework is evaluated across several cross-dataset configurations to measure its ability to generalize beyond training distributions. In the first setting, the model is trained on ASVspoof 2017 and evaluated on ASVspoof 2021 (DF and LA) to determine if representations learned from replay attacks can transfer to modern deepfake and logical access conditions. A second configuration involves training on PartialSpoof with evaluation on ASVspoof 2021 and DiffSSD, testing whether exposure to localized manipulations improves robustness against fully synthetic speech. Conversely, we evaluate models trained on DiffSSD against PartialSpoof to observe how synthetic training data translates to the detection of partially spoofed segments. These experiments are critical for identifying whether the model captures general spoofing cues or merely exploits dataset-specific shortcuts. 3.3
HQ-MPSD Multilingual Methodology
The HQ-MPSD Li et al. [2025a] experiments specifically address language transfer by training models on English speech and testing them on English, Dutch, and Portuguese subsets. The evaluation is further stratified into overall, fully 4
arXiv Template
A P REPRINT
Table 1: Summary of datasets and their roles in the experimental pipeline. Dataset
Primary Type
ASVspoof 2017 Kinnunen et al. [2017]
Replay
ASVspoof 2021 Yamagishi et al. [2021]
DF & Logical Access Partial manipulation
PartialSpoof Zhang et al. [2021c] DiffSSD Bhagtani et al. [2024] HQ-MPSD Li et al. [2025a]
Attack
Synthetic (TTS, diffusion) Multilingual spoofing
Experimental Role Core training and evaluation Cross-dataset evaluation Fine-grained artifact detection Large-scale training and evaluation Cross-lingual robustness analysis
fake, partial clean, and partial noisy conditions to analyze the interaction between language shift and signal degradation. This setup is essential because robust spoof detection should remain invariant to lexical or phonetic variations, focusing instead on the underlying artifacts introduced by manipulation. 3.4
Datasets
To comprehensively evaluate spoofing detection performance, we employ a diverse set of benchmark datasets spanning replay, synthetic, partially manipulated, and multilingual scenarios. This combination enables systematic analysis of both in-distribution performance and cross-domain generalization. 1) Core Benchmark: Replay-Based Spoofing ASVspoof 2017 serves as the primary benchmark for replay attack detection. It contains text-dependent utterances rerecorded under 61 distinct acoustic configurations, introducing realistic channel and environmental distortions Kinnunen et al. [2017]. The dataset is divided into training, development, and evaluation subsets, with a deliberately imbalanced evaluation set to reflect real-world deployment conditions. Table 2: ASVspoof 2017 dataset composition. Subset
Bona fide
Spoof
Total
Training Development Evaluation
1507 760 1298
1507 950 12008
3014 1710 13306
Total
3565
14465
18030
2) Cross-Dataset Generalization: Modern Attacks ASVspoof 2021 (DF and LA tracks) is used exclusively for evaluation to assess generalization to unseen and modern spoofing techniques. The DeepFake (DF) track focuses on neural speech synthesis and voice conversion, while the Logical Access (LA) track targets vulnerabilities in automatic speaker verification systems Yamagishi et al. [2021]. Evaluating on this dataset ensures that the model captures transferable spoofing cues rather than overfitting to training-specific artifacts. 3) Fine-Grained Spoofing: Partial Manipulation PartialSpoof evaluates the detection of partially manipulated utterances, where only segments of speech are spoofed Zhang et al. [2021c]. All signals are resampled to 16 kHz and normalized via cropping or padding. This dataset is critical for assessing the model’s sensitivity to localized and subtle artifacts. 4) Large-Scale Synthetic Speech DiffSSD is a large-scale dataset comprising 94,226 samples designed to evaluate detection of modern TTS and diffusionbased synthetic speech Bhagtani et al. [2024]. It includes diverse synthesis methods and sampling rates, which are unified to 16 kHz during preprocessing. 5
arXiv Template
A P REPRINT
Table 3: DiffSSD split composition. Split
Real
Synthetic
Total
Train Validation Test
9690 2423 12113
22000 5500 42500
31690 7923 54613
Total
24226
70000
94226
Table 4: Cross-dataset generalization performance. Train→Test DiffSSD→PS DiffSSD→ASV21
Model
AUC
EER
XLS-SLS (Pyramid) XLS-SLS (Pyramid)
0.8650 0.8299
23.96 24.80
5) Multilingual Robustness HQ-MPSD enables evaluation of cross-lingual robustness across English, Dutch, and Portuguese Li et al. [2025a]. This dataset allows us to investigate whether the model relies on language-dependent cues or captures intrinsic acoustic artifacts associated with synthetic generation.
