Researchers from the University of Melbourne presented VeriSpoof, an open audio language model (audio LLM) for audio deepfake detection and speech forensics. It handles five tasks at once, each of which usually needs a separate model. VeriSpoof detects voice deepfakes even when only part of a recording is fake, and it shows which part. It also identifies the generator model. For a pair of recordings, it checks whether one generator or two different ones produced them. In addition, the model describes noise, echo and compression. These are not signs of a fake, but they get in the way of the analysis. Finally, the model explains its verdict in detail. You can check every claim by measuring the recording itself or comparing it with the dataset labels.
The model is useful to several groups of researchers. Developers of audio deepfake detection apps get a strong open baseline and a benchmark with its answer to every question. Developers of their own audio LLMs can learn from the ablations, in which the authors changed one component at a time. They show that the encoder sets detection quality, while the language model sets how well the model compares recordings. VeriSpoof also helps experts who examine voice recordings, for example ones attached to a case as evidence. A “fake or not” verdict is not enough for them. They need to know which generator made the recording and whether two messages share a source. They also need to see what the conclusion rests on. By the authors’ estimate, an 8 GB GPU such as the RTX 4060 is enough to run the model. However, VeriSpoof does not suit commercial products: the CC BY-NC 4.0 license prohibits commercial use.
Two versions of the model
The authors released two versions of the model. Both share the same design: the Qwen3-ASR speech encoder and the MiniCPM5-2B language model, 2.85 billion parameters in total. They differ in their training data.
- VeriSpoof-Base uses the official training splits of 11 datasets, about 0.38 million recordings, and the authors run all controlled experiments on it.
- VeriSpoof-Plus follows the same recipe with 12 more datasets, about 4.4 million recordings in total.
On the 14 sets of the Speech-DF-Arena benchmark, Plus errs in only 2.14% of cases. That puts it 3rd out of 28 models overall and 1st among open-weight models. Plus also identifies the generator behind a fake in 96.8% of cases if that generator appeared in training. VeriSpoof-Base finds 99.6% of the partial fakes in PartialEdit when it first writes a rationale for its verdict, versus 78.4% with a direct answer. At the same time, training is cheap. The encoder and the language model stay frozen, so training updates only 29.7 million parameters. With gradient checkpointing, a single 24 GB GPU is enough. The weights of VeriSpoof-Plus and VeriSpoof-Base and the inference code are open under the non-commercial CC BY-NC 4.0 license. A demo and the VeriSpoof-Bench benchmark with 177,852 questions are also available, and the authors promise to release the training code later.
How the model handles audio deepfake detection
The model answers queries as if they were a multiple-choice test. The options are ordinary sentences, such as “This is genuine speech” and “This is a fake.” The model estimates how likely each option is for the recording and picks the more likely one. In the “genuine or fake” question, the margin of one option over the other (the difference of their log-likelihoods) serves as a score. The more the margin leans toward “fake,” the more likely the recording is synthetic. As a result, no task needs its own classifier: one language model answers all the questions.
To get a “yes” or “no” answer, the model compares the score with a threshold. By default, the threshold is zero: a recording counts as fake if the “fake” option gets more than 50% for it. You can shift the threshold to suit the task. To compare VeriSpoof with other deepfake detection models, researchers do not pick the threshold by hand. Instead, they use the EER (equal error rate). They move the threshold to the point where the share of missed fakes among all fakes equals the share of rejected recordings among all genuine ones. This share is the EER. For example, an EER of 2.14% means that the model misses 2.14% of fakes and wrongly rejects 2.14% of genuine recordings. The lower the EER, the better: for a model that guesses at random, it is 50%. Leaderboards such as Speech-DF-Arena use the pooled EER, with one shared threshold for all datasets at once. It is as if the model ran with a single setting on any recording.
