A new preprint reports near-perfect source tracing for speech deepfakes on a closed benchmark of spoofed speech. Its strongest configuration, a fully fine-tuned SSL-AASIST system, reached 99.64% balanced accuracy and a 0.11% equal-error rate (EER) when classifying attacks. Its attribute-extraction results ranged from 99.59% to 99.92% balanced accuracy, with EERs of 0.07% to 0.15%.
Those numbers came from the ASVspoof2019-attr-17 closed-set protocol, which uses only spoofed speech and covers 17 source generators divided among training, development and evaluation sets. In practical terms, the test asks whether the system can distinguish the known generator categories represented in that benchmark; it does not test previously unseen source generators.
How the system makes its call
The system uses multi-task learning: a shared backbone predicts attack attributes while a structured Kolmogorov-Arnold Network, or KAN, performs attack classification. Its connections retain only valid metadata-derived attribute links, giving the model an internal structure for ranking which inputs matter.
All utterances had leading and trailing silence trimmed, and the evaluation used RawBoost augmentation with convolutive, impulsive and stationary noise variants.
The paper judged performance with balanced accuracy—a measure of how well the model handled each class—and one-versus-rest EER on the evaluation set. Attribute extraction was scored separately for each attribute.
The headline result depended on the configuration
Compared with a reproduced AASIST-feature baseline using logistic regression, the difference was substantial. For the paper’s Attribute 1, the baseline reached 91.59% balanced accuracy and a 3.16% EER; for attack classification, it reached 84.37% and 3.35%. This was a model comparison, not a randomized control, so it shows a performance difference rather than proving that one component caused it.
The headline numbers were not shared by every fine-tuning setup. Partial fine-tuning produced attribute-extraction balanced accuracies of 79.81% to 91.57% and EERs of 3.69% to 6.98%; attack classification reached 81.96% balanced accuracy with a 3.64% EER.
With partial fine-tuning of SSL-AASIST, the reported scores fell further, to 50.38%–69.66% for attribute extraction and 61.71% for attack classification, with EERs of 11.82%–15.70% and 9.86%, respectively.
The explanations were mostly consistent, but not uniform
At the model level, text in the inputs attribute dominated feature importance, while attention in the duration attribute contributed least. For individual attack classes, the rankings often highlighted input, waveform and output attributes.
The paper compared those rankings with SHAP. The model-level Spearman correlation—a measure of how similarly two rankings are ordered—was 0.72. Most per-class correlations were positive, but some were below 0.5; A18 was the only negative case, at −0.71.
Feature-importance rankings were also compared across evaluation batch sizes of 8, 32, 64 and 256 samples. Global-versus-local correlations ranged from 0.88 to 0.92, while correlations among local estimates ranged from 0.95 to 1.00.
For a one-sample batch, agreement fell to 0.56 against the global ranking and 0.64–0.66 against other local estimates, although every reported coefficient remained positive.
A strong benchmark result with a narrow reach
In an ablation, removing the metadata-derived structure made little difference to attack classification in the fully connected AASIST_ff comparison: 99.65% balanced accuracy for the fully connected model versus 99.61% for the structured model. The result does not establish an accuracy advantage for the structured KAN.
The study’s evidence remains tied to a closed benchmark of spoofed speech and known source generators. The authors also identify reliance on generator metadata as a limitation when that information is unavailable, so the reported scores do not establish performance beyond those conditions.
The paper reports no confidence intervals or repeated-run uncertainty estimates. Agreement with SHAP is a consistency check, not independent proof that the explanations are faithful.
The authors report that the implementation code is publicly available for transparency and reproducibility. The next test is whether the model’s scores and feature rankings hold for unseen source generators or when generator metadata is unavailable.
Paper data and sources
Original title: Explainability by Design: Structured Kolmogorov-Arnold Networks over Probabilistic Attributes for Speech Deepfake Source Tracing
Authors: Hoang H. Pham, Manasi Chhibber, Tomi H. Kinnunen
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-20
DOI: 10.2139/ssrn.7170780
Original paper · Full text