In this paper, we present our proposed system on Audio Deepfake Detection Challenge (ADD) 2023 Track 2- Manipulation region location (RL). Speech synthesis and voice conversion technologies have been developed in the past few years. However, synthetic audio is harmful when used by criminals and it may attack the security detection system and bring security risks, therefore, fake audio detection technology is in urgent need. Audo Deepfake Detection Challenge extends the attack scenarios into more aspects including manipulation region location where an audio is manipulated by other fake or true audio. To make localization more accurate, we apply the Convolutional Recurrent Neural Network where the CNN extracts high temporal resolution features and RNN models the context information. Besides, we apply linear-softmax pooling method to get the utterance-level true-fake determination which is a weighted sum of frame-level detection scores. To train a noise-robust model, we add MUSAN noise and reverberation to the raw audio. Our system ranked third in ADD 2023 Track 2 with achieving 54.49% segment-based F1-score and 79.50% utterance-level accuracy.
region location (RL) of the ADD 2023 challenge. We study how to design neural network structure and how Audio Deepfake Detection (ADD) is the task to detect the to train the model in both clip-level and frame-level to fake audio which is synthesized. Manipulation region increase both the detection and localization capability of location (RL) is a subtask of ADD, the fake audio is ma- the model. Specifically we apply the convolution recurnipulated partially with other true or fake audio, it is the rent neural network [11] (CRNN) as our backbone and multitask with utterance-level detection and segment- we train the CRNN model in multitask learning manner. based localization. Due to the complexity of audios in In audio detection filed, such as sound event detecrealistic scenarios, it is still very hard to distinguish fake tion, CRNN is usually used to model local and global audios from real ones, and the localization is more chal- information. It has three parts: CNN, RNN and localizalenged as the manipulated region hides in true audio [1]. tion module. The CNN extracts temporal representation It is crucial to detect the fake audio, as it can undermine with limited receptive region to increase the discriminathe robustness of broadly implemented biometric iden- tion among frames, but the global information is insuftification systems and can be harnessed by in-the-wild ifcient. Directly enlarging the receptive region of CNN attackers for criminal usage [2, 3, 4]. Some methods have with pooling or large kernel will decrease the discrimibeen explored to detect the fake audios [5, 6, 7, 8, 9]. nation among frames, which is harmful to frame-level
Audio Deepfake Detection challenge, start from 2022, detection task. In CRNN, after extracting the frame-level has greatly promotes the development of ADD [10]. In output embeddings with CNN, RNN is used to further this year, it has three tracks: the track1 includes two model the context information which compensate for the subtasks with fake audio generation and detection which global information loss of CNN. After RNN, the localizaaims to generate more realistic fake audios and design tion module (a classifier) is used to get frame-level predicmore discriminative models to detect the generated fake tions. Considering the strengths of CRNN, we introduce audio respectively; the track2 is Manipulation region it for RL task instead of only using CNN. Besides, as this location (RL) where participants should not only deter- track evaluates the model performance in both framemine the audio type in utterance-level but also localize level (localization) and clip-level (detection), the CRNN the manipulated region; the track3 aims to recognize the model is trained in multitask learning manner, and to algorithms of deepfake audios. transfer the clip-level classification ability to frame-level This paper presents our work for Track2-Manipulation and aggregate the frame-level predictions to clip-level prediction, linear-softmax pooling [12] is used. Finally, to train a noise-robust model, MUSAN noise [13] and RIR [14] are used as data augmentation.
The model is trained on development dataset, and evaluated on (1) oficial evaluation dataset ; (2) our synthetic partial fake audio dataset with the fully true and fake audio from track1.2 to analyze the models in more detail.
Our system achieves 54.49% segment-based F1-score and 79.5% utterance-level accuracy on the oficial evaluation dataset, and also achieves 11.43% frame-level EER and 11.10% clip-level EER on our synthetic dataset.
The following of this paper is organized: in section 2, we introduce the CRNN model structure and the multitask learning method, in section 3, we introduce the dataset, data augmentation, feature extraction, experiment configurations and evaluation metric, in section 4 we evaluated the performance of diefrent models and learning methods, and finally we conclude this paper in section 5.
