Paper deep dive
What You Train Is What You Get: Gender Bias, Training Composition, and Post-Hoc Mitigation in Audio Deepfake Detection
Aishwarya R. Fursule, Vamshi Nallaguntla, Shruti Kshirsagar, Anderson R. Avila
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 94%
Last extracted: 7/18/2026, 11:44:16 AM
Summary
This study investigates gender bias in audio deepfake detection using the ASVspoof5 dataset, demonstrating that training data composition strongly predicts bias direction, with underrepresented genders performing worse. WavLM-Base+ features exhibit significantly larger gender performance gaps than LogSpectrogram, and post-hoc threshold calibration methods fail to correct underlying score distribution disparities, indicating that fairness must be addressed at the training stage.
Entities (6)
Relation Signals (4)
WavLM-Base+ â produceslargerbiasthan â LogSpectrogram
confidence 95% · WavLM-Base+ features are shown to produce gender performance gaps 3.0 to 4.3 times larger than LogSpectrogram under identical training conditions
Training Data Composition â predictsbiasdirection â Gender Performance
confidence 93% · Experimental results show that training data composition strongly predicts bias direction, with the underrepresented gender performing worse at test time.
Post-Hoc Calibration â failstocorrect â Score Distribution Disparities
confidence 91% · all six calibration strategies... leave the Equal Error Rate gap unchanged... confirming that threshold adjustment cannot correct underlying score distribution disparities.
Balanced Training â reducesbiasin â LogSpectrogram
confidence 90% · balanced training is found to reduce LogSpectrogram bias but leave WavLM bias largely intact.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Audio deepfake detection models determine whether speech is genuine or artificially generated, but high overall accuracy can mask substantial performance disparities across demographic groups. In this work, we investigate gender bias in audio deepfake detection using the ASVspoof5 dataset. We use ASVspoof5 under a controlled custom split designed to isolate gender-composition effects. We train attack-specific models on nine training sets with different gender compositions, ranging from female-only to male-only. We use a ResNet18 classifier with LogSpectrogram and WavLM-Base+ features, and we evaluated six post-hoc threshold calibration methods. Experimental results show that training data composition strongly predicts bias direction, with the underrepresented gender performing worse at test time. WavLM-Base+ features are shown to produce gender performance gaps 3.0 to 4.3 times larger than LogSpectrogram under identical training conditions, and balanced training is found to reduce LogSpectrogram bias but leave WavLM bias largely intact. Moreover, all six calibration strategies, including Oracle calibration with full test-set label access, leave the Equal Error Rate gap unchanged at 1.317 pp, confirming that threshold adjustment cannot correct underlying score distribution disparities. Overall, these findings suggest that gender fairness in audio deepfake detection must be addressed at training time, as post-hoc methods can only partially mitigate the resulting disparities
Tags
Links
- Source: https://arxiv.org/abs/2607.09891v1
- Canonical: https://arxiv.org/abs/2607.09891v1
Trouble viewing inline? Open PDF directly â
Full Text
84,902 characters extracted from source content.
Expand or collapse full text
What You Train Is What You Get: Gender Bias, Training Composition, and Post-Hoc Mitigation in Audio Deepfake Detection Aishwarya R. Fursule, Vamshi Nallaguntla, Shruti Kshirsagar, and Anderson R. Avila A. Fursule, V. Nallaguntla, and S. Kshirsagar are with the School of Computing, Wichita State University, Wichita, KS, USA (e-mail: axfursule@shockers.wichita.edu; vxnallaguntla@shockers.wichita.edu; shruti.kshirsagar@wichita.edu).A. R. Avila is with the Institut national de la recherche scientifique (INRSâEMT), Montreal, QC, Canada, and also with the INRS-UQO Mixed Research Unit on Cybersecurity, Gatineau, QC, Canada (e-mail: anderson.avila@inrs.ca). Abstract Audio deepfake detection models determine whether speech is genuine or artificially generated, but high overall accuracy can mask substantial performance disparities across demographic groups. In this work, we investigate gender bias in audio deepfake detection using the ASVspoof5 dataset. We use ASVspoof5 under a controlled custom split designed to isolate gender-composition effects. We train attack-specific models on nine training sets with different gender compositions, ranging from female-only to male-only. We use a ResNet18 classifier with LogSpectrogram and WavLM-Base+ features, and we evaluated six post-hoc threshold calibration methods. Experimental results show that training data composition strongly predicts bias direction, with the underrepresented gender performing worse at test time. WavLM-Base+ features are shown to produce gender performance gaps 3.0 to 4.3 times larger than LogSpectrogram under identical training conditions, and balanced training is found to reduce LogSpectrogram bias but leave WavLM bias largely intact. Moreover, all six calibration strategies, including Oracle calibration with full test-set label access, leave the Equal Error Rate gap unchanged at 1.317 p, confirming that threshold adjustment cannot correct underlying score distribution disparities. Overall, these findings suggest that gender fairness in audio deepfake detection must be addressed at training time, as post-hoc methods can only partially mitigate the resulting disparities. I Introduction Speech can no longer be reliably trusted as an indicator of human identity [1]. Advances in neural text-to-speech synthesis, voice conversion, and adversarial perturbation now enable generation of audio that can convincingly mimic human speech and deceive listeners [2, 3]. The research community has responded with a range of countermeasures, from classical Gaussian Mixture Model classifiers to end-to-end architectures such as RawNet2 [8], graph attention networks such as AASIST [9], and self-supervised representations including WavLM [38], all benchmarked through the ASVspoof challenge series [34, 35, 36, 7]. However, strong average accuracy does not guarantee equitable performance across demographic groups [29] as a model may achieve a low aggregate Equal Error Rate (EER) while consistently failing one gender on specific attack types, implying that some users receive less protection based on gender alone. Prior work has established that this failure mode exists but has not resolved its cause, particularly with respect to how attack type, speaker gender, and feature representation interact [4, 6, 5]. Detection systems trained on female voices outperform those trained on male voices [12], attributed to spectral artifacts in synthesized female speech. A fairness audit of six detection systems [20] found the opposite: male speakers face higher false positive rates regardless of architecture. A third study [15] attributes disparities to score distribution shift between training and evaluation rather than to spectral artifacts. These findings contradict each other because none controlled the gender composition of the training data. It therefore remains unknown whether bias direction is predictable from composition, whether this relationship holds across attack types, and whether the method of achieving gender balance matters. In [13] we showed that a single threshold obscures statistically significant gender differences across six fairness metrics on ASVspoof5. In [24] we identified score distribution asymmetry and embedding-level gender leakage as structural bias sources, and showed that per-gender threshold calibration reduces false alarm disparity by 54 to 75% without degrading accuracy. Those reductions were in false positive rate gap under balanced training; the present study shows that the EER gap is insensitive to all post-hoc calibration including Oracle calibration [21, 22] with full test-set label access. Critically, neither study varied training gender composition, leaving the three questions above unresolved. A related question follows naturally from this gap in the literature: is there a fundamental limit to how much post-hoc calibration alone can reduce gender disparities? While group fairness criteria are known to be mutually incompatible [21, 22], whether this extends to a hard post-hoc boundary on the EER gap across diverse training compositions has not been shown. Here, we address these questions by training 288 WavLM-Base+ [38] models on ASVspoof5 under nine gender-composition configurations, together with 96 LogSpectrogram models under three baseline configurations, for 384 attack-specific models in total. WavLM-Base+ was selected because it exhibited substantially larger gender gaps than other architectures in our earlier work [24], making it the more informative choice for studying composition effects at scale. Each model is evaluated separately on female and male speakers across all 32 spoofing attacks, with six group fairness metrics assessed under six post-hoc calibration strategies, including an Oracle calibration with direct access to evaluation-set labels. In this work, we systematically evaluate how training gender composition shapes fairness in audio deepfake detection. Our main contributions are: 1. We present the first study (to our knowledge) that systematically varies training gender composition as a controlled independent variable in audio deepfake detection. We train 384 attack-specific models (288 WavLM-Base+ across 9 configurations; 96 LogSpectrogram across 3 configurations) and measure the resulting changes in six fairness metrics. We validate all findings with bootstrap-based significance tests and BenjaminiâHochberg correction [39]. 2. We show that the underrepresented gender in training suffers higher error rates at test time in 31 of 32 attacks, regardless of which gender occupies the minority position. We further show that combined training reduces the mean EER gap from 1.042 p to 0.273 p compared to within-attack balancing at a similar gender ratio. 3. We compare LogSpectrogram and WavLM-Base+ and show that they exhibit systematically different bias patterns on identical training data. We show that balanced training nearly eliminates LogSpectrogram disparity but leaves WavLM disparity largely intact, indicating that gender correlations embedded during SSL pre-training persist through fine-tuning regardless of composition [38, 41]. 