Algorithmic Detection of AI-Generated and Spoofed Speech for Interpretable Voice Authentication

Abstract

Recent advances in neural speech synthesis and voice conversion have increased the risk of logical-access spoofing attacks against voice-authentication systems. This study presents an interpretable, enrollment-conditioned framework that separates speaker-identity verification from subsequent speech-authenticity assessment. The first stage uses Emphasized Channel Attention, Propagation and Aggregation Time Delay Neural Network (ECAPA-TDNN) speaker embeddings and cosine similarity, while the second stage evaluates speaker-conditioned Mel-Frequency Cepstral Coefficient (MFCC), pitch, and local-jitter anomaly scores. These scores are normalized using development target bona fide distributions and combined through a fixed, unweighted score-level fusion; Principal Component Analysis (PCA) waveform reconstruction is retained as an ablation component. The framework was evaluated on the ASVspoof 2019 Logical Access (LA) benchmark using strict separation between development-based calibration and independent evaluation. All feature formulations, normalization references, fusion components, and decision thresholds were frozen before evaluation. On 102,579 evaluation trials, the ECAPA-TDNN stage alone achieved a target False Rejection Rate (FRR) of 0.5773%, a bona fide non-target False Acceptance Rate (FAR) of 1.0532%, and a spoof acceptance rate of 66.1892%. The complete hierarchical system achieved an observed target FRR of 4.8045%, a non-target FAR of 0.7681%, and a spoof acceptance rate of 58.7239%, corresponding to an absolute spoof-acceptance reduction of 7.4653 percentage points. MFCC provided the strongest standalone second-stage discrimination, with a Receiver Operating Characteristic–Area Under the Curve (ROC-AUC) of 0.653055, while the frozen MFCC-pitch-jitter fusion achieved an ROC-AUC of 0.604293 and was selected prospectively under a 5% development target-FRR constraint. Attack-specific evaluation revealed substantial variability across the A07–A19 evaluation conditions, including systematic failure modes for A12 and A16. Within the ASVspoof 2019 LA evaluation setting, the results demonstrate a reproducible and interpretable hierarchical authentication framework while also showing that fixed acoustic descriptors do not provide attack-invariant spoof detection. Because development and evaluation originate from the same benchmark, these results should not be interpreted as evidence of cross-corpus, cross-channel, physical-access, or real-world deployment generalization.

1. Introduction

In recent years, embedded and edge computing systems have become a fundamental component of modern cyber-physical infrastructures, enabling local decision-making based on continuous streams of sensor data and human interaction [1]. Among the various interaction modalities, voice-based interfaces have emerged as a natural and efficient control mechanism, particularly in environments where manual interaction is limited, such as smart homes, automotive systems, wearable devices, and industrial applications [2]. The increasing integration of signal processing algorithms and artificial intelligence models directly on resource-constrained platforms has further accelerated the adoption of Voice User Interfaces (VUIs), driven by requirements related to low latency, energy efficiency, and data privacy [3,4].

However, this technological evolution has introduced new security challenges, as voice interfaces can also act as potential attack vectors. Advances in neural speech synthesis and voice conversion technologies have significantly lowered the barrier for generating highly realistic artificial speech [5]. As a result, modern adversaries are no longer limited to simple replay attacks but can generate synthetic or manipulated voice signals capable of mimicking legitimate users with high fidelity. This paradigm shift fundamentally challenges traditional voice authentication systems, which were originally designed under assumptions that do not account for sophisticated AI-generated spoofing (SPF) attacks [6,7].

Consequently, the problem of voice authentication must be re-evaluated from a security-oriented perspective, where the focus shifts from mere speaker recognition to the assessment of signal authenticity [8]. In this context, the detection of AI-generated and spoofed speech has become a critical research topic, requiring robust methods capable of distinguishing between bona fide and manipulated signals under realistic acoustic conditions [9]. Existing approaches range from deep learning models operating on spectrogram representations to self-supervised learning frameworks that leverage large-scale pretrained embeddings [10]. While these methods often achieve high performance, they are typically computationally expensive, difficult to interpret, and sensitive to domain shifts introduced by channel effects, compression, or environmental noise [11].

An alternative direction, increasingly relevant for embedded and edge deployment, involves the use of hybrid signal processing techniques combined with lightweight learning strategies [12]. In particular, the analysis of time-frequency representations, such as log-Mel spectrograms, together with micro-prosodic characteristics (e.g., pitch variations and jitter), offers a promising pathway for capturing subtle discrepancies between natural and synthetic speech [13]. These features reflect physiological and production-related properties of human speech that are often imperfectly reproduced by generative models, thus providing discriminative cues for spoof detection [14]. When coupled with anomaly detection frameworks, this approach enables the modeling of genuine speech as a reference distribution, facilitating the identification of deviations introduced by artificial generation processes [15].

Despite the strong performance reported by recent anti-spoofing systems, many contemporary approaches rely on jointly learned representations, embedding fusion, or trainable score-level backends. Such strategies can provide strong discrimination but may reduce the direct interpretability of the individual acoustic cues contributing to an authentication decision. This motivates the investigation of modular, enrollment-conditioned architectures in which speaker identity and speech-authenticity evidence remain separately measurable while still contributing to a reproducible end-to-end decision.

The methodological novelty of this work lies in the integration and organization of established components rather than in the introduction of a new acoustic representation or learning algorithm. Specifically, the proposed framework separates speaker-identity verification from subsequent speech-authenticity assessment in a hierarchical decision process, conditions the authenticity descriptors on the claimed speaker’s enrollment data, preserves the individual interpretability of spectral and micro-prosodic anomaly scores, and combines these heterogeneous scores only after development-based normalization. Emphasized Channel Attention, Propagation and Aggregation Time Delay Neural Network (ECAPA-TDNN) speaker similarity provides the first-stage identity gate, while speaker-conditioned Mel-Frequency Cepstral Coefficient (MFCC), pitch, and local-jitter anomaly scores characterize complementary deviations for trials that pass speaker verification. Principal Component Analysis (PCA)-based waveform reconstruction is evaluated independently as an interpretable ablation component rather than being incorporated automatically into the operational detector. Accordingly, the contribution should be understood as a transparent authentication architecture and evaluation methodology built from established signal-processing and speaker-verification components, not as a new standalone feature extractor, neural architecture, or anti-spoofing representation.

A second methodological contribution is the prospective validation protocol used to evaluate this integrated architecture without post hoc optimization. Development and evaluation data from the ASVspoof 2019 Logical Access benchmark are kept strictly separate: operating thresholds, feature formulations, empirical normalization references, and fusion components are selected using development data and frozen before evaluation. The resulting system is assessed using target False Rejection Rate (FRR), bona fide non-target False Acceptance Rate (FAR), spoof acceptance rate, Receiver Operating Characteristic–Area Under the Curve (ROC-AUC), Equal Error Rate (EER), component-level ablation, confidence intervals, and attack-specific analysis across the A07–A19 evaluation conditions. This protocol enables the contribution and limitations of the individual stages to be quantified without post hoc evaluation-set recalibration.

The remainder of this paper is organized as follows. Section 2 reviews relevant work on AI-generated speech detection, anti-spoofing, and spoofing-aware speaker verification. Section 3 presents the proposed hierarchical framework, the ASVspoof 2019 LA protocol, the speaker-conditioned acoustic descriptors, and the frozen fusion procedure. Section 4 reports the independent experimental results, including operating-point performance, ROC-AUC and EER analysis, component ablation, statistical confidence intervals, and attack-specific evaluation. Section 5 discusses the implications, limitations, and observed failure modes of the proposed approach. Finally, Section 6 summarizes the main conclusions and directions for future work.

2. Literature Review

The rapid progress in neural speech synthesis and voice conversion has stimulated extensive research on the detection of AI-generated and spoofed speech, particularly in the context of securing voice authentication systems [16]. The literature reveals a diverse set of approaches, ranging from classical signal processing techniques to advanced deep learning and self-supervised models, reflecting the complexity of distinguishing between genuine and artificially generated speech signals.

The paper [17] describes the Automatic Speaker Verification (ASV) Spoof 2021 edition, marking the transition from assessments under controlled conditions to “in the wild” scenarios, in which bona fide and spoofed signals are affected by real channel degradations. The competition is structured in three tracks: Logical Access (LA), Physical Access (PA), and Deepfake, each corresponding to a distinct threat model, but with the common objective of assessing the ability to generalize countermeasures. The authors define data and training protocols to ensure comparability, use metrics such as Tandem-Detection Cost Function (T-DCF) and EER, and highlight the role of attack diversification and cross-corpus assessments. The results highlight the importance of robustness to domain variations and the methodological risks associated with reliance on non-vocal artifacts or simplified replay scenarios.

Jung et al. [18] propose a unified model for spoofed speech detection, capable of simultaneously capturing artifacts from the spectral and temporal domains, avoiding the need for complex assemblies. The approach uses an end-to-end pipeline starting from the raw signal, in which a RawNet2 encoder is followed by graph-based modeling for the representation of the spectro-temporal structure. The main contribution is the introduction of a Heterogeneous Stacking Graph Attention Layer (HS-GAL), which integrates information from the two domains into a common latent space, together with a stack node aggregation mechanism. The experimental results on ASVspoof 2019 (LA) highlight significant improvements in terms of EER and min T-DCF compared to existing methods, and the proposed lightweight variant (Audio Anti Spoofing Integrated Spectro Temporal-Lightweight (AASIST-L)) demonstrates the feasibility of use in resource-limited scenarios.

The paper [19] introduces the Spoofing-Aware Speaker Verification (SASV) framework, which extends the classic speaker verification scenario by explicitly integrating spoofing attacks into the authentication process. The authors define assessment protocols that include three types of trials (target, bona fide non-target, and spoofed non-target) and propose SASV-EER as the primary metric, alongside Speaker Verification-EER (SV-EER) and SPF-EER for separate performance analysis. Integration strategies between ASV systems and spoofing countermeasures are investigated, using models such as ECAPA-TDNN and AASIST, both by merging at the score level and at the embedding level. The results highlight significant performance improvements through blended approaches while highlighting the current reliance on merger-based architectures and the need to develop more efficient integrated models.

The paper [20] approaches the anti-spoofing issue from a speaker-conditioned perspective, arguing that most existing countermeasures are speaker-independent, although real authentication scenarios involve enrollment information. The authors formulate the task as a test conditioned by the speaker’s identity and propose a speaker-aware extension of the AASIST architecture, in which the speaker embedding, extracted with an ASV model (ECAPA-TDNN), is integrated as auxiliary information in the detection process. Several merging strategies at the frame and utterance level are investigated, and the results on a protocol derived from ASVspoof 2019 highlight significant improvements in terms of EER and min T-DCF compared to speaker-independent approaches. The study demonstrates that the inclusion of information about the speaker can increase the robustness of countermeasures, especially in conditions of difficult generalization.

