Paper deep dive
A Training-Free Proactive Defense Against Partial Speech Manipulation via Self-Embedding Steganography
Yigitcan Özer, Zhe Zhang, Wanying Ge, Xin Wang, Junichi Yamagishi
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%
Last extracted: 8/27/2026, 5:04:14 AM
Summary
This paper proposes a training-free proactive defense against partial deepfake speech manipulation using self-embedding steganography. The method embeds a compressed neural codec representation of the clean speech signal into the audio itself. By comparing the received signal with its self-reconstructed version using Dynamic Time Warping (DTW), the system detects manipulated segments. Experiments on the AV-Deepfake1M dataset show the method significantly outperforms passive detectors like LAV-DF and ResNet, achieving low Equal Error Rates (EER) even under word-swapping attacks.
Entities (8)
Relation Signals (7)
Self-Embedding Steganography → istrainingfree → true
confidence 99% · Remarkably, the proposed method operates without any training
Self-Embedding Steganography → istypeof → Proactive Defense
confidence 97% · propose its use as a proactive defense against partially deepfaked audio
Self-Embedding Steganography → evaluatedon → AV-Deepfake1M
confidence 95% · Experiments on a benchmark dataset... subset of the validation split of the AV-Deepfake1M Dataset
Self-Embedding Steganography → outperforms → LAV-DF
confidence 94% · The proposed method consistently reduces the EER to approximately 8.9%–10.0%... LAV-DF and LAV-DF+ operate close to a random performance level
Self-Embedding Steganography → uses → Dynamic Time Warping
confidence 93% · a detection score is computed on the basis of the dynamic time warping (DTW) [34] between the received signal
Self-Embedding Steganography → uses → Least Significant Bit
confidence 91% · we propose a temporally repetitive adaptation of the classical least significant bit (LSB) scheme
Self-Embedding Steganography → uses → SNAC
confidence 90% · We adopt the neural speech codec SNAC [33] with encoder f... which maps the carrier to a compact latent representation
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Partial deepfake speech, where only limited segments of an utterance are synthesized or manipulated, poses a significant challenge to existing deepfake detection systems. As the proportion of spoofed regions decreases, passive detectors become increasingly unreliable, and accurate detection and restoration remain challenging. In this paper, we revisit audio steganography from a new perspective and propose its use as a proactive defense against partially deepfaked audio. In particular, we consider a self-embedding strategy in which a clean speech signal embeds a compressed representation of itself, enabling post-hoc extraction of reference content. We demonstrate how existing audio steganography methods can be repurposed to support detection of partial deepfakes through codec-based restoration. Experiments on a benchmark dataset show that the proposed approach complements passive defenses. Remarkably, the proposed method operates without any training, providing a robust and data-efficient alternative for partial deepfake detection.
Tags
Links
- Source: https://arxiv.org/abs/2608.25285v1
- Canonical: https://arxiv.org/abs/2608.25285v1
Trouble viewing inline? Open PDF directly →
Full Text
36,050 characters extracted from source content.
Expand or collapse full text
Özer Zhang Ge Wang Yamagishi A Training-Free Proactive Defense Against Partial Speech Manipulation via Self-Embedding Steganography Yigitcan Zhe Wanying Xin Junichi Abstract Partial deepfake speech, where only limited segments of an utterance are synthesized or manipulated, poses a significant challenge to existing deepfake detection systems. As the proportion of spoofed regions decreases, passive detectors become increasingly unreliable, and accurate detection and restoration remain challenging. In this paper, we revisit audio steganography from a new perspective and propose its use as a proactive defense against partially deepfaked audio. In particular, we consider a self-embedding strategy in which a clean speech signal embeds a compressed representation of itself, enabling post-hoc extraction of reference content. We demonstrate how existing audio steganography methods can be repurposed to support detection of partial deepfakes through codec-based restoration. Experiments on a benchmark dataset show that the proposed approach complements passive defenses. Remarkably, the proposed method operates without any training, providing a robust and data-efficient alternative for partial deepfake detection. keywordsaudio steganography, partial