4
Results
This section presents a comprehensive evaluation of the proposed framework across multiple datasets, with a focus on three complementary aspects: cross-dataset generalization, in-domain versus out-of-domain robustness, and multilingual transferability. All experiments are conducted using XLS-SLS-based architectures with different front-end adapter configurations, allowing us to analyze how representation design influences performance under varying conditions. 4.1
Cross-Dataset Generalization
Tables 4 and 5 present the cross-dataset evaluation results, highlighting the challenges associated with domain shift in spoof detection. When trained on DiffSSD and evaluated on PartialSpoof, the model equipped with the temporal pyramid adapter achieves the highest AUC of 0.8650, indicating improved separability between bona fide and spoofed samples under unseen conditions. This suggests that multi-scale temporal modeling enhances the robustness of learned representations, particularly in ranking-based evaluation. However, the improvements in AUC do not consistently translate to threshold-dependent metrics such as EER and F1-score, where performance remains comparable to the base configuration. This discrepancy indicates that although the model can better distinguish between classes globally, it struggles to establish optimal decision boundaries when the data distribution shifts. The degradation observed when evaluating on ASVspoof 2021 further reinforces this observation, as performance drops due to the presence of unseen spoofing mechanisms, including deepfake and logical access attacks. These results collectively demonstrate that cross-dataset generalization remains a significant challenge, and that while temporal pyramid modeling improves representation quality, it does not fully resolve distribution mismatch. 4.2
In-Domain and Cross-Domain Performance
Table 6 provides a broader view of performance across datasets, revealing a clear contrast between in-domain and cross-domain behavior. On PartialSpoof, where training and testing distributions are aligned, the Pyramid model significantly improves performance, reducing the EER from 6.31% to 3.87% and achieving the highest AUC. This confirms that multi-scale temporal modeling effectively captures both local and global spoofing artifacts when the underlying data characteristics are consistent. In cross-domain settings, however, the benefits of the Pyramid adapter become less consistent. While improvements are observed on the ASVspoof2021-LA dataset, performance gains diminish on the DF track, where synthetic artifacts are more complex and less temporally structured. On DiffSSD, the Pyramid model achieves similar AUC and EER values compared to the base model but exhibits a noticeable drop in F1-score and precision, suggesting instability in threshold-based classification. This indicates that although the Pyramid adapter enhances feature representation, it does not always translate into reliable decision-making under significant domain shifts. In contrast, Mel and Sinc adapters consistently underperform across all datasets, highlighting the limitations of fixed spectral transformations in capturing diverse spoofing characteristics. 6
arXiv Template
A P REPRINT
Table 5: Adapter ablation for DiffSSD→PartialSpoof. Metric
Base
Mel
Sinc
Pyramid
EER AUC Accuracy F1-score
0.2367 0.8437 0.7633 0.3997
0.3016 0.7633 0.6984 0.3235
0.3648 0.6962 0.6352 0.2645
0.2396 0.8650 0.7603 0.3958
Test Set
Model
AUC
EER (%)
Acc
F1
Prec
Rec
PartialSpoof
Base Pyramid
0.9795 0.9924
6.31 3.87
0.9369 0.9612
0.7541 0.9780
0.6309 0.9954
0.9369 0.9612
ASVspoof2021-LA
Base Pyramid Mel Sinc
0.9336 0.9462 0.8527 0.9462
14.05 11.94 17.34 11.94
0.8595 0.8806 0.8266 0.8806
0.9166 0.9299 0.8954 0.9299
0.9818 0.9849 0.9768 0.9849
0.8595 0.8806 0.8266 0.8806
ASVspoof2021-DF
Base Pyramid Mel Sinc
0.9658 0.9621 0.7989 0.8691
10.51 10.98 26.45 21.30
0.8949 0.8902 0.7355 0.7870
0.9426 0.9398 0.8428 0.8769
0.9956 0.9954 0.9867 0.9899
0.8949 0.8902 0.7355 0.7871
DiffSSD
Base Pyramid Mel Sinc
0.7516 0.7476 0.6896 0.6216
30.88 30.86 36.68 41.61
0.6912 0.6914 0.6332 0.5839
0.7770 0.4985 0.7287 0.6860
0.8870 0.3897 0.8583 0.8312
