Open-Set Source Tracing of Audio Deepfake Systems

Elie Khoury; Hemlata Tak; Nicholas Klein

REVIEW 4 major objections 6 minor 43 references

Open-Set Source Tracing of Audio Deepfake Systems

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A simple softmax change makes open-set audio source tracing reliably flag unknown deepfake systems.

desk verdict A useful, honest empirical paper: SME consistently beats energy on the MLAAD open-set source-tracing benchmark, though the exact gain needs error bars. read the letter →

arxiv 2507.06470 v1 pith:3NW72VP7 submitted 2025-07-09 eess.AS cs.SD

Nicholas Klein , Hemlata Tak , Elie Khoury This is my paper

classification eess.AScs.SD

keywords audiodeepfakedetectionsourcetracingout-of-distributionsoftmaxenergyscorelargemargincosinelossopen-setrecognitionMLAAD

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that open-set source tracing of audio deepfake systems — deciding which of many possible systems generated a clip, while also flagging clips from systems never seen during training — can be made substantially more reliable by a small change to the energy score used for out-of-distribution detection. The change, called softmax energy (SME), applies a softmax to the classifier logits before computing the energy, so that the top-ranked class dominates instead of being outweighed by lower-ranked predictions. On the MLAAD evaluation protocol with 43 unseen spoof systems, SME beats the standard temperature-scaled energy score in every experiment, with a relative FPR95 improvement of 31% on average, and combined with SME-guided training and codec/reverberation augmentations reaches 8.3% FPR95. The practical point is that many new deepfake systems appear faster than labeled training data can track them, so a scoring method that robustly says ‘unknown’ is a building block for trustworthy audio forensics.

What carries the argument

The central object is softmax energy (SME), defined in Eq. (2) as $E_{\mathrm{sm}}(x;f) = -T\log \sum_i e^{\sigma_i(f(x))/T}$, where $\sigma_i$ is the $i$-th softmax output. It adapts the standard energy score by running the pre-softmax logits through softmax first, which sharpens the logit distribution and makes the energy depend mostly on the top few classes. That counteracts the observed failure pattern of the energy score on LMCL-based classifiers, where OOD samples have larger lower-ranked logits that otherwise dominate the unbounded sum. The paper also uses SME as a training objective, adding squared hinge terms that push SME values for in-distribution samples above $m_{\mathrm{in}}$ and for auxiliary OOD samples below $m_{\mathrm{out}}$.

What would settle it

Collect or synthesize a new set of audio deepfake systems outside MLAAD, train an LMCL source-tracing classifier on a disjoint set of seen systems, and compare FPR95 of SME versus temperature-scaled energy. If on this new OOD collection the average second-to-tenth ranked logits are no longer larger for OOD samples than for in-distribution samples, SME will not beat scaled energy; the sorted-logit comparison on the new OOD set is the direct check.

Watch

Extended reading notes

Core claim

On a ResNet-34 classifier trained with Large Margin Cosine Loss, the standard energy score fails for out-of-distribution detection because LMCL produces bounded cosine-similarity logits: out-of-distribution samples have larger second-to-tenth ranked logits than in-distribution samples, and the log-sum-exp in the energy score lets those lower logits dominate, mis-ranking unknown systems as known. The paper’s central discovery is that inserting a softmax between the logits and the energy sum — $E_{\mathrm{sm}}(x;f) = -T \log \sum_i \exp(\sigma_i(f(x))/T)$ — restores the dominance of the top logit and fixes this failure mode. On the MLAAD Eval set this gives a relative FPR95 reduction of 31% on average over scaled energy, and the best configuration (SME-guided training with ASVspoof 5 copy synthesis plus codec and reverberation augmentation) reaches 8.3% FPR95 and 8.1% EERc, with in-distribution accuracy essentially unchanged at about 95.6%. The remaining hard case is six OOD models trained on the same single-speaker data as in-distribution models, where FPR95 stays at 48.5%.

Load-bearing premise

The load-bearing premise is that the development-set logit pattern — OOD samples having larger second-to-tenth ranked logits than in-distribution samples — continues to hold for the 43 unseen systems in the evaluation set and for future OOD systems; if that pattern weakens or reverses, SME’s advantage over temperature-scaled energy shrinks or disappears.