Yi et al. [21] introduce the ADD (Audio Deepfake Detection) 2023 edition, extending the evaluation of audio deepfake detection beyond binary classification by defining three complementary tasks: adversarial detection (audio fake game), localization of manipulated segments, and recognition of the generator algorithm. The authors propose realistic evaluation protocols, including adversarial scenarios, channel degradations, and open-set conditions, along with dedicated metrics such as Weighted EER (WEER), segment-level F1, and F1 macro. The results highlight that although performance in classical detection is high, localization and attribution tasks remain challenging, underscoring the need for more robust and generalizable methods.

The paper [22] proposes an audio deepfake detection system that combines a self-supervised frontend based on WavLM with a Multi-Fusion Attentive (MFA) classifier. The authors argue that, unlike other Self-Supervised Learning (SSL) models, WavLM more effectively captures information related to the speaker and acoustic environment, relevant to the identification of spoofing artifacts. The representations extracted at the level of all layers of the encoder are aggregated through attentive statistics pooling mechanisms both on the temporal and layer dimensions, allowing the exploitation of informational complementarity. Evaluations on ASVspoof benchmarks show competitive performance in terms of EER and min T-DCF, confirming the efficiency of combining multi-layer representations with a relatively simple attentive backend.

The paper [23] investigates the limitations of self-supervised models in generalizing unseen generating algorithms and proposes a mechanism for selecting the relevant layers in Cross-Lingual Speech-Representations (XLS-R). The authors introduce a Sensitive Layer Selection (SLS) classifier, which aggregates representations extracted from all layers of the Transformer encoder through a weighting mechanism inspired by squeeze-and-excitation recalibration. This strategy allows the capitalization of information distributed on different levels of abstraction, using a simple classification backend. Ratings on ASVspoof benchmarks and “in the wild” sets show peak performance in terms of EER, highlighting the importance of exploiting multi-layer representations. At the same time, the results indicate that fine-tuning and augmentation remain essential to ensure robustness in real conditions.

The paper [24] highlights the importance of generalization to unseen distributions and score calibration in deepfake audio detection, proposing a simplified approach based on self-supervised representations extracted from pre-trained models (e.g., wav2vec 2.0, XLS-R) combined with a linear classifier. The authors show that such representations, used with a logistic regression backend, can provide competitive performance in terms of EER on out-of-domain sets, as well as better Expected Calibration Error (ECE), compared to more complex end-to-end models. The results underscore that the simplicity of the backend, combined with informative SSL frontends, can lead to more robust and computationally efficient systems.

Tahaoglu et al. [25] approach audio spoofing detection from a security-oriented perspective, highlighting the difficulties of generalizing between different types of attacks: Text-to-Speech (TTS), Voice Conversion (VC), and replay. The authors propose a hybrid approach based on explicit spectral characteristics: Linear Frequency Cepstral Coefficients (LFCC), MFCC, and Constant Q Cepstral Coefficients (CQCC), combined with ResNeXt classification models and multi-feature merger strategies. The results show that embedding fusion offers the best performance and robustness, with each type of feature contributing complementarily depending on the type of attack. Evaluations on ASVspoof benchmarks confirm that this approach improves transferability between scenarios and provides an effective trade-off between performance and interpretability.

Table 1 summarizes the comparative contributions of the reference works, highlighting the target task, methodological novelty, experimental resources, and metrics used to support the choice of a reproducible methodology in detecting the authenticity of the voice.

Table 1. Comparative synthesis of key works on voice authenticity detection.

Paper	Target Issue	Central Contribution	Evaluation Data and Settings	Reported Metrics	Practical Observation
[17]	Robust anti-spoofing evaluation under realistic conditions	Definition of three tracks LA, PA, Deepfake (DF) with channel degradations, codec and conditions close to actual use, plus analysis on hidden subsets	ASVspoof 2019 LA and PA for training, ASVspoof 2021 LA, PA, DF benchmark, with Voice over Internet Protocol Public Switched Telephone Network (VoIP-PSTN) channels and codecs	T-DCF for LA and PA, EER for DF	Emphasizes generalization, sensitivity to non-speech artifacts, and differences between simulated and real replay conditions
[18]	End-to-End (E2E) Raw Waveform Anti-Spoofing Detection	Graph-based spectro-temporal modeling and integration through the HS-GAL layer, avoiding costly ensemble architectures and enabling a unified model	ASVspoof 2019 LA, compared to graph and raw waveform baselines	min T-DCF and EER	Includes the low-complexity AASIST-L variant for resource-constrained inference
[19]	Voice authentication in the presence of spoofing	Formalizes SASV as an integrated ASV plus Countermeasure (CM) problem with non-target spoofed trials and merge score and embedding baselines	VoxCeleb2 for ASV, ASVspoof 2019 LA for CM and Fusion, SASV Specific Protocol	SASV-EER, SV-EER, SPF-EER	Highlights that ASV integration with CM is necessary in real-world scenarios where the detector cannot be evaluated in isolation
[20]	Anti-spoofing conditioned by the target speaker	Introduces the speaker-aware load and injects enrollment embedding into the AASIST countermeasure by merging at the frame or utterance level	Protocol derived from ASVspoof 2019 LA, enrollment extracted with ECAPA-TDNN, external data analyses	EER and min T-DCF	Demonstrates performance gains when enrollment information is available, reinforcing its relevance to operational authentication scenarios
[21]	Audio deepfake detection, manipulation localization, generator assignment	Extends the evaluation to adversarial game generation detection, partial detection, and recognition algorithm in open-set mode	Data based on AISHELL-3, with evaluation protocols defined across three tracks: Fake Game (FG), partial fake, and open-set detection	Deception Success Rate (DSR), WEER, Combined Metrics for Location, F1 Macro for Attribution	Provides a modern framework for real-world scenarios beyond the real fake binary
[22]	Deepfake detection using SSL frontend	It uses WavLM as an SSL encoder and an MFA classifier that fuses information across layers and time via time-wise Attentive Statistics Pooling (T-ASP) and layer-wise ASP (L-ASP)	Training according to ASVspoof 2021 rules, rating on ASVspoof 2019 LA, ASVspoof 2021 LA and DF	min T-DCF and EER	Highlights the advantage of exploiting multi-layer information from SSL for generalization, with controlled backend architecture
[23]	Robust deepfake detection under various conditions	Proposes SLS (Sensitive Layer Selection) over XLS-R with SENet-inspired recalibration weighting for aggregation of useful layers	ASVspoof 2019 LA train, review on ASVspoof 2021 LA, DF and sets in the wild, with RawBoost augmentation	EER	Shows that layer selection and realistic augmentation remain critical for out-of-domain performance
[24]	Deepfake detection with generalization and calibration	Demonstrates the effectiveness of a minimalist logistic regression backend over frozen SSL representations by explicitly analyzing calibration and uncertainty	Multi-set benchmark including in-the-wild, partial spoof, and miscellaneous data	EER and ECE	Introduces calibration as a security requirement for interpretable decisions in access control
[25]	Spoof detection on LA, PA, DF with a focus on robustness	Hybrid approach with LFCC, MFCC, CQCC and ResNeXt classifier, with multi-feature fusion via Multilayer Perceptron (MLP) and analysis by attack type	ASVspoof 2019 LA & PA, ASVspoof 2021 LA, PA, DF	EER and min T-DCF	Provides a robust and relatively interpretable baseline, relevant for comparisons with SSL and E2E methods

The proposed strategy differs from existing anti-spoofing and spoofing-aware speaker-verification approaches primarily in the way identity and authenticity evidence are organized and combined. AASIST [18] learns an integrated spectro-temporal representation directly from speech, while the SASV framework [19] investigates score- and embedding-level integration between automatic speaker verification and dedicated spoofing countermeasures. Speaker-aware anti-spoofing [20] further incorporates enrollment-derived speaker information directly into the countermeasure architecture. Other recent approaches rely on self-supervised speech representations and learned classification backends [22,23,24], whereas explicit spectral representations can also be combined through trainable classifiers or feature-fusion strategies [25].

In contrast, the present framework preserves a hierarchical separation between identity verification and authenticity assessment. ECAPA-TDNN cosine similarity first determines whether a trial proceeds beyond the speaker-verification gate. For ASV-accepted trials, speaker-conditioned MFCC, pitch, and jitter anomaly scores remain individually interpretable, are normalized against development target bona fide reference distributions, and are subsequently combined through a fixed unweighted score-level fusion. PCA reconstruction error is retained as an independently evaluated ablation component rather than being included in the final fusion. The contribution therefore lies in a transparent, enrollment-conditioned decision architecture with prospectively frozen normalization and operating thresholds, rather than in a new learned representation or an assertion of universal superiority over end-to-end countermeasures.

Against this background, the present study does not seek to replace learned anti-spoofing representations with a new handcrafted descriptor. Instead, it investigates whether established speaker-verification and interpretable acoustic measures can be organized into an enrollment-conditioned hierarchical decision framework in which identity and authenticity evidence remain separately observable and prospectively calibrated. The external AASIST comparison further serves to distinguish the interpretability-oriented contribution of the proposed architecture from state-of-the-art neural spoof-detection performance.

3. Proposed Algorithmic Framework

This section introduces a compact and interpretable algorithmic framework for the detection of AI-generated and spoofed speech. The proposed approach combines spectral and micro-prosodic analysis within a modular detection mechanism designed for interpretable processing and compatibility with edge and embedded computing scenarios.

3.1. Problem Formulation

Voice authentication systems are vulnerable to logical-access spoofing attacks in which synthesized or voice-converted speech is generated to imitate the characteristics of a legitimate speaker. The experimental threat model considered in this study is restricted to the Logical Access scenario represented by the ASVspoof 2019 LA benchmark [26,27]. Accordingly, the evaluated spoofing conditions comprise text-to-speech and voice-conversion attacks presented directly to the authentication system. Physical-access replay attacks are outside the scope of the present experimental validation [26,28].

The task addressed in this work is enrollment-conditioned verification of both speaker identity and speech authenticity rather than conventional speech recognition. Given a claimed speaker s and a test utterance x, the proposed framework first determines whether the utterance is sufficiently consistent with the enrolled speaker representation. Trials that satisfy this identity criterion are subsequently examined for spectral and micro-prosodic deviations relative to the corresponding bona fide enrollment characteristics.

The resulting architecture therefore separates two distinct questions. The first stage evaluates whether the test utterance is compatible with the claimed identity using ECAPA-TDNN speaker embeddings and cosine similarity. The second stage evaluates whether an ASV-accepted utterance exhibits anomalous MFCC, pitch, or jitter characteristics relative to the claimed speaker. PCA-based waveform reconstruction is additionally evaluated as an interpretable ablation component but is not included in the final frozen authenticity fusion [28,29]. The final authentication decision is obtained through the hierarchical procedure described in Section 3.2, Section 3.3, Section 3.4 and Section 3.5.