4. We demonstrate that voice conversion attacks produce the largest gender gaps under same-attack evaluation by preserving source speaker gender through the conversion process [15]. We also find that adversarial perturbation attacks produce the smallest EER gap but the largest demographic parity disparity under same-attack evaluation, making them simultaneously the most and least fair depending on the metric [17, 21]. These results show that a single metric cannot capture both dimensions. 5. We show that all six calibration strategies, including Oracle calibration, leave the EER gap unchanged at 1.317 p across all nine configurations. We attribute this to the fact that threshold adjustment shifts the operating point along the ROC curve but cannot alter its shape; distribution-level EER disparities therefore require retraining, not recalibration. We further show that per-gender EER calibration [24], which reduced disparity by 54 to 75% under balanced training, worsens equalized odds under imbalanced training, a failure mode invisible in single-composition experiments. Together, these results show that fairness disparities in audio deepfake detection are not merely artifacts of threshold selection, but arise from the interaction between training composition, attack type, and feature representation. This finding reframes fairness mitigation in spoofing countermeasures as a data- and representation-level problem rather than a purely post-hoc calibration problem. The remainder of this paper is organized to support this central argument. Section I reviews related work on audio deepfake detection, fairness evaluation, and demographic disparities in spoofing countermeasures. Section I describes the experimental setup, including the dataset, training configurations, feature representations, classifier architecture, evaluation protocol, fairness metrics, threshold calibration strategies, and statistical validation procedure. Section IV presents and analyzes the experimental results across training configurations, attack types, feature representations, and threshold calibration strategies. Section V discusses the limitations of this study, and Section VI concludes the paper. TABLE I: Spoofing attacks in ASVspoof5 [7] across TTS (text-to-speech), VC (voice conversion), and AT (adversarial perturbation). F (Female) and M (Male) columns show total number of utterances per gender across all splits. ID Type Algorithm F M ID Type Algorithm F M A01 TTS GlowTTS [50] 10095 10350 A17 TTS ZMM-TTS [47] 8660 7497 A02 TTS Variant of A01 10095 10350 A18 AT A17+Malafide 8508 7411 A03 TTS Variant of A01 10095 10350 A19 TTS MaryTTS [46] 7430 6773 A04 TTS GradTTS [51] 10095 10350 A20 AT A12+Malafide 7694 6910 A05 TTS Variant of A04 10095 10350 A21 TTS A09+BigVGAN [52] 8513 7478 A06 TTS Variant of A04 10095 10350 A22 TTS Variant of A09 [53] 8350 7491 A07 TTS FastPitch [54] 10095 10350 A23 AT A09+Malafide 8389 7438 A08 TTS VITS [55] 10095 10350 A24 VC In-house ASR 8533 7463 A09 TTS ToucanTTS [56] 6695 7007 A25 VC DiffVC [57] 8484 7519 A10 TTS A09+HiFiGAN [58] 6695 7007 A26 VC A16+genuine noise 8472 7522 A11 TTS Tacotron2 [59] 6695 7007 A27 AT A26+Malacopula 8549 7355 A12 TTS Unit-select 6695 7007 A28 TTS YourTTS [48] 8454 7507 A13 VC StarGANv2-VC [60] 6695 7007 A29 TTS XTTS [49] 8395 7549 A14 TTS YourTTS [48] 6695 7007 A30 AT A18+Mal.+Malacop. 8405 7466 A15 VC VAE-GAN [61] 6695 7007 A31 AT A22+Malacopula 8285 7418 A16 VC In-house ASR 6695 7007 A32 AT A25+Malacopula 8194 7314 I Related Work I-A Audio Deepfake Detection Detection methods for synthetic speech have evolved from classical Gaussian mixture model classifiers to end-to-end architectures such as RawNet2 [8], graph attention networks such as AASIST [9], and self-supervised representations such as WavLM [38]. The ASVspoof challenge series [34, 35, 36, 7] has driven this progress by providing standardized benchmarks across neural TTS, voice conversion, and adversarial perturbation scenarios. Pre-trained large-scale TTS systems such as NaturalSpeech [33] now generate highly natural speech with speaker-specific prosodic and acoustic characteristics, increasing the difficulty of detecting synthetic speech when demographic cues are preserved in the generated signal. The PhonemeDF dataset [25] and phonetic analyses using HuBERT embeddings [23, 74] further characterize the acoustic properties of real and synthetic speech that detectors rely on, including gender-correlated spectral features. Studies on SSL frontend generalization show that SSL representations trained on large-scale corpora do not generalize equally to all speaker subgroups [41], suggesting that demographic disparities in detection performance may originate partly in the pre-training stage rather than in fine-tuning or architecture choice. Despite strong average performance, detection systems show systematic demographic disparities that aggregate metrics do not expose, motivating the fairness analysis in this paper. I-B Demographic Bias in Audio Deepfake Detection Fairness in speaker verification and audio deepfake detection has received growing attention, with studies consistently documenting performance gaps across demographic groups [29]. An early analysis of speaker recognition [11] showed that models trained on gender-imbalanced corpora yield unequal verification performance for male and female speakers. Research on adversarial and multi-task strategies for speaker verification [37] found that adversarial debiasing reduces gender gaps but also reduces overall system utility, leading practitioners to prefer post-hoc solutions that do not require retraining. Empirical work on self-supervised learning [14] shows that pre-training data distribution can strongly influence the representations a model encodes, and that such information may persist through downstream fine-tuning. In audio deepfake detection specifically, gender-dependent performance has been observed from several directions. One study [12] found that detectors trained on female speech outperform those trained on male speech, attributing this to high-pitched spectral artifacts in synthetic female voices. A structured fairness audit across six detection systems [20] showed that male speakers consistently face higher false positive rates regardless of architecture. Independent work [15] confirmed that score distribution shifts between genders contribute to bias independently of spectral artifacts, and proposed artifact-focused self-synthesis as a training-time mitigation strategy; this approach is complementary to the composition-controlled analysis in this study, which evaluates post-hoc calibration rather than training-time intervention. A gender-balanced deepfake dataset [16] and the SCDF dataset [30], which provides speaker characteristics including gender, age, and dialect annotations to enable demographic fairness evaluation, reflect the communityâs recognition of gender imbalance as a structural problem requiring dedicated evaluation resources. Fairness analysis in video deepfake detection [27, 28, 18, 19] confirm that demographic disparities persist across modalities and that balanced training does not fully eliminate them. A study on speech enhancement under noisy conditions [26] further motivates robust fairness evaluation under diverse deployment scenarios beyond clean laboratory conditions. Most directly related to this work, [13] conducted the first comprehensive gender fairness evaluation on ASVspoof5 using five group fairness metrics under a fixed training composition, and [24] showed that per-gender threshold calibration reduces false alarm disparity by 54 to 75% under balanced training. Neither study varied training gender composition, leaving it unknown whether bias direction is predictable from composition or whether the method of achieving gender balance affects fairness outcomes. I-C Fairness Theory and Mitigation Strategies The machine learning fairness literature provides the theoretical grounding for this study. A comprehensive survey of bias sources across the ML pipeline [17] categorized fairness metrics into group, individual, and causal families. A study on how bias enters AI systems at the data collection, representation, and training stages [10] shows that data-stage decisions produce measurable fairness consequences at test time. An intervention-based analysis of spoofing countermeasures [40] further shows that data-stage decisions create confounded statistical pathways that persist at inference time regardless of model scale. Empirical work on standard empirical risk minimization [14] showed that minority groups experience disproportionate performance degradation as training progresses, even when overall accuracy improves. The foundational equalized odds criterion [21] requires model outputs to be conditionally independent of group membership given the true label. The impossibility result in [22] shows that equalized odds, predictive parity, and calibration cannot simultaneously hold when base rates differ across groups. These theoretical constraints predict that no single post-hoc calibration strategy can satisfy all fairness criteria simultaneously. Post-processing methods attract practitioners because they require no retraining [17]. The equalized odds framework [21] provides a principled post-hoc approach, and per-gender threshold calibration has been applied in speaker verification to reduce demographic disparities [37], though its behavior under varied training compositions in deepfake detection has not been characterized. To the best of our knowledge, no prior study has varied training gender composition as a controlled experimental variable, evaluated multi-strategy calibration across diverse compositions, or formally characterized where post-hoc correction reaches a hard boundary. This paper addresses all three gaps across 384 models, nine configurations, 32 attacks, and six calibration strategies. I Experimental Setup In this section, we describe the dataset, gender-composition configurations, system architecture, fairness metrics, and statistical validation procedure used in this study. Fig. 2 summarizes the overall system. Raw audio passes through two front-end feature representations into a shared ResNet18 classifier backend, trained under nine gender-composition configurations. We evaluate each model using EER and six group fairness metrics, and we apply six post-hoc threshold calibration strategies to assess how far fairness can be improved without retraining. TABLE I: Summary of training, development, and evaluation splits pooled across all attacks by gender and class. Split Female Male Spoof Bonafide Spoof Bonafide Train 187330 32034 179854 40022 Dev 26749 4576 25683 5717 Eval 53556 9154 51430 11436 I-A ASVspoof5 Dataset All experiments use ASVspoof5 [7], the most recent ASVspoof challenge benchmark. It covers 32 distinct spoofing systems (A01âA32) spanning neural TTS, voice conversion (VC), and adversarial