Editorial extensions

If this is right

SME can be dropped into an already-trained LMCL source-tracing model as a post-hoc scoring change, requiring no retraining and no architecture modification.
Adding SME-guided training with auxiliary OOD data from ASVspoof 5 and copy synthesis, plus codec and reverberation augmentation, pushes FPR95 from 10.7% (baseline) to 8.3% on the MLAAD Eval set.
Removing the six speaker-overlap OOD systems, the same model reaches 1.7% FPR95, showing that the remaining difficulty is specifically systems trained on the same single-speaker data as in-distribution systems.
The best model without auxiliary data reaches 9.9% FPR95 and an unweighted EER of 11.3%, far below the 63% unweighted EER of the provided reference system.
Across all experiments, SME gives better EERc and FPR95 than both MSP and energy on the full Eval set.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

I would expect the same softmax-before-energy trick to transfer to other OOD detection tasks built on bounded-logit classifiers, such as face or speaker recognition with cosine losses; the paper explicitly leaves cross-domain transfer as future work.
The success of SME-guided training suggests that any training signal that sharpens the logit distribution for in-distribution samples and flattens it for OOD samples could work, so other kurtosis-based score transformations are worth testing.
The stubborn 48.5% FPR95 on speaker-overlap OOD systems points to a limit of score-based OOD detection alone: distinguishing two different synthesis systems trained on the same voice may require modeling speaker identity or training-data provenance explicitly.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Klein et al. give us a clean empirical result: on the 43-unseen-system MLAAD Eval set, replacing the energy score with softmax energy (SME) lowers FPR95 consistently across their ablations, from an average of 14.1 to 9.7, a 31% relative gain. That is the thing to remember. The result is actionable and the failure mode they identify makes sense.

What is actually new is narrow but real. SME is Eq. (2): apply softmax to the logits first, then compute energy. The paper shows that for LMCL models, OOD samples have larger second-to-tenth logits than ID samples, so the standard energy sum lets those lower logits dominate and mis-ranks OOD as ID. Softmax accentuates the top logit and fixes that. The explanation is backed by Figure 1, and the fix is simple enough that it can be applied post-hoc to any existing model. Their SME-guided training and augmentation experiments are also solid; the best system hits 8.3% FPR95 and beats the special-session reference by a wide margin.

The paper is well organized, the protocol is standard, and the authors are honest about limitations. They report the difficult speaker-overlap subset separately (48.5% FPR95) and explicitly say more experiments are needed. The self-citation to their earlier source-tracing paper is appropriate since they build on that baseline.

Soft spots: the stress-test concern is real but not decisive. Every condition is a single run with no error bars, and FPR95 is a point estimate that can move by a few points across seeds. But the improvement appears in all six rows of Table 3, so I would be surprised if the direction flipped; only the magnitude is uncertain. I would want a couple of seeds before trusting the 31% number. A missing comparison to softmax entropy also bothers me a little, because SME with T=1 is essentially a smooth approximation of entropy; if it matches entropy on this benchmark, the novelty is mostly in the application to bounded LMCL logits rather than in the score itself. That is a minor issue in practice. Finally, the energy baseline is given T=1/16 after Dev tuning while SME uses T=1; a more exhaustive temperature sweep could change the baseline, though the authors did try to make it fair.

Who is this for: people working on audio deepfake source tracing or OOD scoring for bounded-logit classifiers. It is a solid conference-level paper that should go to peer review and likely be accepted after adding error bars and an entropy comparison.

Referee Report

4 major / 6 minor

Summary. The manuscript addresses open-set source tracing of audio deepfake systems under the Interspeech 2025 special-session protocol built on MLAAD. The authors propose softmax energy (SME), a modification of the energy OOD score that operates on softmax probabilities, and show on a ResNet34/LMCL baseline that SME yields lower FPR95 than MSP and temperature-scaled energy. They also introduce SME-guided training with auxiliary OOD data from ASVspoof 5 and copy synthesis, plus codec and reverberation augmentation, achieving an Eval FPR95 of 8.3%. The best model without auxiliary data improves over the session reference system by an absolute 52% unweighted EER.