deepfake detection, audio watermarking, self-embedding steganography †address: National Institute of Informatics, Tokyo, Japan†email: yiitozer, zhe, gewanying, wangxin, jyamagis@nii.ac.jp 1 Introduction Recent advances in text-to-speech (TTS) and voice conversion (VC) technologies have enabled highly realistic deepfake audio [1, 2]. While fully synthesized speech can often be detected reliably [3], real-world attacks increasingly involve partial manipulation, where only short segments of an otherwise authentic utterance are replaced [4]. Such localized manipulations substantially reduce the reliability of passive detection systems [5], which struggle especially when spoofed regions are brief or sparse. Moreover, identifying manipulated segments and recovering the original content remains difficult under this setting, limiting the practical utility of existing countermeasures [6]. To address these challenges, recent studies have investigated partial deepfake detection and localization [7, 8, 9, 10, 11]. Furthermore, benchmark datasets such as HalfTruth [12], PartialSpoof [13], PartialEdit [14], LlamaPartialSpoof [15], and AV-Deepfake1M [16] have facilitated research in partial deepfake detection. In parallel, audio steganography has been widely studied for secure communication and data hiding [17]. Beyond covert communication, steganography also provides a natural mechanism for proactive defense, as auxiliary information can be embedded into signals prior to distribution and later extracted for verification and recovery [18]. Recent neural methods further improve fidelity and capacity, enabling high-quality speech hiding and recovery [19, 20, 21, 22, 23, 24]. Relatedly, several audio watermarking systems, e.g., AudioSeal [25], also enable provenance verification and tampering localization. However, these approaches primarily focus on authorship and attribution, and do not directly support fine-grained content recovery under partial manipulation. Figure 1: Overview of the proposed self-embedding-based audio steganography framework against partial deepfake manipulation. Discrepancies between the received spoofed signal ~sp x_sp and its reconstruction R(~sp)R( x_sp) enable detection while restoration is ensured through neural codec-based reconstruction. In this work, we build upon this perspective and investigate a proactive defense paradigm grounded in audio steganography. Rather than attempting to identify synthesis artifacts after a manipulation has already occurred, we embed auxiliary information into the signal prior to distribution. In particular, we adopt a self-embedding strategy (see Figure 1), in which the embedded payload consists of a compact representation of the carrier signal itself. Self-embedding steganography has previously been explored in related domains, including video authentication [26] and digital image data hiding and reconstruction [27, 28, 29]. However, to the best of our knowledge, this paper constitutes the first systematic investigation of self-embedding as a proactive defense mechanism in the audio domain. By embedding a self-referential description of the signal, obtained via a compact neural speech codec representation, our approach enables a direct comparison between the received waveform and its self-reconstruction, thereby facilitating the detection of manipulated regions. As our main contribution, we propose a temporally repetitive adaptation of the classical least significant bit (LSB) scheme [30, 31] to embed a neural codec-derived representation of the carrier signal. Conceptually, the proposed method is related to the deep learning-based speech hiding method WavInWav [32]. Different from this approach, we adopt a lightweight, training-free strategy that enables robust self-recovery under partial manipulation without requiring large-scale model training or specialized architectures. Through systematic experiments on a subset of the AV-Deepfake1M dataset [16], we demonstrate that the proposed method complements existing passive defenses and outperforms open-source baselines under partial deepfake attacks. 2 Self-Embedding Steganography Against Partial Speech Manipulation This section formalizes the proposed self-embedding framework for partial speech manipulation, describes the temporally repetitive LSB embedding scheme, analyzes its embedding capacity and repetition behavior, and introduces the computation of the self-reconstruction-based detection score. 