This formulation reflects the practical difficulty posed by contemporary text-to-speech and voice-conversion systems: a spoofed utterance may preserve sufficient speaker characteristics to pass a conventional identity-verification stage while still being artificially generated. The objective of the second stage is therefore not to re-estimate speaker identity but to provide complementary evidence of speech authenticity for trials that have already satisfied the frozen speaker-verification criterion.

3.2. Enrollment-Based Speaker Verification and Presentation-Attack Detection

The first stage of the proposed framework performs enrollment-conditioned speaker verification using an ECAPA-TDNN embedding model. ECAPA-TDNN was selected because its channel-attention and multi-layer feature aggregation mechanisms provide compact speaker-discriminative representations suitable for verification under variable acoustic conditions [30]. In the present implementation, the pretrained SpeechBrain ECAPA-TDNN model produces a 192-dimensional embedding for each 16 kHz mono utterance [31].

Let u(x) ∈ ℝ¹⁹² denote the embedding extracted from utterance x. Each utterance-level embedding is first normalized to unit Euclidean norm:

$$e\left(x\right)={\displaystyle \frac{u\left(x\right)}{{‖u\left(x\right)‖}_2}}$$

(1)

For the enrolled speaker (s), the normalized embeddings obtained from the E_s official bona fide enrollment utterances are averaged and subsequently normalized again to obtain the speaker reference embedding:

$$e_s={\displaystyle \frac{\frac{1}{E_s}{\displaystyle {\sum }_{j=1}^{E_S}}e\left(x_{s,j}\right)}{{‖\frac{1}{E_s}{\displaystyle {\sum }_{j=1}^{E_S}}e\left(x_{s,j}\right)‖}_2}}$$

(2)

For a test utterance x claiming identity s, speaker similarity is measured through cosine similarity. Because both vectors are unit-normalized, the score reduces to their inner product:

$$S_{\mathit{ASV}}\left(x,s\right)=e_s^{T}e\left(x\right)$$

(3)

The speaker-verification stage acts as the first gate of the hierarchical system. A trial is passed to the authenticity-analysis stage only when:

S_ASV(x, s) ≥ τ_ASV

(4)

The operating threshold was calibrated exclusively on the ASVspoof 2019 LA development target and bona fide non-target trials by selecting the operating point at which the development false-acceptance and false-rejection rates were most closely balanced. This procedure yielded the frozen threshold τ_ASV = 0.4152109027. Spoof trials were not used to determine this identity-verification threshold. The same threshold was subsequently applied without modification to the independent evaluation partition.

Speaker verification alone does not determine whether an accepted signal represents a bona fide presentation. A synthesized or voice-converted utterance may preserve sufficient speaker characteristics to pass the identity gate. Therefore, every trial satisfying Equation (4) is forwarded to the second stage, where speaker-conditioned spectral and micro-prosodic anomaly indicators are evaluated. This separation preserves the distinction between identity verification and presentation-authenticity assessment while allowing the contribution of each stage to be quantified independently [26,27,28,32].

3.3. Experimental Dataset and Evaluation Protocol

The experimental validation was conducted using the LA partition of the ASVspoof 2019 benchmark [33]. This database provides official speaker-enrollment protocols together with target, bona fide non-target, and spoofed authentication trials, thereby enabling the proposed framework to be evaluated under a standardized speaker-verification and logical-access spoofing scenario. All audio signals were processed as mono waveforms at a sampling rate of 16 kHz [33].

The experimental procedure followed a strict separation between development and evaluation data. The development protocol contained 29,548 speaker-verification trials, comprising 1484 target trials, 5768 bona fide non-target trials, and 22,296 spoof trials. The corresponding development enrollment protocol contained 142 bona fide enrollment utterances from 10 speakers. Spoofed development trials were associated with attack conditions A01–A06. Development data were used exclusively for operating-point calibration, formulation selection, feature normalization, and fusion configuration.

The independent evaluation protocol contained 102,579 trials, including 5370 target trials, 33,327 bona fide non-target trials, and 63,882 spoof trials. The evaluation enrollment set contained 696 bona fide utterances from 48 enrolled speakers. The spoofed evaluation subset comprised attack conditions A07–A19. According to the official ASVspoof 2019 taxonomy [27], eleven of these conditions correspond to spoofing systems not represented among the development attacks, whereas A16 and A19 are known-reference conditions that use the same underlying spoofing algorithms as development attacks A04 and A06, respectively. The evaluation partition therefore combines previously unseen spoofing systems with two known-reference algorithms while remaining completely disjoint from the development trials.

No system parameter was optimized using the evaluation set. The speaker-verification operating threshold, the formulation of the acoustic anomaly indicators, the selection of the final fusion components, the empirical normalization reference, and the final fusion threshold were all fixed using development data before evaluation scores were inspected. After this configuration was frozen, the evaluation set was processed once using the unchanged decision rules. Evaluation-derived EER operating points were computed only as descriptive statistics and were not used to recalibrate the deployed system.

Speaker verification was evaluated using the official target and bona fide non-target trials. The ECAPA-TDNN operating point was calibrated exclusively on the development target and non-target distributions. Spoof trials were subsequently passed through the same identity-verification stage, allowing the number of spoofed utterances rejected directly by the speaker-verification stage and the number passed to the authenticity-analysis stage to be quantified separately.

The second stage was evaluated only on trials that passed the frozen speaker-verification threshold. Speaker-conditioned MFCC, pitch, jitter, and PCA scores were computed relative to the corresponding official bona fide enrollment data. The final authenticity configuration was selected on the development set under a predefined end-to-end target false-rejection-rate constraint of 5%. The final fusion consisted of the MFCC-, pitch-, and jitter-based anomaly scores, while PCA was retained as an independent ablation component. No modification of the feature definitions, fusion components, fusion weights, or decision thresholds was performed after observing the evaluation results.

Performance was assessed at both stages of the hierarchy. Speaker-verification performance was characterized using target FRR, bona fide non-target FAR, ROC-AUC, and EER. For spoof trials, the principal end-to-end measure was the spoof acceptance rate, defined as the proportion of spoof trials ultimately accepted by the complete system. Component-level discrimination between target bona fide and spoof trials was additionally characterized using ROC-AUC and EER. Ninety-five-percent Wilson confidence intervals were computed for operating-point proportions, while speaker-cluster percentile bootstrap intervals were used for ROC-AUC and EER to account for the repeated-trial structure associated with individual enrolled speakers.

3.4. Interpretable Detection Features for Synthetic Speech

After speaker-consistency verification, the proposed framework evaluates four interpretable acoustic anomaly representations: speaker-conditioned MFCC deviation, fundamental-frequency variation, local jitter, and PCA-based waveform reconstruction error. The descriptors were selected to characterize complementary aspects of the speech signal, including spectral-envelope deviation, temporal pitch behavior, cycle-to-cycle micro-prosodic variation, and waveform-level reconstruction mismatch.

Each component was evaluated independently before fusion to preserve its physical interpretation and to quantify its individual contribution. Based exclusively on development-set analysis, the final authenticity stage retained MFCC-, pitch-, and jitter-based anomaly scores. PCA reconstruction error was excluded from the final fusion and retained as an ablation component for independent evaluation. Consequently, the final system does not assume that all available descriptors contribute equally or that every interpretable feature necessarily improves the combined detector.

The three retained authenticity scores were subsequently normalized relative to the development target bona fide distribution and combined only at the score level, without feature concatenation or a trainable meta-classifier. The exact normalization and fusion procedure are described in the subsequent decision-fusion subsection.

The spectral-deviation branch was implemented using MFCCs. All utterances were processed at 16 kHz using 25 ms analysis windows (400 samples), a 10 ms hop (160 samples), a 400 − point Fourier transform, and a 40 − band Mel filter bank spanning 20–7600 Hz. Twenty MFCCs were retained for each frame. Logarithmic Mel-band energies were used before cepstral transformation.

For an utterance x containing T_x analysis frames, the frame-level MFCC vectors c_t(x) ∈ R²⁰ were summarized by their utterance-level mean:

$$\overline{c}\left(x\right)={\displaystyle \frac{1}{T_x}}{\displaystyle \sum _{t=1}^{T_x}}{c}_t\left(x\right)$$

(5)

For each enrolled speaker s, the official bona fide enrollment utterances were used to estimate a speaker-conditioned MFCC reference. For coefficient k, the enrollment mean, and standard deviation were computed as:

$${\mu }_{s,k}^{\left(M\right)}={\displaystyle \frac{1}{E_s}}{\displaystyle \sum _{e=1}^{E_s}}{\overline{c}}_k\left(x_{s,e}\right)$$

(6)

$${\sigma }_{s,k}^{\left(M\right)}=\sqrt{{\displaystyle \frac{1}{E_s}}{\displaystyle \sum _{e=1}^{E_s}}{\left[{\overline{c}}_k\left(x_{s,e}\right)-{\mu }_{s,k}^{\left(M\right)}\right]}^2}$$

(7)

The test utterance was standardized coefficient-wise relative to the claimed speaker’s enrollment profile:

$$z_k^{\left(M\right)}\left(x,s\right)={\displaystyle \frac{{\overline{c}}_k\left(x\right)-{\mu }_{s,k}^{\left(M\right)}}{{\sigma }_{s,k}^{\left(M\right)}}}$$

(8)

The resulting MFCC anomaly score was defined as the root-mean-square standardized deviation across the 20 coefficients:

$$S_M\left(x,s\right)=\sqrt{{\displaystyle \frac{1}{20}}{\displaystyle \sum _{k=1}^{20}}{\left[z_k^{\left(M\right)}\left(x,s\right)\right]}^2}$$

(9)

Higher S_M values indicate greater spectral-envelope deviation from the bona fide enrollment characteristics of the claimed speaker. This speaker-conditioned formulation was fixed using development data and was subsequently applied unchanged to the independent evaluation partition.

Figure 1 illustrates the MFCC extraction procedure for deterministically selected bona fide and spoof utterances from the ASVspoof 2019 LA development partition. The visualization presents the waveform, log-Mel representation, and resulting MFCCs using the same frozen signal-processing parameters employed in the experimental pipeline. The figure is included to illustrate the spectral representation and does not constitute a standalone performance result.

Figure 1. MFCC-based spectral representation for deterministically selected ASVspoof 2019 LA development utterances.

Local jitter was estimated using a Praat-compatible PointProcess procedure implemented through Parselmouth. For each utterance, periodic glottal pulses were detected using a pitch floor of 75 Hz and a pitch ceiling of 500 Hz. The admissible period range was consequently constrained using a minimum period of 0.8/f_max, a maximum period of 1.25/f_min, and a maximum period factor of 1.3. Local jitter was then computed from the cycle-to-cycle variation in consecutive admissible fundamental periods. The number of detected pulses was retained as an auxiliary reliability descriptor but was not directly included in the final fusion score.

