The Vicomtech partial deepfake detection and location system for the 2023 ADD Challenge

Abstract

This paper describes our submitted system to the 2023 Audio Deepfake Detection Challenge Track 2. This track focuses on locating the manipulated regions in partially fake audio. Our approach integrates a pre-trained Wav2Vec2 based feature extractor and two diferent downstream models for deepfake detection and audio clustering. While the detection module is composed of a simple but eficient downstream neural classification model, the clustering-based neural network was trained to first segment the audio and then discriminate between the original regions and the manipulated segments. The final segmentation was obtained by combining the clustering process with the decision score through the application of some post-processing strategies. We evaluate our system on the test set of the challenge track, showing good performance for partially fake detection and location in challenging environments. Our novel, simple and eficient approach ranked fourth in the mentioned challenge among sixteen participants.

Keywords

• eol>Partial deepfake
• anti-spoofing
• audio tampering
• wav2vec2
• deep clustering

1. Introduction

The remainder of this paper is organized as follows.

Section 2 briefly reviews related works for partial deepfake detection and location. Our proposed approach is described in Section 3, including the diferent neural network modules and post-processing techniques. Then, Section 4 discusses the experimental framework and challenge results. Finally, the conclusions are summarized in Section 5.

2. Related work

Cosine Layer Linear Layer Att. Stat. Pool.

FF Layers

o Adap. Layer h, Detection

Clustering wav2vec2 Transformer Layer L

The increasing interest in partial deepfakes has con

tributed to creating related databases to train and eval- Transformer Layer 1 uate countermeasure systems. This is the case of the CNN Feature Encoder PartialSpoof [ 8 ] or the Half-Truth databases [ 9 ]. For the former, the authors experimented with detection systems that combine self-supervised feature extractors with both utterance- and segment-level scoring [ 10, 12 ]. Several techniques were proposed for the partial deepfake de- aFnigdulroeca1t:iOonvesryvsiteewmobfathseedproonpowsaevd2pvaerct2i.al deepfake detection tection track of ADD 2022 challenge [ 13, 14, 17, 18 ] considering diferent architectures and data augmentation techniques. Although the goal was the detection of partial fakes, the work in [ 15 ] included a fake span discovery 3. Proposed approach mechanism via question answering to predict the boundaries of the fake clip, but the location performance was A diagram of our proposed system for the ADD Challenge not evaluated. On the other hand, recent works have 2023 is shown in Figure 1. Our system is composed of a also explored the location of fake clips or manipulated W2V2 feature extractor and the corresponding detection audio by detecting the artifacts in the boundaries of the and clustering neural networks. A detailed explanation inserted segment [ 19, 20, 21 ]. Thus, these works com- of each part is presented in the following subsections, monly addressed the problem as a classification task to including the processing of the final system output. detect the frames containing the boundaries.

Our proposed approach is based on our previous sys- 3.1. Wav2Vec2 Feature Extractor tem for partial deepfake detection presented to the 2022 ADD challenge [ 13 ]. We further improved our method First, we extract deep features from the speech signal usby considering a clustering-based neural network to seg- ing pre-trained self-supervised neural networks. In this ment the original and manipulated parts of the audio. work we integrated the XLS-128 W2V2 model [24, 25], This approach is inspired by previous works in source which includes 300M parameters and was trained with separation [22] and speaker diarization [23], where this unlabelled speech data from 128 diferent languages. A deep clustering technique proved to perform well. We 7-layer convolutional network encoder is first used to proexplored the clustering approach for partial deepfake lo- cess the speech signal, extracting 1024-dimension vector cation for two reasons. Firstly, as the manipulation can representations every 20 ms with a receptive field of 25 be done with an original clip, directly detecting spoofed ms. These features are further processed with a 24-layer segments in the audio is not feasible. Secondly, the direct Transformer to compute contextualized representations detection of boundaries can be challenging to address from the speech signal. The model was trained using selfdue to the class-imbalance behavior of the problem (few supervised techniques to learn high-level representations boundary segments in the whole audio). Our approach is of the speech data. based on first segmenting the audio by exploiting acoustic Instead of fine-tuning the W2V2 model for each spediferences in consecutive regions generated by diferent cific task, we considered a general pre-trained feature speakers, genuine and fake audio segments, the back- extractor for the diferent downstream models. We exground o boundary artifacts, among others. Then, this ploited the information from the diferent transformer information is used along our detection-based module to layers in order to robust the speech representation for classify the segments into original or fake clips. To the the downstream task. Thus, a trainable adaptation layer best of our knowledge, this is the first work exploring is plugged between the W2V2 feature extractor and the clustering-based methods for partial deepfake location. downstream model. The adaptation layer consists of a temporal normalization layer [26] followed by a weighted sum of the diferent layers o = ∑︀

