VeriSpoof-Base: beyond real or fake, one audio LLM for speech deepfake detection, source verification and grounded reasoning

Try the demo (upload a recording, get a verdict, reasoning and a per-token synthetic-speech profile).

VeriSpoof is an audio language model that answers questions about how a recording was made. The same weights detect spoofed speech, name the generation system, decide whether two recordings come from the same system, describe the recording channel, and explain the decision in fixed, checkable lines (measured observations, a localized synthetic span, a decision).

VeriSpoof-Base is trained on the official training splits of nine public corpora only. It is the model of all controlled studies in our paper. On the 14 test sets of the Speech-DF-Arena leaderboard it reaches a pooled EER of 4.43% and a mean EER of 4.28%. Inserted into the public snapshot of 31 Oct 2026, it ranks fourth of 28 systems and first among open-weight ones, with less than half the pooled EER of the next open-weight detector (DF Arena 1B, 9.52%).

What is different

1. The detection score is the model's own answer. There is no detection head. The model is asked whether the recording is genuine or spoofed, and the score is the log-likelihood of its spoof answer minus that of its bona fide answer. The EERs below therefore measure the answer a user reads. This answer agrees with the decision the model reaches after writing out its reasoning on 98.6% (In-the-Wild), 99.6% (ASVspoof 2019 LA) and 98.2% (ASVspoof 5) of recordings.
2. One model, several forensic questions. Besides detection, the same checkpoint answers generator identity, acoustic model and vocoder classes, same-generator / same-acoustic-model / same-vocoder verification for two recordings, and recording conditions (noise, reverberation, codec).
3. Reasoning that can be checked and that the decision follows. The reasoning lines are trained on targets computed from the audio the model hears: bandwidth, SNR, level and clipping are measured on the waveform, and synthetic spans come from dataset labels. Counterfactual training makes the decision follow the stated localization: the decision changes when the localization is inverted in 100% of tests and in 99.5% of tests with wording never seen in training, and does not change when only the channel or observation lines are edited.
4. Open evaluation protocol. The paper releases lists, labels and scoring scripts for source verification, channel conditions, grounded reasoning, localization and faithfulness, alongside the detection results below.

Training data

Official training splits only; no evaluation split of any corpus, and none of the test sets below, was used for training.

• Spoofed and bona fide speech: ASVspoof 2019 LA, ASVspoof 5, SpoofCeleb, MLAAD, STOPA, DFADD, LibriSeVoc, CodecFake+
• Partial spoofs (localization): PartialSpoof, HAD, PartialEdit

About 0.38 M training utterances. MLAAD generators in the unseen-model and unseen-architecture protocols are held out.

Usage

Install the inference package (a CUDA GPU with about 12 GB is required; the weights are downloaded on first use):

hf download AustinXiao/VeriSpoof-Base --include "code/*" --local-dir verispoof
pip install ./verispoof/code

from verispoof import VeriSpoof

model = VeriSpoof.from_pretrained("AustinXiao/VeriSpoof-Base")

# Detection. score = log p(spoof answer) - log p(bona fide answer); label uses threshold 0
model.detect("sample.wav")                        # {'label': 'spoof', 'score': ...}
model.detect(["a.wav", "b.flac"], batch_size=16)  # a list in, a list out; arrays need sr=...

# Grounded reasoning, plus the per-token head (probability that each 0.16 s token is synthesized)
r = model.explain("sample.wav")
print(r["text"])         # OBSERVATIONS / CHANNEL_STATUS / LOCALIZATION / SOURCE_PROFILE / DECISION lines
r["decision"], r["spans"], r["token_prob"]

# Source verification of two spoofed recordings: generator, acoustic_model or vocoder
model.same_source("a.wav", "b.wav", level="generator")   # {'same': ..., 'score': log p(yes) - log p(no)}
model.compare("a.wav", "b.wav")                           # source-verification reasoning

# Closed questions
model.condition("sample.wav", attr="codec")               # also "noise", "reverb"
model.generator("sample.wav", ["XTTS-v2", "Bark", "VITS"])  # candidate systems you supply

Detection uses the prompt "Is this recording genuine human speech or spoofed speech? Options: bona fide; spoof." and the two answers "This recording is bona fide: it is genuine human speech." and "This recording is a spoof: it is synthetic or converted speech, not genuine human speech."

Faster reasoning with vLLM

For many recordings, VeriSpoofVLLM runs the reasoning (explain, compare) in vLLM; the audio front end stays in PyTorch. Detection scores and the per-token head use VeriSpoof above.

pip install "./verispoof/code[vllm]"

from verispoof.vllm_backend import VeriSpoofVLLM

if __name__ == "__main__":          # vLLM starts its engine in a separate process
    m = VeriSpoofVLLM.from_pretrained("AustinXiao/VeriSpoof-Base")
    results = m.explain(["a.wav", "b.wav", "c.wav"])   # batched
    pairs = m.compare([("a.wav", "b.wav"), ("c.wav", "d.wav")])

Reasoning, one A100	per recording	speed-up
VeriSpoof.explain, one at a time	2.24 s	1×
VeriSpoofVLLM.explain, one at a time	0.50 s	4.5×
VeriSpoofVLLM.explain, batch of 64	0.05 s	46×

Decisions are identical to VeriSpoof (64 / 64 recordings, 32 / 32 pairs); the wording of borderline measurements can differ. If vLLM fails to load a FlashInfer sampling kernel on an older system, set VLLM_USE_FLASHINFER_SAMPLER=0 (decoding is greedy).