Because absolute jitter values vary considerably between speakers, the detector did not use the raw local-jitter value as the authenticity score. Instead, a speaker-conditioned anomaly score was derived from the official bona fide enrollment utterances. Local jitter was first transformed to the logarithmic domain, after which the enrollment distribution for each speaker was summarized using its median and median absolute deviation (MAD). The robust scale was defined as 1.4826 MAD, with the standard deviation used as a fallback when the MAD-based scale became numerically inadequate. For a test utterance, the jitter anomaly score was defined as the absolute standardized deviation of its log-jitter value from the corresponding speaker-specific enrollment center. Higher scores therefore indicate stronger deviation from the enrolled speaker’s habitual cycle-to-cycle pitch-period variability.

Let T_i denote the duration of the i-th admissible fundamental period detected by the Praat-compatible PointProcess procedure, with N representing the number of accepted periods. The local jitter is defined as the mean absolute difference between consecutive periods normalized by the mean period:

$$J_{\mathit{local}}={\displaystyle \frac{\frac{1}{N-1}{\displaystyle {\sum }_{i=1}^{N-1}}\left|T_i-T_{i+1}\right|}{\frac{1}{N}{\displaystyle {\sum }_{i=1}^N}{T}_i}}$$

(10)

To reduce the influence of the strongly skewed raw jitter distribution, the local-jitter value was transformed to the logarithmic domain:

y(x) = ln(J_local(x))

(11)

For each enrolled speaker s, a robust reference center was estimated exclusively from the corresponding bona fide enrollment utterances:

$$m_s=\mathit{median}\left({\left\{y_{s,e}\right\}}_{e=1}^{E_s}\right)$$

(12)

where E_s denotes the number of enrollment utterances available for speaker s. The corresponding robust scale was computed as

$${\sigma }_s^J=1.4826 \mathit{median} \left(\left|y_{s, e}-m_s\right|\right)$$

(13)

When the median-absolute-deviation scale was numerically insufficient, ${\sigma }_s^J$ was replaced by the standard deviation of the enrollment log-jitter values. Consistently with Equation (11), the speaker-conditioned jitter anomaly score assigned to test utterance x was defined as the absolute standardized deviation of its log-transformed local-jitter value from the speaker-specific enrollment center:

$$S_J\left(x, s\right)={\displaystyle \frac{\left|y\left(x\right)-m_s\right|}{{\sigma }_s^J}}={\displaystyle \frac{\left|\ln \left(J_{\mathit{local}}\left(x\right)\right)-m_s\right|}{{\sigma }_s^J}}$$

(14)

Higher S_J values indicate stronger deviation from the local-jitter behavior observed in the bona fide enrollment recordings of the claimed speaker. Importantly, the detector therefore evaluates deviation from a speaker-specific reference rather than whether synthetic speech necessarily exhibits either higher or lower raw jitter than bona fide speech.

Figure 2 illustrates the local-jitter extraction procedure for representative bona fide and spoof utterances selected from the ASVspoof 2019 LA development partition. The visualization shows the corresponding speech waveforms together with the detected periodic pulses used for local-jitter estimation. The raw jitter values are presented only to illustrate the signal-processing stage, whereas the operational detector uses the speaker-conditioned standardized log-jitter anomaly score defined in Equation (14).

Figure 2. Illustration of local-jitter estimation for deterministically selected ASVspoof 2019 LA development utterances.

Fundamental-frequency behavior was analyzed as a complementary speaker-conditioned micro-prosodic descriptor. The pitch trajectory was estimated using the Praat autocorrelation method implemented through Parselmouth, with a temporal step of 10 ms, a pitch floor of 75 Hz, and a pitch ceiling of 500 Hz. Unvoiced observations were excluded from the computation of the primary pitch descriptors.

For each utterance, four pitch-related quantities were retained in the operational feature vector: mean fundamental frequency, standard deviation of the voiced fundamental-frequency values, coefficient of variation, and the root-mean-square (RMS) frame-to-frame pitch variation. The fraction of voiced observations was retained only as a diagnostic quantity and was not incorporated into the final pitch anomaly score or the frozen fusion.

$${\mu }_{F_0}={\displaystyle \frac{1}{M}}{\displaystyle \sum _{m=1}^M}{F}_0\left(m\right)$$

(15)

where M is the number of valid voiced observations.

$${\sigma }_{F_0}=\sqrt{{\displaystyle \frac{1}{M}}{\displaystyle \sum _{m=1}^M}{\left(F_0\left(m\right)-{\mu }_{F_0}\right)}^2}$$

(16)

$$C{V}_{F_0}={\displaystyle \frac{{\sigma }_{F_0}}{{\mu }_{F_0}}}$$

(17)

And the RMS temporal variation is

$$R_{{∆F}_0}=\sqrt{{\displaystyle \frac{1}{M-1}}{\displaystyle \sum _{m=1}^{M-1}}{\left[F_0\left(m+1\right)-F_0\left(m\right)\right]}^2}$$

(18)

Accordingly, the utterance-level pitch representation used by the operational implementation was defined as

$$p\left(x\right)={\left[{\mu }_{F_0}, {\sigma }_{F_0},C{V}_{F_0},R_{∆F_0}\right]}^T$$

(19)

As in the other speaker-conditioned branches, the raw descriptor vector was not compared using a universal threshold. For each enrolled speaker s, the mean ${\mu }_s^{\left(p\right)}$ and standard deviation ${\sigma }_s^{\left(p\right)}$ of each pitch descriptor were estimated from the corresponding official bona fide enrollment utterances. The pitch anomaly score for test utterance x was defined as the RMS standardized deviation.

$$S_p\left(x,s\right)=\sqrt{{\displaystyle \frac{1}{4}}{\displaystyle \sum _{k=1}^4}{\left({\displaystyle \frac{p_k\left(x\right)-{\mu }_{s,k}^p}{{\sigma }_{s,k}^{\left(p\right)}}}\right)}^2 }$$

(20)

Higher S_p values indicate stronger deviation from the pitch behavior represented by the claimed speaker’s enrollment recordings. This formulation does not assume that spoofed speech necessarily exhibits lower or higher raw fundamental-frequency variability; instead, it measures departure from the speaker-specific bona fide reference.

Figure 3 illustrates the frozen pitch-extraction procedure for the same deterministically selected bona fide and spoof utterances from the ASVspoof 2019 LA development partition. The waveform and corresponding fundamental-frequency trajectory are presented together with the utterance-level pitch statistics used to construct the speaker-conditioned descriptor. The figure is intended to illustrate the feature-extraction procedure rather than to demonstrate standalone spoof separability.

Figure 3. Fundamental-frequency analysis for deterministically selected ASVspoof 2019 LA development utterances.

Waveform-level anomaly analysis was implemented using a speaker-conditioned PCA reconstruction model trained exclusively on the official bona fide enrollment utterances of the claimed speaker. Each waveform was converted to mono at 16 kHz, its utterance-level direct-current component was removed, and it was segmented into overlapping 25 ms frames with a 10 ms hop. The mean value of each frame was subsequently removed. To reduce the influence of silence and very-low-energy regions, frames were retained as active when their root-mean-square energy was no more than 40 dB below the maximum frame energy of the corresponding utterance.

For each enrolled speaker, the active frames from all official enrollment utterances were concatenated to construct the speaker-specific PCA reference. Eigendecomposition of the enrollment covariance matrix was performed, and the smallest number K_s of principal components whose cumulative explained variance reached at least 95% was retained. No evaluation utterance was used to estimate the PCA basis or its dimensionality.

Let x_i ∈ R^L denote the i-th active test frame and μ_s the mean enrollment frame of speaker s. Using the speaker-specific PCA basis $U_s\in R^{K_s\times L}$, the centered test frame is reconstructed as:

$${\widehat{x}}_{i,s}=\left[\left(x_i-{\mu }_s\right)U_s^T\right]U_s$$

(21)

The corresponding frame-level reconstruction error is

$$e_{i,s}={\displaystyle \frac{1}{L}}‖\left(x_i-{\mu }_s\right)-{ {\widehat{x}}_{i,s}‖}_2^2$$

(22)

For a test utterance containing N_x active frames, the PCA anomaly score is defined as the mean reconstruction error:

$$S_{\mathit{PCA}}\left(x,s\right)={\displaystyle \frac{1}{N_x}}{\displaystyle \sum _{i=1}^{N_x}}{e}_{i,s}$$

(23)

Higher S_PCA values indicate a larger waveform-level reconstruction mismatch relative to the speaker-specific bona fide enrollment subspace. However, PCA reconstruction error was treated as an independently evaluated anomaly descriptor rather than as definitive evidence of spoofing. Development-set analysis did not support its inclusion in the frozen final fusion; it was therefore retained exclusively for component-level and ablation analysis.

Figure 4 illustrates the speaker-conditioned PCA reconstruction procedure for the same deterministically selected bona fide and spoof utterances from the ASVspoof 2019 LA development partition. The figure shows the original waveforms, active centered frames, their PCA reconstructions, and the resulting residuals. This visualization is intended to demonstrate the reconstruction mechanism and should not be interpreted as evidence that the PCA score alone provides reliable bona fide-spoof discrimination.

Figure 4. Speaker-conditioned PCA reconstruction analysis for deterministically selected ASVspoof 2019 LA development utterances.

3.5. Hierarchical Decision and Frozen Score Fusion

The proposed decision architecture operates hierarchically. The ECAPA-TDNN score defined in Equation (3) is evaluated first as an identity gate. Trials with S_ASV(x, s) < τ_ASV are rejected immediately. Only trials satisfying the frozen speaker-verification criterion in Equation (4) are forwarded to the authenticity-analysis stage. This separation allows identity errors and spoof-related errors to be quantified independently.

The second stage combines the speaker-conditioned MFCC, pitch, and jitter anomaly scores defined in Equations (9), (20) and (14), respectively. PCA reconstruction error was evaluated independently but was not retained in the final fusion. Because the three retained components have different numerical ranges and statistical distributions, their raw values were not averaged directly. Instead, each score was transformed into an empirical percentile relative exclusively to the corresponding development target bona fide distribution.

Let S_c(x,s) denote the raw anomaly score for component c ∈ {M,P,J}, corresponding to MFCC, pitch, and jitter, and let $\{S_{c, i}^{\mathit{dev}}{\}}_{i=1}^N$ denote the sorted scores obtained from development target trials that passed the frozen ASV gate. In the present protocol, N_T = 1465. The empirical target-reference percentile is defined as:

$$Q_c\left(x,s\right)={\displaystyle \frac{\#\left\{i:S_{c,i}^{\mathit{dev}}<S_c\left(x,s\right)\right\}+0.5}{N_T+1}}$$

(24)

Higher percentile values therefore indicate stronger deviation relative to the bona fide target distribution observed during development. The same frozen development reference arrays were used unchanged for all evaluation trials.