0.6912 0.6915 0.6332 0.5839
Table 6: Performance across datasets under in-domain and cross-domain conditions. 4.3
Multilingual Generalization
The multilingual evaluation results demonstrate that the proposed model generalizes well across languages in terms of ranking performance, achieving high AUC values in all settings. In the English-to-English scenario, performance is nearly perfect, indicating that the model effectively captures spoofing characteristics when training and testing distributions are aligned. Under cross-language conditions, performance remains strong in terms of AUC but degrades in threshold-based metrics such as EER and accuracy, particularly for Portuguese. This suggests that while spoofing artifacts exhibit a degree of language independence, decision boundaries remain sensitive to language-specific variations. The gap between ranking and classification performance highlights the need for improved calibration strategies when deploying spoof detection systems in multilingual environments. 4.4
Comparison with Prior Work
Table 8 provides a comprehensive comparison between the proposed approach and existing methods on the PartialSpoof dataset, a challenging benchmark designed to evaluate detection of partially manipulated speech. Unlike fully spoofed scenarios, PartialSpoof requires models to identify localized artifacts that may appear only in short temporal segments, making it particularly sensitive to the quality of temporal modeling. Traditional approaches such as CQCC-LCNN Todisco et al. [2016a] and LCNN-BLSTM Zhang et al. [2021a] exhibit relatively high error rates, highlighting the limitations of handcrafted features and shallow temporal modeling in capturing fine-grained spoofing artifacts. While subsequent deep learning and self-supervised approaches significantly improve performance by leveraging richer representations, many of these methods still rely on fixed temporal resolutions, which can limit their ability to effectively capture artifacts occurring at multiple time scales. Recent state-of-the-art methods, including TDL Xie et al. [2024], CFPRF Wu et al. [2024], AGO Zeng et al. [2025], and BAM Zhong et al. [2024], demonstrate that improved temporal modeling leads to substantial gains in performance. Among them, BAM Zhong et al. [2024] achieves the lowest reported EER, establishing a strong benchmark on this dataset. However, a closer examination of the results reveals that performance across methods varies depending on the evaluation metric, suggesting that minimizing EER alone does not fully capture overall model robustness. In this context, the proposed Pyramid model achieves the best overall performance across multiple evaluation metrics. Specifically, it attains the highest AUC of 0.9924 and the highest F1-score of 0.9780, while achieving a highly 7
arXiv Template
A P REPRINT
Train
Test
AUC
EER
Acc
F1
Prec
Rec
EN→EN EN→NL EN→PT
Overall Overall Overall
0.9995 0.9738 0.9490
0.0075 0.0625 0.1311
0.9925 0.7723 0.8716
0.9948 0.8679 0.9202
0.9971 0.7683 0.8616
0.9925 0.9970 0.9874
Table 7: Multilingual evaluation on HQ-MPSD. Model
Year
Resolution
Train
EER ↓ (%)
AUC ↑
F1 ↑
CQCC-LCNN Todisco et al. [2016a] LCNN-BLSTM (LFCC) Zhang et al. [2021a] LCNN-BLSTM (W2V2) Zhang et al. [2021b] SELCNN-BLSTM Wu et al. [2022] w2v2-large-MLP Tak et al. [2022]
– 2021 2021 2021 –
20 ms 160 ms 160 ms 160 ms 160 ms
PS PS PS PS PS
27.17 16.21 9.87 16.60 9.24
– – – – –
– – – – –
TRACE S1 Khan et al. [2026] TRACE S2 Khan et al. [2026] TRACE S3 Khan et al. [2026] TRACE (Proposed) Khan et al. [2026]
2026 2026 2026 2026
20 ms 20 ms 20 ms 20 ms
– – – –
16.37 11.08 14.68 8.08
0.91 0.95 0.92 0.97
– – – –
TDL Xie et al. [2024] CFPRF Wu et al. [2024] AGO Zeng et al. [2025] GNCL Ge et al. [2025] BAM (WavLM-Large) Zhong et al. [2024]
2024 2024 2025 2025 2024
160 ms – 40 ms 20 ms 160 ms
PS PS PS PS PS
7.04 7.41 6.79 11.81 3.58
– – – – –
– 0.9389 0.9436 0.8979 0.9609
Base Model (Ours) Pyramid Model (Ours)
2026 2026
chunk chunk
PS PS
6.31 3.87
0.9795 0.9924
0.7541 0.9780
Table 8: Comparison of our method with prior work on the PartialSpoof dataset. Lower EER is better, while higher AUC and F1 indicate better performance.
