Open audio LLM for speech forensics

Beyond real
or fake.

VeriSpoof is one audio language model that tells you whether speech is a deepfake, which system made it, whether two recordings share a source, what the channel did to it, and why — in short lines that can each be checked against the audio.

▶ Watch the film · 1:59 See it reason Models Live demo Code Benchmark Tech report (arXiv)

2.14%pooled EER on 14 Speech-DF-Arena sets
#3 of 28 · #1 open-weight

6.2%EER deciding if two recordings share a source,
generators unseen in training

99.6%partial fakes caught after reasoning
vs 78.4% one-step (PartialEdit)

29.7Mtrained parameters of 2.85B
training fits one 24 GB GPU

Yang Xiao · The University of Melbourne · Technical report, 2026

The film · 1:59

One model, every question. It even catches its creator.

Captions in Chinese and English. Every model output in the film is a real VeriSpoof output on that clip. The character is AI-generated art. All voices are synthetic, including Yang Xiao’s (credits) · 1080p

01Genuine?bona fide or spoof, as a score

02Which system?generator, acoustic model, vocoder

03Same source?two recordings, one generator?

04What channel?noise, reverberation, codec

05Why?checkable lines → decision

One set of weights, no task heads: every answer is a sentence whose likelihood is the score.

Example gallery

Every line is a claim. Every claim is checked.

Real test recordings, run offline through the released inference package. Play one, read the one-step answer and the rationale, and see each line checked against waveform measurements and dataset labels.

0.00 / 0.00 s

labelled synthetic span span stated by the model P(synthetic) per 0.16 s token

One-step answer

score = log p(spoof answer) − log p(bona fide answer)

After reasoning

Grounded rationale

Raw model output

Source verification: same system or not?

One-step answer “Do Audio A and Audio B come from the same generator?”

score = log p(yes) − log p(no)

Verification rationale

Raw model output

Audio: ASVspoof 2019 LA (ODC-By 1.0), PartialEdit (CC BY 4.0), HAD (CC BY 4.0), CodecFake+ (MIT), DFADD (MIT); evaluation splits only, never used in training. Outputs: greedy decoding with the released verispoof package, precomputed offline (credits).

How it works

An audio LLM whose answers are its scores.

VeriSpoof architecture: a Qwen3-ASR speech encoder with a learned mix of 25 layers feeds an audio tokenizer that outputs 16 utterance tokens and 52 frame tokens of 0.16 s; MiniCPM5-2B reads them and answers questions on authenticity, generator, noise level, same source and why. — Audio components turn one recording, or a pair, into utterance tokens and 0.16 s frame tokens that an LLM reads; the same weights answer every question. Figure from the tech report.

01 · Perception

Two resolutions of audio

A Qwen3-ASR (AuT) encoder hears an 8 s window. A learned mix of all 25 layers, adapted with DoRA, feeds a tokenizer with 16 utterance tokens (what is constant: the source) and 52 frame tokens of 0.16 s (what changes: where the fake is), with time marks every 0.8 s.

02 · Read-out

Answers as scores

MiniCPM5-2B with LoRA reads the tokens. No question has its own head: the score is the likelihood of the model's own answer sentence, so it can be thresholded at any operating point.

s = log p(spoof answer)
− log p(bona fide answer)

03 · Rationale

Grounded, line by line

Targets are not written by a teacher model. They are computed from the exact window the model hears, so each field has an independent checker:

OBSERVATIONS ↔ waveform measurements
CHANNEL_STATUS ↔ logged condition
LOCALIZATION ↔ labelled spans
SOURCE_PROFILE ↔ generator metadata

04 · Faithfulness

Counterfactual training

In 20% of rationale examples the localization is reversed and only the decision that follows is trained. The model never learns to say something false about the audio; it learns that the decision must follow the stated evidence: 99.5% of decisions follow an edit form never seen in training.

Perception alignment (PA)

Tokenizer + encoder DoRA learn detection and source questions with the LLM frozen.

Forensic question tuning (QT)

LLM LoRA added; acoustic model, vocoder, condition and pair questions.

Grounded rationale tuning (RT)

Detection and verification rationales plus counterfactuals; QT questions replayed.

Only 29.7 M of 2.85 B parameters are trained (tokenizer 17.85 M, encoder DoRA 3.24 M, LLM LoRA 8.60 M, per-token head 6 k). Base: official training splits of eight corpora plus three partial-spoof corpora (0.38 M utterances). Plus: the same recipe with twelve more corpora (4.0 M more utterances).

Every question and both rationale formats

The question templates VeriSpoof answers, with example answers: authenticity, generator, recording condition, acoustic model or vocoder, same source, and the detection and verification rationale formats. — Question templates with example answers (tech report, Figure 4).

Results

Third of 28 on Speech-DF-Arena. First with open weights.

Every line of the 14 official Speech-DF-Arena protocols, scored with the model's own answer. Pooled EER uses one threshold over all 2.34 M trials — the board's ranking.

Speech-DF-Arena, 14 sets EER (%), lower is better · public snapshot of 31 Oct 2026 with both VeriSpoof models inserted

27 systems on the public board plus both VeriSpoof models. Inserted alone, each model ranks among 28: Plus third, Base fourth.