The final authenticity-fusion score is the unweighted arithmetic mean of the three normalized component scores:

$$S_F\left(x,s\right)={\displaystyle \frac{Q_M\left(x,s\right)+Q_P\left(x, s\right)+Q_J(x, s)}{3}}$$

(25)

Equal weighting was adopted as an a priori design choice after percentile normalization rather than as an empirically optimal weighting scheme. Because the three retained scores are mapped to the same development-target percentile scale, assigning identical weights preserves a direct and transparent contribution from each descriptor, introduces no additional trainable fusion parameters, and reduces the risk of adapting the fusion backend to idiosyncrasies of the development attacks. The choice, therefore, reflects the interpretability and parsimony objectives of the proposed framework rather than a claim that equal weighting maximizes spoof-discrimination performance. No fusion weight was modified after evaluation results became available. Three predefined component subsets were compared on the development partition: MFCC + jitter, MFCC + pitch + jitter, and MFCC + PCA + pitch + jitter. Candidate operating points were constrained by a predefined maximum end-to-end target FRR of 5%. Under this development-only criterion, the MFCC + pitch + jitter configuration was selected and frozen before evaluation. The resulting development-selected fusion threshold was

τ_F = 0.8304911323

(26)

The final hierarchical decision is, therefore,

$$D\left(x,s\right)=\left\{\begin{array}{c}\mathit{REJEC}{T}_{\mathit{identity}}, S_{\mathit{ASV}}\left(x,s\right)<{\tau }_{\mathit{ASV}}\\ \mathit{REJEC}{T}_{\mathit{authenticity}}, S_{\mathit{ASV}}\left(x,s\right)\ge {\tau }_{\mathit{ASV}} \mathit{and} S_F\left(x,s\right)\ge {\tau }_F\\ \mathit{ACCEPT}, S_{\mathit{ASV}}\left(x,s\right)\ge {\tau }_{\mathit{ASV}} \mathit{and} S_F\left(x,s\right)<{\tau }_F\end{array}\right.$$

(27)

Both τ_ASV = 0.4152109027 and τ_F = 0.8304911323, together with the component definitions and the development-target empirical normalization references, were frozen before the independent evaluation partition was processed. No threshold, feature formulation, component subset, or fusion weight was changed after evaluation results became available.

To examine the sensitivity of this design choice, two alternative fusion strategies were subsequently evaluated as post hoc analyses requested during peer review, without redefining the primary frozen system. First, a convex weighted mean was considered over the three normalized MFCC, pitch, and jitter scores, with non-negative weights constrained to sum to one and searched on a 0.1 grid using development data only. Second, an L₂-regularized logistic-regression fusion was trained on development target and spoof trials using the same three normalized scores. For both alternatives, all fusion parameters and operating thresholds were selected exclusively on development data under the same maximum end-to-end target-FRR constraint of 5% and were then applied unchanged to evaluation. Evaluation data were not used to select weights, train the logistic model, or determine operating thresholds.

Algorithm 1 summarizes the operational inference procedure after development-based calibration has been completed and all model components, normalization references, and decision thresholds have been frozen. The algorithm explicitly separates speaker-identity rejection from second-stage authenticity rejection and excludes PCA from the deployed fusion because PCA is retained only for ablation analysis.

Algorithm 1. Frozen Hierarchical Voice Authentication and Spoof Detection

Input:     - Claimed speaker s and official bona fide enrollment utterances Es     - Test utterance x (mono, 16 kHz)     - Frozen ECAPA-TDNN embedding model     - Speaker-conditioned MFCC, pitch, and jitter scoring procedures     - Sorted development-target reference score arrays RM, RP, and RJ     - Frozen thresholds: τASV = 0.4152109027 and τF = 0.8304911323 Output:     - Final decision D ∈ {ACCEPT, REJECTidentity, REJECTauthenticity}     - Scores SASV, SM, SP, SJ, QM, QP, QJ, and SF 1: Extract and L2-normalize the ECAPA-TDNN embedding of each enrollment utterance in Es. 2: Average the normalized enrollment embeddings and L2-normalize the resulting speaker-reference vector. 3: Extract and L2-normalize the ECAPA-TDNN embedding of test utterance x. 4: Compute cosine speaker similarity SASV(x,s). 5: If SASV(x,s) < τASV: 6:        Return REJECT_identity. 7: Compute the speaker-conditioned MFCC anomaly score SM(x,s). 8: Compute the speaker-conditioned pitch anomaly score SP(x,s). 9: Compute the speaker-conditioned jitter anomaly score SJ(x,s). 10: For each component c ∈ {M, P, J}: 11:        Set pc = searchsorted(Rc, Sc(x,s), side = right). $12: \mathrm{Compute} Q_c(x,s)={\displaystyle \frac{p_c+0.5}{\left|R_c\right|+ 1}}$. $13: \mathrm{Compute} S_F(x,s)={\displaystyle \frac{Q_M(x,s)+ Q_P(x,s)+ Q_J(x,s)}{3}}$. 14: If SF(x,s) ≥ τF: 15:        Return REJECT_authenticity. 16: Else: 17:        Return ACCEPT.

PCA reconstruction error is intentionally omitted from Algorithm 1 because it is evaluated only as an ablation component and does not contribute to the frozen operational decision.

3.6. External AASIST Anti-Spoofing Baseline

To provide a direct comparison with an established neural anti-spoofing method, the proposed interpretable authenticity stage was additionally evaluated against AASIST. The publicly released pretrained AASIST model [18] for the ASVspoof 2019 Logical Access condition was used without retraining, fine-tuning, or modification of its learned parameters [33]. The baseline therefore represents an established supervised, in-domain anti-spoofing system rather than a training-budget-matched alternative to the proposed hand-crafted speaker-conditioned descriptors.

AASIST was evaluated on the same trials that passed the frozen ECAPA-TDNN identity gate and therefore operated on the same conditional Stage-2 population used for the MFCC, pitch, jitter, PCA, and fusion analyses. Audio was processed at 16 kHz using the official AASIST evaluation input length of 64,600 samples. Shorter utterances were repeat-padded to the required length, whereas longer utterances were truncated according to the reference evaluation procedure. Frequency augmentation was disabled during inference. The model’s bona fide output logit was retained as the native AASIST score; for consistency with the anomaly score convention used elsewhere in this study, its sign was reversed so that larger values indicated stronger spoof evidence.

The AASIST operating threshold was selected exclusively on the ASVspoof 2019 LA development Stage-2 trials. The same predefined constraint used for the proposed hierarchy was imposed: the complete ASV+AASIST system was required to maintain an end-to-end target FRR not exceeding 5% on development data. Among operating points satisfying this constraint, the threshold minimizing development spoof acceptance was selected. This yielded a frozen AASIST anomaly threshold of −3.165504932404, equivalent to a native bona fide-score threshold of 3.165504932404. The threshold was subsequently applied unchanged to the evaluation partition. No AASIST threshold, network parameter, preprocessing rule, or score transformation was adjusted after evaluation results became available.

4. Experimental Results and Analysis

Following development-set calibration and configuration freezing, the complete hierarchical system was evaluated on the independent ASVspoof 2019 LA evaluation partition without modifying any feature formulation, normalization reference, decision threshold, or fusion component. Results are reported first at the frozen operating points and are subsequently complemented by discrimination analysis, component ablation, confidence intervals, and attack-specific evaluation. This organization distinguishes the operational authentication performance of the complete system from descriptive threshold-independent measures such as ROC-AUC and EER.

4.1. Development Calibration and Independent Evaluation Performance

On the development partition, calibration of the ECAPA-TDNN identity stage produced the frozen threshold τ_ASV = 0.4152109027. At this operating point, the target FRR was 1.2803%, while the bona fide non-target FAR was 1.2483%. Among the 22,296 development spoof trials, 8755 passed the ASV gate, corresponding to an ASV-only spoof acceptance rate of 39.2671%.

The development-selected MFCC + pitch + jitter fusion, operating at the frozen threshold τ_F = 0.8304911323, rejected an additional 704 of the 8755 spoof trials that had passed speaker verification, corresponding to a Stage-2 detection rate of 8.0411% within the ASV-passed spoof subset. The resulting end-to-end development target FRR was 4.9865%, the bona fide non-target FAR was 0.6935%, and the final spoof acceptance rate was 36.1096%.

The frozen configuration was then applied unchanged to the independent evaluation partition. The ECAPA-TDNN stage rejected 31 of 5370 target trials, yielding a target FRR of 0.5773%, while 351 of 33,327 bona fide non-target trials were accepted, corresponding to a FAR of 1.0532%. For spoof trials, 42,283 of 63,882 presentations passed the ASV gate, giving an ASV-only spoof acceptance rate of 66.1892%.

The frozen authenticity stage rejected a further 4769 of these 42,283 ASV-passed spoof trials, corresponding to an 11.2788% Stage-2 rejection rate within this subset. The complete hierarchical system therefore accepted 37,514 of 63,882 spoof trials, resulting in a final spoof acceptance rate of 58.7239%. At the same operating point, 258 of 5370 target trials were rejected by the complete system, giving an observed end-to-end target FRR of 4.8045%, while 256 of 33,327 bona fide non-target trials were accepted, yielding a final non-target FAR of 0.7681%. Thus, the observed evaluation target FRR remained below the predefined 5% operating constraint while the authenticity stage reduced spoof acceptance beyond the ASV-only baseline.

Table 2 summarizes the frozen operating-point results on the development and independent evaluation partitions, highlighting the contribution of the second-stage authenticity analysis relative to the ASV-only baseline. Stage-2 rejection is calculated only among spoof trials that passed the frozen ECAPA-TDNN identity gate. The evaluation configuration was not recalibrated after development.

Table 2. Development and independent evaluation performance at the frozen operating points.

Split	System	Target FRR (%)	Non-Target FAR (%)	Spoof Acceptance (%)	Stage-2 Rejection Among ASV-Passed Spoof (%)
Development	ASV only	1.2803	1.2483	39.2671	—
Development	ASV + frozen fusion	4.9865	0.6935	36.1096	8.0411
Evaluation	ASV only	0.5773	1.0532	66.1892	—
Evaluation	ASV + frozen fusion	4.8045	0.7681	58.7239	11.2788

4.2. ROC-AUC and EER Analysis

To complement the frozen operating-point analysis, threshold-independent discrimination was assessed using ROC-AUC and EER. For the ECAPA-TDNN identity stage, the analysis was performed between target and bona fide non-target trials. For the second-stage acoustic components, the analysis was performed between target bona fide and spoof trials that had passed the frozen ASV gate. The corresponding EER thresholds were computed only as descriptive evaluation statistics and were not used to modify the deployed operating points.

The ECAPA-TDNN identity stage provided strong separation between target and bona fide non-target evaluation trials, with an ROC-AUC of 0.999402 and an EER of 0.7628%. Among the second-stage authenticity descriptors, MFCC provided the strongest standalone global discrimination, achieving an ROC-AUC of 0.653055 and an EER of 39.6694%. Jitter achieved an ROC-AUC of 0.591061, whereas pitch and PCA remained close to chance-level global discrimination, with ROC-AUC values of 0.492133 and 0.494421, respectively.