Model architecture
For audio deepfake detection, VeriSpoof combines two open models: the Qwen3-ASR speech recognition encoder and the MiniCPM5-2B language model. The language model cannot hear sound, so an audio tokenizer links the two. Here is the full path of a recording:
- Encoder. Qwen3-ASR processes an 8-second segment of the recording. It combines the features from all 25 of its layers into a weighted sum. The model learns the weights of this sum during training;
- Audio tokenizer. It turns the features into two sets of tokens. Sixteen tokens describe the recording as a whole: the model uses them to recognize the generator and to compare recordings. The other 52 tokens correspond to 0.16 s segments and keep the timing: the model uses them to find the synthesized fragment. Between them, text time markers appear every 0.8 s, so the model can name an interval in seconds;
- Language model. MiniCPM5-2B receives the audio tokens and the text of the question. To compare two recordings, the prompt includes the tokens of both;
- Answer. The model either scores the answer options right away, as described above, or first writes a rationale and then a decision. In addition, a small classifier on top of the language model’s hidden states labels each 0.16-second segment as genuine or synthesized. This gives a synthesis profile over time.
Training updates only 29.7 million of the 2.85 billion parameters: the tokenizer, the DoRA adapters in the encoder and LoRA in the language model. It runs in three stages. First, with the language model frozen, the authors tune the tokenizer and the encoder on questions about authenticity, the generator and recording conditions. Next, they add LoRA to the language model and teach it to answer all the forensic questions. In the last stage, the model learns to write rationales, including on counterfactual examples. Both versions go through the same stages, but Plus has a longer first stage. In addition, the authors balance its data over 211 spoof sources so that large datasets do not dominate.
A decision you can verify
The rationale consists of fixed fields, and you can check each one without the model:
- OBSERVATIONS (bandwidth, SNR, loudness, clipping) against measurements of the waveform;
- CHANNEL_STATUS (noise, reverberation, codec) against the augmentation log. These statements should not affect the decision;
- LOCALIZATION (synthesized intervals in seconds) against the labels;
- SOURCE_PROFILE (generation method, acoustic model, vocoder) against the generator metadata.
The decision comes last: the model labels a recording fake if the rationale lists at least one generated interval. No other neural network writes the training rationales. Instead, the data preparation code assembles them. It takes measurements directly on the same 8-second segment that the model hears. The fake intervals and generator details come from the dataset labels. Therefore, every statement in the training examples is correct by construction.
The decision also has to actually follow from the rationale instead of being a separate judgment. For this, in 20% of training examples the model gets a rationale with the opposite answer about synthesized fragments. For example, the rationale says there are none when there are. The authors train the model to output the decision that follows from such a text, that is, “genuine speech.” However, they do not train it to write false statements about the recording.
Audio deepfake detection on leaderboards: the best open result
The authors did not officially submit the model to the leaderboards. Instead, they ran VeriSpoof themselves on the leaderboards’ own test sets, with the same recording lists, labels and scoring rules. Then they compared the resulting numbers with the published leaderboard tables, so VeriSpoof’s scores are the authors’ own measurements. On the 2.34 million recordings of Speech-DF-Arena, only the proprietary Modulate VELMA-2 (1.59%) and Resemble 3B-Omni (2.10%) are ahead of Plus. Base, at 4.43%, beats all other open models. On the 16 sets of SpoofRadar, Base and Plus score 4.23% and 4.04% versus 9.96% for the best open model.
There is an important caveat for audio deepfake detection in other languages. At the shared SpoofRadar threshold, Plus flagged 92.9% of genuine Russian audiobooks from XMAD-Bench as fake. Yet within that language, it separates the classes with an EER of at most 1.95%. Base makes this mistake on no more than 3.1% of genuine recordings in any language. So for a new language or domain, it is worth setting the threshold on genuine speech from that domain.
The VeriSpoof-Bench benchmark
The Speech-DF-Arena and SpoofRadar leaderboards test only fake detection. The other VeriSpoof tasks, from generator identification to rationales, had no public benchmark. So the authors built and released VeriSpoof-Bench: 54 test subsets and 177,852 questions in six groups. Most questions ask whether a recording is authentic (95,852). Next come checking whether two recordings share a source (43,000), recording conditions (16,000) and generator identification (10,000). Another 13,000 questions test rationales for single recordings and for pairs.