competitive EER of 3.87%. Although BAM reports a slightly lower EER, the proposed Pyramid model demonstrates superior overall performance by achieving the highest AUC and F1-score, indicating stronger ranking capability and more reliable classification behavior. This distinction is important because EER reflects performance at a single operating point, whereas AUC and F1-score capture performance across a broader range of decision thresholds and class distributions. The improved performance of the Pyramid model can be attributed to its explicit multi-scale temporal modeling, which enables the network to capture spoofing artifacts at both fine-grained and long-range temporal resolutions. In contrast, BAM primarily relies on fixed-scale feature aggregation, which may limit its ability to fully capture the variability of localized spoofing patterns present in PartialSpoof. As a result, while BAM is optimized for a specific threshold leading to slightly lower EER, it exhibits less consistent behavior across varying decision boundaries. From a practical perspective, the superior AUC and F1-score of the Pyramid model indicate better robustness and stability under different operating conditions, which is critical for real-world deployment where the optimal threshold is often unknown or dynamic. Therefore, despite the marginal difference in EER, the proposed approach provides a more reliable and generalizable solution for spoof detection, particularly in scenarios involving partial and heterogeneous spoofing artifacts. The substantial improvement over the Base model, where EER is reduced from 6.31% to 3.87% and F1-score increases from 0.7541 to 0.9780, further confirms the effectiveness of multi-scale temporal modeling. By explicitly capturing both local and global temporal dependencies, the Pyramid adapter enables the model to better detect localized spoofing artifacts that are difficult to identify using single-scale representations. Overall, these results demonstrate that the proposed approach not only matches but surpasses prior methods in terms of overall performance quality. By achieving the best balance across AUC, F1-score, and competitive EER, the model establishes a new strong benchmark for PartialSpoof and highlights the importance of multi-scale temporal modeling for robust spoof detection.