Evaluation

Speech-DF-Arena, 14 test sets

Every line of the official protocols (speech_df_arena, commit 97a4445) is scored. Accuracy at threshold 0.

Dataset	Trials	EER (%)	Accuracy (%)
asvspoof_2019	71,237	0.49	99.25
asvspoof_2021_la	148,176	5.48	93.54
asvspoof_2021_df	533,928	0.97	99.40
asvspoof_2024	680,774	2.59	98.42
in_the_wild	31,779	1.20	98.93
fake_or_real	4,528	5.39	90.02
codecfake	304,241	4.97	89.51
add_2022_track_1	109,199	14.05	88.42
add_2022_track_3	126,861	3.87	96.84
add_2023_round_1	111,976	5.01	90.35
add_2023_round_2	118,477	10.61	92.87
dfadd	3,755	0.00	99.97
librisevoc	92,407	0.02	99.99
sonar	3,948	5.19	83.11
Average		4.28	94.33
Pooled	2,341,286	4.43

Fake-or-Real, Codecfake, ADD and SONAR have no training data in VeriSpoof-Base; their EERs are the main gap to the systems above it.

Compared with the leaderboard

Systems on the public snapshot (31 Oct 2026), ordered by pooled EER, the board's ranking.

System	Availability	Params	Average EER	Pooled EER
Modulate VELMA-2	Proprietary	0.3 B	1.10	1.59
Resemble Detect-3B-Omni	Proprietary	3 B	2.60	2.10
Hiya Authenticity Verification	Proprietary	1 B	2.11	2.32
VeriSpoof-Base (this model)	Open-weight	2.9 B	4.28	4.43
DLMSL SpeakSure	Proprietary	0.7 B	3.80	6.14
Whispeak	Proprietary	0.1 B	3.05	8.06
DF Arena 1B	Open-weight	1 B	5.66	9.52
XLS-R + SLS	Open-weight	0.3 B	14.01	16.08

Average = mean of the 14 set EERs (the board's own "Average" column differs slightly for some systems).

Beyond detection

Our released protocol; up to 10,000 trials per set, reasoning on 500 recordings per set.

Task	Result
Detection, SpoofCeleb / CodecFake+ / CodecFake+ CoSG (unseen)	EER 0.20 / 3.95 / 4.84%
Detection under added noise, reverberation and codecs (6 sets)	mean EER 5.23%
Same-generator verification, MLAAD seen / unseen model / unseen architecture	EER 17.2 / 13.8 / 20.3%
Same-generator verification, SpoofCeleb / ASVspoof 2019 LA	EER 11.3 / 8.2%
Generator identification (MLAAD, closed set)	95.4% accuracy
Acoustic model under an unseen vocoder (SpoofCeleb)	84.7% accuracy
Recording condition (noise / reverberation / codec)	75.9% accuracy
Decision after reasoning, 11 sets	91.2–99.6% accuracy
Measured observations (SNR within 10 dB / level within 5 dB / bandwidth class)	88–99 / 95–100 / 64–91%
Partial-spoof localization, text spans (HAD / PartialEdit / PartialSpoof)	IoU 0.61 / 0.58 / 0.25
Per-token head (HAD / PartialEdit / PartialSpoof)	F1 0.91 / 0.79 / 0.74
Decision follows inverted localization (trained / new wording / inserted span)	1.00 / 0.995 / 1.00
Decision unchanged when channel or observation lines are contradicted	1.00 / 1.00
Source-verification reasoning, verdict EER (SpoofCeleb / STOPA / CoSG)	17.7 / 13.2 / 19.4%

Intended use

Research on audio deepfake detection, source tracing and explainable forensics. Not intended as the only basis for decisions about people; a forensic decision should combine this score with other evidence and human review.

License

CC BY-NC 4.0 (non-commercial use).

Citation

A technical report is coming soon. Until then, please cite this model card:

@misc{verispoof2026,
  title        = {{VeriSpoof-Base}: Beyond Real or Fake, One Audio {LLM} for Speech Deepfake Detection, Source Verification and Grounded Reasoning},
  author       = {Xiao, Yang},
  year         = {2026},
  howpublished = {\url{https://huggingface.co/AustinXiao/VeriSpoof-Base}},
  note         = {Hugging Face model card}
}

Contact

Yang Xiao, yxiao9550@student.unimelb.edu.au