Some of the source-verification pairs come from MLAAD, a dataset with recordings from many speech generators. The authors split them into three groups: generators from the training data, new models of familiar architectures, and entirely new architectures. They removed the generators of the last two groups from all training data. Copies of recordings with noise, echo and compression come in two kinds. In the first, the distortions are random, as in training. In the second, each recording has a single distortion recorded in the labels. This lets the authors check whether the model describes recording conditions correctly.
The shared-source tests also contain traps: pairs of recordings from different generators that share the generation method, acoustic model and vocoder. Traps, same-source pairs and ordinary different-source pairs make up equal parts of the tests, so matching attributes alone do not give away the answer. Finally, the authors drew the questions once and used the same ones for every model. So the tables in the paper compare models on exactly the same recordings.
The authors released the recording lists, labels, prompts, reference rationales, scoring scripts and the answers of both VeriSpoof versions to every question. The benchmark contains no audio, though. You download the original datasets from their distributors, and the scripts find the needed files. They then rebuild derived recordings such as the noisy copies. The scripts come under CC BY-NC 4.0, and each subset keeps the license of its source dataset. The benchmark is available on Hugging Face.
Recording source and comparison with audio LLMs
Plus can tell whether two recordings share a source even for generators that were not in training. Its EER is 6.17% for new models of known architectures and 15.00% for new architectures. For comparison, the authors trained a pair classifier on top of the frozen DF-Arena-1B encoder, which scores 26.5% and 24.8%. On copies with noise and codecs, the EER rises to 23-30%. Meanwhile, six general-purpose audio LLMs without fine-tuning, including Qwen3-Omni and Audio Flamingo 3, answer source questions almost at random. Their balanced accuracy is 48.4-53.3%, with chance at 50%. Even in audio deepfake detection, they fall far behind VeriSpoof: 52.1-64.7% balanced accuracy on average versus 96.5% for Plus.
Reasoning makes audio deepfake detection more accurate
The direct answer judges the recording as a whole, whereas in reasoning the model first searches for synthesized intervals frame by frame. On unseen MLAAD generators, the decision of VeriSpoof-Base after reasoning is correct in 97.4% of cases versus 85.8% for the direct answer. The rationales state loudness correctly for at least 95% of recordings, while bandwidth is the weakest field (64-91%). The intervals match the labels with an IoU of 0.58-0.61 when there are few fragments, and 0.25-0.31 when there are many short ones.
Without counterfactual training, a model told that there was no synthesis still called 42% of unseen MLAAD recordings fake. With it, the decision follows a paraphrased opposite localization, unseen in training, in 99.5% of cases versus 73.8%. Moreover, contradictions in the channel and measurement statements never change the decision.
What matters more: the encoder or the LLM
Among seven frozen encoders, Qwen3-ASR preserves source features best. It is also nearly as good at detection as the best anti-spoofing encoder, so it does not discard synthesis artifacts. Changing only how the model uses its features lowers the EER on ASVspoof 5 from 9.56% to 3.10%. Meanwhile, the source-verification EER stays at 16-19%. Changing only the LLM, by contrast, moves detection by 0.5 points and source verification by 5.5. For fakes re-synthesized by neural codecs, the source questions are essential. Without them, the EER on CodecFake+ is 12.6% versus 2.2%, even with five times as many authenticity labels.
Limitations and running the model
By the authors’ estimate, inference on single-recording tasks needs 6-7 GB of VRAM. With vLLM on an A100 and a batch of 64, a rationale takes 0.05 s per recording.
There is also a weak spot. On most test sets, source questions help the model find fakes or at least do not hurt. There is one exception: ASVspoof 2021 LA, a set from the ASVspoof 2021 challenge where the organizers passed synthesized speech through telephone channels. Trained only on “genuine or fake” questions, the same model reaches 1.77% EER on this set. With source questions, the EER rises to 3.40%. The errors fall on three attack types that were not in training, and after rationale training the EER grows to 5.17%. The authors have not yet found the cause: it is neither the threshold nor any single codec. Finally, the authors warn that VeriSpoof should not be the sole basis for a decision.