5
Discussion
This work investigates spoofed speech detection from complementary perspectives, including cross-dataset generalization using XLS-R within the SLS framework and multilingual robustness using HQ-MPSD. The results consistently 8
arXiv Template
A P REPRINT
demonstrate that while modern self-supervised representations provide strong performance under in-domain conditions, their ability to generalize across datasets, spoofing mechanisms, and languages remains limited. This gap highlights a fundamental challenge in spoof detection: the discrepancy between learning discriminative representations and achieving robust decision-making under distribution shift. A central finding of this study is the critical role of front-end design in shaping model performance. The incorporation of the Temporal Pyramid adapter leads to consistent improvements in ranking-based metrics such as AUC, indicating that multi-scale temporal modeling enhances the model’s ability to capture discriminative spoofing patterns across varying conditions. This suggests that spoofing artifacts often manifest at different temporal resolutions, and that aggregating information across multiple scales provides a richer representation. However, these gains do not consistently translate into improvements in threshold-dependent metrics such as EER and F1-score. This discrepancy reveals an important limitation: improved feature separability does not necessarily yield optimal classification boundaries, particularly when the test distribution differs from the training data. In contrast, simpler front-end designs such as Mel and Sinc-based adapters show consistently weaker performance, suggesting that fixed spectral transformations are insufficient for modeling the complex and evolving nature of spoofing artifacts. The challenges of cross-dataset generalization further reinforce this observation. Models trained on one dataset exhibit noticeable performance degradation when evaluated on another, reflecting the substantial variability in spoofing techniques and recording conditions. For instance, replay-based distortions in ASVspoof 2017 differ fundamentally from the synthetic and deepfake artifacts present in ASVspoof 2021, while fully synthetic datasets such as DiffSSD introduce characteristics that do not directly transfer to partially manipulated signals in PartialSpoof. As a result, models tend to learn dataset-specific cues rather than invariant spoofing characteristics, limiting their applicability in real-world scenarios. This indicates that current training paradigms do not sufficiently capture the diversity of spoofing conditions and that stronger emphasis on domain-invariant learning is required. The multilingual evaluation provides additional insight into the nature of spoofing artifacts. High AUC values across languages suggest that many spoofing characteristics are largely language-independent and can be captured by the learned representations. Nevertheless, the degradation observed in EER and accuracy under cross-language conditions indicates that classification performance remains sensitive to language-dependent variations. This effect is particularly evident in challenging cases such as partially spoofed signals, where subtle acoustic differences across languages can influence decision boundaries. These findings imply that while representation learning captures general spoofing patterns, effective deployment in multilingual settings requires improved calibration and adaptation mechanisms. Despite the promising results, several limitations remain. The reliance on utterance-level supervision restricts the model’s ability to handle partially spoofed inputs where artifacts are localized in time. Furthermore, the observed gap between ranking performance and classification accuracy suggests that current models lack robustness in decision calibration, especially under distribution shift. Finally, the limited generalization across datasets highlights the need for training strategies that better capture the diversity of spoofing conditions.
6
Conclusion
This work presents a comprehensive study of spoofed speech detection with a focus on quantitative performance, robustness, and generalization across datasets and languages. Through the integration of pretrained foundation models and self-supervised representations, the proposed framework achieves consistently strong performance across multiple benchmarks, highlighting the effectiveness of combining representation learning with task-specific adaptation. A key contribution of this work is the demonstrated improvement in ranking-based and classification metrics through multi-scale temporal modeling. The proposed Pyramid model achieves the highest AUC (0.9924) and F1-score (0.9780) on the PartialSpoof dataset, along with a competitive EER of 3.87%, outperforming or matching SOTA methods across multiple evaluation criteria. These results indicate that the model provides not only strong separability between bona fide and spoofed samples but also balanced classification performance, which is critical for reliable deployment. Importantly, the observed gap between AUC and EER across experiments highlights that optimizing a single metric is insufficient; instead, robust spoof detection requires consistent performance across multiple evaluation measures. The cross dataset experiments further reveal that while high in-domain performance is achievable, generalization remains a significant challenge. Performance degradation observed when transferring between datasets such as DiffSSD, ASVspoof, and PartialSpoof demonstrates that current models are still sensitive to variations in spoofing mechanisms and data distributions. This finding underscores the importance of developing domain-invariant representations and evaluating models under realistic cross dataset conditions rather than relying solely on in-domain benchmarks. Multilingual evaluation using HQ-MPSD shows that the proposed approach maintains strong ranking performance across languages, achieving high AUC even under cross language settings. However, variations in EER and accuracy indicate that decision boundary calibration remains sensitive to language-specific characteristics, particularly in challenging 9
arXiv Template
A P REPRINT
scenarios involving partial or noisy spoofing. This suggests that while spoofing artifacts share common structural properties across languages, achieving fully language-agnostic detection remains an open problem.