2.1 Problem Formulation Let ∈ℝTx ^T denote a clean discrete-time speech signal of length T. In general audio steganography, an embedder E:ℝT×ℝM→ℝTE:R^T×R^M ^T hides an arbitrary message ∈ℝMm ^M in the carrier signal x, producing a stego signal ~=E(,) x=E(x,m), which is intended to remain perceptually indistinguishable from the original carrier. A corresponding stego decoder D:ℝT→ℝMD:R^T ^M attempts to recover the embedded message, resulting in ^=D(~) m=D( x). As depicted in Figure 1, this work departs from generic steganography by using a non-arbitrary message m. We adopt the neural speech codec SNAC [33] with encoder f:ℝT→ℝMf:R^T ^M, which maps the carrier to a compact latent representation =f()m=f(x). Under this self-embedding setting, the steganographic embedder hides the codec representation of the signal itself, producing ~=E(,) x=E(x,m). Decoding the stego signal yields an estimate ^=D(~) m=D( x). A synthesis function g:ℝM→ℝTg:R^M ^T is then applied to the recovered message m to obtain a codec-based reconstruction of the waveform. To analyze the robustness of self-embedding under partial deepfake manipulations, we introduce a spoofing operator A(⋅)A(·) that replaces single or multiple localized time intervals of a signal. Let ℐkk=1K\I_k\_k=1^K denote a collection of word-level intervals, with each interval given by ℐk=[tstart(k),tend(k)]I_k=[t_start^(k),t_end^(k)], where K denotes the number of intervals. For each interval, a corresponding manipulated segment is inserted. Importantly, the proposed framework makes no assumptions about the internal mechanism of the spoofing operator. In contrast to passive deepfake detectors that are often trained for specific synthesis artifacts, our formulation treats A(⋅)A(·) as a generic replacement operator. The manipulated segment may be generated by a TTS or VC model, or obtained through simple signal processing operations such as waveform splicing and segment-level temporal replacement from arbitrary audio recordings. Building on these definitions, we obtain the following variants of the utterance that serve as the basis for our analysis. The real signal is the clean carrier x. Embedding the self-referential message yields the stego signal ~ x. Applying the partial spoofing operator A(⋅)A(·) to the clean signal produces the spoofed signal spx_ sp11 1 The spx_ sp is not protected by the proposed method; it is used in the experiment to test the performance of passive deepfake detectors (§ 3.2)., while applying the same operator to the stego signal yields the spoofed stego signal ~sp x_sp. At verification time, let y denote the received signal, where =~y= x in the absence of manipulation and =~spy= x_sp under partial spoofing. We define the self-reconstruction operator as R()=g(D()).R(y)=g (D(y) ). Given a dissimilarity measure d, the reconstruction mismatch score is defined as s()=d(R(),).s(y)=d (R(y),\,y ). Detection is then formulated as a binary hypothesis test, δ()=0,s()≤τ,1,s()>τ,δ(y)= cases0,&s(y)≤τ,\\ 1,&s(y)>τ, cases where δ()=0δ(y)=0 indicates an authentic signal, δ()=1δ(y)=1 indicates a manipulated signal, and τ is a decision threshold. 2.2 Temporally Repetitive LSB Adaptation As a proactive defense mechanism, we adopt LSB embedding, which encodes binary information by modifying the least significant bit of each audio sample while introducing only minimal amplitude distortion. Specifically, we employ an LSB-based scheme with temporal repetition. For the binary message ∈0,1Mm∈\0,1\^M, the embedder integrates the message bits into the LSB of the audio samples repeatedly at fixed temporal offsets. In particular, the rthr^th repetition begins at sample index rPrP, where P is the repetition period (in samples) and P≥MP≥ M ensures that repetitions do not overlap. Given the carrier signal x of length T, the maximum number of repetitions is then R=1+⌊T−MP⌋.R=1+ T-MP . At decoding time, the decoder reads the LSB stream from the stego audio. If only a single copy is present, the first M bits are returned. When multiple repetitions are available, which is the case in our approach, the decoder retrieves all R copies and applies majority voting across repetitions for each bit: m^i=1,if 1R∑r=1Rmi(r)≥0.5,0,otherwise. m_i= cases1,&if 1R _r=1^Rm_i^(r)≥ 0.5,\\ 0,&otherwise. cases 2.3 Capacity and Repetition Analysis In our experiments, the carrier waveform is sampled at 16kHz16\,kHz, while the self-embedding payload is obtained by resampling to 24kHz24\,kHz and encoding with the SNAC 24kHz24\,kHz model at 0.98kbps0.98\,kbps [33]. The resulting bitstream is embedded in the 16kHz16\,kHz carrier via temporally repetitive LSB encoding, and the same resampling is applied when decoding the payload for self-reconstruction. At 0.98kbps0.98\,kbps, a one-second speech signal produces approximately 980980 payload bits. Including the 6464-bit synchronization preamble and setting P=MP=M yields a frame length of 10441044 