Significance. If the empirical finding is robust, the paper offers a practically valuable result: a simple post-hoc score change substantially improves open-set rejection for LMCL-based source-tracing models, a regime where the standard energy score is known to degrade because of bounded logits. The evaluation on a standardized protocol with 43 unseen spoof systems is a clear strength, as is the paper's effort to explain the mechanism through the ranked logits in Figure 1. However, the generality of the claims is currently limited by single-run results, the absence of standard softmax-entropy baselines, and the protocol-specific checkpoint selection, so the significance is real but not yet fully established.

major comments (4)

[§6.3, Tables 2 and 3] All FPR95 and EERc values come from single runs without seeds, confidence intervals, or significance tests. FPR95 is a threshold-based point metric and can vary by several points across random initializations of a 50-epoch ResNet34 with on-the-fly augmentation. Several SME-versus-energy gaps in Table 3 are small (e.g., 12.8 vs 9.9, 13.6 vs 9.6, 10.9 vs 8.3), so the headline 31% relative improvement and the 8.3% result are not yet demonstrated to be beyond run-to-run noise. I request mean and standard deviation over at least three seeds, or a paired significance test, for at least the key comparisons in Tables 2 and 3.
[§4, Eq. (2); §6.3] The proposed SME is the negative log-sum-exp of the softmax probabilities. For the probability vectors produced by a classifier, this quantity is closely related to standard softmax entropy and to the squared L2 norm of the probability vector, but the paper compares SME only against MSP and energy. Without an entropy baseline (and, ideally, an additional standard OOD score such as ODIN), the reader cannot determine whether the observed improvement is specific to SME or is a general property of softmax-concentration scores. This baseline is necessary for the novelty claim.
[§6.1 and §6.3] The 31% average relative FPR95 improvement is computed over Table 3 rows, but checkpoints for all Table 3 models were selected using Dev EERc computed with SME, and rows with auxiliary data used SME-guided training. This means the comparison may be influenced by the model-selection criterion, not only by the scoring function. Table 2 provides a controlled comparison on a fixed energy-selected checkpoint; the paper should either report the average improvement on energy-selected checkpoints or explicitly discuss the effect of selection on the headline number.
[§3.2.3, Figure 1; §6] The paper's explanation for SME's advantage relies on the logit-rank pattern in Figure 1, which is shown only for the LMCL baseline on the Dev set. To establish that this pattern is stable and that SME's benefit is not an artifact of the particular Dev and Eval OOD systems, the authors should show similar logit-rank plots for at least one SME-guided trained model and for Eval OOD systems, or provide a per-system FPR95 breakdown. Without this, the mechanism remains plausible but not directly tested.

minor comments (6)

[§3.2.3 and Table 2] The caption and text do not explicitly state whether Table 2 reports Dev or Eval results; Section 6.1 implies they are Dev, but this should be made explicit in the caption and in the running text.
[§4, Eq. (2)] The notation σ_i(f(x)/T) is ambiguous because the softmax operation conventionally includes its own temperature. Please define σ_i(z) explicitly in the text and state precisely how the temperature T is applied inside the softmax and in the outer exponent.
[Table 3] The caption should specify that 'None (Baseline)' is trained with the standard LMCL loss without SME-guided training, while rows with auxiliary data use the SME-guided objective; it should also define 'CS' and 'Aug' after first use.
[§6.3] The phrase 'an average FPR95 of 9.7%–31% lower relative to that of scaled energy' is confusing; rephrase as 'an average FPR95 of 9.7%, which is 31% relative reduction from the energy baseline's 14.1%.'
[§3.1] The class-weighting scheme for EERc and FPR95 is not fully described; please specify how weights are computed for OOD classes and how they affect the threshold selection in FPR95.
[§7] The comparison to the reference system uses 'unweighted EER', but this metric is not defined in Section 3.1; please define it and clarify whether the comparison uses the identical Eval protocol as the reference.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: SME is an independently defined scoring function tested on held-out Eval OOD systems; all self-citations are background only.

full rationale

The paper's central claim is empirical and not circular. SME is a mathematically well-defined transformation of logits given in Eq. (2), and the comparison with the energy score in Eq. (1) is performed on fixed models and on the held-out MLAAD Eval protocol with 43 unseen spoof systems. The FPR95 results are reported on Eval data that were not used to fit the SME definition or the main comparison. Model checkpoints were selected on the Dev set using SME, energy, or MSP, and footnote 7 states that SME consistently gave better results under each Dev-selection criterion, so the reported advantage is not forced by construction. SME-guided training uses SME in the loss and in evaluation, but this is standard outlier-exposure training rather than a circular reduction: the loss does not directly optimize FPR95 on unseen OOD classes, and generalization to the Eval set is a nontrivial empirical outcome. The self-citation to prior work [14] motivates the LMCL baseline but is not load-bearing for the SME claim; there is no uniqueness theorem imported from the authors' prior work, and no ansatz is smuggled in via self-citation. The paper's own Section 7 limitation that further experiments are needed across protocols and models is a scoping caveat, not evidence of circularity. No equation-level reduction of a prediction to its input or fitted parameter was found.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