VeriSpoof-PlusVeriSpoof-Baseproprietaryopen weights

Per-set EER table (click a column to sort)

Table 2 of the tech report. Teffic-Audio from its paper; ‡ from SpoofRadar, whose pooled EER covers other sets. Best per column in bold.

SpoofRadar v1.0, 16 sets pooled EER (%) · lower is better

Both models beat every open-weight system on the published leaderboard (best: DF Arena 500M, 9.96%). Plus: ACC 95.96 · macro-F1 94.54 · mean set EER 1.65.

Same source? EER (%) on spoof–spoof pairs · lower is better

frozen probe (DF-Arena-1B)BasePlus

Reasoning catches what one answer misses decision accuracy (%) on the same 500 recordings

one-step answerafter reasoning

The decision follows the stated evidence % of decisions that follow a reworded, inverted localization never seen in training · Base

without counterfactual trainingwith

Numbers from the technical report; protocols, lists and scoring scripts in VeriSpoof-Bench.

Use it

Four lines to a verdict you can audit.

# CUDA GPU with about 12 GB; weights download on first use
hf download AustinXiao/VeriSpoof-Plus --include "code/*" --local-dir verispoof
pip install ./verispoof/code

from verispoof import VeriSpoof

model = VeriSpoof.from_pretrained("AustinXiao/VeriSpoof-Plus")   # or "AustinXiao/VeriSpoof-Base"

model.detect("sample.wav")              # {'label': 'spoof', 'score': log p(spoof) - log p(bona fide)}
r = model.explain("sample.wav")         # grounded rationale + per-token synthetic probability
print(r["text"])                        # OBSERVATIONS / CHANNEL_STATUS / LOCALIZATION / SOURCE_PROFILE / DECISION
r["decision"], r["spans"], r["token_prob"]

model.same_source("a.wav", "b.wav", level="generator")   # also "acoustic_model", "vocoder"
model.compare("a.wav", "b.wav")                          # verification rationale
model.condition("sample.wav", attr="codec")              # also "noise", "reverb"
model.generator("sample.wav", ["XTTS-v2", "Bark", "VITS"])  # candidates you supply

# pip install "./verispoof/code[vllm]"  ·  rationales for many files, about 46x faster in batches
from verispoof.vllm_backend import VeriSpoofVLLM

if __name__ == "__main__":          # vLLM starts its engine in a separate process
    m = VeriSpoofVLLM.from_pretrained("AustinXiao/VeriSpoof-Plus")
    results = m.explain(["a.wav", "b.wav", "c.wav"])          # batched
    pairs = m.compare([("a.wav", "b.wav"), ("c.wav", "d.wav")])

Live demo ↗Upload a recording: verdict, rationale and per-token profile. Plus by default, Base selectable. VeriSpoof-Plus ↗The strongest model: 2.14% pooled EER, 6.2% same-source EER on unseen generators. VeriSpoof-Base ↗Official training splits only; the model of all controlled studies. 4.43% pooled EER. Code ↗The pip-installable inference package with a vLLM backend. Training code follows with the peer-reviewed paper. VeriSpoof-Bench ↗Lists, labels and scoring scripts for source verification, channel, grounded reasoning, localization and faithfulness.

Intended for research on deepfake detection, source tracing and explainable forensics. A forensic decision should combine this score with other evidence and human review.

Cite

If VeriSpoof helps your work

BibTeX

@misc{verispoof2026,
  title         = {{VeriSpoof}: Beyond Real or Fake with One Audio {LLM}},
  author        = {Xiao, Yang and Dang, Ting},
  year          = {2026},
  eprint        = {2611.04634},
  archivePrefix = {arXiv},
  primaryClass  = {eess.AS},
  url           = {https://arxiv.org/abs/2611.04634}
}

License

VeriSpoof weights and code: CC BY-NC 4.0 (non-commercial). The base models keep their own license: MiniCPM5-2B and Qwen3-ASR-1.7B, Apache-2.0.

Gallery audio

Evaluation recordings, redistributed under their licenses: ASVspoof 2019 LA (ODC-By 1.0), PartialEdit (CC BY 4.0), HAD (CC BY 4.0), CodecFake+ (MIT) and DFADD (MIT). PartialEdit and DFADD build on VCTK (CC BY 4.0). Corpus papers are cited in the tech report.

Film

Narration and Yang Xiao’s voice are synthetic (Fish Audio). Music “78 PULSE” by kjartan_abel (CC BY 4.0); sound effects “2 Impact Wet” by original_sound (CC BY 3.0) and “data corrupted” by Saltbearer (CC BY 4.0), the rest CC0, via Openverse and Freesound. Recordings from PartialEdit (CC BY 4.0) and MLAAD (CC BY-NC 4.0). Made with HyperFrames.

Acknowledgements

Experiments used computational resources of the National Computational Infrastructure (NCI Australia) and of the University of Melbourne. Generative AI tools were used to assist with writing code, running and summarising experiments, and drafting and editing the report and this page; the authors reviewed and take responsibility for all content.

Contact

Yang Xiao, The University of Melbourne
yxiao9550@student.unimelb.edu.au

Beyond realor fake.