=0 h,, where h, is the hidden representation for time step and transformer layer , is the number of transformer layers, and are trainable weights normalized to sum one. The output representations o are then used as the input for the specialized downstream models [27].

3.2. Deepfake detection and clustering networks

The objective of the task is not only to detect partially fake audio but also to indicate the segment of the speech that has been manipulated. Therefore, our approach is based on combining two diferent modules which we have named as detection and clustering networks. The architectures of both modules are described in the following paragraphs.

The detection network is identical to the one used in our previous work for the ADD2022 Challenge [ 13 ]. The network scores the audio signal, where the scoring is related to the likeness of the audio to be genuine. The output representations from the corresponding adaptation layer are first processed by two feed-forward (FF) layers with ReLU activations and dropout. A single embedding vector from the audio is then obtained using attentive statistical pooling followed by a linear activation layer. Finally, the final score is obtained using a cosine layer, which computes the cosine similarity between the embedding and a trainable vector network. The model is trained to give higher scores for genuine speech using a One-class (OC) softmax loss function [28].

The manipulated segment location involves a more challenging task. In this challenge, the partial deepfake can be created using synthetic or real audios, which makes it dificult to use previous methods for partial spoofing segment scoring [ 12 ]. Faced with this complex scenario, we propose using a clustering-based approach, where the network is trained to classify the output representations into two diferent clusters whenever they represent original audio, manipulated real clips, or synthetic speech. The underlying idea is that the network can learn to segment the audio when detecting diferent acoustic conditions or insertion artifacts. The output representations are fed into a recurrent bidirectional neural network based on LSTM (BLSTM) to exploit temporal information on the vectors fully. The output is processed by a FF layer with sigmoid activation that outputs a single value per time. The network is trained using binary cross-entropy (BCE) loss. To avoid the label ambiguity problem in the clusters assignment, we used permutationinvariant training (PIT) [22].

To summarize the network architecture and make its structure easier to understand for the reader, in Table 1 we show the layers and their output dimensions for each corresponding network module.

3.3. Post-processing strategies

Our proposed systems outputs an score ∈ [ −1, 1 ] from the detection model and a sequence = [1, · · · , ] ∈ [ 0, 1 ] from the clustering module. We analyzed the results in the development set to design a group of postprocessing strategies for the final clustering of the testing audios. We first binarized the sequence by thresholding to segment the speech signal into two clusters, where the threshold is set experimentally. Sequences with only one segment (unique cluster) are classified as genuine or fake clips using the detection score with a pre-defined optimum threshold. Moreover, during the PIT training, the network seems to have learnt a discriminative clustering between original and fake clips. We observed this on the development set, where the clustering module tends to assign lower values to the part of the original clip and higher values for manipulated or fake clips. This may be due to the artifacts in the fake clip, or the boundaries, yielding the network to detect these structures. Then, for the first attempt, we directly map the segments with zero value to genuine/real audio parts, and the rest with one value to fake parts.

However, there were some audios for which the clustering module tended to detect several short segments of fake audio. We define short segments as thoses with a duration spanning the receptive field of the W2V2 model (i.e., one or two W2V2 feature frames). This efect was more common in genuine clips manipulated with real audio segments, specially in those in which the genuine and manipulated segment belong to the same speakers.