perturbation (AT) attacks, making it well-suited for studying attack-dependent fairness. The dataset is divided into three official partitions: training (A01âA08), development (A09âA16), and evaluation (A17âA32) each containing bonafide utterances denoted as Bonafide Train (BT), Bonafide Dev (BD), and Bonafide Eval (BE) respectively, alongside spoofed speech spanning neural TTS, voice conversion, and adversarial perturbation attacks, whose attack identifiers and algorithms are listed in Table I. Both female and male speakers appear across all 32 attacks. The training partition contains approximately 10,000 utterances per gender per attack; the development partition contains 6,700â6,900; the evaluation partition contains approximately 18,000 female and 16,000 male utterances per attack. This reflects a slight female-majority imbalance (53% F / 47% M) inherent to ASVspoof5 and not to our experimental design. Gender labels and class annotations come directly from the official ASVspoof5 protocol files. All audio signals are resampled to 16 kHz; feature-specific duration normalization is described in Section I-C, following an approach similar to that in [32]. Figure 1: ASVspoof5 dataset protocol used in this study. (A01-A08 training, A09 -A16 development, A17-A32 evaluation). I-B Gender-Composition Training Configurations Rather than following the official ASVspoof5 partition, we construct custom per-gender per-attack splits using all utterances from all 32 attacks regardless of their official partition assignment. For each (attack, gender) pair, all available utterances are pooled and divided into a stratified 70 / 10 / 20% split for training, development, and evaluation respectively, ensuring every attack appears in every split and gender proportions are controlled explicitly, as illustrated in Fig. 1. Table I reports the resulting utterance counts pooled across all 32 attacks, by split, gender, and class. Splits are stratified by attack and gender but not guaranteed to be speaker-disjoint; potential speaker overlap across splits is acknowledged as a limitation in Section V. We confirm gender balance in our custom training split via chi-squared test (Ï2=0.597Ï^2=0.597, p=0.440p=0.440), ruling out training-set gender imbalance as a confound for the composition experiments. The development set serves two purposes: monitoring validation loss for early stopping during training, and calibrating the decision threshold at the global EER operating point before evaluation. From this pool we construct nine gender-composition configurations (Table I). F+X%M denotes a female-anchored configuration using 100% of available female utterances plus X% of available male utterances added to the training set. For example, F+25%M uses all female utterances and adds 25% of male utterances, making female speakers the dominant group. M+X%F denotes the symmetric male-anchored case: 100% of available male utterances plus X% of available female utterances. An internal validity check is embedded in this design. F+75%M uses all female utterances plus 75% of male utterances; M+25%F uses all male utterances plus only 25% of female utterances. Both produce a training set where one gender contributes 100% of its pool and the other contributes 25%, but the dominant gender differs. If both configurations produce the same bias direction despite using entirely different utterance pools, the dominant gender in training drives bias, not the specific utterances selected. Section IV-B1 confirms this. The nine configurations form two experimental tiers. Baseline (F, M, Combined) uses the full pool of one gender or both equally, evaluated under both LogSpectrogram and WavLM-Base+ to isolate how feature type modulates bias. GenderMix (the six partial-mix configurations) uses WavLM-Base+ only, because WavLM exhibits substantially larger and more widespread gender disparities than LogSpectrogram in baseline experiments (Section IV-A), making it the more consequential representation for studying composition effects at scale. Together the nine configurations span the full spectrum from gender-exclusive to balanced, enabling a systematic controlled analysis of training composition as a fairness variable. TABLE I: Gender-composition training configurations for F (Female) and M (Male). F+X%M denotes female-anchored training with X% male utterances added; M+X%F denotes the symmetric male-anchored case. Config F pool used (%) M pool used (%) Baseline F (Female only) 100 0 M (Male only) 0 100 Combined 100 100 Female-anchored GenderMix F+25%M 100 25 F+50%M 100 50 F+75%M 100 75 Male-anchored GenderMix M+75%F 75 100 M+50%F 50 100 M+25%F 25 100 I-C Feature Representations We resample all audio signals to 16 kHz prior to feature extraction. Duration normalization differs by feature and is described in each subsection below. Baseline configurations use both LogSpectrogram and WavLM-Base+; GenderMix configurations use WavLM-Base+ only. We select these two representations to contrast a handcrafted time-frequency feature whose bias traces to vocoder spectral artifacts with a pre-trained SSL model whose gender encoding originates upstream of fine-tuning, independently of training composition [69]. I-C1 LogSpectrogram The LogSpectrogram (LogSpec) applies a logarithmic transformation to the magnitude spectrogram, capturing frequency-band energy variations informative for detecting artifacts introduced by speech synthesis and voice conversion [13]. We zero-pad signals shorter than 4.0 s and truncate signals longer than 4.0 s. We compute features with FFT size 800, hop length 320 samples, and a Hann window, yielding a feature map of shape (1Ă401Ă201)(1Ă 401Ă 201) corresponding to 401 frequency bins and 201 time frames, which the ResNet18 classifier treats as a single-channel image. We evaluate LogSpec under the three baseline configurations only (F, M, Combined), providing a diagnostic reference for how feature type modulates bias before the WavLM-based GenderMix analysis. I-C2 WavLM-Base+ WavLM-Base+ [38] is a self-supervised speech model pre-trained on 94,000 hours of unlabeled speech using a masked speech prediction objective with denoising. It consists of a CNN feature encoder followed by 12 Transformer layers producing contextualized frame-level embeddings of dimension 768 at a stride of 320 samples (20 ms at 16 kHz). WavLM embeddings encode detailed speaker-level information, including pitch contours, vocal tract resonances, and speaking style. We hypothesize that this encoding contributes to gender-differential detection performance across attack types because these properties differ systematically between male and female speakers. Rather than zero-padding, we repeat signals cyclically to exactly 64,600 samples (â 4.04 s) to avoid introducing silence regions that would alter the SSL feature statistics. We extract representations from the final Transformer layer, which captures speaker-sensitive identity and demographic cues [38], yielding a fixed-size feature map of shape (201Ă768)(201Ă 768) where T=â64600/320â=201T= 64600/320 =201 frames. We pre-extract all features offline prior to model training, and all 288 WavLM models load these identical pre-computed features, ensuring that observed differences between configurations reflect only the gender-composition variable. I-D ResNet18 Classifier Backend Both feature representations pass through a ResNet18 architecture [31] with a binary output head. We treat the 2D feature map as a single-channel image, pass it through the ResNet18 convolutional trunk, and apply adaptive average pooling followed by a linear layer producing a two-class logit. This backend matches the design in [13], which used the same ResNet18 architecture for fairness evaluation on ASVspoof5, ensuring that fairness differences in this study are attributable to feature representation and training composition rather than classifier architecture. We train each model independently using AdamW [42] with learning rate 3Ă10â53Ă 10^-5 and weight decay 10â410^-4. To account for class imbalance between bonafide and spoofed utterances within each attack-specific training set, we apply class-weighted binary cross-entropy: wc=NCâ Nc,câbonafide, spoofw_c= NC· N_c, câ\bonafide, spoof\ (1) where N is total training samples, C=2C=2, and NcN_c is the count of class c. We train each model for a maximum of 100 epochs with early stopping on minimum development loss (patience = 15 epochs), and we apply a ReduceLROnPlateau scheduler [72] that halves the learning rate when development loss does not improve for 5 consecutive epochs. We use the checkpoint achieving minimum development loss for all evaluations. To ensure reproducibility, we determine the gender-composition subset for each configuration prior to training using fixed random seed s=42s=42, ensuring identical utterance pools across all experimental runs. Mini-batches use per-epoch shuffling during training; development and evaluation loaders use sequential loading. This strict control over randomness ensures that observed differences between configurations reflect only the gender-composition variable and not variation in file selection or batch ordering. I-E Evaluation Protocol We train one attack-specific model per (attack, configuration) pair: 288 WavLM-Base+ models across all nine configurations (9 Ă 32), plus 96 LogSpectrogram models for the three baseline configurations (3 Ă 32), yielding 384 models in total. Each model trains solely on the attack it targets, following the per-attack paradigm that isolates attack-specific bias from cross-attack generalization effects [62, 63, 64]. At evaluation time, we run each model separately on the female and male subsets of the held-out evaluation pool, yielding per-gender EER estimates [63, 65]. We calibrate the decision threshold on the development set at the global EER operating point and keep it fixed during evaluation, ensuring gender differences reflect score distribution disparities rather than threshold placement [13, 65]. Figure 2: Overview of the proposed system for gender fairness evaluation and post-hoc mitigation in audio deepfake detection. I-F Fairness Evaluation Framework Here, we formalize the metrics used to quantify detection performance and gender fairness, the threshold calibration strategies evaluated as post-hoc mitigation, and the statistical validation procedure applied throughout. Let Gâf,mGâ\f,m\ denote speaker gender, Yâ0,1Yâ\0,1\ the true label (0 = bonafide, 1 = spoof), and Y^=â[sâ„Ξ]â0,1 Y=1[sâ„Ξ]â\0,1\ the model prediction, where s is the detectorâs spoof score and Ξ is the decision threshold. TPgTP_g, TNgTN_g, FPgFP_g, FNgFN_g denote confusion matrix counts restricted to gender group gâf,mgâ\f,m\. I-F1 Detection Performance Metric The Equal Error Rate (EER) marks the operating point where the false alarm rate and miss rate are equal: EER:FARâ(Ξ)=FRRâ(Ξ)EER:\ FAR(Ξ)=FRR(Ξ) (2) We compute per-gender EER values EERfEER_f and EERmEER_m by finding, for each gender independently, the threshold at which that genderâs false alarm rate equals its miss rate. We then measure gender disparity in detection performance as the absolute EER gap: ÎâEER=|EERfâEERm| = |\,EER_f-EER_m | (3) We use the absolute gap rather than a relative ratio because a ratio is undefined when either gender achieves near-zero EER, which occurs for several attacks in this study. I-F2 Group Fairness Metrics We evaluate six group fairness metrics that collectively capture distinct reliability failure modes across different deployment contexts. Each metric equals zero when the model treats both genders identically on the corresponding criterion. We report all six because they capture distinct fairness dimensions that no single metric can summarize, as the divergent attack rankings in Section IV illustrate. SPD measures whether both genders receive equal spoof-flagging rates regardless of ground truth [73]: SPD=|P(Y^=1âŁG=f)âP(Y^=1âŁG=m)|SPD= |P( Y=1 G=f)-P( Y=1 G=m) | (4) A high SPD means one gender is flagged as spoof more frequently than the other, independent of whether the flagging is correct. SPD is the relevant criterion for broadcast monitoring and content moderation, where the demographic reach of flagging decisions must be equitable. EOpD measures whether spoofed utterances are detected at equal rates for both genders [21]: EOpD=|TPfTPf+FNfâTPmTPm+FNm|EOpD= | TP_fTP_f+FN_f- TP_mTP_m+FN_m | (5) A high EOpD means the model misses more spoof utterances from one gender than the other and is the primary criterion for contexts where missed detections are the critical failure mode, such as fraud detection and identity verification. EOD measures combined disparity in both true positive and false positive rates across genders [75]: EOD= = |TPfTPf+FNfâTPmTPm+FNm| | TP_fTP_f+FN_f- TP_mTP_m+FN_m | (6) +|FPfFPf+TNfâFPmFPm+TNm| + | FP_fFP_f+TN_f- FP_mFP_m+TN_m | EOD equals zero only when the model simultaneously equalizes detection rates and false alarm rates across genders, making it a stricter criterion than EOpD alone and relevant when both missed detections and false alarms carry significant consequences. FPRgapFPR_gap measures whether bonafide speakers receive equal false rejection rates across genders [76]: FPRgap=|FPfFPf+TNfâFPmFPm+TNm|FPR_gap= | FP_fFP_f+TN_f- FP_mFP_m+TN_m | (7) A high FPRgapFPR_gap means bonafide speakers of one gender are more frequently rejected as spoof than the other, directly affecting user experience equity in voice authentication systems. PPD measures whether spoof predictions carry equal precision across genders [77]: PPD=|TPfTPf+FPfâTPmTPm+FPm|PPD= | TP_fTP_f+FP_f- TP_mTP_m+FP_m | (8) A high PPD means spoof predictions are less reliable for one gender than the other and is relevant in legal or forensic applications where prediction precision directly determines downstream decisions. TED measures asymmetry in the ratio of false alarms to missed detections across genders [78]: TED=|FPfFNfâFPmFNm|TED= | FP_fFN_f- FP_mFN_m | (9) TED = 0 means the model makes proportionally the same mix of false alarms and missed detections for both genders. A large TED indicates the model primarily false-alarms one gender while primarily missing spoof detections for the other, a failure mode not captured by rate-based metrics. We exclude cases where FNg=0FN_g=0 for either gender, as TED is undefined in those cases. TED captures a distinct fairness dimension from the five rate-based metrics above, as the correlation analysis in Section IV-C1 confirms. TABLE IV: Feature comparison in terms of mean EER over 32 same-attack evaluations. F_EER and M_EER denote female and male EER, respectively. Gap = ||F_EER â- M_EER||. Config LogSpectrogram WavLM-Base+ F_EER M_EER EER gap Biased F_EER M_EER EER gap Biased F 0.133 0.768 0.635 10/32 2.782 4.690 1.917 32/32 M 0.665 0.315 0.621 9/32 5.056 2.780 2.276 32/32 Combined 0.095 0.156 0.063 2/32 2.226 2.180 0.273 20/32 TABLE V: Feature comparison in terms of mean EER over 32 Cross-Attack). F_EER (Female EER) and M_ EER (Male EER), Gap = ||F_EER â- M_EER|| Config LogSpectrogram WavLM-Base+ F_EER M_EER EER gap Biased F_EER M_EER EER gap Biased F 33.207 34.151 0.944 32/32 30.423 30.803 1.591 32/32 M 34.292 33.492 0.800 32/32 31.905 30.552 1.963 32/32 Combined 33.158 32.953 0.205 32/32 30.918 30.464 1.491 32/32 I-F3 Threshold Calibration Strategies We evaluate six threshold calibration strategies as post-hoc mitigation for improving group fairness without retraining. Each detector produces a spoof score s; a higher score indicates stronger evidence that the utterance is spoofed. We select thresholds by interpolating the development-set ROC curve to find the exact operating point satisfying each strategyâs criterion, and we apply them unchanged to the held-out evaluation set. TC0 sets a single global threshold ΞâΞ^* at the operating point where the combined false alarm rate equals the combined miss rate across both genders, without gender-specific adjustment, and serves as the standard deployment baseline. TC_EER sets separate per-gender thresholds Ξfâ _f^* and Ξmâ _m^*, each at the per-gender EER operating point on the development set, following the gender-specific thresholding approach of [79] and as used in our prior work [24]. TC_FPR sets per-gender thresholds such that FPRfâ(Ξf)=FPRmâ(Ξm)FPR_f( _f)=FPR_m( _m) on the development set, targeting FPRgapâ 0FPR_gap\,â\,0 [80]. TC_TPR sets per-gender thresholds such that TPRfâ(Ξf)=TPRmâ(Ξm)TPR_f( _f)=TPR_m( _m) on the development set, targeting EOpDâ 0EOpD\,â\,0 [80]. TC_DP sets per-gender thresholds such that the overall positive prediction rate is equal across genders on the development set, targeting SPDâ 0SPD\,â\,0 [73]. Finally, Oracle selects per-gender thresholds using evaluation-set labels directly; this strategy is not deployable and serves only as the theoretical upper bound on what any threshold-based post-hoc strategy can achieve [21, 80]. We note that threshold calibration changes the operating point of a detector but does not change the underlying score distributions. Selecting a different threshold can change deployment-time FPR, TPR, SPD, or EOD, but cannot reshape the ROC curve or eliminate distribution-level EER disparities. We therefore treat EER gap as the primary bias indicator throughout this study. I-G Statistical Significance and Multiple Comparison Correction We validate all reported fairness gaps via Poisson bootstrap resampling [43] with N=1000N=1000 resamples per model. For each resample, we draw confusion matrix counts independently from Poisson distributions parameterized by the observed counts, treating each cell as an independent count rather than resampling individual utterances. This approximation is valid when utterance-level correlations between confusion matrix cells are small relative to cell magnitudes, which holds for the evaluation set sizes used in this study [43]. We estimate bootstrap p-values as the proportion of resamples in which the resampled metric value equals zero, consistent with testing H0â: gap = 0H_0: gap\,=\,0 against a two-sided alternative. We acknowledge that N=1000N=1000 resamples represents a practical lower bound for significance testing at p<0.001p<0.001, and we identify increasing N to 5000 or 10000 as a direction for future work [45]. We apply multiple comparison correction using the BenjaminiâHochberg false discovery rate procedure [39] at α=0.05α=0.05, within each metric across all 288 WavLM-based model-level tests (9 configurations Ă 32 attacks). We apply BH correction within each metric rather than across all metrics simultaneously, as between-metric dependencies would make joint correction overly conservative. BH correction remains valid under positive regression dependence among test statistics [44], a condition that holds when tests share overlapping utterance pools as in this study. Figure 3: EERgap_gap under same-attack and cross-attack evaluation across all nine gender-composition configurations for TTS (text-to-speech), VC (voice conversion), and AT (adversarial perturbation) attacks. IV Results & Discussion In this section, we present and discuss our experimental results in three parts: feature comparison for gender bias, fairness under varying training composition, and post-hoc mitigation. IV-A Baseline Feature Comparison In this first experiment, we investigate whether feature representation itself shapes gender bias, independent of training composition. Table IV addresses this using the three baseline configurations. Under Female-Only training, LogSpectrogram produces an EER gap of 0.635 p, while WavLM-Base+ produces 1.917 p (which is three times larger). We observe the same pattern under Male-Only training, where WavLMâs gap of 2.276 p is 3.7 times that of LogSpectrogramâs 0.621 p. Here, we hypothesize that balancing the training data would close the gap for both features in similar fashion. We test this directly using Combined training, which trains both features on exactly the same gender-balanced data and removes composition as a confound. Here, LogSpectrogram bias nearly disappears: it falls to 0.063 p, with only 2 of 32 attacks remaining biased. WavLM-Base+ behaves very differently. Its gap narrows only modestly, to 0.273 p, and 20 of 32 attacks remain biased. Rather than converging, the two features diverge further under balanced training: the WavLM-to-LogSpectrogram ratio grows from 3.0x under Female-Only training to 4.3x under Combined training, consistent with [13]. If balanced data alone explained the disparity, we would expect both features to move toward fairness together. We instead find that only one of them does. These results suggest that the two representations capture different forms of gender information. LogSpectrogram captures vocoder spectral artifacts that balanced training can neutralize, since those artifacts are tied to the attack-specific synthesis process and disappear once training data covers both genders equally. WavLM-Base+, in contrast, encodes speaker gender as a distributed pattern across 768 embedding dimensions during self-supervised pre-training, a pattern that fine-tuning on balanced data cannot remove [14, 29]. To investigate whether WavLMâs resistance to balanced training is specific to the attacks seen during training or reflects a more fundamental property of how the model encodes gender, we evaluate each attack-specific model on cross attacks, as shown in Table V. We observe that every one of the 32 models, regardless of feature type or configuration, shows a cross-attack EER gap exceeding 0.5 p. Under