A training-free defense that embeds a compressed representation of clean speech into the signal detected simulated one-word and two-word swaps with much lower equal error rates than the tested baselines in an audio-only evaluation. For single-word swaps, its EER, or equal error rate, was approximately 8.9% to 10.0%, compared with around 50% for LAV-DF and LAV-DF+ and 44% to 47.5% for ResNet. For two-word swaps, the proposed method was at about 4.4% to 5.1%, while ResNet was 42.07% to 46.44% and the LAV-DF systems remained at a random-performance level.
EER is the operating point where false-positive and false-negative rates are equal. A lower EER indicates better discrimination between authentic and manipulated signals, which is why the gap between the proposed method and the baselines matters.
A signal that carries its own reference
The approach is proactive: clean speech carries a compressed representation of itself. After the signal is received, that embedded information is decoded and used to restore a reference waveform. The verification score then uses dynamic time warping, or DTW, to compare the received signal with this codec-based self-reconstruction.
In the reported engineering check, a one-second carrier sampled at 16 kHz could hold approximately 980 payload bits from a 24 kHz SNAC representation running at 0.98 kbps. A 64-bit synchronization preamble made the frame 1,044 bits long, allowing 15 non-overlapping repetitions in one second. The payload was recovered exactly at the bit level, and waveform decoding succeeded in all evaluated cases.
How the test was set up
The benchmark used real recordings from an audio-only subset of the AV-Deepfake1M validation split. The proof-of-concept attack replaced one or two target words with re-synthesized segments taken from other utterances by the same speaker, using publicly available vocoders or waveform-reconstruction algorithms. The comparison included LAV-DF and LAV-DF+, run audio-only, and a pretrained ResNet-based deepfake-word detector operating on acoustic features.
Across the tested re-synthesis methods, authentic recordings tended to produce lower DTW scores, while word-swapped signals shifted toward higher values. The paper describes this separation qualitatively rather than with a separate quantitative estimate.
The weak point was very short edits
The result was not uniform across edits of different lengths. When the researchers divided swaps into non-overlapping 0.1-second bins, EER exceeded 20% for segments shorter than 0.1 seconds, then fell below 10% once swapped-segment duration was above 0.3 seconds. In this evaluation, brief edits were therefore harder to distinguish than longer ones.
A narrow test, not a universal answer
The strong benchmark numbers describe a narrow proof of concept. The tested attacker used one or two same-speaker word swaps made with the specified re-synthesis systems, and evaluation against diverse attacking methods was left for future work. The results therefore do not establish performance against attacks beyond this word-swapping setup.
The authors describe the approach as lightweight and training-free, requiring no spoofed training data, and say it could complement passive defenses when manipulations are sparse. Within the tested setup, the reported results support that interpretation, but they do not by themselves establish a general detector.
The manuscript is identified as arXiv version 2 in cs.SD and dated 18 September 2026. The work was supported by JSPS MEXT KAKENHI Grant 24H00732.
Paper data and sources
Original title: A Training-Free Proactive Defense Against Partial Speech Manipulation via Self-Embedding Steganography
Authors: Yigitcan Özer, Zhe Zhang, Wanying Ge et al.
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-26
DOI: Not available
Original paper · Full text