Thus, the network seems to detect the artifacts on the boundaries in the inserted clips as fake segments. In those cases, we hypothesized that this information could help to discover the fake segments from a manipulated The detection and clustering modules were trained inregion. Following this assumptions, we evaluated three dependently using the same pre-trained W2V2 model post-processing strategies applied to the initially com- as feature extractor. The training of both models was puted clusters: performed with the Adam optimizer. [29] with a learning 1. If two non-consecutive short segments are de- rraattee foofr3t h·e10FF−4 lawyeirtshoinutthweedigethetcdtieocnany,eatwndortkhewdasrospeotutot tected as fake, and the rest are tagged as genuine, 0.2. The W2V2 parameters were frozen during training. the segments in the middle of the fake segments In order to cope with limitations in GPU memory, we are labelled as fake as well. used a mini-batch of 8 utterances and accumulated gra2. If only a single short segment was detected as dients of eight mini-batches, yielding an efective minifake, we considered it as a single boundary di- batch of 64 utterances. The length of the utterances was viding two segments, where the longest one is adjusted using zero-padding during batch creation. To labelled as genuine and the shortest as fake. validate the model and keep the best parameters, we eval3. As an extension of the first rule, if more than 2 uated the performance on the development set after each short segments were initially tagged as fake, the epoch and considered an early-stopping strategy. Thus, ifrst and last segments were considered as borders we kept the model with the lowest validation loss, and the and all the segments in the middle were labelled training stopped after 10 epochs without improvements as fake as well, by keeping the segments outside on the development set.

the borders as genuine. Additionally, with the aim of improving our models’ Although these strategies are mainly based on empirical robustness for challenging conditions, we also explored analysis of development data, we expected they help to data augmentation techniques during the training phase. improve the location accuracy of partially fake clips. We We considered the recently proposed Rawboost method will discuss the benefits of the post-processing settings [30], which has shown outstanding performance for deepin the following subsection. fake detection and anti-spoofing systems. Rawboost operates directly upon raw waveform speech signals by considering diferent distortions created on the fly for 4. Experimental results a given audio signal. In particular, we evaluated using linear and non-linear convolutive noise as well as impulsive signal-dependent additive noise. We chose this method to evolve the finite impulse response (FIR) data augmentation we analyzed for partial deepfake detection in the ADD 2022 challenge [ 13 ], which showed significant improvements in the tasks evaluated.

In this section, we first describe the speech databases used during the challenge to train and test the diferent approaches. Then, we explain the training setup procedure as well as the data augmentation techniques applied to the speech data. Finally, we show and analyze the experimental results obtained during the challenge evaluation phase and our best approach.

4.3. Challenge results

4.1. ADD 2023 Track 2 database

The ADD 2023 Track 2 database [ 16 ] comprises genuine and partially fake Chinese speech. The partial deepfakes can be complete fake audios generated by synthetic or voice conversion techniques, or manipulated audios where another real clip or synthetic segment has replaced a part of a genuine utterance. The database includes training, development, and evaluation sets with approximately 53K, 18K, and 50K utterances, respectively. The audios from the training and development partitions are annotated, indicating whether they are genuine or partial deepfakes, and the temporal boundaries of the original and inserted clips.

4.2. Experimental framework

The downstream models were fine-tuned using the data from the training set in the ADD2023 Track 2 database.

We evaluated our proposed approach in the test set of the ADD2023 Track2 database. The participant systems in the challenge were evaluated using a metric score defined by the organizers. This score is computed as follows,

Score = 0.3 · sen + 0.7 · 1seg, (1) where sen is the average sentence accuracy (related to the classification of audios as genuine or fake), and 1seg corresponds to an average segment 1 score that measures the ability of the model to identify manipulated areas in speech correctly. The 1 score is obtained by taking fake segments as positive samples and using a frame length of 10 ms. The weighted factors were deifned by the organizers, giving more importance to the segmentation than the fakeness detection.

Table 2 shows the results obtained for our diferent evaluated systems in the challenge. For each method, we provide the resulting final score, the sentence accuracy, and the segment 1 score. In addition, we also report the precision and recall for the fake segments. We compared five diferent alternatives: standalone clustering approach (Cluster), classification of single-segment audios using the detection module with an optimized threshold (Det.), and the combination of post-processing stages to refine the clusters (PP). As it can be observed, the best results were obtained when the clustering and detection modules were combined with post-processing strategies, especifically when applying one and multiple fake short-segments detection (rules 2 and 3).