Combined training, we find that the EER gap LogSpectrogram had nearly closed under same-attack evaluation reopens only modestly, to 0.205 p, while WavLMâs gap remains essentially unchanged at 1.491 p. We further find that balanced training reduces LogSpectrogramâs cross-attack gap substantially, by 0.739 p (from 0.944 to 0.205 p), but reduces WavLMâs by only 0.100 p (from 1.591 to 1.491 p). Our results indicate that bias direction follows training composition even under these cross conditions. Specifically, Female-Only training consistently produces higher male EER for both features, and Male-Only training reverses this relationship as expected. Overall, these results indicate that gender information is embedded in WavLM-Base+ before fine-tuning begins and transfers readily to unseen attacks, making training composition an insufficient remedy for its bias. LogSpectrogram, by contrast, serves as an informative counter-example: its bias responds substantially to balanced training in both same-attack and cross-attack conditions, while WavLMâs does not. Because WavLM-Base+ represents the more persistent and therefore more practically important case, we use it exclusively for the remaining GenderMix and calibration experiments. TABLE VI: Mean fairness metrics across all nine gender-composition configurations for WavLM-Base+, averaged over 32 same-attack evaluations. All values are bootstrap-significant (pâȘ0.001p 0.001, N=1000N=1000) Config F_EER M_EER EER gap FPR_gap SPD EOpD EOD PPD TED Disadv. (%) (%) (p) Baseline Configurations F 2.782 4.690 1.917 0.0242 0.0204 0.0238 0.0359 0.0039 0.115 M â M 5.056 2.780 2.276 0.0495 0.0105 0.0088 0.0511 0.0089 0.363 F â Combined 2.226 2.180 0.273 0.0052 0.0108 0.0042 0.0061 0.0008 0.098 F â GenderMix â Female-Anchored F+25%M 1.213 3.150 1.940 0.0236 0.0252 0.0167 0.0263 0.0029 0.184 M â F+50%M 1.133 2.174 1.042 0.0120 0.0253 0.0087 0.0133 0.0013 0.100 M â F+75%M 1.143 1.568 0.438 0.0050 0.0277 0.0046 0.0068 0.0005 0.114 M â GenderMix â Male-Anchored M+75%F 1.669 1.049 0.627 0.0092 0.0303 0.0027 0.0093 0.0020 0.154 F â M+50%F 2.315 1.100 1.215 0.0169 0.0321 0.0052 0.0170 0.0034 0.154 F â M+25%F 3.291 1.165 2.126 0.0323 0.0339 0.0097 0.0324 0.0064 0.207 F â TABLE VII: Mean fairness metrics across all nine gender-composition configurations for WavLM-Base+, averaged over 32 cross-attack evaluations. All values are bootstrap-significant (pâȘ0.001p 0.001, N=1000N=1000) Config F_EER M_EER EER gap FPR_gap SPD EOpD EOD PPD TED Disadv. (%) (%) (p) Baseline Configurations F 30.423 30.803 1.591 0.0367 0.0232 0.0238 0.0424 0.0093 54.785 M â M 31.905 30.552 1.963 0.0346 0.0102 0.0088 0.0371 0.0102 6.358 F â Combined 30.918 30.464 1.491 0.0267 0.0063 0.0042 0.0272 0.0092 19.819 F â GenderMix - Female-Anchored F+25%M 30.511 30.567 1.626 0.0392 0.0161 0.0167 0.0426 0.0256 31.319 M â F+50%M 30.762 30.559 1.549 0.0285 0.0091 0.0087 0.0300 0.0256 28.267 F â F+75%M 30.858 30.556 1.597 0.0270 0.0073 0.0046 0.0276 0.0258 28.667 F â GenderMix - Male-Anchored M+75%F 30.973 30.408 1.622 0.0272 0.0085 0.0027 0.0276 0.0261 18.429 F â M+50%F 31.168 30.344 1.774 0.0273 0.0110 0.0052 0.0283 0.0262 17.600 F â M+25%F 31.390 30.293 1.885 0.0284 0.0150 0.0097 0.0308 0.0265 29.526 F â IV-B Fairness Under Varying Training Composition In this section, we investigate the gender bias of WavLM-Base+. We examine how varying the gender composition across nine configurations affects fairness outcomes under both same-attack and cross-attack evaluations. IV-B1 Same-Attack Fairness In this experiment, we investigate how the nine gender-composition configurations affect fairness under same-attack evaluation. Table VI reports mean fairness metrics across all 32 same-attack evaluations for each of the nine configurations. We find a pattern that holds firmly across all nine: the gender that dominates training ends up advantaged at test time. Female-anchored configurations (F, F+25%M, F+50%M, F+75%M) disadvantage male speakers, while male-anchored configurations reverse this relationship exactly. We observe this behavior in 31 of 32 attacks, across all six fairness metrics simultaneously, with the sole exception of A19 (MaryTTS) under Combined training, where the resulting EER gap does not exceed our statistical significance threshold. Prior work has reported both directions of disparity, sometimes within the same body of literature [12, 20]; our results resolve this apparent contradiction by showing that the proportion of speech from each gender during training, rather than any innate acoustic quality of male or female speech, determines which gender a trained model will disadvantage. Next, we examine whether this disadvantage can be reduced gradually, or whether it persists until training reaches full balance. We find that increasing the proportion of the minority gender improves the EER gap monotonically, but with diminishing returns. Under female-anchored configurations, supplementing the corpus with minority male speech at 25%, 50%, and 75% reduces the EER gap from 1.940 p to 1.042 p to 0.438 p. We observe the mirror image under male-anchored configurations, where the EER gap falls from 2.126 p to 1.215 p to 0.627 p, in steps of 0.911, 0.588, and 0.354 p. None of the within-attack GenderMix configurations cross the 0.5 p threshold we treat as practically meaningful bias; only Combined training, which pools 100% of both genders across all 32 attacks, reaches 0.273 p. We attribute the additional improvement from F+75%M to Combined (0.165 p) and from M+75%F to Combined (0.354 p) to a fairness benefit specific to population-level pooling, one that within-attack balancing alone cannot achieve [11]. We further investigate whether all fairness metrics improve simultaneously as the composition becomes more balanced or whether trade-offs emerge among them. Within female-anchored configurations, we observe the EER gap decreasing steadily from F+25%M to F+75%M (1.940, 1.042, 0.438 p), while SPD instead increases over the same range (0.0252, 0.0253, 0.0277). We interpret this divergence as reflecting two distinct underlying quantities: the EER gap captures threshold calibration error relative to the dominant genderâs acoustic space, whereas SPD captures detection rate disparity across the full score distribution. Improving one is therefore shown to come at the expense of the other, consistent with established fairness impossibility results [22]. Under same-attack evaluation, we find that Combined training achieves the best value on six of seven metrics (EER gap = 0.273 p, FPR gap = 0.0052, EOpD = 0.0042, EOD = 0.0061, PPD = 0.0008, TED = 0.098), while M achieves the lowest SPD (0.0105 versus 0.0108 for Combined). Our results show that the fairness metrics do not move in unison. TABLE VIII: Performance evaluation of six threshold calibration strategies in terms of per-gender FPR and TPR (%) across all nine gender-composition configurations. Config TC0 TC_EER TC_FPR TC_TPR TC_DP Oracle F M F M F M F M F M F M FPR (%) â lower = fewer false alarms on bonafide speakers F 2.643 4.862 2.777 4.688 3.753 3.753 2.069 5.791 3.227 4.361 2.777 4.688 M 4.454 3.688 5.052 2.778 4.071 4.071 6.657 2.002 4.075 4.177 5.052 2.778 Combined 2.067 2.358 2.222 2.176 2.212 2.213 5.994 5.306 1.991 2.599 2.222 2.176 F+25%M 1.172 3.703 1.253 3.410 1.172 1.173 0.917 4.773 5.764 3.074 1.229 3.168 F+50%M 1.084 2.270 1.116 2.153 1.084 1.079 0.905 2.826 6.199 1.776 1.145 2.201 F+75%M 1.169 1.615 1.159 1.605 1.169 1.165 1.018 1.804 6.923 1.198 1.157 1.583 M+75%F 1.828 0.920 1.668 1.037 1.828 1.823 1.897 0.881 7.549 0.609 1.687 1.070 M+50%F 2.575 0.896 2.129 1.133 2.575 2.582 2.902 0.810 8.040 0.613 2.339 1.122 M+25%F 4.176 0.945 3.433 1.161 4.176 4.171 4.937 0.776 9.449 0.616 3.315 1.183 TPR (%) â higher = better spoof detection rate F 96.912 95.435 97.205 95.290 97.851 94.041 96.178 96.171 97.056 94.830 97.205 95.290 M 94.237 97.760 94.926 97.205 93.835 97.997 96.000 96.000 93.426 97.941 94.926 97.205 Combined 97.574 97.989 97.762 97.805 97.749 97.831 97.780 97.784 96.653 98.010 97.762 97.805 F+25%M 98.748 97.281 98.795 96.995 92.384 84.781 98.013 98.015 99.140 96.191 98.795 96.857 F+50%M 98.772 97.900 98.828 97.737 89.273 85.446 98.336 98.337 99.281 96.583 98.876 97.829 F+75%M 98.877 98.439 98.858 98.404 92.511 90.765 98.657 98.659 99.437 96.942 98.866 98.440 M+75%F 98.506 98.628 98.269 98.820 92.177 93.234 98.566 98.568 99.250 96.944 98.339 98.957 M+50%F 98.010 98.481 97.428 98.865 97.907 99.659 98.245 98.245 98.908 96.694 97.689 98.905 M+25%F 97.461 98.425 96.611 98.798 97.397 99.815 97.942 97.943 98.505 96.543 96.716 98.840 IV-B2 Cross-Attack Generalization Here, we investigate whether trends persist when models are evaluated on unseen attack types. Table VII and Fig. 4 report metrics when each model trained on attack i evaluates on all remaining attacks jâ ijâ i. Figure 4: Fairness metric heatmap across TTS (text-to-speech), VC (voice conversion), and AT (adversarial perturbation) attacks under same-attack (left side) and cross-attack (right side) evaluation across all nine gender-composition configurations. Our experimental results reveal that the composition advantages are reduced dramatically under this cross-attack evaluation test. The range of same-attack EER gaps, which spans 0.273â2.276 p, reduces to 1.491â1.963 p under cross-attack evaluation. Furthermore, the ratio between Combined and M EER falls from 8.3x to just 1.3x. We also observe that the monotonic trend anchored by female speakers, which held cleanly under same-attack evaluation, no longer holds in cross-attack evaluation. As we observe that F+50%M (1.549 p) now produces a lower bias gap than F+75%M (1.597 p), reversing the ordering we reported in Section IV-B1. As can be seen in the table, the male-anchored EER gap pattern remains the same in cross-attack evaluation, though compressed. Additionally, we observe a more pronounced effect when we examine which gender is disadvantaged. Two of the three female-anchored mixtures switch the disadvantaged gender completely: F+50%M and F+75%M disadvantage male speakers under same-attack evaluation but disadvantage female speakers under cross-attack evaluation. In contrast, F+25%M disadvantages male speakers in both settings. An analysis based only on same-attack evaluation cannot reveal this change, which raises the question of what causes it. We hypothesize that a calibration effect is responsible. Specifically, decision thresholds learned from the score distribution of one attack, which reflects that attackâs particular gender bias, may be positioned differently relative to the score distribution of another attack. As a result, the disadvantaged gender can change when the model is evaluated on an unseen attack. AT attacks show the sharpest such reversal â the