bits. Since LSB embedding uses one bit per sample, a one-second utterance offers 16,00016,000 embedding positions, allowing ⌊16,000/1044⌋=15 16,000/1044 =15 non-overlapping frame repetitions. This redundancy yields error-free payload recovery in all our experiments, both for unmodified stego signals (~ x) and after the partial manipulation attacks (~sp x_sp), described in § 3.1, resulting in 100%100\% bit-exact payload reconstruction and successful waveform decoding in all evaluated cases. Figure 2: Warping paths computed with dynamic time warping (DTW), left: the stego signal ~ x and the reconstructed audio R(~)R( x), without no manipulation, right: the stego signal after manipulation (~sp x_sp) and the reconstructed audio (R(~sp)R( x_sp)) from the manipulated stego signal. 2.4 Detection Score via Dynamic Time Warping For the proposed self-embedding steganography approach, a detection score is computed on the basis of the dynamic time warping (DTW) [34] between the received signal y and its self-reconstruction R()=g(D())R(y)=g(D(y)) (see § 2.1). DTW provides a mechanism for aligning two time sequences under possible local temporal distortions. This is particularly suitable in our setting, as partial speech manipulations introduce temporal inconsistencies between y and R()R(y). Consequently, by allowing non-linear temporal alignment, DTW isolates structural mismatches beyond trivial timing offsets. As illustrated in Figure 2, we apply the DTW to normalized mel-log spectrogram features using cosine distance as the local dissimilarity measure. Here, the accumulated cost matrix is shown in grayscale, and the optimal warping path is overlaid in black, while the manipulated segment is highlighted in red. In the absence of manipulation, the warping path closely follows the diagonal, reflecting near one-to-one temporal correspondence. In contrast, partial manipulations result in higher accumulated costs and localized deviations from the diagonal. Let π∗π^* denote the optimal warping path obtained by DTW(R(),)DTW(R(y),y). We define the per-utterance score as sDTW()=1|π∗|∑t∈π∗cts_DTW(y)= 1|π^*| _t∈π^*c_t where ctc_t denotes the local cosine distance between two frames of the mel-log spectrum along the optimal warping path. Overall, the scalar sDTW()s_DTW(y) quantifies the average alignment mismatch between self-reconstruction and the received signal, with higher values indicating a higher chance of being manipulated. 3 Experiments This section describes the experimental setup and reports quantitative results for evaluating the proposed self-embedding-based defense against partial deepfake attacks. 3.1 Dataset and Threat Model The evaluation is conducted on a subset of the validation split22 2 This choice is motivated by the fact that labels and metadata are available only for the training and validation sets, whereas the test set is not publicly annotated. of the AV-Deepfake1M Dataset [16], whose first release is derived from the VoxCeleb2 corpus [35]. Although the database was originally designed for audio–visual deepfake research, our study focuses exclusively on the audio modality. Furthermore, we only use the real recordings for the experiments. Although we impose no restrictions on the spoofing operator A(⋅)A(·) (§ 2.1), and the proposed method can be applied to broader cases. For the proof‑of‑concept experiment in this paper, we assume that the attacker manipulates a part of the real recording. In particular, the attacker replaces one or two target words with re‑synthesized segments drawn from other utterances of the same speaker, thereby preserving speaker identity while altering the linguistic content. In our experiments, the re‑synthesis is conducted using publicly available pre‑trained vocoders or waveform reconstruction algorithms: GriffinLim [36], HiFiGAN [37], HNSincNSF [38], HNSincNSFHiFi [39], and WaveGlow [40]. The attacker is also assumed to use a time‑domain cross‑correlation method when replacing the swapped word [4], which helps to reduce the artifacts around the swapped word segments and the chance of being detected. Note again that the attacker assumed in the experiment is for the proof-of-concept purpose. Testing against diverse attacking methods is left to future work. 3.2 Evaluation Methodology and Baseline Systems To assess the detection capability of the proposed self-embedding steganography approach, we quantify the performance using the equal error rate (EER). The scores sDTW()s_DTW(y) of the positive data are computed between the signals without manipulation and their self-reconstruction (i.e., DTW(R(~),~)DTW(R( x), x)); those of the negative data are computed between the manipulated signals