three defensive layers — detection + watermarking + provenance
A. anti-spoof detection
ASVspoof 5 · AASIST · RawNet2
input audio → classifier
output: "real" or "synthetic"
EER 0.42% on ASVspoof 2019 LA
EER 7.23% on ASVspoof 5 (real-world)
handles uncooperative adversaries
B. audio watermarking
AudioSeal · WaveVerify
generator embeds signal
detector extracts payload
16-bit payload per clip
survives MP3 / EQ / noise
> 99% bit accuracy pre-attack
C. provenance manifest
C2PA · CAI
signed JSON manifest
creator · tool · timestamp
cryptographic hash
verifiable off-band
bypassable by re-encoding → pair with watermark
the gaps each defense has — why you need all three
detection: degrades OOD; overfits to training-time generators
watermarking: pitch-shift breaks every 2026 watermark (bit acc < 60%)
provenance: trivially strippable by re-encoding → does nothing alone
2026 production checklist for any voice-gen deploy
1. AudioSeal embed on every generation (detector shipped in CI)
2. C2PA-sign manifest with model id + user id + timestamp
3. AASIST / RawNet2 detector running on inbound call audio (fraud, replay)
4. audit log + 30-day retention + consent artifact + rate-limit + kill-switch