fairest under same-attack evaluation (0.122 p) but among the most biased under cross-attack evaluation (1.669 p) â because adversarial perturbations calibrate tightly to a specific attackâs feature space and misalign more severely on unseen attacks than TTS or VC artifacts, which generalize more gracefully across attack types. Fig. 4 examines this pattern metric by metric. We find that Combined training attains the lowest or second-lowest value across most metrics in all six panels, suggesting that its advantage generalizes reasonably well, although it becomes less pronounced under cross-attack evaluation.We further observe that AT SPD effectively vanishes under cross-attack evaluation, surviving only as statistical ties in Table VII; this confirms our earlier suspicion that the SPD inversion reported in Table VI was an artifact of within-attack threshold calibration rather than a genuine fairness effect. VC attacks, by contrast, continue to dominate most metrics under cross-attack evaluation and retain comparatively high FPR gap values in both settings. As shown in Fig. 4, TED scores increase sharply across all configurations compared with their same-attack values: F rises from 0.115 to 54.785, Combined from 0.098 to 19.819, and M from 0.363 to 6.358. We attribute this increase to numerical instability in the underlying FP/FN ratio measured by TED. Specifically, near-zero false-negative counts at operating points close to the cross-attack EER threshold cause large variations in the metric. Therefore, we interpret cross-attack TED values with caution and exclude them from the subsequent cross-attack comparisons. IV-B3 Attack-Level Bias Patterns Here, we investigate attack-level bias patterns by examining whether all spoofing attacks are equally affected. Table IX lists all 32 attacks in rank order by their mean rank across SPD, EOpD, EOD, and PPD, and ranks TED separately. We find that four of the five most biased attacks according to the four-metric ranking are pre-trained TTS systems. A28 (pre-trained YourTTS) ranks as the most biased attack overall, both by mean rank across the four metrics and individually, with EOD = 0.105 and an EER gap of 6.759 p. We also find that A17 (ZMM-TTS) and A29 (XTTS) rank among the five most biased attacks, which we attribute to their similar pre-training process [15]. In addition, A13 (StarGANv2-VC) appears in this group despite not relying on pre-training; we hypothesize that this behavior reflects the gender-based score distribution shift that prior work has linked to domain shift in voice conversion systems [15]. We further observe that ranking the same 32 attacks by TED produces a markedly different scenario: none of the attacks in the TED-worst list appears in the four-metric-worst list. For example, A19 (MaryTTS) ranks 32nd by TED yet ranks as the ninth fairest attack according to the four rate-based metrics, while A14 (from-scratch YourTTS) ranks as the second fairest attack by error-rate metrics but only 29th by TED. Specifically, comparing A28 and A14 keeps the underlying framework fixed, as both attacks use YourTTS, and changes only whether the system was pre-trained. The difference is substantial: A28 produces an EER gap of 6.759 p, whereas A14 produces only 0.031 p, a 218-fold difference attributable solely to pre-training. Together with our findings for the WavLM-Base+ baseline, this comparison suggests that pre-training is a major source of unintentional gender-correlated information [14, 29]. In TTS synthesis, pre-training creates attacks with gendered prosody, whereas in self-supervised representations, it enables the detector to learn gender-correlated cues. We conclude that the choice of fairness metric strongly influences which attacks appear biased, highlighting that no single metric is sufficient to characterize fairness at the attack level. TABLE IX: Ranking comparison of attacks by fairness metrics along with EER gap. Top and bottom panels rank attacks by mean rank across SPD, EOpD, EOD, and PPD; middle panel ranks attacks by TED separately. Attack Type SPD EOpD EOD PPD EER gapâ Most Unfair â by SPD, EOpD, EOD, and PPD A28 TTS 0.038 0.034 0.105 0.020 6.759 p A13 VC 0.035 0.045 0.063 0.006 3.789 p A17 TTS 0.027 0.017 0.063 0.012 3.455 p A15 VC 0.033 0.039 0.058 0.009 3.489 p A29 TTS 0.024 0.014 0.047 0.008 2.899 p Most Unfair â by TED only A19 TTS TED = 0.402 0.355 p A32 AT TED = 0.313 0.098 p A30 AT TED = 0.278 0.588 p A14 VC TED = 0.258 0.031 p A25 VC TED = 0.248 1.298 p Most Fair â by SPD, EOpD, EOD, and PPD A14 VC 0.013 0.0002 0.001 0.0001 0.031 p A12 TTS 0.013 0.0010 0.002 0.0002 0.114 p A16 VC 0.013 0.0050 0.007 0.0010 0.422 p A20 AT 0.014 0.0020 0.004 0.0010 0.143 p A19 TTS 0.008 0.0020 0.003 0.0010 0.355 p â EER gap is shown for reference only and is not used in the ranking. IV-C Mitigation Strategies : Threshold Calibration Results We next explore whether post-hoc threshold calibration can close the gender fairness gap without retraining. We observed two consistent findings. First, the EER gap is completely resistant to calibration. As Table X shows, the EER gap remains fixed at 1.317 p across all six strategies, including Oracle calibration with full access to evaluation-set labels. This result confirms and extends the theoretical findings of [21], who showed that post-hoc calibration can satisfy individual fairness criteria but cannot eliminate structural disparities in the underlying score distributions. Second, we find that each calibration strategy succeeds in its intended goal, but this success comes with trade-offs in other metrics. As can be seen, TC_FPR effectively equalizes false alarms and reduces FPR_gap to nearly zero (0.0001), but this improvement comes at a clear cost to detection performance. Table X shows that TC_FPR reduces TPR to 84- 92% under GenderMix configurations, compared with 97 -99% under TC0. We interpret this behavior as a direct consequence of increasing the threshold to equalize false alarms, which necessarily reduces both gendersâ ability to detect spoofed speech. Surprisingly, TC_TPR exhibits the opposite trade-off. By equalizing spoof detection rates across genders, it reduces EOpD to 0.0001 but increases FPR_gap to 0.0261, compared with 0.0152 under TC0. We consider TC_TPR to be most appropriate for deployments in which missed spoof detections are more critical than false alarms. Table VIII shows that the right calibration choice depends on which mistake hurts more: a false alarm on a real speaker, or a missed spoof attack. TC_FPR keeps false alarms equal across genders in every configuration, such as 3.753% for both under F, which suits something like consumer voice login. The cost lands on detection: under female-skewed configurations, spoof detection drops to 84% to 92%, down from 97% to 99% without calibration. TC_TPR does the opposite, keeping detection rates nearly identical across genders, within a tenth of a point, which fits higher-stakes settings like financial or forensic verification. Its cost falls on false alarms instead, which can differ by as little as under 1 point or as much as 4.66 points depending on the configuration. TC_DP fits neither story well: it pushes male false alarms near zero (0.616%) while female false alarms climb past 9%, making it a poor fit regardless of which mistake matters more. Finally, TC_EER reveals an unexpected dependency. Under balanced training, our previous work [24] showed that TC_EER reduces disparity by 54-75%. Under the varied compositions examined here, however, TC_EER provides only a marginal improvement in FPR_gap (0.0137 versus 0.0152 under TC0) and actually worsens SPD (0.0276 versus 0.0237). We attribute this failure to the composition-dependent score distribution shifts discussed in Section IV-B and conclude that TC_EER should be applied only under combined, balanced training rather than under the imbalanced configurations where it appears most needed. Lastly, we investigate whether thresholds calibrated for one attack generalize to others. We calibrate development-set thresholds on the same attack used for training and apply them unchanged to unseen attack types. Under this mismatch, FPR rises above 70%, indicating that threshold calibration depends on attack-specific score distributions and requires recalibration whenever the deployment attack changes. IV-C1 Practical Guidelines for Trustworthy Deployment Table XI shows that SPD is statistically independent of EER gap (Ï=+0.065Ï=+0.065, p=0.270p=0.270) and of EOD, PPD, and FPR_gap, while EOpD, EOD, PPD, and FPR_gap form a strongly correlated cluster (Ï>0.41Ï>0.41, EOD vs. FPR_gap reaching Ï=0.953Ï=0.953). TED negatively correlates with EOpD (Ï=â0.166Ï=-0.166, p=0.005p=0.005), indicating that equalizing detection rates tends to increase FP/FN asymmetry. Combined with our finding in Section IV-B3 that metric choice changes the attack-level fairness verdict for 5 of 32 attacks [17], we conclude that practitioners should select the metric that best matches their deployment context. For voice authentication, where false rejection equity is the primary concern, we recommend prioritizing FPR_gap, as A28 consistently ranks as the worst attack under this criterion. For content moderation, where missed spoof detections represent the critical failure mode, we recommend prioritizing EOpD, as A13 ranks worst. For broadcast monitoring, where the demographic reach of flagging decisions must be equitable, we recommend prioritizing SPD, as A27 ranks worst under this criterion. These findings further motivate four minimum requirements we propose for trustworthy system certification. First, we recommend that practitioners supplement aggregate EER with per-gender EER reported separately for each attack in the target deployment environment, since aggregate metrics can conceal systematic per-gender failures. Second, we recommend reporting all six fairness metrics â SPD, EOpD, EOD, PPD, TED, and FPR_gap â rather than relying on any single one, given that metric choice alone can flip the attack-level fairness verdict. Third, we recommend documenting training gender composition as standard metadata alongside performance numbers, since our results in Section IV-B1 show that composition is the strongest predictor of bias direction. Fourth, we recommend deliberate calibration strategy selection: practitioners should apply TC_FPR when false alarm equity is the deployment priority, TC_TPR when detection rate equity matters most, and avoid TC_EER entirely under imbalanced training conditions. Two practical constraints bound these guidelines. Threshold calibration requires speaker gender labels at inference time, which many deployments do not provide, and the binary gender framing used here reflects the ASVspoof5 protocol labels and does not