and the reconstructed versions (i.e., DTW(R(~sp),~sp)DTW(R( x_sp), x_sp)). The decision threshold of EER (τ in § 2.1) corresponds to the operating point at which the false positive rate equals the false negative rate. Lower EER values indicate better discriminative capacity between authentic and manipulated signals. For comparison, we consider the LAV-DF [7] and LAV-DF+ [8] models, which were originally proposed for audio--visual partial deepfake detection and jointly exploit both modalities. To the best of our knowledge, these models are among the few partial deepfake detectors with publicly available pretrained checkpoints, enabling reproducible evaluation33 3 https://github.com/ControlNet/LAV-DF. In our experiments, we operate them in an audio-only setting. Detection for these two baseline systems relies on the predicted boundary maps produced by the model when the spoofed signal spx_ sp is provided as input (see § 2.1). A detection score, indicating the chance that the recording is manipulated, is computed as the mean of the boundary map. The EERs are then computed in the same manner as that for the proposed method. In addition, we include a pretrained ResNet-based model designed for deepfake word detection [41]. Unlike LAV-DF and LAV-DF+, this model operates purely on acoustic features without cross-modal information. Including this model allows us to assess whether a strong audio-only detector can identify the word-level attacks considered in our setting. Note that the model, by design, produces frame-level detection logits, averages the logits corresponding to each word segment into a single value, and makes a real/fake decision for each word. For the experimental comparison, wherein an utterance-level score is needed, we compute the mean of the frame-level logits and use it as the utterance-level score. The EER is then computed in the same manner as for the other methods. Table 1: Detection performance under the word-swapping attack, reported as EER (%). The pooled result is followed by results for each re-synthesis model. Lower EER values indicate better detection performance. Ours LAV-DF [7] LAV-DF+ [8] ResNet [41] Single-word swapping GriffinLim [36] 9.95 50.17 49.90 47.46 HiFiGAN [37] 9.38 50.04 49.90 47.52 HNSincNSF [38] 9.52 50.10 49.90 46.97 HNSincNSFHiFi [39] 9.52 50.31 49.90 47.52 WaveGlow [40] 8.91 50.37 50.03 43.98 Two-word swapping GriffinLim 4.97 50.07 48.34 45.89 HiFiGAN 5.00 50.03 48.56 46.44 HNSincNSF 5.07 49.96 48.34 45.67 HNSincNSFHiFi 5.07 50.03 48.34 45.45 WaveGlow 4.44 50.11 48.62 42.07 3.3 Detection Performance We evaluate the detection performance under the word-swapping attack, which represents the primary and realistic partial deepfake threat model considered in this study. Table 1 reports detection performance under the word-swapping attack for the proposed self-embedding method and the LAV-DF [7], LAV-DF+ [8], and ResNet [41] baselines. For the single-word swapping case, LAV-DF and LAV-DF+ operate close to a random performance level, with EER values consistently around 50%50\% across all vocoders. The pretrained ResNet detector achieves slightly lower EERs in the range of 44%44\%–47.5%47.5\%, yet its performance remains near-random, indicating limited sensitivity to localized word-level manipulations. In contrast, the proposed method consistently reduces the EER to approximately 8.9%8.9\%–10.0%10.0\% across all re-synthesis models. This margin shows that self-reconstruction yields more discriminative cues for detecting content-level manipulations. For the two-word swapping case, a similar trend is observed. LAV-DF and LAV-DF+ remain at a random performance level, while the ResNet detector shows moderate improvement, with EER values decreasing to approximately 42.07%42.07\%–46.44%46.44\%. The proposed method further reduces the EER to 4.4%4.4\%–5.1%5.1\%, indicating increased detection capability as the extent of manipulation increases. Replacing two temporally separated words induces a larger discrepancy between the manipulated waveform and the self-reconstruction of the authentic signal, which the proposed method captures effectively, whereas passive detectors remain largely insensitive to such localized alterations. The DTW-based analysis further supports this observation. Figure 3 illustrates this behavior by showing the distribution of sDTWs_DTW for authentic speech and single-word swap manipulations across all vocoders. Authentic samples are tightly concentrated at lower score values, while word-swapping attacks consistently shift the distribution toward higher scores. Importantly, this separation persists across different re-synthesis methods, indicating that the proposed