The frozen MFCC + pitch + jitter fusion achieved an ROC-AUC of 0.604293 and an EER of 42.5144%. Therefore, the fusion did not outperform MFCC as a threshold-independent binary discriminator. Its role in the final system should instead be interpreted in relation to the prospectively defined operating constraint and the end-to-end authentication trade-off analyzed in the subsequent ablation experiment. This distinction is important because the final fusion was selected on development data under an end-to-end target-FRR constraint rather than by maximizing evaluation ROC-AUC.

For external comparison, the pretrained AASIST anti-spoofing model [18] was evaluated on the same ASV-passed Stage-2 population. AASIST achieved substantially stronger target bona fide versus spoof discrimination than the interpretable acoustic components and their frozen fusion, with an evaluation ROC-AUC of 0.999777 and an EER of 0.3197%. Speaker-cluster bootstrap resampling over the 48 evaluation speakers yielded a 95% confidence interval of [0.999590, 0.999904] for ROC-AUC and [0.2222%, 0.5666%] for EER. These results establish AASIST as a substantially stronger anti-spoofing discriminator under the present in-domain ASVspoof 2019 LA evaluation. However, this comparison should not be interpreted as a training-budget-matched comparison: AASIST is a supervised neural countermeasure pretrained for the ASVspoof 2019 LA condition, whereas the proposed second stage was designed around individually interpretable, speaker-conditioned acoustic anomaly descriptors.

Table 3 reports the evaluation ROC-AUC and EER values together with speaker-cluster bootstrap confidence intervals for the identity stage, the proposed interpretable authenticity components and fusion, and the external AASIST baseline. EER operating points reported in this table are descriptive evaluation statistics only. They were not used to recalibrate the frozen ASV, the proposed authenticity-stage decision threshold, or the development-selected AASIST operating threshold.

Table 3. Evaluation discrimination performance of the proposed components and the external AASIST baseline with speaker-cluster bootstrap confidence intervals.

System/ Component	Discrimination Task	ROC-AUC	95% CI	EER (%)	95% CI (%)
ECAPA-TDNN ASV	Target vs. bona fide non-target	0.999402	[0.998868, 0.999813]	0.7628	[0.4615, 1.0788]
MFCC	Target bona fide vs. spoof	0.653055	[0.610045, 0.695222]	39.6694	[36.0230, 43.0585]
PCA	Target bona fide vs. spoof	0.494421	[0.472297, 0.516022]	50.4571	[48.8499, 52.3258]
Pitch	Target bona fide vs. spoof	0.492133	[0.459396, 0.521871]	50.2712	[48.0536, 52.8472]
Jitter	Target bona fide vs. spoof	0.591061	[0.576193, 0.605412]	43.5661	[42.5251, 44.6394]
Frozen fusion	Target bona fide vs. spoof	0.604293	[0.578635, 0.631821]	42.5144	[40.3029, 44.4841]
AASIST external baseline	Target bona fide vs. spoof	0.999777	[0.999590, 0.999904]	0.3197	[0.2222, 0.5666]

Figure 5 presents the evaluation ROC curves for the proposed system and its constituent components; the external AASIST baseline is reported numerically in Table 3 to preserve the visibility of the substantially lower-performing interpretable curves. The two panels are shown separately because the ECAPA-TDNN identity stage and the second-stage authenticity analysis address different discrimination tasks. Figure 5a represents target versus bona fide non-target speaker verification, whereas Figure 5b compares target bona fide and spoof trials within the ASV-passed Stage-2 population.

Figure 5. Receiver operating characteristic analysis on the independent ASVspoof 2019 LA evaluation partition: (a) ECAPA-TDNN speaker-verification discrimination between target and bona fide non-target trials; (b) Stage-2 discrimination between target bona fide and spoof trials for MFCC, PCA, pitch, jitter, and the frozen MFCC + pitch + jitter fusion.

4.3. Component, Fusion, and External-Baseline Comparison

To determine the contribution of each authenticity component to end-to-end authentication performance, an ablation analysis was performed using the development-frozen operating threshold associated with each standalone descriptor. No threshold was recalibrated on the evaluation partition. Each proposed configuration retained the same ECAPA-TDNN identity gate, while the second stage consisted of either a single acoustic component or the frozen MFCC + pitch + jitter fusion. For external comparison, the pretrained AASIST countermeasure was also placed after the same frozen ECAPA-TDNN identity gate and evaluated on the identical ASV-passed Stage-2 population. Its operating threshold was selected exclusively on development data under the same predefined end-to-end target-FRR constraint and was then applied unchanged to evaluation.

MFCC produced the largest reduction in spoof acceptance when used independently, decreasing the evaluation spoof acceptance rate from 66.1892% for ASV alone to 47.7944%. However, this configuration increased the target FRR to 7.2812%, exceeding the predefined 5% operating constraint. The standalone pitch configuration similarly exceeded the constraint, with a target FRR of 6.8529%.

PCA maintained a target FRR below 5% but provided only a limited reduction in spoof acceptance, from 66.1892% to 63.6674%. Jitter provided a more favorable operating-point trade-off, reducing spoof acceptance to 59.3156% while maintaining an observed target FRR of 3.6872%. The frozen MFCC + pitch + jitter fusion produced an observed target FRR of 4.8045%, a bona fide non-target FAR of 0.7681%, and a spoof acceptance rate of 58.7239%.

The external AASIST baseline exhibited a markedly different operating profile. Using its development-selected threshold, AASIST rejected 42,265 of the 42,283 spoof trials that had passed the frozen ASV gate, corresponding to a Stage-2 spoof-detection rate of 99.9574%. The resulting end-to-end system achieved a target FRR of 4.0968%, a bona fide non-target FAR of 0.9992%, and a spoof acceptance rate of 0.0282%. Relative to the ASV-only spoof acceptance rate of 66.1892%, the ASV+AASIST configuration reduced spoof acceptance by 66.1610 percentage points.

Among the proposed interpretable configurations whose observed target FRR remained within the predefined constraint, the frozen MFCC + pitch + jitter fusion produced the lowest spoof acceptance rate. However, the external AASIST baseline substantially outperformed all proposed interpretable configurations in spoof discrimination and end-to-end spoof rejection while also maintaining an observed evaluation target FRR below 5%. This result confirms that the principal contribution of the proposed framework is not state-of-the-art anti-spoofing accuracy, but rather the explicit separation of speaker identity and authenticity decisions together with speaker-conditioned, individually interpretable acoustic evidence. The comparison also illustrates the performance gap between the proposed transparent anomaly-based design and a supervised neural anti-spoofing countermeasure trained for the ASVspoof 2019 LA domain.

Table 4 summarizes the evaluation results for the ASV-only configuration, the individual interpretable authenticity components, the frozen proposed fusion, and the external AASIST baseline. All second-stage operating thresholds were selected using development data only and were applied unchanged to the evaluation partition. Stage-2 rejection is calculated only among spoof trials that passed the frozen ASV gate. The predefined development constraint required the end-to-end target FRR not to exceed 5%.

Table 4. Evaluation comparison of the proposed hierarchical configurations and the external AASIST baseline using development-selected operating thresholds.

Configuration	Target FRR (%)	Non-Target FAR (%)	Spoof Acceptance (%)	Stage-2 Rejection Among ASV-Passed Spoof (%)
ASV only	0.5773	1.0532	66.1892	—
ASV + MFCC	7.2812	0.6301	47.7944	27.7913
ASV + PCA	3.1844	1.0262	63.6674	3.8100
ASV + Pitch	6.8529	0.8342	63.1023	4.6638
ASV + Jitter	3.6872	0.8312	59.3156	10.3848
ASV + frozen fusion	4.8045	0.7681	58.7239	11.2788
ASV + AASIST external baseline	4.0968	0.9992	0.0282	99.9574

4.4. Fusion-Weight Sensitivity Analysis

A post hoc sensitivity analysis was performed to assess whether the original equal-weight fusion was strongly dependent on its weighting assumption. The primary frozen system was not modified. Two alternatives were defined using development data only: a convex weighted mean over the normalized MFCC, pitch, and jitter scores and an L₂-regularized logistic-regression fusion. For each alternative, the fusion parameters and operating threshold were determined exclusively from development data under the same predefined end-to-end target-FRR constraint of 5%, after which the resulting configuration was applied unchanged to the evaluation partition.

For the convex strategy, 66 non-negative weight combinations with a grid resolution of 0.1 and unit weight sum were evaluated. Development-set selection yielded weights of 0.2 for MFCC, 0.0 for pitch, and 0.8 for jitter, with an operating threshold of 0.899113. The resulting evaluation ROC-AUC was 0.613132 and the EER was 42.3295%. At the selected operating point, the end-to-end target FRR was 4.5438%, the bona fide non-target FAR was 0.8072%, and the spoof acceptance rate was 56.6435%.

The development-trained logistic fusion assigned coefficients of 0.9338, 0.0598, and 0.9907 to the normalized MFCC, pitch, and jitter scores, respectively, with an intercept of −1.0825. Its development-selected operating threshold was 0.663664. On evaluation, this strategy achieved an ROC-AUC of 0.641147 and an EER of 40.6671%, together with an end-to-end target FRR of 3.7430%, a non-target FAR of 0.7952%, and a spoof acceptance rate of 56.3977%.

Both alternative strategies therefore reduced spoof acceptance relative to the original equal-weight fusion, which yielded 58.7239%, while the logistic fusion also provided the strongest threshold-independent discrimination among the three fusion variants. Equal weighting should consequently not be interpreted as empirically optimal. Its retention as the primary system reflects the prospectively frozen protocol and the design objective of maintaining a simple, non-learned, directly interpretable score combination. The sensitivity analysis indicates that moderate performance gains are possible through development-trained weighting, but these gains introduce additional optimization or learned fusion parameters and remain substantially smaller than the performance difference observed relative to the external AASIST baseline.

Table 5 summarizes the evaluation performance of the original equal-weight fusion and the two alternative fusion strategies. All parameters specific to the alternative strategies, including convex weights, logistic-regression coefficients, and operating thresholds, were determined exclusively from development data and were subsequently applied unchanged to the evaluation partition. The comparison is therefore intended as a sensitivity analysis of the fusion design rather than as a retrospective re-selection of the primary operational system.

Table 5. Sensitivity of evaluation performance to alternative fusion strategies selected exclusively on development data.