No new physical or structural entities are introduced. SME is a mathematical transformation of existing logits, not a new carrier, force, or conserved quantity, so the graviton problem does not apply.

free parameters (6)

Energy temperature T (LMCL baseline) = 1/16
Tuned on Dev set for energy score with LMCL model; needed for comparisons in Tables 2 and 3 (Section 3.2.2).
SME temperature T (non-LMCL baseline) = 4
Tuned on Dev set to improve SME for the non-LMCL baseline (Section 4, Table 2).
SME loss margin min = -3.21980
Chosen from intersection of ID and OOD SME distributions on Dev set (Section 6.1).
SME loss margin mout = -3.21976
Chosen with min from Dev distributions (Section 6.1).
SME loss scaling lambda = 2e8
Set so classification and SME loss magnitudes match after first epoch (Section 6.1).
LMCL scaling factor and margin schedule = s=16, margin 0 to 0.5
Set with minimal Dev tuning for the cosine loss (Section 3.2.2).

assumptions (4)

domain assumption In-distribution samples have higher energy magnitude than OOD samples under the (softmax-transformed) logit distribution.
Core assumption inherited from energy-based OOD detection (Liu et al. [22]); the SME fix relies on ID softmax vectors being more peaked than OOD ones (Section 3.2.3, Figure 1).
domain assumption Dev set is representative of Eval for hyperparameter selection (T, margins, lambda, checkpoint choice).
All tuning uses Dev; Eval is reported once (Sections 3.2.2, 6.1).
domain assumption ASVspoof 5 auxiliary OOD data is disjoint from MLAAD Eval OOD systems and representative of unseen spoofing systems.
Required for SME-guided training results; paper asserts disjointness without a detailed overlap audit (Section 5).
domain assumption Copy-synthesis with five neural vocoders produces artifacts similar to those of unseen vocoders.
Motivates the copy-synthesis augmentation for open-set generalization (Section 5).

how reviews work

0 comments

Cite this review

Pith. "Pith review of Open-Set Source Tracing of Audio Deepfake Systems." pith.science (2026). https://pith.science/paper/3NW72VP7

@misc{pith2026250706470,
  author       = {Pith},
  title        = {Pith review of: Open-Set Source Tracing of Audio Deepfake Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3NW72VP7}},
  note         = {Machine review of arXiv:2507.06470}
}

read the original abstract

Existing research on source tracing of audio deepfake systems has focused primarily on the closed-set scenario, while studies that evaluate open-set performance are limited to a small number of unseen systems. Due to the large number of emerging audio deepfake systems, robust open-set source tracing is critical. We leverage the protocol of the Interspeech 2025 special session on source tracing to evaluate methods for improving open-set source tracing performance. We introduce a novel adaptation to the energy score for out-of-distribution (OOD) detection, softmax energy (SME). We find that replacing the typical temperature-scaled energy score with SME provides a relative average improvement of 31% in the standard FPR95 (false positive rate at true positive rate of 95%) measure. We further explore SME-guided training as well as copy synthesis, codec, and reverberation augmentations, yielding an FPR95 of 8.3%.

Figures

Figures reproduced from arXiv: 2507.06470 by the authors.

**Figure 1.** Average top 10 logits for MLAAD Dev set samples, predicted by the LMCL-baseline model. that energy-based OOD detection relies on ID data typically exhibiting greater magnitude energy than OOD data. Observing equation 1, note that each logit independently contributes to the magnitude of the resulting energy, with larger logits contributing exponentially more. The key difference when utilizing energy with the LMCL … view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

43 extracted references · 38 canonical work pages

[1]

Introduction In the field of audio deepfake detection, efforts to decipher the provenance of manipulated audio have been gaining attention. This task, known as source tracing or source attribution, holds importance in many sectors such as intellectual property (IP) protection, digital forensics, and enhancing trust in audio deep- fake detection systems. E...

work page 2025
[2]

[19] introduced Energy-based Open-World Soft- max which adds an output logit to estimate the model’s uncer- tainty

Related Work on OOD Detection Many approaches have been proposed to produce scores indi- cating the probability that a given sample is in-distribution (ID) versus OOD. [19] introduced Energy-based Open-World Soft- max which adds an output logit to estimate the model’s uncer- tainty. However, this approach requires modifying the model architecture and trai...