An analysis of the results obtained gives some insights into how the diferent steps help improve the final score. The base system shows good sentence detection accuracy (close to 78%), but with the lowest recall of the fake segments, which indicates that the system does not recover many manipulated parts. The detection threshold optimization yields some improvements in the accuracy and the recall at the expense of a reduction in precision. Nevertheless, the final results show better performance in terms of 1 score. Then, applying the post-processing techniques on detected manipulated utterances helps to better locate the regions with fake audio. The three evaluated combinations show similar precision around 50%, but the best combination of rules yields the best recall of 53% and a 1 score close to 52%. It demonstrates how we can exploit the detected artifact regions during the clustering step to refine the final output and better catch insertion clips.

5. Conclusions

In this work, we have presented our proposed system for

the 2023 ADD challenge Track 2 based on a pre-trained wav2vec2 feature extractor and downstream neural networks for detection and clustering of partial deepfakes. Our approach exploits the deep features from W2V2 to develop two modules: (1) a detection network that scores the audio in terms of its likeness to be a partial deepfake, and (2) a clustering-based network that segments the audio to discriminate between original and fake clips. This information is combined to obtain the final segmentation, using post-processing strategies to refine the result. Our proposed method shows competitive results in the 2023 ADD challenge, ranking fourth in Track 2 among the participants. As future work, we will further research the combination of both modules to improve the accuracy in the detection of manipulated segments. In addition, we will analyze diferent data augmentation techniques to better adapt the system for challenging scenarios with diferent background conditions, as well as other self-supervised models to compute robust speech representations.

Acknowledgments

This work has received funding from the European Union’s Horizon Europe research and innovation programme in the context of project EITHOS, under Grant Agreement No. 101073928.

References

[1] B. Sisman , J. Yamagishi , S. King , H. Li , An overview of voice conversion and its challenges: From statistical modeling to deep learning , IEEE/ACM Transactions on Audio, Speech, and Language Processing 29 ( 2021 ) 132 - 157 .

[2] T.-N. Le , H. H. Nguyen , J. Yamagishi , I. Echizen , Robust deepfake on unrestricted media: Generation and detection , in: Frontiers in Fake Media Generation and Detection , 2022 , pp. 81 - 107 .

[3] Z. Wu , N. Evans , T. Kinnunen , J. Yamagishi , F. Alegre , H. Li , Spoofing and countermeasures for speaker verification: A survey , Speech Communication 66 ( 2015 ) 130 - 153 .

[4] C. B. Tan , et al., A survey on presentation attack detection for automatic speaker verification systems: State-of-the-art, taxonomy, issues and future direction , Multimedia Tools and Applications 80 ( 2021 ) 32725 - 32762 .

[5] A. Nautsch , X. Wang , N. Evans , T. H. Kinnunen , V. Vestman , M. Todisco , H. Delgado , M. Sahidullah , J. Yamagishi , K. A. Lee , ASVspoof 2019 : spoofing countermeasures for the detection of synthesized, speech , in: Proc. ICPR , 2022 , pp. 3224 - 3230 . converted and replayed speech , IEEE Transactions [21] Z. Cai , W. Wang , M. Li , Waveform boundary detecon Biometrics, Behavior, and Identity Science 3 tion for partially spoofed audio , in: Proc. ICASSP , ( 2021 ) 252 - 265 . 2023 .

[6] J. Yamagishi , et al., ASVspoof 2021 : Accelerating [22] M. Kolbaek , D. Yu , Z.-H. Tan , J. Jensen , Multitalker progress in spoofed and deepfake speech detection, speech separation with utterance-level permutain : Proc. ASVspoof Workshop , 2021 , pp. 47 - 54 . tion invariant training of deep recurrent neural net-

[7] J. Yi , et al., ADD 2022 : The first audio deep synthesis works , IEEE/ACM Transactions on Audio, Speech, detection challenge, in: Proc. ICASSP , 2022 , pp. and Language Processing 25 ( 2017 ) 1901 - 1913 . 9216 - 9220 . [23] S. Horiguchi , Y. Fujita , S. Watanabe , Y. Xue , P. Gar-

[8] L. Zhang , X. Wang , E. Cooper , J. Yamagishi, cia, Encoder -decoder based attractors for end-toJ. Patino , N. Evans , An initial investigation for end neural diarization, IEEE/ACM Transactions on detecting partially spoofed audio , in: Proc. Inter- Audio, Speech, and Language Processing 30 ( 2022 ) Speech, 2021 , pp. 4264 - 4268 . 1493 - 1507 .