Fusion Strategy	Evaluation ROC-AUC	EER (%)	Target FRR (%)	Non-Target FAR (%)	Spoof Acceptance (%)	Stage-2 Spoof Rejection (%)
Equal-weight fusion (primary frozen system)	0.604293	42.5144	4.8045	0.7681	58.7239	11.2788
Development-optimized convex fusion	0.613132	42.3295	4.5438	0.8072	56.6435	14.4219
Development-learned logistic fusion	0.641147	40.6671	3.7430	0.7952	56.3977	14.7932

4.5. Statistical Confidence and Attack-Specific Analysis

To quantify uncertainty at the frozen operating point, 95% Wilson confidence intervals were computed for the principal end-to-end proportions. On the independent evaluation partition, the complete system achieved a target FRR of 4.8045% with a 95% confidence interval of [4.2641%, 5.4095%], a bona fide non-target FAR of 0.7681% [0.6799%, 0.8677%], and a spoof acceptance rate of 58.7239% [58.3416%, 59.1051%]. The observed target FRR was therefore below the predefined 5% development constraint; however, because the upper confidence bound exceeds 5%, these results should not be interpreted as establishing a population-level FRR below 5%.

The aggregate spoof acceptance rate masks substantial variation across attack conditions. The independent ASVspoof 2019 LA evaluation partition contains conditions A07–A19. Eleven of these correspond to spoofing systems not represented among the development attacks, whereas A16 and A19 are known-reference systems using the same underlying algorithms as development attacks A04 and A06, respectively [27]. The evaluation set spans conventional and neural TTS systems, TTS-sourced conversion pipelines, and human-source voice-conversion systems employing substantially different acoustic models and waveform-generation mechanisms. Attack-specific analysis therefore provides information about how the frozen hierarchy responds to heterogeneous synthesis and conversion mechanisms rather than treating the evaluation spoof population as a homogeneous class. For each attack, the final end-to-end spoof acceptance rate was computed at the frozen operating point, while the Stage-2 fusion score was independently characterized using ROC-AUC and speaker-cluster bootstrap confidence intervals.

The results reveal pronounced attack dependence. The complete system was comparatively effective against A09, A17, A18, and A19, for which final spoof acceptance rates were 1.1803%, 1.5873%, 4.1921%, and 13.8584%, respectively. In contrast, A10, A11, A12, A15, and A16 remained substantially more challenging, with final spoof acceptance rates above 86%. These results indicate that the interpretable acoustic descriptors capture some spoof-generation artifacts effectively but do not provide uniform protection across unseen synthesis and conversion conditions.

The attack-specific ROC-AUC analysis further illustrates this variability. The fusion achieved strong discrimination for A07, A08, A09, A14, A17, A18, and A19, while performance deteriorated markedly for several other conditions. A12 and A16 produced ROC-AUC confidence intervals whose upper bounds remained below 0.5, indicating systematic score inversion for these attacks under the frozen Stage-2 representation. A15 also yielded a low point estimate, although its confidence interval included the 0.5 chance level. These conditions therefore represent concrete failure modes rather than random variation around the aggregate result.

Table 6 reports the attack-specific evaluation results for the complete hierarchical system and the frozen Stage-2 fusion score together with the principal generation characteristics of each evaluation attack. Spoof acceptance is measured end-to-end using the frozen ASV and fusion thresholds. ROC-AUC characterizes Stage-2 target bona fide versus spoof discrimination for trials reaching the authenticity stage. Confidence intervals for ROC-AUC were obtained using speaker-cluster bootstrap resampling. The attack-generation characteristics are summarized from the official ASVspoof 2019 description [27].

Table 6. Attack-specific spoof acceptance, frozen-fusion discrimination, and principal generation characteristics for ASVspoof 2019 LA evaluation conditions A07–A19.

Attack	Generation Characteristic	Final Spoof Acceptance (%)	Fusion ROC-AUC	95% Bootstrap CI
A07	TTS; Recurrent Neural Network (RNN) acoustic/duration models; MCC/F0; WORLD followed by Generative Adversarial Network (GAN)-based waveform post-filtering	64.6113	0.842981	[0.812001, 0.871839]
A08	TTS; autoregressive RNN acoustic model; Mel-Cepstral Coefficients (MCC)/F0; neural source-filter waveform model	63.1461	0.830238	[0.806410, 0.853824]
A09	TTS; RNN acoustic/duration models; MCC/F0; Vocaine waveform generation	1.1803	0.910867	[0.874205, 0.950555]
A10	TTS; attention-based acoustic model with d-vector speaker conditioning; Mel-spectrogram; WaveRNN	93.1420	0.526274	[0.499377, 0.555789]
A11	TTS; attention-based acoustic model; Mel-spectrogram; Griffin-Lim waveform reconstruction	91.1884	0.590143	[0.555824, 0.626503]
A12	TTS; RNN-based modeling from F0 and linguistic features; WaveNet waveform generation	86.6300	0.416181	[0.371105, 0.461144]
A13	TTS-source voice conversion; moment-matching conversion of MCCs; waveform filtering	70.4518	0.570497	[0.528526, 0.615212]
A14	TTS-source voice conversion; ASR/RNN-based conversion; MCC/F0/Band Aperiodicity (BAP); Speech Transformation and Representation using Adaptive Interpolation of weiGHTed spectrum (STRAIGHT)	79.1412	0.771664	[0.729805, 0.811293]
A15	TTS-source voice conversion; ASR/RNN-based conversion; MCC/F0; WaveNet	97.0492	0.461458	[0.409242, 0.513605]
A16	TTS; Classification and Regression Tree (CART)-based acoustic modeling; MFCC/F0; waveform concatenation; known-reference algorithm corresponding to A04	97.2324	0.390063	[0.359200, 0.424620]
A17	Human-source voice conversion; Variational Autoencoder (VAE)-based conversion; MCC/F0; waveform filtering	1.5873	0.737384	[0.597199, 0.803846]
A18	Human-source voice conversion; MFCC/i-vector and Probabilistic Linear Discriminant Analysis (PLDA)-based conversion; MFCC vocoder	4.1921	0.79318	[0.717293, 0.846342]
A19	Human-source voice conversion; Gaussian Mixture Model-Universal Background Model (GMM-UBM) conversion; Linear Predictive Coding (LPC); spectral filtering and overlap-add; known-reference algorithm corresponding to A06	13.8584	0.738373	[0.680282, 0.784285]

The attack taxonomy helps interpret the substantial variation observed in Table 6. The proposed Stage-2 representation assumes that spoofed speech tends to exhibit larger speaker-conditioned spectral or micro-prosodic deviations than target bona fide speech, such that larger normalized MFCC, pitch, and jitter scores provide monotonically stronger spoof evidence. The attack-specific results demonstrate that this assumption is not uniformly valid across generation mechanisms. A09, for example, was separated effectively, with a fusion ROC-AUC of 0.910867 and a final spoof acceptance rate of 1.1803%, indicating that its RNN/Vocaine synthesis pipeline produced deviations that were well aligned with the direction encoded by the frozen anomaly scores.

By contrast, A12 and A16 constitute stronger violations of the assumed anomaly direction. Their fusion ROC-AUC values were 0.416181 and 0.390063, respectively, with bootstrap confidence intervals whose upper bounds remained below 0.5. Thus, within the ASV-passed population, these spoof trials tended systematically to receive lower fusion anomaly scores than target bona fide trials rather than merely producing overlapping score distributions. A16 is particularly informative because it uses MFCC and F0 parameterization together with waveform concatenation and corresponds to a known-reference algorithm already represented by A04 during development [27]. Waveform concatenation reuses natural waveform material, and its relatively natural local spectral and periodic structure may therefore reduce the deviations targeted by the present MFCC-, pitch-, and jitter-based representation. This interpretation is consistent with the observed score inversion, although the present experiment does not isolate a single component as its causal source.

A12 similarly combines explicit F0 and linguistic modeling with WaveNet waveform generation. Its inverted fusion behavior suggests that neural waveform generation can produce signals whose selected speaker-conditioned descriptors do not follow the assumed “larger deviation implies stronger spoof evidence” direction. A15, which also employs WaveNet but within a TTS-sourced conversion pipeline, exhibited a low ROC-AUC point estimate of 0.461458; however, its confidence interval included 0.5, so this condition supports weak discrimination rather than statistically clear score inversion.

The paired attack structures further illustrate that waveform-generation choices materially affect the usefulness of the proposed descriptors. A14 and A15 use closely related TTS-sourced conversion architectures but differ in waveform generation, using STRAIGHT and WaveNet, respectively; the frozen fusion achieved substantially stronger discrimination for A14 (ROC-AUC 0.771664) than for A15 (0.461458). Likewise, A10 and A11 share a related attention-based TTS architecture but use WaveRNN and Griffin-Lim waveform generation, respectively. Both remained difficult at the frozen operating point, with final spoof acceptance above 90%, although A11 provided somewhat stronger Stage-2 ranking than A10. These contrasts suggest that the acoustic and waveform-generation path can change which artifacts remain detectable by fixed spectral and micro-prosodic descriptors. They should not, however, be interpreted as causal isolation experiments because the benchmark systems differ in more than one implementation detail.

Finally, A17–A19 use human speech as the source for voice conversion and produced comparatively low final spoof acceptance rates. Their Stage-2 ROC-AUC values also remained above chance, although to differing degrees. This indicates that the proposed representation can capture useful deviations for several conventional voice-conversion pathways, but the overall end-to-end result reflects both the initial ECAPA-TDNN identity gate and the subsequent authenticity stage. Consequently, the attack-specific results support a mechanism-dependent interpretation of the proposed detector rather than a universal claim that synthetic or converted speech necessarily exhibits increased MFCC, pitch, or jitter anomaly.

Figure 6 visualizes the attack-specific behavior of the frozen system. The upper panel compares the ASV-only and final end-to-end spoof acceptance rates across A07–A19, while the lower panel presents the corresponding Stage-2 fusion ROC-AUC values with 95% speaker-cluster bootstrap confidence intervals. The horizontal chance-reference line in the lower panel highlights attack conditions for which the fusion score provides limited or inverted discrimination.

Figure 6. Attack-specific evaluation across ASVspoof 2019 LA conditions A07–A19.

5. Discussion

The independent evaluation demonstrates that the proposed framework behaves differently when assessed as a global binary discriminator and when assessed at a prospectively selected authentication operating point. This distinction is particularly evident for the MFCC component. MFCC achieved the highest standalone Stage-2 ROC-AUC (0.653055), exceeding the frozen fusion ROC-AUC of 0.604293. However, when its development-frozen standalone threshold was embedded in the complete hierarchical system, the evaluation target FRR increased to 7.2812%, exceeding the predefined 5% constraint. The final fusion should therefore not be interpreted as the strongest global spoof discriminator. Rather, it represents the development-selected configuration that maintained the prescribed authentication operating constraint while reducing spoof acceptance relative to the ASV-only baseline.

This result also illustrates why threshold-independent metrics and operational authentication metrics should be reported jointly. ROC-AUC summarizes discrimination across the complete range of possible thresholds, whereas the deployed system operates at one fixed point selected before evaluation. In the present experiment, the complete system reduced spoof acceptance from 66.1892% for ECAPA-TDNN alone to 58.7239%, corresponding to an absolute reduction of 7.4653 percentage points. This reduction was accompanied by an increase in observed target FRR from 0.5773% to 4.8045%. Consequently, the second-stage authenticity analysis provides additional spoof rejection at a measurable usability cost rather than a uniformly dominant improvement across all error criteria.