work page
[3]

Dataset and Metrics In this work, we adopt the source tracing protocol based on the MLAAD [25] dataset [17] 1

Datasets, Metrics, and Baseline 3.1. Dataset and Metrics In this work, we adopt the source tracing protocol based on the MLAAD [25] dataset [17] 1. It comprises only spoofed utter- ances and is divided into three partitions: train, development (Dev) and evaluation (Eval). To make the task more challeng- ing, organizers include OOD spoofing classes in the ...

work page
[4]

Applying softmax on the logits accentuates their skew before computing energy

SME-based Scoring for OOD Detection We propose a novel adaptation to the energy score for OOD detection (Eq 1), SME, defined as follows: Esm(x; f ) = −T ∗ log kX i eσi(f (x)/T ) (2) where σi denotes the i-th output of the softmax function. Applying softmax on the logits accentuates their skew before computing energy. Similar to the effect of scaling the l...

work page
[5]

[22] proposes adding two squared hinge loss terms to the cross-entropy loss to encourage separation by energy score

SME-based Training for OOD Detection It has been shown that the OOD detection performance of sys- tems that use MSP or energy can be improved by encourag- ing separation in the scores for ID and OOD data during train- ing [21,22]. [22] proposes adding two squared hinge loss terms to the cross-entropy loss to encourage separation by energy score. Inspired ...

work page
[6]

Implementation Details For the remaining experiments, we follow the setting of the baseline model with LMCL, except computing Dev perfor- mance using SME

Results 6.1. Implementation Details For the remaining experiments, we follow the setting of the baseline model with LMCL, except computing Dev perfor- mance using SME. For fair comparison, we repeat our base- line experiment using SME to compute Dev performance. For the SME-guided training loss hyper-parameters, we observed the distribution of SME values ...

work page
[7]

Replacing the typi- cal temperature-scaled energy score with SME provides a rela- tive improvement in average FPR95 of 31% across our experi- ments

Discussions In this paper, we propose a novel adaptation to the energy score for OOD detection: softmax energy (SME). Replacing the typi- cal temperature-scaled energy score with SME provides a rela- tive improvement in average FPR95 of 31% across our experi- ments. Leveraging SME and data augmentation, our best model without the use of auxiliary data ach...

work page
[8]

Deepfake algorithm recognition system with augmented data for add 2023 challenge

X.-M. Zeng, J.-T. Zhang, K. Li, Z.-L. Liu, W.-L. Xie, and Y . Song, “Deepfake algorithm recognition system with augmented data for add 2023 challenge.” in Proc. of IJCAI 2023 Workshop on Deep- fake Audio Detection and Analysis , 2023, pp. 31–36

work page 2023

Show all 43 references

[9]

Generalized source tracing: Detecting novel audio deep- fake algorithm with real emphasis and fake dispersion strategy,

Y . Xie, R. Fu, Z. Wen, Z. Wang, X. Wang, H. Cheng, L. Ye, and J. Tao, “Generalized source tracing: Detecting novel audio deep- fake algorithm with real emphasis and fake dispersion strategy,” in Porc. INTERSPEECH, 2024, pp. 4833–4837

2024
[10]

Attacker attri- bution of audio deepfakes,

N. M. M ¨uller, F. Dieckmann, and J. Williams, “Attacker attri- bution of audio deepfakes,” in Proc. INTERSPEECH, 2022, pp. 2788–2792

2022
[11]

Neural codec source tracing: Toward comprehensive attribution in open-set condition,

Y . Xie, X. Wang, Z. Wang, R. Fu, Z. Wen, S. Cao, L. Ma, C. Li, H. Cheng, and L. Ye, “Neural codec source tracing: Toward comprehensive attribution in open-set condition,” arXiv preprint arXiv:2501.06514, 2025

2025 arXiv
[12]

Synthetic speech detection through short-term and long-term prediction traces,

C. Borrelli, P. Bestagini, F. Antonacci, A. Sarti, and S. Tubaro, “Synthetic speech detection through short-term and long-term prediction traces,” EURASIP Journal on Information Security , vol. 2021, pp. 1–14, 2021

2021
[13]

Investigating prosodic signatures via speech pre- trained models for audio deepfake source attribution,

O. C. Phukan, D. Singh, S. R. Behera, A. B. Buduru, and R. Sharma, “Investigating prosodic signatures via speech pre- trained models for audio deepfake source attribution,” arXiv preprint arXiv:2412.17796, 2024

