Adaptive purification strengthens audio deepfake detection against attacks
Detection-Guided Adaptive Purification with Diffusion Models for Robust Audio Deepfake Detection
Cryptography and SecuritySound
Summary
Audio deepfake detectors can be tricked by subtle changes that hide fake voices. The authors designed a smart cleanup step that adjusts how much it 'cleans' each recording based on how suspicious it looks. If a recording is likely fake, it gets a stronger cleanup to remove tricks; if not, it stays mostly unchanged. This approach helps find fakes more reliably without messing up real voices. They tested it on several detectors and attacks and found it works better than other ways to defend against trickery.
What this means in practice
- •For voice security teams: Improve the reliability of audio deepfake detection tools by applying adaptive cleanup that better identifies manipulated speech.
- •For cybersecurity engineers: Deploy adaptive purification methods to strengthen defenses against adversarial attacks on voice authentication systems.
Authors
Muhammed Salih Kayhan, Qiben Yan
Abstract
Audio deepfake detectors remain vulnerable to adversarial perturbations that suppress the acoustic cues used for detection, allowing manipulated utterances to evade the detector. Although existing defenses can improve robustness, they require retraining the detector or introduce additional distortion. Diffusion-based purification instead leaves the pretrained detector unchanged, but existing methods use the same purification strength for all inputs, creating a trade-off between removing adversarial perturbations and preserving the subtle spoofing cues needed for detection. In this paper, we propose Detection-Guided Adaptive Purification (DGAP), a diffusion-based defense that adjusts purification strength per input. Building on the observation that a light purification perturbs the detector score of an adversarial input far more than that of a benign one, the framework uses the resulting score shift as a reference-free indicator of adversarial manipulation. Inputs with small shifts are passed unchanged, whereas flagged inputs undergo stronger purification before final detection. We evaluate the framework against three adversarial attack settings across three deepfake detectors, and compare it with nine existing defenses. Our results show that DGAP achieves the best defense performance across all detectors while leaving benign inputs nearly unaffected, and remains effective under the defense-aware adaptive attack.