The external AASIST comparison provides an important reference point for interpreting these results. On the same ASV-passed Stage-2 evaluation population, AASIST achieved an ROC-AUC of 0.999777 and an EER of 0.3197%, compared with 0.604293 and 42.5144%, respectively, for the frozen interpretable fusion. At its development-selected operating threshold, AASIST rejected 99.9574% of the spoof trials that passed the ASV gate and reduced the end-to-end spoof acceptance rate to 0.0282%, while producing an observed target FRR of 4.0968% and a bona fide non-target FAR of 0.9992%. By comparison, the proposed frozen fusion yielded a spoof acceptance rate of 58.7239%, a target FRR of 4.8045%, and a non-target FAR of 0.7681%. Thus, AASIST provided markedly stronger spoof discrimination and spoof rejection, although the proposed fusion yielded the lower bona fide non-target FAR at the selected operating points.

This performance gap is important for positioning the contribution of the present work. The proposed authenticity stage is not intended as a state-of-the-art replacement for supervised neural anti-spoofing systems such as AASIST. Its contribution instead lies in maintaining an explicit separation between speaker identity and speech authenticity while representing the latter through individually interpretable, enrollment-conditioned spectral and micro-prosodic deviations. Moreover, the comparison is not training-budget matched: the external AASIST baseline is a supervised neural countermeasure pretrained for the ASVspoof 2019 LA domain, whereas the proposed authenticity stage uses fixed acoustic formulations and non-learned score fusion. The results therefore quantify the detection-performance gap associated with the present transparent design rather than supporting a claim of superiority over modern learned countermeasures.

Further component analysis shows that interpretability does not imply that every physically motivated descriptor is individually discriminative. PCA reconstruction error yielded an ROC-AUC of 0.494421 and an EER of 50.4571%, providing no useful global separation between target bona fide and spoof trials in the evaluation population. Its exclusion from the final development-selected fusion is therefore consistent with the independent evaluation results. Pitch likewise showed near-chance standalone discrimination, with an ROC-AUC of 0.492133, whereas jitter retained moderate discriminative information with an ROC-AUC of 0.591061. These findings support evaluating interpretable descriptors empirically rather than assuming that synthetic speech necessarily exhibits a fixed direction of deviation in pitch instability, jitter, or waveform reconstruction error.

The attack-specific results reveal a second important limitation of aggregate metrics. Performance varied markedly across A07–A19 and depended strongly on the synthesis or conversion mechanism. A12 and A16 produced fusion ROC-AUC confidence intervals whose upper bounds remained below 0.5, demonstrating systematic inversion of the frozen anomaly score rather than merely weak separation. This directly violates the operational assumption that spoofed speech should generally produce larger speaker-conditioned spectral and micro-prosodic deviations than target bona fide speech. Conversely, conditions such as A09, A17, A18, and A19 were handled substantially more effectively, while A07, A08, and A14 illustrate that useful ranking discrimination does not necessarily translate into low spoof acceptance at one development-frozen threshold. The proposed representation should therefore be interpreted as mechanism-sensitive: it captures artifacts generated by some TTS and VC pipelines but is not invariant to the acoustic model, source-speech type, or waveform-generation procedure.

The hierarchical structure nevertheless provides diagnostic information that would be obscured by reporting only a single end-to-end error rate. Of the 63,882 evaluation spoof trials, 21,599 were rejected directly by the frozen identity stage, whereas 42,283 reached the authenticity stage. The latter population is particularly challenging because these trials already exhibit sufficient speaker similarity to satisfy the ECAPA-TDNN gate. The second stage rejected 4769 of these ASV-passed spoof trials. Accordingly, the reported Stage-2 ROC-AUC and EER values characterize a conditional, ASV-passed population and should not be interpreted as countermeasure performance over the complete ASVspoof evaluation corpus.

Several limitations define the scope of the present conclusions. First, the experimental validation is restricted to the ASVspoof 2019 Logical Access partition and therefore addresses synthesized and voice-converted logical-access attacks rather than physical-access replay conditions. Second, although development and evaluation data were strictly separated, the A07–A19 evaluation set is only partially unseen at the spoofing-system level: eleven evaluation spoofing systems are not represented among the development attacks, whereas A16 and A19 are known-reference conditions using the same underlying algorithms as development attacks A04 and A06, respectively [27]. Both partitions nevertheless originate from the same benchmark and should not be interpreted as evidence of cross-corpus generalization. Accordingly, the use of previously unseen A07–A19 attacks supports evaluation of within-benchmark attack generalization, but it does not establish robustness to independent corpora, different acquisition channels, unseen recording conditions, or attack-generation pipelines outside ASVspoof 2019 LA. Third, the final system uses fixed, non-learned score fusion and intentionally prioritizes interpretability over the representation capacity of modern learned anti-spoofing architectures. The external AASIST experiment directly quantifies the resulting performance gap: although the proposed representation remains individually inspectable at the component level, it is substantially less discriminative than the supervised neural countermeasure under the present in-domain evaluation. Accordingly, the proposed framework should not be interpreted as achieving state-of-the-art anti-spoofing accuracy. Fourth, the current ablation establishes the behavior of standalone components and the frozen fusion but does not fully isolate higher-order interactions among every possible fusion subset. Finally, the observed evaluation target FRR of 4.8045% remained below the predefined 5% constraint, but its 95% confidence interval extended to 5.4095%; therefore, the experiment does not establish a population-level guarantee that FRR remains below 5%.

These limitations identify concrete directions for subsequent validation. Cross-corpus testing should determine whether the frozen speaker-conditioned normalization and fusion strategy transfers to speech produced by different generators, codecs, channels, and recording conditions. The pronounced attack dependence also motivates stronger representations for conditions such as A12 and A16, while preserving independent enrollment and calibration procedures. In addition, future experiments should include leave-one-component-out fusion analysis, additional representative neural and self-supervised anti-spoofing baselines, and cross-corpus evaluation under matched trial protocols. The strong AASIST result further motivates investigating hybrid architectures in which learned countermeasures provide stronger spoof discrimination while the speaker-conditioned acoustic descriptors are retained as an auxiliary interpretable evidence layer. Such extensions would determine whether the transparency and modularity of the present framework can be preserved while narrowing the performance gap observed for unseen spoofing conditions.

6. Conclusions

This study presented an interpretable, enrollment-conditioned framework for joint speaker verification and logical-access speech-authenticity assessment. The proposed architecture separates identity verification from subsequent spoof-related acoustic analysis: an ECAPA-TDNN speaker-verification stage acts as the initial identity gate, while speaker-conditioned MFCC, pitch, and jitter anomaly scores are normalized relative to development target bona fide trials and combined through a fixed unweighted score-level fusion. PCA-based waveform reconstruction was evaluated as an additional interpretable descriptor but was excluded from the final fusion following development-set analysis.

The experimental protocol was redesigned around the official ASVspoof 2019 Logical Access benchmark, with strict separation between development-based calibration and independent evaluation. All operating thresholds, feature formulations, normalization references, and fusion components were frozen before evaluation. On the independent evaluation partition, the ECAPA-TDNN stage alone produced a target FRR of 0.5773%, a bona fide non-target FAR of 1.0532%, and a spoof acceptance rate of 66.1892%. The complete hierarchical system achieved an observed target FRR of 4.8045%, a non-target FAR of 0.7681%, and a spoof acceptance rate of 58.7239%, corresponding to an absolute reduction of 7.4653 percentage points in spoof acceptance relative to the ASV-only baseline.

An external comparison with the pretrained AASIST anti-spoofing model further clarified the position of the proposed framework relative to an established supervised countermeasure. On the same ASV-passed Stage-2 evaluation population, AASIST achieved an ROC-AUC of 0.999777 and an EER of 0.3197%, compared with 0.604293 and 42.5144%, respectively, for the frozen interpretable fusion. At its development-selected operating threshold, the ASV+AASIST configuration achieved a target FRR of 4.0968%, a bona fide non-target FAR of 0.9992%, and a spoof acceptance rate of 0.0282%. These results demonstrate that AASIST provides substantially stronger spoof discrimination under the present in-domain benchmark, while the contribution of the proposed framework lies primarily in its transparent hierarchical organization, enrollment conditioning, and individually interpretable authenticity evidence rather than in state-of-the-art anti-spoofing accuracy.

Among the proposed interpretable Stage-2 descriptors, threshold-independent analysis showed that MFCC was the strongest individual component, with an ROC-AUC of 0.653055, whereas the frozen MFCC + pitch + jitter fusion achieved an ROC-AUC of 0.604293. The fusion was therefore not globally superior to MFCC as a binary discriminator. Its selection was instead determined prospectively on development data under the predefined end-to-end target-FRR constraint of 5%. Consistent with this criterion, standalone MFCC reduced spoof acceptance more strongly but produced an evaluation target FRR of 7.2812%, while the frozen fusion maintained an observed target FRR of 4.8045%.

The results also demonstrate substantial attack dependence. Although several evaluation conditions were detected effectively, A12 and A16 produced systematic degradation in the frozen fusion score, confirming that the proposed interpretable descriptors do not provide attack-invariant protection. The A07–A19 evaluation set should therefore be interpreted as a heterogeneous, partially unseen benchmark condition rather than as a uniformly unseen attack set. Accordingly, the framework should be interpreted as a transparent and reproducible hierarchical authentication approach rather than as a universal or state-of-the-art anti-spoofing solution. The present conclusions are further limited to the ASVspoof 2019 Logical Access scenario and do not establish robustness to physical-access replay attacks or cross-corpus recording and synthesis conditions.

All quantitative performance claims reported in this study should therefore be interpreted specifically within the ASVspoof 2019 LA protocol. In particular, the separation between development attacks A01–A06 and evaluation attacks A07–A19 provides evidence regarding previously unseen attack conditions within this benchmark, but not regarding transfer to independent datasets, recording environments, codecs, channels, languages, or synthesis systems drawn from different distributions.

Future work should therefore evaluate the frozen methodology across independent anti-spoofing corpora, additional synthesis and voice-conversion systems, codecs, transmission channels, and recording conditions. Attention should be given to attack conditions for which the current interpretable representation exhibits weak or inverted discrimination. The strong performance of the external AASIST baseline also motivates hybrid extensions in which learned anti-spoofing representations provide stronger detection capability while the enrollment-conditioned MFCC, pitch, and jitter descriptors are retained as an auxiliary interpretable evidence layer. Additional neural, self-supervised, and spoofing-aware baselines under matched enrollment, calibration, and cross-corpus evaluation protocols would further characterize the trade-off between interpretability, modularity, and spoof-detection performance.