2024 arXiv
[14]

ADD 2023: the second au- dio deepfake detection challenge,

J. Yi, J. Tao, R. Fu, X. Yan, C. Wang, T. Wang, C. Y . Zhang, X. Zhang, Y . Zhao, Y . Ren et al. , “ADD 2023: the second au- dio deepfake detection challenge,” in Proceedings of IJCAI 2023 Workshop on Deepfake Audio Detection and Analysis , 2023, pp. 125–130

2023
[15]

Detect- ing unknown speech spoofing algorithms with nearest neighbors

J. Lu, Y . Zhang, Z. Li, Z. Shang, W. Wang, and P. Zhang, “Detect- ing unknown speech spoofing algorithms with nearest neighbors.” in Proc. of IJCAI 2023 Workshop on Deepfake Audio Detection and Analysis, 2023, pp. 89–94

2023
[16]

Towards explainable spoofed speech attribution and detection: a probabilistic approach for characterizing speech synthesizer com- ponents,

J. Mishraa, M. Chhibbera, H.-j. Shimb, and T. H. Kinnunena, “Towards explainable spoofed speech attribution and detection: a probabilistic approach for characterizing speech synthesizer com- ponents,” arXiv preprint arXiv:2502.04049, 2025

2025 arXiv
[17]

The npu-aslp system for deepfake algorithm recognition in add 2023 challenge

Z. Wang, Q. Wang, J. Yao, and L. Xie, “The npu-aslp system for deepfake algorithm recognition in add 2023 challenge.” inProc. of IJCAI 2023 Workshop on Deepfake Audio Detection and Analysis, 2023, pp. 64–69

2023
[18]

Deepfake algorithm recog- nition through multi-model fusion based on manifold measure

Y . Tian, Y . Chen, Y . Tang, and B. Fu, “Deepfake algorithm recog- nition through multi-model fusion based on manifold measure.” in Proc. of IJCAI 2023 Workshop on Deepfake Audio Detection and Analysis, 2023, pp. 76–81

2023
[19]

From speaker verification to deepfake algorithm recognition: Our learned lessons from add2023 track 3

X. Qin, X. Wang, Y . Chen, Q. Meng, and M. Li, “From speaker verification to deepfake algorithm recognition: Our learned lessons from add2023 track 3.” in Proc. of IJCAI 2023 Workshop on Deepfake Audio Detection and Analysis , 2023, pp. 107–112

2023
[20]

also explored a scoring method based on features, lever- aging Mahalanobis distance. However, a recent study [3] found that Mahalanobis and kNN distance metrics underperform com- pared to the logits-based methods, Maximum Softmax Proba- bility (MSP) [21] and energy [22]. MSP i...

2025 arXiv
[21]

An initial investigation for detecting vocoder fingerprints of fake audio,

X. Yan, J. Yi, J. Tao, C. Wang, H. Ma, T. Wang, S. Wang, and R. Fu, “An initial investigation for detecting vocoder fingerprints of fake audio,” in Proceedings of the 1st International Workshop on Deepfake Detection for Audio Multimedia , 2022, pp. 61–68

2022
[22]

Source tracing: detecting voice spoofing,

T. Zhu, X. Wang, X. Qin, and M. Li, “Source tracing: detecting voice spoofing,” in Proc. APSIPA ASC, 2022, pp. 216–220

2022
[23]

Source trac- ing of audio deepfake systems,

N. Klein, T. Chen, H. Tak, R. Casal, and E. Khoury, “Source trac- ing of audio deepfake systems,” in Proc. INTERSPEECH, 2024, pp. 1100–1104

2024
[24]

Distinguish- ing neural speech synthesis models through fingerprints in speech waveforms,

C. Y . Zhang, J. Yi, J. Tao, C. Wang, and X. Yan, “Distinguish- ing neural speech synthesis models through fingerprints in speech waveforms,” in Proc. China National Conference on Chinese Computational Linguistics, 2024, pp. 259–273

2024
[25]

Using mlaad for source tracing of audio deepfakes,

N. M ¨uller, “Using mlaad for source tracing of audio deepfakes,” https://deepfake-total.com/sourcetracing, Fraunhofer AISEC, 11 2024

2024
[26]

ASVspoof 5: Design, collection and validation of resources for spoofing, deepfake, and adversarial attack detection using crowdsourced speech,

X. Wang, H. Delgado, H. Tak, J.-w. Jung, H.-j. Shim, M. Todisco, I. Kukanov, X. Liu, M. Sahidullah, T. Kinnunenet al., “ASVspoof 5: Design, collection and validation of resources for spoofing, deepfake, and adversarial attack detection using crowdsourced speech,” arXiv preprin...

