ML Security PapersContext and Transcripts Improve Detection of Deepfake Audios of Public Figures
Chongyang Gao 1, Marco Postiglione 1, Julian Baldwin 1, Natalia Denisenko 1, Isabel Gortner 1, Luke Fosdick 1, Chiara Pulice 1, Sarit Kraus 2, V.S. Subrahmanian 1
Published on arXiv
2601.13464
Output Integrity Attack
OWASP ML Top 10 — ML09
Key Finding
Incorporating context and/or transcripts improves audio deepfake detection by 5%–37.58% in F1-score, 3.77%–42.79% in AUC, and 6.17%–47.83% in EER over audio-only baselines across four datasets.
CADD (Context-based Audio Deepfake Detector)
Novel technique introduced
Humans use context to assess the veracity of information. However, current audio deepfake detectors only analyze the audio file without considering either context or transcripts. We create and analyze a Journalist-provided Deepfake Dataset (JDD) of 255 public deepfakes which were primarily contributed by over 70 journalists since early 2024. We also generate a synthetic audio dataset (SYN) of dead public figures and propose a novel Context-based Audio Deepfake Detector (CADD) architecture. In addition, we evaluate performance on two large-scale datasets: ITW and P$^2$V. We show that sufficient context and/or the transcript can significantly improve the efficacy of audio deepfake detectors. Performance (measured via F1 score, AUC, and EER) of multiple baseline audio deepfake detectors and traditional classifiers can be improved by 5%-37.58% in F1-score, 3.77%-42.79% in AUC, and 6.17%-47.83% in EER. We additionally show that CADD, via its use of context and/or transcripts, is more robust to 5 adversarial evasion strategies, limiting performance degradation to an average of just -0.71% across all experiments. Code, models, and datasets are available at our project page: https://sites.northwestern.edu/nsail/cadd-context-based-audio-deepfake-detection (access restricted during review).
Key Contributions
- CADD architecture that augments audio deepfake detectors with automatically gathered contextual signals (demographics, news, social media) and speech transcripts, improving F1 by 5%–37.58% over audio-only baselines.
- Journalist-provided Deepfake Dataset (JDD) of 255 real-world deepfakes collected from 70+ journalists, plus a synthetic dataset (SYN) of dead public figures, both with accompanying context.
- Robustness evaluation showing CADD limits performance degradation to –0.71% on average across 5 adversarial evasion strategies, outperforming context-free detectors under attack.
🛡️ Threat Analysis
CADD is a novel detection architecture for AI-generated audio (audio deepfakes), falling squarely under ML09's 'AI-generated content detection' pillar; the paper also evaluates adversarial evasion resistance, reinforcing the output-integrity security angle.