extend to non-binary or intersectional identities. Within these bounds, our results map which fairness gaps training composition predicts, which feature choice determines, and which post-hoc strategies can and cannot close TABLE X: Performance comparison of fairness metrics across six threshold calibration strategies, averaged over all nine gender-composition configurations and 32 same-attack evaluations. Strategy EER gap FPR_gap SPD EOpD EOD PPD TC0 1.317 0.0152 0.0237 0.0124 0.0203 0.0031 TC_EER 1.317 0.0137 0.0276 0.0136 0.0162 0.0024 TC_FPR 1.317 0.0001 0.0293 0.0301 0.0301 0.0021 TC_TPR 1.317 0.0261 0.0304 0.0001 0.0261 0.0027 TC_DP 1.317 0.0479 0.0000 0.0268 0.0573 0.0099 Oracle 1.317 0.0132 0.0268 0.0132 0.0133 0.0023 TABLE XI: Pairwise Pearson correlations between fairness metrics and EER gap across all 288 WavLM same-attack evaluations. pâ<0.05^*p<0.05; pâ<0.001^**p<0.001; ns = not significant. Metric Pair Ï p SPD â independent of all others SPD vs. EER gap +0.065+0.065 0.2700.270 ns SPD vs. EOpD +0.376+0.376 <0.001â<0.001^** SPD vs. EOD +0.083+0.083 0.1600.160 ns SPD vs. FPR_gap â0.063-0.063 0.2870.287 ns EOpD/EOD/PPD/FPR_gap â strongly correlated cluster EOD vs. FPR_gap +0.953+0.953 <0.001â<0.001^** PPD vs. FPR_gap +0.974+0.974 <0.001â<0.001^** EER gap vs. EOD +0.932+0.932 <0.001â<0.001^** EER gap vs. FPR_gap +0.922+0.922 <0.001â<0.001^** TED â orthogonal to rate-based metrics TED vs. EOpD â0.166-0.166 0.005â0.005^* TED vs. EER gap +0.056+0.056 0.3400.340 ns TED vs. FPR_gap +0.230+0.230 <0.001â<0.001^** V Limitations In this section, we discuss the limitations of this study. Five limitations define the scope of our findings. First, we rely on the binary gender labels provided by the official ASVspoof5 protocol files, which restricts our analysis to female and male speaker subgroups and excludes non-binary, self-identified, and intersectional gender identities. Second, we construct custom 70/10/20 splits that provide a controlled setup for fairness analysis but are not directly comparable to official ASVspoof5 challenge scores. We stratify splits by attack and gender but do not guarantee speaker disjointness across splits, potential speaker overlap across splits is acknowledged as a limitation in Section V. We emphasize that the primary goal of this study is not speaker-independent generalization, but controlled comparison of gender-composition effects under identical split construction.. Because the evaluation pool constitutes 20% of all available utterances and ASVspoof5 contains multiple utterances per speaker, we expect evaluation speakers to also appear in the training pool. Speaker IDs are not available in the evaluation outputs we use here, so we cannot quantify the exact fraction of overlapping speakers; the direction and magnitude of any resulting bias in our fairness estimates therefore remain unknown. Third, we compare only two feature representations: LogSpectrogram, evaluated under the three baseline configurations, and WavLM-Base+, evaluated under all nine configurations. Whether the composition-driven fairness patterns we observe generalize to other self-supervised representations or model architectures remains an open question we leave to future work. Fourth, we calibrate threshold calibration strategies on same-attack development data and apply them to evaluation utterances from that same attack. We do not evaluate how well these thresholds generalize to unseen attack types at deployment time, and we identify attack-matched cross-attack calibration as an important direction for future work. Fifth, we evaluate post-hoc mitigation only. Calibration adjusts decision thresholds but cannot alter learned representations, training objectives, or score distributions. Training-time interventions such as fairness-aware objectives, adversarial debiasing, and representation-level regularization fall outside the scope of this study and represent the most pressing direction for future work, given our finding that threshold calibration cannot close distribution-level EER gaps regardless of how well the calibration strategy is designed. VI Conclusion This paper presents four main findings. First, training data composition strongly predicts bias direction: the gender underrepresented in training consistently performs worse at test time, regardless of which gender occupies the minority position. Second, feature representation shapes bias magnitude independently of training composition: WavLM-Base+ produces gender gaps 3.0 to 4.3 times larger than LogSpectrogram under identical training conditions, and balanced training reduces LogSpectrogram bias but leaves WavLM bias largely intact. Third, post-hoc threshold calibration cannot close the EER gap: all six strategies tested, including Oracle calibration with full test-set label access, leave the EER gap unchanged at 1.317 p, confirming that distribution-level disparities require retraining rather than recalibration. Fourth, no single fairness metric captures every failure mode: metric choice alone flips the attack-level fairness verdict for 5 of 32 attacks, and per-gender EER calibration that works well under balanced training actively worsens equalized odds under imbalanced training. Together, these findings indicate that gender fairness in audio deepfake detection must be built in at training time, as post-hoc correction can only partially address the resulting disparities. References [1] K. T. Mai, S. Bray, T. Davies, and L. D. Griffin, âWarning: Humans cannot reliably detect speech deepfakes,â PLOS ONE, vol. 18, no. 8, p. e0285333, 2023. [2] O. A. Shaaban and R. Yildirim, âAudio deepfake detection using deep learning,â Engineering Reports, vol. 7, no. 3, p. e70087, 2025. [3] I. Khan, K. Khan, and A. Ahmad, âA comprehensive survey of deepfake generation and detection techniques in audio-visual media,â ICCK Journal of Image Analysis and Processing, vol. 1, no. 2, p. 73â95, 2025. [4] J. Yi, C. Wang, J. Tao, X. Zhang, C. Y. Zhang, and Y. Zhao, âAudio deepfake detection: A survey,â arXiv preprint arXiv:2308.14970, 2023. [5] M. Hong, D. Jiang, Z. Xie, W. Zhao, G. Wang, and C. J. Zhang, âVulnerabilities of audio-based biometric authentication systems against deepfake speech synthesis,â arXiv preprint arXiv:2601.02914, 2026. [6] B. Zhang, H. Cui, V. Nguyen, and M. Whitty, âAudio deepfake detection: What has been achieved and what lies ahead,â Sensors, vol. 25, no. 7, p. 1989, 2025. [7] X. Wang, H. Delgado, H. Tak, J. W. Jung, H. J. Shim, M. Todisco, et al., âASVspoof 5: Crowdsourced speech data, deepfakes, and adversarial attacks at scale,â arXiv preprint arXiv:2408.08739, 2024. [8] H. Tak, J. Patino, M. Todisco, A. Nautsch, N. Evans, and A. Larcher, âEnd-to-end anti-spoofing with RawNet2,â in Proc. ICASSP 2021 â IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2021, p. 6369â6373. [9] J. W. Jung, H. S. Heo, H. Tak, H. J. Shim, J. S. Chung, B. J. Lee, et al., âAASIST: Audio anti-spoofing using integrated spectro-temporal graph attention networks,â in Proc. ICASSP 2022 â IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2022, p. 6367â6371. [10] E. Ntoutsi, P. Fafalios, U. Gadiraju, V. Iosifidis, W. Nejdl, M. E. Vidal, et al., âBias in data-driven artificial intelligence systems: An introductory survey,â Wiley Interdisciplinary Reviews: Data Mining and Knowledge Discovery, vol. 10, no. 3, p. e1356, 2020. [11] G. Fenu, M. Marras, G. Medda, and G. Meloni, âFair voice biometrics: Impact of demographic imbalance on group fairness in speaker recognition,â in Proc. Interspeech, 2021, p. 1892â1896. [12] J. J. Bird and A. Lotfi, âReal-time detection of AI-generated speech for deepfake voice conversion,â arXiv preprint arXiv:2308.12734, 2023. [13] A. Fursule, S. Kshirsagar, and A. R. Avila, âGender fairness in audio deepfake detection: Performance and disparity analysis,â in Proc. 2026 IEEE Conference on Artificial Intelligence (CAI), 2026, p. 2116â2121. [14] T. Hashimoto, M. Srivastava, H. Namkoong, and P. Liang, âFairness without demographics in repeated loss minimization,â in Proc. International Conference on Machine Learning, 2018, p. 1929â1938. [15] H. S. Nguyen-Le, H. C. Nguyen-Thanh, N. A. Le-Khac, D. T. Nguyen, and H. H. Nguyen-Le, âAFSS: Artifact-focused self-synthesis for mitigating bias in audio deepfake detection,â arXiv preprint arXiv:2603.26856, 2026. [16] A. V. Nadimpalli and A. Rattani, âGBDF: Gender balanced deepfake dataset towards fair deepfake detection,â in Proc. International Conference on Pattern Recognition, 2022, p. 320â337. [17] N. Mehrabi, F. Morstatter, N. Saxena, K. Lerman, and A. Galstyan, âA survey on bias and fairness in machine learning,â ACM Computing Surveys, vol. 54, no. 6, p. 1â35, 2021. [18] Y. Ju, S. Hu, S. Jia, G. H. Chen, and S. Lyu, âImproving fairness in deepfake detection,â in Proc. IEEE/CVF Winter Conference on Applications of Computer Vision, 2024, p. 4655â4665. [19] L. Lin, X. He, Y. Ju, X. Wang, F. Ding, and S. Hu, âPreserving fairness generalization in deepfake detection,â in Proc. IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, p. 16815â16825. [20] A. K. S. Yadav, K. Bhagtani, D. Salvi, P. Bestagini, and E. J. Delp, âFairSSD: Understanding bias in synthetic speech detectors,â in Proc. IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024, p. 4418â4428. [21] M. Hardt, E. Price, and N. Srebro, âEquality of opportunity in supervised learning,â in Advances in Neural Information Processing Systems, vol. 29, 2016. [22] A. Chouldechova, âFair prediction with disparate impact: A study of bias in recidivism prediction instruments,â Big Data, vol. 5, no. 2, p. 153â163, 2017. [23] D. E. Temmar, A. Hamadene, V. Nallaguntla, A. Fursule, M. S. Allili, S. Kshirsagar, and A. R. Avila, âPhonetic analysis of real and synthetic speech using HuBERT embeddings: Perspectives for deepfake detection,â in Proc. 2025 IEEE International Conference on Systems, Man, and Cybernetics (SMC), 2025, p. 86â91. [24] A. Fursule, S. Kshirsagar, and A. R. Avila, âTowards trustworthy audio deepfake detection: A systematic framework for diagnosing and mitigating gender bias,â in Proc. IEEE International Conference on Systems, Man, and Cybernetics (SMC), 2026. [25] V. Nallaguntla, A. Fursule, S. Kshirsagar, and A. R. Avila, âPhonemeDF: A synthetic speech dataset for audio deepfake detection and naturalness evaluation,â arXiv preprint arXiv:2603.15037, 2026. [26] S. Kshirsagar and A. R. Avila, âInvestigating the impact of speech enhancement on audio deepfake detection in noisy environments,â arXiv preprint arXiv:2603.14767, 2026. [27] L. Trinh and Y. Liu, âAn examination of fairness of AI models for deepfake detection,â arXiv preprint arXiv:2105.00558, 2021. [28] Y. Xu, P. Terhörst, M. Pedersen, and K. Raja, âAnalyzing fairness in deepfake detection