2025 arXiv
[27]

Improv- ing the robustness of deepfake audio detection through confidence calibration

Y . Zhang, J. Lu, Z. Li, Z. Shang, W. Wang, and P. Zhang, “Improv- ing the robustness of deepfake audio detection through confidence calibration.” in Proc. of IJCAI 2023 Workshop on Deepfake Audio Detection and Analysis, 2023, pp. 70–75

2023
[28]

A simple unified framework for detecting out-of-distribution samples and adversarial attacks,

K. Lee, K. Lee, H. Lee, and J. Shin, “A simple unified framework for detecting out-of-distribution samples and adversarial attacks,” in Proc. NeurIPS, vol. 31, 2018

2018
[29]

A baseline for detecting misclassi- fied and out-of-distribution examples in neural networks,

D. Hendrycks and K. Gimpel, “A baseline for detecting misclassi- fied and out-of-distribution examples in neural networks,” inProc. International Conference on Learning Representations (ICLR) , 2022

2022
[30]

Energy-based out-of- distribution detection,

W. Liu, X. Wang, J. D. Owens, and Y . Li, “Energy-based out-of- distribution detection,” in Proc. Advances in neural information processing systems (NeurIPS), vol. 33, 2020, pp. 21 464–21 475

2020
[31]

Enhancing the reliability of out-of-distribution image detection in neural networks,

S. Liang, Y . Li, and R. Srikant, “Enhancing the reliability of out-of-distribution image detection in neural networks,” in Proc. ICLR, 2018

2018
[32]

CosFace: Large margin cosine loss for deep face recognition,

H. Wang, Y . Wang, Z. Zhou, X. Ji, D. Gong, J. Zhou, Z. Li, and W. Liu, “CosFace: Large margin cosine loss for deep face recognition,” in Proc. Conference on Computer Vision and Pat- tern Recognition (CVPR), 2018, pp. 5265–5274

2018
[33]

MLAAD: The multi-language audio anti-spoofing dataset,

N. M. M ¨uller, P. Kawa, W. H. Choong, E. Casanova, E. G ¨olge, T. M ¨uller, P. Syga, P. Sperl, and K. B ¨ottinger, “MLAAD: The multi-language audio anti-spoofing dataset,” inInternational Joint Conference on Neural Networks (IJCNN) , 2024

2024
[34]

Open category detection with pac guarantees,

S. Liu, R. Garrepalli, T. Dietterich, A. Fern, and D. Hendrycks, “Open category detection with pac guarantees,” in Proc. ICML, 2018, pp. 3169–3178

2018
[35]

Deep anomaly detection with outlier exposure,

D. Hendrycks, M. Mazeika, and T. Dietterich, “Deep anomaly detection with outlier exposure,” in Proc. ICLR, 2019

2019
[36]

MCE 2018: The 1st multi-target speaker detection and identification challenge evaluation,

S. Shon, N. Dehak, D. Reynolds, and J. Glass, “MCE 2018: The 1st multi-target speaker detection and identification challenge evaluation,” in Proc. INTERSPEECH, 2019, pp. 356–360

2018
[37]

Deep residual learning for image recognition,

K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proc. CVPR, 2016, pp. 770–778

2016
[38]

ASVspoof 5: Crowdsourced speech data, deepfakes, and adversarial attacks at scale,

X. Wang, H. Delgado, H. Tak, J.-w. Jung, H.-j. Shim, M. Todisco, I. Kukanov, X. Liu, M. Sahidullah, T. Kinnunenet al., “ASVspoof 5: Crowdsourced speech data, deepfakes, and adversarial attacks at scale,” in Proc. ASVspoof 2024 Workshop, 2024, pp. 1–8

2024
[39]

Neural source-filter waveform models for statistical parametric speech synthesis,

X. Wang, S. Takaki, and J. Yamagishi, “Neural source-filter waveform models for statistical parametric speech synthesis,” IEEE/ACM Transactions on Audio, Speech, and Language Pro- cessing, vol. 28, pp. 402–415, 2020

2020
[40]

Waveglow: A flow-based generative network for speech synthesis,

R. Prenger, R. Valle, and B. Catanzaro, “Waveglow: A flow-based generative network for speech synthesis,” inProc. ICASSP, 2019, pp. 3617–3621

