Replay Attacks Against Audio Deepfake Detection

TL;DR

Replay attacks significantly undermine audio deepfake detection systems by re-recording and playing back fake audio through various devices, revealing vulnerabilities even with adaptive retraining, as demonstrated using the new ReplayDF dataset.

Contribution

This paper introduces ReplayDF, a comprehensive dataset for studying replay attacks on audio deepfake detection, and analyzes the vulnerability of existing models under realistic acoustic conditions.

Findings

Detection performance drops significantly under replay attacks.

Even adaptive RIR retraining does not fully mitigate vulnerabilities.

ReplayDF enables further research into robust audio deepfake detection.

Abstract

We show how replay attacks undermine audio deepfake detection: By playing and re-recording deepfake audio through various speakers and microphones, we make spoofed samples appear authentic to the detection model. To study this phenomenon in more detail, we introduce ReplayDF, a dataset of recordings derived from M-AILABS and MLAAD, featuring 109 speaker-microphone combinations across six languages and four TTS models. It includes diverse acoustic conditions, some highly challenging for detection. Our analysis of six open-source detection models across five datasets reveals significant vulnerability, with the top-performing W2V2-AASIST model's Equal Error Rate (EER) surging from 4.7% to 18.2%. Even with adaptive Room Impulse Response (RIR) retraining, performance remains compromised with an 11.0% EER. We release ReplayDF for non-commercial research use.