self-embedding mechanism captures partial manipulation-induced inconsistencies that remain detectable after vocoder reconstruction. Figure 4 shows detection performance as a function of the swapped word duration, computed in non-overlapping 0.1s0.1\,s bins for each vocoder. A clear monotonic trend emerges: shorter manipulations are harder to detect, while longer swaps yield progressively lower EERs. For very short insertions (<0.1s<0.1\,s), the EER exceeds 20%20\%, whereas it drops below 10%10\% once the duration of the swapped segment exceeds 0.3s0.3\,s. This pattern aligns with the self-reconstruction-based verification mechanism: longer manipulations lead to a stronger mismatch between R()R(y) and y and consequently lower error rates. Figure 3: Score distributions computed via DTW-based dissimilarity metric (sDTWs_DTW) for authentic signals and single-word swap manipulations under various vocoder conditions. Figure 4: Detection performance as a function of swapped-word duration. Each point reports the EER within a 0.1 s duration bin for different vocoders. The results reveal a fundamental difference between proactive and passive defenses for partial deepfake detection. Passive detectors depend on synthesis artifacts that diminish as the manipulated region becomes shorter, which explains their near-random performance in the word-swapping scenario. In contrast, the proposed self-embedding approach evaluates the temporal consistency between the received signal and the self-reconstruction of the authentic waveform, making it capable of detecting even brief semantic or temporal disruptions. However, when the manipulated segment becomes extremely short, the resulting mismatch becomes weaker, making such manipulations more difficult to detect. 4 Conclusion In this paper, we investigated audio steganography as a proactive defense mechanism against partial manipulations in speech signals. By adopting a self-embedding strategy based on temporally repetitive LSB encoding, we showed that a speech signal can reliably carry a compact representation of itself, enabling post-hoc detection of manipulated regions through codec-based restoration. Practically, the method is lightweight, training-free, and compatible with existing codecs and embedding schemes, making it readily deployable within current audio processing pipelines. Experimental results on a benchmark dataset demonstrated that the proposed approach is effective even when manipulated segments are sparse, without requiring any spoofed training data. These findings highlight the complementary roles of proactive and passive defenses for mitigating partial deepfakes. Future work will explore more advanced and robust embedding strategies as well as tighter integration with neural codecs to further improve resilience against increasingly sophisticated manipulation attacks. 5 Acknowledgements This work was supported by JSPS MEXT KAKENHI Grant (24H00732). We thank NII visiting researchers Sunan Zou and Yassine El Kheir for their valuable feedback on the article’s visualizations. 6 Generative AI Use Disclosure Generative AI tools were used only for language editing and polishing (e.g., grammar, wording, and readability improvements) in this manuscript. No generative AI tool was used to write major parts of the paper, generate scientific claims, or make research decisions. All technical content, analyses, results, and conclusions were produced and verified by the authors, and the authors take full responsibility for the final manuscript. References [1] Y. Patel, S. Tanwar, R. Gupta, P. Bhattacharya, I. E. Davidson, R. Nyameko, S. Aluvala, and V. Vimal (2023) Deepfake generation and detection: case study and challenges. IEEE Access, p. 143296–143323. External Links: Document Cited by: §1. [2] K. Bhagtani, A. K. S. Yadav, P. Bestagini, and E. J. Delp (2024) Are recent deepfake speech generators detectable?. In Proceedings of the ACM Workshop on Information Hiding and Multimedia Security (IH&MMSec), Baiona, Spain, p. 277–282. External Links: Document Cited by: §1. [3] M. Li, Y. Ahmadiadli, and X. Zhang (2025) A survey on speech deepfake detection. ACM Computing Surveys 57 (7), p. 1–38. Cited by: §1. [4] L. Zhang, X. Wang, E. Cooper, J. Yamagishi, J. Patino, and N. W. D. Evans (2021) An initial investigation for detecting partially spoofed audio. In Proceedings of the Annual Conference of the International Speech Communication Association (Interspeech), Brno, Czechia, p. 4264–4268. External Links: Document Cited by: §1, §3.1. [5] J. He, J. Yi, J. Tao, S. Zeng, and H. Gu (2025) Manipulated regions localization for partially deepfake audio: a survey. Note: arXiv Cited by: §1. [6] X. Wang and