2019
[41]

HiFi-GAN: Generative adversarial networks for efficient and high fidelity speech synthesis,

J. Kong, J. Kim, and J. Bae, “HiFi-GAN: Generative adversarial networks for efficient and high fidelity speech synthesis,” Proc. NeurIPS, vol. 33, pp. 17 022–17 033, 2020

2020
[42]

Spoofed training data for speech spoofing countermeasure can be efficiently created using neural vocoders,

X. Wang and J. Yamagishi, “Spoofed training data for speech spoofing countermeasure can be efficiently created using neural vocoders,” in Proc. ICASSP, 2023, pp. 1–5

2023
[43]

librosa: Audio and music signal analysis in python,

B. McFee, C. Raffel, D. Liang, D. P. Ellis, M. McVicar, E. Batten- berg, and O. Nieto, “librosa: Audio and music signal analysis in python,” in Proceedings of the 14th python in science conference , vol. 8, 2015

2015

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

Introduction In the field of audio deepfake detection, efforts to decipher the provenance of manipulated audio have been gaining attention. This task, known as source tracing or source attribution, holds importance in many sectors such as intellectual property (IP) protection, digital forensics, and enhancing trust in audio deep- fake detection systems. E...

work page 2025

[2] [2]

[19] introduced Energy-based Open-World Soft- max which adds an output logit to estimate the model’s uncer- tainty

Related Work on OOD Detection Many approaches have been proposed to produce scores indi- cating the probability that a given sample is in-distribution (ID) versus OOD. [19] introduced Energy-based Open-World Soft- max which adds an output logit to estimate the model’s uncer- tainty. However, this approach requires modifying the model architecture and trai...

work page

[3] [3]

Dataset and Metrics In this work, we adopt the source tracing protocol based on the MLAAD [25] dataset [17] 1

Datasets, Metrics, and Baseline 3.1. Dataset and Metrics In this work, we adopt the source tracing protocol based on the MLAAD [25] dataset [17] 1. It comprises only spoofed utter- ances and is divided into three partitions: train, development (Dev) and evaluation (Eval). To make the task more challeng- ing, organizers include OOD spoofing classes in the ...

work page

[4] [4]

Applying softmax on the logits accentuates their skew before computing energy

SME-based Scoring for OOD Detection We propose a novel adaptation to the energy score for OOD detection (Eq 1), SME, defined as follows: Esm(x; f ) = −T ∗ log kX i eσi(f (x)/T ) (2) where σi denotes the i-th output of the softmax function. Applying softmax on the logits accentuates their skew before computing energy. Similar to the effect of scaling the l...

work page

[5] [5]

[22] proposes adding two squared hinge loss terms to the cross-entropy loss to encourage separation by energy score

SME-based Training for OOD Detection It has been shown that the OOD detection performance of sys- tems that use MSP or energy can be improved by encourag- ing separation in the scores for ID and OOD data during train- ing [21,22]. [22] proposes adding two squared hinge loss terms to the cross-entropy loss to encourage separation by energy score. Inspired ...

work page

[6] [6]

Implementation Details For the remaining experiments, we follow the setting of the baseline model with LMCL, except computing Dev perfor- mance using SME

Results 6.1. Implementation Details For the remaining experiments, we follow the setting of the baseline model with LMCL, except computing Dev perfor- mance using SME. For fair comparison, we repeat our base- line experiment using SME to compute Dev performance. For the SME-guided training loss hyper-parameters, we observed the distribution of SME values ...

work page

[7] [7]

Replacing the typi- cal temperature-scaled energy score with SME provides a rela- tive improvement in average FPR95 of 31% across our experi- ments

Discussions In this paper, we propose a novel adaptation to the energy score for OOD detection: softmax energy (SME). Replacing the typi- cal temperature-scaled energy score with SME provides a rela- tive improvement in average FPR95 of 31% across our experi- ments. Leveraging SME and data augmentation, our best model without the use of auxiliary data ach...

work page

[8] [8]

Deepfake algorithm recognition system with augmented data for add 2023 challenge

X.-M. Zeng, J.-T. Zhang, K. Li, Z.-L. Liu, W.-L. Xie, and Y . Song, “Deepfake algorithm recognition system with augmented data for add 2023 challenge.” in Proc. of IJCAI 2023 Workshop on Deep- fake Audio Detection and Analysis , 2023, pp. 31–36

work page 2023