The model structure of CRNN is shown in Figure 1, The relation of utterance fake and frame fake is bagthe CRNN model has three part: CNN, RNN and clas- instance, and often obey the standard multiple instance sifier+softmax. The input is log-mel spectrogram, it is (SMI) assumption: the bag label is positive if and only if feed to CNN block firstly, the CNN block has 5 sub-blocks, the bag contains at least one positive instance. In clipeach sub-block is a VGG-style block which contains con- level, the model is trained in a multi-instance learning volution block, batch normalization and ReLU activa- manner, while in frame-level, the model is trained in a tion function, they are stacked by Conv-BN-Conv-BN- standard supervised learning manner. We term the whole ReLU and followed by average pooling. To maintain a training method as multitask learning high temporal resolution (as the detection is applied at Specifically given frame-level prediction ∈ every 0.01s), the average pooling is only applied along R ×2 , the 2 class denotes fake and true respectively. frequency-dimension. After the CNN block, frequency- We select the frame-level fake prediction , ∈ wise global average pooling is used to get frame-level R ×1 , the clip-level fake prediction , ∈ R1 is a representations, then the output is feed to Bi-GRU which weighted average of ,, it is implemented with has 2 layers, finally a classifier with softmax is used to linear-softmax pooling [12] method: get frame-level prediction. The configuration of CRNN model is shown in Table 1.
, = ∑︀ 2,,/ ∑︀ ,, =0 =0
(1) where denotes the ℎ frame, the , ∈ R1 and
∈ R2 are defined as: provided by organizers, the audio samples of train and dev set are shown in Table 2. In our exploration, we find , = 1 − , (2) the dev set are too easy to detect and localize fake audios, = (,, ,) (3) therefore, we synthesis another dev set with cut-paste the audio from track1.2 dev set, also shown in Table 2, Given clip-level prediction and frame-level predic- and we mainly validate our model on the synthetic-dev tion , the loss function for the data with batch size dataset. is a sum of frame-level and clip-level Cross-Entropy loss in which is defined as follows, 3.2. Input representations 2 1 ∑︁ ∑︁ ,,(,,) = −
=0 =0 1 2 − ∑=︁0 ∑=︁0 ∑=︁0 ,,,(,,,) where the , ∈ R2 and ,, ∈ R2 denotes the clip-level and frame-level one-hot labels respectively, the denotes the ℎ sample,the denotes the ℎ frame.
With the linear-softmax pooling to aggregate the frame-level predictions to clip-level prediction, the gradient of clip-level loss also afects the frame-level learning, and the frame-level predictions are driven to the extremes 0 and 1, resulting in well-localized detections of sound events, which has been explored in [12]. Linear-softmax pooling is better than mean or max pooling, because the max pooling is afected by false positive predictions and the mean pooling shows worse performance when detect short duration manipulated region.
Mel-spectrogram is extracted, which is based on short(4) time Fourier transform (STFT), the window size of fast Fourier transform (FFT) is 25ms, the hop size is 10ms, the FFT number 512, the mel filter number is 41. As a result, each 4-second sound clip is transformed into a 2D time-frequency representation with a size of (400×41) as the model input after instance mean-std normalization.
0.01, SGD is used as optimizer with momentum of 0.9 and weight decay of 1e-4. We set balanced weight for CE loss based on the duration of true and fake region.
As the fake region is very realistic, the fake probability is usually small when the model is evaluated on the Our models are firstly evaluated on syn-dev dataset with evaluation dataset, therefore, we tune the threshold to a frame-level and clip-levl EER metric. Then the model is small value to get hard output from soft fake predictions, evaluated on the oficial rank metrics including utterancethe manipulate region is further determined as shown in level accuracy (ACC) and segment-based F1-score. Specififgure 2. And the utterance-level and frame-level predic- ically, given the number of frame-level true positive (TP), tions share diferent thresholds.
4. Results achieves worse results which shows the linear-softmax pooling is a better aggregation method to pool the frameIn this section, we firstly evaluate our models on the syn- level predictions to clip-level prediction (we only change dev dataset to show the performance of CRNN model, the pooling function in the test stage, as simply use mean linear-softmax pooling, and data augmentaions, in this or max pooling in the training stage achieve worse recase, we use a fixed threshold of 0.5 to determine the fake sults and they do not obey the standard multiple instance detection. Then we report the results on the leaderboard (SMI) assumption [12]). of our models with tuning a best threshold to balance the precision and recall rate.