References Zainab Almutairi and Hebah Elgibreen. A review of modern audio deepfake detection methods: Challenges and future directions. Algorithms, 15(5):155, 2022. doi:10.3390/a15050155. Arun Babu, Changhan Wang, Andros Tjandra, Kushal Lakhotia, Qiantong Xu, Naman Goyal, Kritika Singh, Patrick von Platen, Yatharth Saraf, Juan Pino, Alexei Baevski, Alexis Conneau, and Michael Auli. Xls-r: Selfsupervised cross-lingual speech representation learning at scale. In Interspeech 2022, pages 2278–2282, 2022. doi:10.21437/Interspeech.2022-143. Kratika Bhagtani, Amit Kumar Singh Yadav, Paolo Bestagini, and Edward J. Delp. Diffssd: A diffusion-based dataset for speech forensics, 2024. Sijia Fei, Qiang Feng, and Fei Gao. Multi-scale temporal causal network for speech emotion recognition. IEEE Access, 2026. Zhiyong Ge, Xin Xu, Hao Guo, Zijiang Yang, and Björn Schuller. Gncl: A graph neural network with consistency loss for segment-level spoofed speech detection. In ICASSP 2025, pages 1–5, 2025. Mahesh R. Kamble, Harish B. Sailor, Hemant A. Patil, and Haizhou Li. Advances in anti-spoofing: from the perspective of asvspoof challenges. APSIPA Transactions on Signal and Information Processing, 9:e2, 2020. Awais Khan, Muhammad Umar Farooq, Kutub Uddin, and Khalid Malik. Trace: Training-free partial audio deepfake detection via embedding trajectory analysis of speech foundation models, 2026. Tomi Kinnunen, Zhi-Zheng Wu, Kong Aik Lee, Filip Sedlak, Eng Siong Chng, and Haizhou Li. Vulnerability of speaker verification systems against voice conversion spoofing attacks: The case of telephone speech. In 2012 IEEE international conference on acoustics, speech and signal processing (ICASSP), pages 4401–4404. IEEE, 2012. Tomi Kinnunen, Md. Sahidullah, Héctor Delgado, Massimiliano Todisco, Nicholas Evans, Junichi Yamagishi, and Kong Aik Lee. The asvspoof 2017 challenge: Assessing the limits of replay spoofing attack detection. In Interspeech 2017, pages 2–6, 2017. doi:10.21437/Interspeech.2017-1111. Menglu Li, Majd Alber, Ramtin Asgarianamiri, Lian Zhao, and Xiao-Ping Zhang. Hq-mpsd: A multilingual artifactcontrolled benchmark for partial deepfake speech detection. arXiv preprint arXiv:2512.13012, 2025a. Ming Li, Mark Alber, Ramin Asgarianamiri, Lei Zhao, and Xiao-Ping Zhang. Hq-mpsd: A multilingual artifactcontrolled benchmark for partial deepfake speech detection. arXiv preprint arXiv:2512.13012, 2025b. Mirco Ravanelli and Yoshua Bengio. Speaker recognition from raw waveform with sincnet. In 2018 IEEE spoken language technology workshop (SLT), pages 1021–1028. IEEE, 2018. Hyeji Tak, Massimiliano Todisco, Xin Wang, Jee-weon Jung, Junichi Yamagishi, and Nicholas Evans. Automatic speaker verification spoofing and deepfake detection using wav2vec 2.0 and data augmentation, 2022. Chen Boon Tan, Mohd H. A. Hijazi, Norshahriah Khamis, Puteri N. E. Nohuddin, Zairul Zainol, Frans Coenen, and Abdullah Gani. A survey on presentation attack detection for automatic speaker verification systems: State-of-the-art, taxonomy, issues and future direction. Multimedia Tools and Applications, 80(21):32725–32762, 2021. Massimiliano Todisco, Héctor Delgado, and Nicholas Evans. Constant q cepstral coefficients and light cnn baseline for spoofing countermeasures, 2016a. CQCC-based baseline cited for PartialSpoof comparison. Massimiliano Todisco, Héctor Delgado, and Nicholas Evans. A new feature for automatic speaker verification antispoofing: Constant q cepstral