J. Yamagishi (2021) A comparative study on recent neural spoofing countermeasures for synthetic speech detection. In Proceedings of the Annual Conference of the International Speech Communication Association (Interspeech), Brno, Czech Republic, p. 4259–4263. External Links: Document Cited by: §1. [7] Z. Cai, K. Stefanov, A. Dhall, and M. Hayat (2022) Do you really mean that? Content-driven audio-visual deepfake dataset and multimodal method for temporal forgery localization. In Proceedings of the International Conference on Digital Image Computing: Techniques and Applications (DICTA), Sydney, Australia. External Links: Document Cited by: §1, §3.2, §3.3, Table 1. [8] Z. Cai, S. Ghosh, A. Dhall, T. Gedeon, K. Stefanov, and M. Hayat (2023) Glitch in the matrix: a large-scale benchmark for content-driven audio-visual forgery detection and localization. Computer Vision and Image Understanding, p. 103818. External Links: Document Cited by: §1, §3.2, §3.3, Table 1. [9] A. Khan, K. M. Malik, and S. Nawaz (2024) Frame-to-utterance convergence: a spectra-temporal approach for unified spoofing detection. In Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Seoul, Republic of Korea, p. 10761–10765. External Links: Document Cited by: §1. [10] Y. Xie, H. Cheng, Y. Wang, and L. Ye (2024) An efficient temporary deepfake location approach based on embeddings for partially spoofed audio detection. In Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Seoul, Republic of Korea, p. 966–970. External Links: Document Cited by: §1. [11] N. Klein, H. Tak, J. Fullwood, K. Regmi, L. Spinoulas, G. Sivaraman, T. Chen, and E. Khoury (2025) Pindrop it! audio and visual deepfake countermeasures for robust detection and fine-grained localization. In Proceedings of the ACM International Conference on Multimedia (ACMMM), Dublin, Ireland, p. 13700–13706. External Links: Document Cited by: §1. [12] J. Yi, Y. Bai, J. Tao, H. Ma, Z. Tian, C. Wang, T. Wang, and R. Fu (2021) Half-truth: a partially fake audio detection dataset. In Proceedings of the Annual Conference of the International Speech Communication Association (Interspeech), Brno, Czechia, p. 1654–1658. External Links: Document Cited by: §1. [13] L. Zhang, X. Wang, E. Cooper, N. W. D. Evans, and J. Yamagishi (2023) The PartialSpoof database and countermeasures for the detection of short fake speech segments embedded in an utterance. IEEE/ACM Transactions on Audio, Speech, and Language Processing, p. 813–825. External Links: Document Cited by: §1. [14] Y. Zhang, B. Tian, L. Zhang, and Z. Duan (2025) PartialEdit: identifying partial deepfakes in the era of neural speech editing. In Proceedings of the Annual Conference of the International Speech Communication Association (Interspeech), Rotterdam, The Netherlands, p. 5353–5357. Cited by: §1. [15] H. Luong, H. Li, L. Zhang, K. A. Lee, and E. S. Chng (2025) LlamaPartialSpoof: an LLM-driven fake speech dataset simulating disinformation generation. In Proceedings of the IEEE International Conference on Acoustics, Speech, and Signal Processing (ICASSP), Hyderabad, India, p. 1–5. External Links: Document Cited by: §1. [16] Z. Cai, S. Ghosh, A. P. Adatia, M. Hayat, A. Dhall, T. Gedeon, and K. Stefanov (2024) AV-Deepfake1M: a large-scale LLM-driven audio-visual deepfake dataset. In Proceedings of the ACM International Conference on Multimedia (ACMMM), Melbourne, Australia, p. 7414–7423. External Links: Document Cited by: §1, §1, §3.1. [17] F. Djebbar and B. Ayad (2012) Comparative study of digital audio steganography techniques. EURASIP Journal on Audio, Speech, and Music Processing. External Links: Document Cited by: §1. [18] Z. Wang, O. Byrnes, H. Wang, R. Sun, C. Ma, H. Chen, Q. Wu, and M. Xue (2023) Data hiding with deep learning: a survey unifying digital watermarking and steganography. IEEE Transactions on Computational Social Systems, p. 2985–2999. Cited by: §1. [19] F. Kreuk, Y. Adi, B. Raj, R. Singh, and J. Keshet (2020) Hide and Speak: Towards deep neural networks for speech steganography. In Proceedings of the Annual Conference of the International Speech Communication Association (Interspeech), Shanghai, China, p. 4656–4660. External Links: Document Cited by: §1. [20] W. Cui, S. Liu, F. Jiang, Y. Liu, and D. Zhao (2020) Multi-stage residual hiding for image-into-audio steganography. In Proceedings of the IEEE International Conference on Acoustics, Speech, and Signal Processing (ICASSP), Barcelona, Spain, p. 2832–2836. External Links: Document Cited by: §1. [21] Y. Kong and J. Zhang (2020) Adversarial audio: a new information hiding method. In Proceedings of the Annual Conference of the International Speech Communication Association (Interspeech), Shanghai, China, p. 2287–2291. Cited by: §1. [22] M. Geleta, C. Punti, K. McGuinness, J. Pons, C. Canton, and X. Giró-i-Nieto (2022) PixInWav: Residual steganography for hiding pixels in audio. In Proceedings of the IEEE International Conference on Acoustics, Speech, and Signal Processing (ICASSP), Singapore, p. 2485–2489. External Links: Document Cited by: §1. [23] C. Chang and I. Echizen (2025) Steganography beyond space-time with chain of multimodal AI. Scientific Reports 15, p. 12908. External Links: Document Cited by: §1. [24] S. Zhang, B. Tian, Y. Gao, X. Liu, and W. Yang (2025) HIFI-Stego: A high-fidelity embedding audio steganography based on audio features decoupling. IEEE/ACM Transactions on Audio, Speech and Language Processing, p. 2032–2044. External Links: Document Cited by: §1. [25] R. S. Roman, P. Fernandez, H. Elsahar, A. Défossez, T. Furon, and T. Tran (2024) Proactive detection of voice cloning with localized watermarking. In Proceedings of the International Conference on Machine Learning (ICML), Vienna, Austria. Cited by: §1. [26] P. Yogarajah, J. V. Condell, K. Curran, and P. McKevitt (2011) Video authentication: A self-embedding steganography approach. In Proceedings of the International Machine Vision and Image Processing Conference (IMVIP), United Kingdom, p. 174–189. Cited by: §1. [27] A. Cheddad, J. V. Condell, K. Curran, and P. McKevitt (2009) A secure and improved self-embedding algorithm to combat digital document forgery. Signal Processing 89 (12), p. 2324–2332. External Links: Document Cited by: §1. [28] L. Rakhmawati, S. Suwadi, and W. Wirawan (2020) Blind robust and self-embedding fragile image watermarking for image authentication and copyright protection with recovery capability. International Journal of Intelligent Engineering & Systems 13 (5). Cited by: §1. [29] L. Wang, S. Banerjee, Y. Cao, J. Mou, and B. Sun (2024) A new self-embedding digital watermarking encryption scheme. Nonlinear Dynamics 112 (10), p. 8637–8652. External Links: Document Cited by: §1. [30] W. Bender, D. Gruhl, N. Morimoto, and A. Lu (1996) Techniques for data hiding. IBM Systems Journal 35 (3–4), p. 313–336. External Links: Document Cited by: §1. [31] E. Franz, A. Jerichow, S. Möller, A. Pfitzmann, and I. Stierand (1996) Computer-based steganography: how it works and why therefore any restrictions on cryptography are nonsense, at best. In Proceedings of Information Hiding, Cambridge, UK, p. 7–21. Cited by: §1. [32] W. Fan, K. Chen, X. Wang, W. Zhang, and N. Yu (2025) WavInWav: time-domain speech hiding via invertible neural network. Note: arXiv External Links: 2510.02915 Cited by: §1. [33] H. Siuzdak, F. Grötschla, and L. A. Lanzendörfer (2024) SNAC: multi-scale neural audio codec. In Audio Imagination: NeurIPS 2024 Workshop on AI-Driven Speech, Music, and Sound Generation, Vancouver, Canada. Cited by: §2.1, §2.3. [34] M. Müller (2007) Dynamic time warping. In Information Retrieval for Music and Motion, p. 69–84. External Links: Document Cited by: §2.4. [35] J. S. Chung, A. Nagrani, and A. Zisserman (2018) VoxCeleb2: deep speaker recognition. In Proceedings of the Annual Conference of the International Speech Communication Association (Interspeech), Hyderabad, India, p. 1086–1090. External Links: Document Cited by: §3.1. [36] D. W. Griffin and J. S. Lim (1984) Signal estimation from modified short-time Fourier transform. IEEE Transactions on Acoustics, Speech, and Signal Processing 32 (2), p. 236–243. Cited by: §3.1, Table 1. [37] J. Kong, J. Kim, and J. Bae (2020) HiFi-GAN: generative adversarial networks for efficient and high fidelity speech synthesis. In Advances in Neural Information Processing Systems (NeurIPS), p. 17022–17033. Cited by: §3.1, Table 1. [38] X. Wang and J. Yamagishi (2019) Neural harmonic-plus-noise waveform model with trainable maximum voice frequency for text-to-speech synthesis. In Proceedings of the 10th ISCA Speech Synthesis Workshop (SSW), Vienna, Austria, p. 1–6. External Links: Document Cited by: §3.1, Table 1. [39] N. Tomashenko, X. Wang, X. Miao, H. Nourtel, P. Champion, M. Todisco, E. Vincent, N. Evans, J. Yamagishi, and J. Bonastre (2022) The VoicePrivacy 2022 challenge evaluation plan. Note: arXiv External Links: 2203.12468 Cited by: §3.1, Table 1. [40] R. Prenger, R. Valle, and B. Catanzaro (2019) WaveGlow: A Flow-based Generative Network for Speech Synthesis. In Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Brighton, UK, p. 3617–3621. Cited by: §3.1, Table 1. [41] H. M. Tran, X. Wang, W. Ge, X. Liu, and J. Yamagishi (2026) Deepfake word detection by next-token prediction using fine-tuned whisper. Note: arXiv External Links: 2602.22658 Cited by: §3.2, §3.3, Table 1.