with massively annotated databases,â IEEE Transactions on Technology and Society, vol. 5, no. 1, p. 93â106, 2024. [29] W. T. Hutiri and A. Y. Ding, âBias in automated speaker recognition,â in Proc. ACM Conference on Fairness, Accountability, and Transparency (FAccT), 2022, p. 230â247. [30] V. StanÄk, K. Srna, A. Firc, and K. Malinka, âSCDF: A Speaker Characteristics DeepFake Speech Dataset for Bias Analysis,â arXiv preprint arXiv:2508.07944, 2025. [31] K. He, X. Zhang, S. Ren, and J. Sun, âDeep residual learning for image recognition,â in Proc. IEEE Conference on Computer Vision and Pattern Recognition, 2016, p. 770â778. [32] O. Pascu, D. OneaĆŁÄ, H. Cucu, and N. MĂŒller, âEasy, interpretable, effective: openSMILE for voice deepfake detection,â in Proc. ICASSP 2025 â IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2025, p. 1â5. [33] X. Tan, J. Chen, H. Liu, J. Cong, C. Zhang, Y. Liu, et al., âNaturalSpeech: End-to-end text-to-speech synthesis with human-level quality,â IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 46, no. 6, p. 4234â4245, 2024. [34] Z. Wu, J. Yamagishi, T. Kinnunen, C. Hanilçi, M. Sahidullah, A. Sizov, et al., âASVspoof: The automatic speaker verification spoofing and countermeasures challenge,â IEEE Journal of Selected Topics in Signal Processing, vol. 11, no. 4, p. 588â604, 2017. [35] J. Yamagishi, X. Wang, M. Todisco, M. Sahidullah, J. Patino, A. Nautsch, et al., âASVspoof 2021: Accelerating progress in spoofed and deepfake speech detection,â arXiv preprint arXiv:2109.00537, 2021. [36] X. Liu, X. Wang, M. Sahidullah, J. Patino, H. Delgado, T. Kinnunen, et al., âASVspoof 2021: Towards spoofed and deepfake speech detection in the wild,â IEEE/ACM Transactions on Audio, Speech, and Language Processing, vol. 31, p. 2507â2522, 2023. [37] R. Peri, K. Somandepalli, and S. Narayanan, âTo train or not to train adversarially: A study of bias mitigation strategies for speaker recognition,â arXiv preprint arXiv:2203.09122, 2022. [38] S. Chen, C. Wang, Z. Chen, Y. Wu, S. Liu, Z. Chen, et al., âWavLM: Large-scale self-supervised pre-training for full stack speech processing,â IEEE Journal of Selected Topics in Signal Processing, vol. 16, no. 6, p. 1505â1518, 2022. [39] Y. Benjamini and Y. Hochberg, âControlling the false discovery rate: A practical and powerful approach to multiple testing,â Journal of the Royal Statistical Society: Series B (Methodological), vol. 57, no. 1, p. 289â300, 1995. [40] S. Rubio, P. Bello, D. Ribas, A. Miguel, E. Lleida, and A. Ortega, âAn intervention-based framework for shortcut diagnosis in spoofing countermeasures,â in Proc. Odyssey 2026: The Speaker and Language Recognition Workshop, 2026, p. 1â8. [41] A. Das, Y. El Kheir, F. R. Guttierez, T. Polzehl, and S. Möller, âCan SSL frontend generalize to all-type audio spoofing?â in Proc. Odyssey 2026: The Speaker and Language Recognition Workshop, 2026, p. 277â283. [42] I. Loshchilov and F. Hutter, âDecoupled weight decay regularization,â arXiv preprint arXiv:1711.05101, 2017. [43] J. A. Hanley and B. MacGibbon, âCreating non-parametric bootstrap samples using Poisson frequencies,â Computer Methods and Programs in Biomedicine, vol. 83, no. 1, p. 57â62, 2006. [44] Y. Benjamini and D. Yekutieli, âThe control of the false discovery rate in multiple testing under dependency,â The Annals of Statistics, vol. 29, no. 4, p. 1165â1188, 2001. [45] B. Efron and R. J. Tibshirani, An Introduction to the Bootstrap. New York, NY, USA: Chapman and Hall, 1993. [46] I. Steiner and S. Le Maguer, âCreating new language and voice components for the updated MaryTTS text-to-speech synthesis platform,â in Proceedings of the Eleventh International Conference on Language Resources and Evaluation (LREC 2018), Miyazaki, Japan, May 2018. [47] C. Gong, X. Wang, E. Cooper, D. Wells, L. Wang, J. Dang, and J. Yamagishi, âZMM-TTS: Zero-shot multilingual and multispeaker speech synthesis conditioned on self-supervised discrete speech representations,â IEEE/ACM Transactions on Audio, Speech, and Language Processing, vol. 32, p. 4036â4051, 2024. [48] E. Casanova, J. Weber, C. D. Shulby, A. C. Junior, E. Gölge, and M. A. Ponti, âYourTTS: Towards zero-shot multi-speaker TTS and zero-shot voice conversion for everyone,â in Proceedings of the International Conference on Machine Learning (ICML), p. 2709â2720, PMLR, Jun. 2022. [49] E. Casanova, K. Davis, E. Gölge, G. Göknar, I. Gulea, L. Hart, and J. Weber, âXTTS: A massively multilingual zero-shot text-to-speech model,â arXiv preprint arXiv:2406.04904, 2024. [50] J. Kim, S. Kim, J. Kong, and S. Yoon, âGlow-TTS: A generative flow for text-to-speech via monotonic alignment search,â in Advances in Neural Information Processing Systems, vol. 33, p. 8067â8077, 2020. [51] V. Popov, I. Vovk, V. Gogoryan, T. Sadekova, and M. Kudinov, âGrad-TTS: A diffusion probabilistic model for text-to-speech,â in Proceedings of the International Conference on Machine Learning (ICML), p. 8599â8608, PMLR, Jul. 2021. [52] S. G. Lee, W. Ping, B. Ginsburg, B. Catanzaro, and S. Yoon, âBigVGAN: A universal neural vocoder with large-scale training,â arXiv preprint arXiv:2206.04658, 2022. [53] F. Lux, J. Koch, and N. T. Vu, âExact prosody cloning in zero-shot multispeaker text-to-speech,â in Proceedings of the 2022 IEEE Spoken Language Technology Workshop (SLT), p. 962â969, IEEE, Jan. 2023. [54] A. ĆaĆcucki, âFastPitch: Parallel text-to-speech with pitch prediction,â in Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), p. 6588â6592, IEEE, Jun. 2021. [55] J. Kim, J. Kong, and J. Son, âConditional variational autoencoder with adversarial learning for end-to-end text-to-speech,â in Proceedings of the International Conference on Machine Learning (ICML), p. 5530â5540, PMLR, Jul. 2021. [56] F. Lux, J. Koch, and N. T. Vu, âLow-resource multilingual and zero-shot multispeaker TTS,â in Proceedings of the 2nd Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics and the 12th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), p. 741â751, Nov. 2022. [57] V. Popov, I. Vovk, V. Gogoryan, T. Sadekova, M. Kudinov, and J. Wei, âDiffusion-based voice conversion with fast maximum likelihood sampling scheme,â arXiv preprint arXiv:2109.13821, 2021. [58] J. Kong, J. Kim, and J. Bae, âHiFi-GAN: Generative adversarial networks for efficient and high-fidelity speech synthesis,â in Advances in Neural Information Processing Systems, vol. 33, p. 17022â17033, 2020. [59] J. Shen, R. Pang, R. J. Weiss, M. Schuster, N. Jaitly, Z. Yang, Z. Chen, Y. Zhang, Y. Wang, R. Skerry-Ryan, R. A. Saurous, Y. Agiomyrgiannakis, and Y. Wu, âNatural TTS synthesis by conditioning WaveNet on mel spectrogram predictions,â in Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), p. 4779â4783, IEEE, Apr. 2018. [60] Y. A. Li, A. Zare, and N. Mesgarani, âStarGANv2-VC: A diverse, unsupervised, non-parallel framework for natural-sounding voice conversion,â arXiv preprint arXiv:2107.10394, 2021. [61] E. A. AlBadawy and S. Lyu, âVoice conversion using speech-to-speech neuro-style transfer,â in Proc. Interspeech, 2020, p. 4726â4730. [62] A. Mohamed, H.-Y. Lee, L. Borgholt, J. D. Havtorn, J. Edin, C. Igel, K. Kirchhoff, S.-W. Li, K. Livescu, L. Mangu, T. N. Sainath, and S. Watanabe, âSelf-supervised speech representation learning: A review,â IEEE Journal of Selected Topics in Signal Processing, vol. 16, no. 6, p. 1179â1210, 2022. [63] U. Sen, A. Luqman, and A. Chattopadhyay, âToward noise-aware audio deepfake detection: Survey, SNR-benchmarks, and practical recipes,â arXiv preprint arXiv:2512.13744, 2025. [64] C. Zhang and D. Yu, âC3-DINO: Joint contrastive and non-contrastive self-supervised learning for speaker verification,â IEEE Journal of Selected Topics in Signal Processing, vol. 16, no. 6, p. 1273â1283, 2022. [65] C. Gao, M. Postiglione, J. Baldwin, N. Denisenko, I. Gortner, L. Fosdick, and V. S. Subrahmanian, âContext and transcripts improve detection of deepfake audios of public figures,â arXiv preprint arXiv:2601.13464, 2026. [66] A. I. Zahran, A. A. Fahmy, K. T. Wassif, and H. Bayomi, âFine-tuning self-supervised learning models for end-to-end pronunciation scoring,â IEEE Access, vol. 11, p. 112650â112663, 2023. [67] W. Ge, Z. Fazal, and E. Jakobsson, âUsing optimal f-measure and random resampling in gene ontology enrichment calculations,â Frontiers in Applied Mathematics and Statistics, vol. 5, p. 20, 2019. [68] C. Tuglus and M. J. van der Laan, âModified FDR controlling procedure for multi-stage analyses,â Statistical Applications in Genetics and Molecular Biology, vol. 8, no. 1, Art. 12, 2009. [69] C. Hanilçi, M. Sahidullah, and T. Kinnunen, âCyclostationarity analysis as a complement to self-supervised representations for speech deepfake detection,â arXiv preprint arXiv:2603.03921, 2026. [70] B. Muller, A. A. Ortiz Barrañón, and L. Roberts, âTraining-free cross-lingual dysarthria severity assessment via phonological subspace analysis in self-supervised speech representations,â medRxiv, 2026. [71] A. Cowling, P. Hall, and M. J. Phillips, âBootstrap confidence regions for the intensity of a Poisson point process,â Journal of the American Statistical Association, vol. 91, no. 436, p. 1516â1524, 1996. [72] A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, A. Desmaison, A. Köpf, E. Yang, Z. DeVito, M. Raison, A. Tejani, S. Chilamkurthy, B. Steiner, L. Fang, J. Bai, and S. Chintala, âPyTorch: An imperative style, high-performance deep learning library,â in Advances in Neural Information Processing Systems, vol. 32, 2019. [73] C. Dwork, M. Hardt, T. Pitassi, O. Reingold, and R. Zemel, âFairness through awareness,â in Proceedings of the 3rd Innovations in Theoretical Computer Science Conference, 2012, p. 214â226. [74] V. Nallaguntla, S. Kshirsagar, and A. R. Avila, âPhoneme-Level Deepfake Detection Across Emotional Conditions Using Self-Supervised Embeddings,â arXiv preprint arXiv:2605.03079, 2026. [75] D. Pessach and E. Shmueli, âA review on fairness in machine learning,â ACM Computing Surveys, vol. 55, no. 3, p. 1â44, 2022. [76] S. Verma and J. Rubin, âFairness definitions explained,â in Proceedings of the International Workshop on Software Fairness, p. 1â7, May 2018. [77] D. Hellman, âMeasuring algorithmic fairness,â Virginia Law Review, vol. 106, no. 4, p. 811â866, 2020. [78] S. Wachter, B. Mittelstadt, and C. Russell, âBias preservation in machine learning: The legality of fairness metrics under EU non-discrimination law,â West Virginia Law Review, vol. 123, no. 3, p. 735â790, 2021. [79] N. Jain and H. Wang, âInclusive speaker verification with adaptive thresholding,â arXiv preprint arXiv:2111.05501, 2021. [80] G. Pleiss, M. Raghavan, F. Wu, J. Kleinberg, and K. Q. Weinberger, âOn fairness and calibration,â in Advances in Neural Information Processing Systems, vol. 30, 2017.