coefficients. In Odyssey 2016: The Speaker and Language Recognition Workshop, pages 283–290, 2016b. Thien Tran, Thanh Duc Bui, and Panagiotis Simatis. Parallelchain lab’s antispoofing systems for asvspoof 5. In The automatic speaker verification spoofing countermeasures workshop (ASVspoof 2024). ISCA, Kos, Greece, pages 9–15, 2024. Haibin Wu, Hsin-Chieh Kuo, Nanxin Zheng, Kuo-Hsuan Hung, Hung-Yi Lee, Yu Tsao, Hsin-Min Wang, and Helen Meng. Partially fake audio detection by self-attention-based fake span discovery. In ICASSP 2022, pages 9236–9240, 2022. Jing Wu, Wenjun Lu, Xiaolong Luo, Rui Yang, Qi Wang, and Xiaochun Cao. Coarse-to-fine proposal refinement framework for audio temporal forgery detection and localization. In Proceedings of the 32nd ACM International Conference on Multimedia, pages 7395–7403, 2024. doi:10.1145/3664647.3681478. 10
arXiv Template
A P REPRINT
Yihan Wu, Jee-Weon Jung, Hye-Jin Shim, Xin Cheng, and Xin Wang. Wildspoof: advancing in-the-wild data in text-tospeech generation and spoofing-aware automatic speaker verification. In ICASSP 2026-2026 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 21922–21924. IEEE, 2026. Zhizheng Wu, Nicholas Evans, Tomi Kinnunen, Junichi Yamagishi, Federico Alegre, and Haizhou Li. Spoofing and countermeasures for speaker verification: A survey. Speech Communication, 66:130–153, 2015. doi:10.1016/j.specom.2014.10.005. Yiting Xie, Hong Cheng, Yuxuan Wang, and Lin Ye. An efficient temporary deepfake location approach based embeddings for partially spoofed audio detection. In ICASSP 2024, pages 966–970, 2024. Junichi Yamagishi, Xin Wang, Massimiliano Todisco, Md. Sahidullah, Jose Patino, Andreas Nautsch, Xuechen Liu, Kong Aik Lee, Tomi Kinnunen, Nicholas Evans, and Héctor Delgado. Asvspoof 2021: Accelerating progress in spoofed and deepfake speech detection. In Proceedings of the 2021 Edition of the Automatic Speaker Verification and Spoofing Countermeasures Challenge, pages 47–54, 2021. Jiangyan Yi, Chenglong Wang, Jianhua Tao, Xiaohui Zhang, Chu Yuan Zhang, and Yan Zhao. Audio deepfake detection: A survey, 2023. Siding Zeng, Jiangyan Yi, Jianhua Tao, Jiayi He, Zheng Lian, Shuang Liang, Chu Zhang, Yixuan Chen, and Xiaohui Zhang. Adversarial training and gradient optimization for partially deepfake audio localization. In ICASSP 2025, pages 1–5, 2025. Lin Zhang, Xin Wang, Erica Cooper, and Junichi Yamagishi. Multitask learning in utterance-level and segmental-level spoof detection. In Proceedings of the ASVspoof 2021 Workshop, 2021a. Lin Zhang, Xin Wang, Erica Cooper, and Junichi Yamagishi. Multitask learning in utterance-level and segmental-level spoof detection. In Proceedings of the ASVspoof 2021 Workshop, 2021b. Lin Zhang, Xin Wang, Erica Cooper, Junichi Yamagishi, Jose Patino, and Nicholas Evans. An initial investigation for detecting partially spoofed audio. In Interspeech 2021, pages 1654–1658, 2021c. doi:10.21437/Interspeech.20211001. Lin Zhang, Xin Wang, Erica Cooper, Nicholas Evans, and Junichi Yamagishi. The partialspoof database and countermeasures for the detection of short fake speech segments embedded in an utterance. IEEE/ACM Transactions on Audio, Speech, and Language Processing, 31:813–825, 2023. doi:10.1109/TASLP.2022.3233236. Jiaming Zhong, Baoyuan Li, and Jiangyan Yi. Enhancing partially spoofed audio localization with boundary-aware attention mechanism. In Interspeech 2024, pages 4838–4842, 2024. doi:10.21437/Interspeech.2024-1477.
11