[9] J. Yi , Y. Bai , J. Tao , H. Ma , Z. Tian , C. Wang , T. Wang , [24] A. Baevski , Y. Zhou , A. Mohamed , M. Auli , wav2vec R. Fu , Half-Truth : A partially fake audio detection 2.0: A framework for self-supervised learning of dataset , in: Proc. InterSpeech , 2021 , pp. 1654 - 1658 . speech representations, in: Proc. NeurIPS , 2020 , pp.

[10] L. Zhang , X. Wang , E. Cooper , J. Yamagishi , Multi- 12449 -12460. task learning in utterance-level and segmental-level [25] A. Babu , et al., XLS-R : Self-supervised cross-lingual spoof detection , in: Proc. ASVspoof Workshop , speech representation learning at scale, arXiv 2021 , pp. 9 - 15 . preprint arXiv: 2111 .09296 ( 2021 ).

[11] M. H. Rahman , et al., Detecting synthetic speech [26] D. Ulyanov , A. Vedaldi , V. Lempitsky , Instance manipulation in real audio recordings , in: Proc. normalization: The missing ingredient for fast stylIEEE WIFS , 2022 . ization, arXiv preprint arXiv:1607.08022 ( 2016 ).

[12] L. Zhang , X. Wang , E. Cooper , N. Evans , J. Yamag- [27] L. Pepino , P. Riera , L. Ferrer, Emotion Recognition ishi, The PartialSpoof database and countermea- from Speech Using wav2vec 2.0 Embeddings, in: sures for the detection of short fake speech seg- Proc. InterSpeech , 2021 , pp. 3400 - 3404 . ments embedded in an utterance , IEEE/ACM Trans- [28] Y. Zhang , F. Jiang , Z. Duan , One-class learning actions on Audio, Speech, and Language Processing towards synthetic voice spoofing detection , IEEE 31 ( 2023 ) 813 - 825 . Signal Processing Letters 28 ( 2021 ) 937 - 941 .

[13] J. M. Martín-Doñas , A. Álvarez , The Vicomtech au- [29] D. P. Kingma , J. Ba , Adam: A method for stochastic dio deepfake detection system based on Wav2Vec2 optimization , in: Proc. ICLR , 2015 . for the 2022 ADD Challenge , in: Proc. ICASSP , 2022 , [30] H. Tak , M. Kamble , J. Patino , M. Todisco , N. Evans , pp. 9241 - 9245 . Rawboost: A raw data boosting and augmentation

[14] Z. Lv , S. Zhang , K. Tang , P. Hu, Fake audio detection method applied to automatic speaker verification based on unsupervised pretraining models , in: Proc. anti-spoofing, in: Proc. ICASSP , 2022 , pp. 6382 - ICASSP , 2022 , pp. 9231 - 9235 . 6386 .

[15] H. Wu , et al., Partially fake audio detection by self-attention-based fake span discovery , in: Proc. ICASSP , 2022 , pp. 9236 - 9240 .

[16] J. Yi , et al., ADD 2023 : The second audio deepfake detection challenge , in: Proc. IJCAI Workshop on Deepfake Audio Detection and Analysis (DADA) , 2023 .

[17] M. Li , Y. Ahmadiadli , X.-P. Zhang , A comparative study on physical and perceptual features for deepfake audio detection , in: Proc. DDAM workshop , 2022 , pp. 35 - 41 .

[18] X. Liu , et al., Deep spectro-temporal artifacts for detecting synthesized speech , in: Proc. DDAM workshop , 2022 , pp. 69 - 75 .

[19] Z. Zeng , Z. Wu , Audio splicing localization: Can we accurately locate the splicing tampering? , in: Proc. ISCSLP , 2022 , pp. 120 - 124 .

[20] B. Zhang , T. Sim, Localizing fake segments in