As shown in Table3, the CRNN model with linear-softmax achieves best results among our submissions with 54.49% pooling and data augmentation achieves best results of SB-F1 and 79.50% ACC, which ranked third in the chal11.43% frame-level EER, 87.46%segment-based F1 and lenge. Without GRU or augmentaion, the performance 11.10% clip-level EER. With out data augmentation, the decreased by a large margin, the evaluation may share performance decreases by a large margin, which shows diferent data distribution with the development, therethat the MUSAN noise and RIR help train a robust model. fore, data augmentation will reduce the overfitting to the Without GRU, the performance also decreased, especially training set. As there are more parameters in CRNN and the SB-F1, which show that GRU helps model the context the feature space becomes larger after using RNN to modinformation which is beneficial for detection task. Replac- eling the context information among frames, the CRNN ing linear-softmax with max pooling or mean pooling
model is easier to overfit to training data compared with CNN, therefore, without data augmentation, the performance of CRNN decreased a lot and is even worse than CNN. As shown in Table 5, without thresholding (i.e., use ifxed threshold of 0.5), the performance decreses, which shows that the fake audio in the evaluation dataset may be more realistic, resulting in low prediction probability, and threshold independent metric may be more appropriate for evaluation. Finally, the linear-softmax pooling also achieves best performance on the evaluation dataset compared with mean and max pooling.
the ADD 2023 challenge. To be specific, we use the CRNN model as backbone and train the model in a multitask learning manner. The RNN models the context information which is benifical to detection task, and in the multitask-learning, linear-softmax pooling helps get more precise clip-level fake detection results. MUSAN and RIR are used as data augmentation to make the model generalize to unseen data. Our final model achieves the 54.49% SB-F1 score and 79.5% ACC which ranked third on the leaderboard. In the future, we are aiming to design better models and study how to synthesis more realistic fake audios for training models. [6] Z. Peng, X. Li, T. Lee, Pairing weak with strong:
Twin models for defending against adversarial attack on speaker verification., in: Interspeech, 2021, pp. 4284–4288. [7] H. Wu, H.-C. Kuo, N. Zheng, K.-H. Hung, H.-Y. Lee,
Y. Tsao, H.-M. Wang, H. Meng, Partially fake audio detection by self-attention-based fake span discovery, in: ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), IEEE, 2022, pp. 9236–9240. [8] Z. Lv, S. Zhang, K. Tang, P. Hu, Fake audio detection based on unsupervised pretraining models, in: ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), IEEE, 2022, pp. 9231–9235. [9] J. M. Martín-Doñas, A. Álvarez, The vicomtech audio deepfake detection system based on wav2vec2 for the 2022 add challenge, in: ICASSP 20222022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), IEEE, 2022, pp. 9241–9245. [10] R. F. X. Y. C. W. T. W. C. Y. Z. X. Z. Y. Z. Y. R. L.
X. J. Z. H. G. Z. W. S. L. Z. L. H. L. Jiangyan Yi, Jianhua Tao, Add 2023: the second audio deepfake detection challenge, IJCAI 2023 Workshop on Deepfake Audio Detection and Analysis (DADA 2023) (2023). [11] E. Cakır, G. Parascandolo, T. Heittola, H. Huttunen,
T. Virtanen, Convolutional recurrent neural networks for polyphonic sound event detection, IEEE Trans. Audio, Speech, and Language Proc. 25 (2017) [1] J. Yi, Y. Bai, J. Tao, Z. Tian, C. Wang, T. Wang, R. Fu, 1291–1303.
Half-truth: A partially fake audio detection dataset, [12] Y. Wang, J. Li, F. Metze, A comparison of five arXiv preprint arXiv:2104.03617 (2021). multiple instance learning pooling functions for [2] H. Wu, Y. Zhang, Z. Wu, D. Wang, H.-y. Lee, sound event detection with weak labeling, in: IEEE Voting for the right answer: Adversarial de- ICASSP, 2019, pp. 31–35. fense for speaker verification, arXiv preprint [13] D. Snyder, G. Chen, D. Povey, Musan: A muarXiv:2106.07868 (2021). sic, speech, and noise corpus, arXiv preprint [3] Z. Wu, S. Gao, E. S. Cling, H. Li, A study on re- arXiv:1510.08484 (2015).
play attack and anti-spoofing for text-dependent [14] T. Ko, V. Peddinti, D. Povey, M. L. Seltzer, S. Khudanspeaker verification, in: Signal and Information pur, A study on data augmentation of reverberant Processing Association Annual Summit and Con- speech for robust speech recognition, in: 2017 IEEE ference (APSIPA), 2014 Asia-Pacific, IEEE, 2014, pp. International Conference on Acoustics, Speech and 1–5. Signal Processing (ICASSP), IEEE, 2017, pp. 5220– [4] S. Liu, H. Wu, H.-y. Lee, H. Meng, Adversarial at- 5224.
tacks on spoofing countermeasures of automatic speaker verification, in: 2019 IEEE Automatic Speech Recognition and Understanding Workshop (ASRU), IEEE, 2019, pp. 312–319. [5] H. Wu, X. Li, A. T. Liu, Z. Wu, H. Meng, H.-y. Lee,
Adversarial defense for automatic speaker verification by cascaded self-supervised learning models, in: ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), IEEE, 2021, pp. 6718–6722.