VeriSpoof-Base

Beyond real or fake: one unified audio LLM for speech deepfake forensics.

VeriSpoof-Base is an open-weight audio language model for speech deepfake forensics, trained on the official training splits of public corpora only. From a single recording it decides whether the speech is genuine or spoofed, names the system that generated it, tells whether a second recording comes from the same generator, acoustic model or vocoder, and recognizes the noise, reverberation and codec of the channel. It explains every decision in short lines that can each be checked against the audio, and its 2.9 B parameters run on a single 12 GB GPU.

It ranks #4 of 28 systems on Speech-DF-Arena (4.43% pooled EER over 14 test sets), ahead of every open-weight system other than VeriSpoof-Plus, and is the model of all controlled studies in the technical report.

News

2026-11-04 · 🥇 New: VeriSpoof-Plus, #1 open-weight on Speech-DF-Arena (pooled EER 2.14%, #3 of 28 systems) and on SpoofRadar v1.0 (4.04%).
2026-11-04 · 🥈🏆 #2 open-weight on SpoofRadar v1.0: pooled EER 4.23% over 16 test sets, behind only VeriSpoof-Plus; the next open-weight system is at 9.96%.
2026-10-31 · 🥈🏆 #2 open-weight on Speech-DF-Arena: pooled EER 4.43% over 14 test sets, #4 of 28 systems, behind only VeriSpoof-Plus; the next open-weight system is at 9.52% (public snapshot of 31 Oct 2026).
2026-10-31 · VeriSpoof-Base released.

Highlights

Strong detection on official training splits only. Fourth of 28 systems on Speech-DF-Arena (4.43% pooled EER) and 4.23% pooled EER on SpoofRadar v1.0, ahead of every open-weight system other than VeriSpoof-Plus on both boards. It is the model of all controlled studies in the technical report.
One model, five forensic questions. The same weights detect spoofed speech, identify the generator (95.4% on MLAAD), name the acoustic model under an unseen vocoder (84.7%), verify whether two recordings come from the same system, and recognize noise, reverberation and codec. Every answer is the model's own text answer, scored; there are no task-specific heads.
Evidence you can check. The reasoning states bandwidth, noise level, the synthesized span and a decision, each line checkable against the audio. The decision follows the evidence: invert the stated span and the decision flips, in 100% of tests and in 99.5% with wording never seen in training.
Catches partial fakes. With reasoning, 99.6% of partially edited recordings in PartialEdit are caught, against 78.4% for the one-step answer.

Need the best numbers? See Base or Plus?

The film

1:59, Chinese and English captions. All voices in the film are synthetic (Fish Audio), including Yang Xiao’s. Music “78 PULSE” by kjartan_abel (CC BY 4.0); sound effects “2 Impact Wet” by original_sound (CC BY 3.0) and “data corrupted” by Saltbearer (CC BY 4.0), the rest CC0, via Openverse and Freesound; recordings from PartialEdit (CC BY 4.0) and MLAAD (CC BY-NC 4.0). Every model output shown is a real VeriSpoof output on that clip. The character is AI-generated art.

Model at a glance


Parameters	2.9 B: audio encoder from Qwen3-ASR-1.7B, language model MiniCPM5-2B
Input	a speech recording at any sample rate (resampled to 16 kHz)
Output	an answer with its score; reasoning lines; a per-token synthetic-speech probability (every 0.16 s)
Tasks	detection, generator identification, source verification, recording condition, grounded reasoning
Hardware	one CUDA GPU with about 12 GB

Quick start

hf download AustinXiao/VeriSpoof-Base --include "code/*" --local-dir verispoof
pip install ./verispoof/code

from verispoof import VeriSpoof

model = VeriSpoof.from_pretrained("AustinXiao/VeriSpoof-Base")   # weights are downloaded on first use

# Detection. score = log p(spoof answer) - log p(bona fide answer); label uses threshold 0
model.detect("sample.wav")                        # {'label': 'spoof', 'score': ...}
model.detect(["a.wav", "b.flac"], batch_size=16)  # a list in, a list out; arrays need sr=...

# Grounded reasoning, plus the per-token head (probability that each 0.16 s token is synthesized)
r = model.explain("sample.wav")
print(r["text"])         # OBSERVATIONS / CHANNEL_STATUS / LOCALIZATION / SOURCE_PROFILE / DECISION lines
r["decision"], r["spans"], r["token_prob"]

# Source verification of two spoofed recordings: generator, acoustic_model or vocoder
model.same_source("a.wav", "b.wav", level="generator")   # {'same': ..., 'score': log p(yes) - log p(no)}
model.compare("a.wav", "b.wav")                           # source-verification reasoning

# Closed questions
model.condition("sample.wav", attr="codec")               # also "noise", "reverb"
model.generator("sample.wav", ["XTTS-v2", "Bark", "VITS"])  # candidate systems you supply

Faster reasoning with vLLM

pip install "./verispoof/code[vllm]"

from verispoof.vllm_backend import VeriSpoofVLLM

if __name__ == "__main__":          # vLLM starts its engine in a separate process
    m = VeriSpoofVLLM.from_pretrained("AustinXiao/VeriSpoof-Base")
    results = m.explain(["a.wav", "b.wav", "c.wav"])   # batched
    pairs = m.compare([("a.wav", "b.wav"), ("c.wav", "d.wav")])

Reasoning, one A100	per recording	speed-up
`VeriSpoof.explain`, one at a time	2.24 s	1×
`VeriSpoofVLLM.explain`, one at a time	0.50 s	4.5×
`VeriSpoofVLLM.explain`, batch of 64	0.05 s	46×

Decisions are identical to VeriSpoof (64 / 64 recordings, 32 / 32 pairs). Detection scores and the per-token head use VeriSpoof. If vLLM fails to load a FlashInfer sampling kernel, set VLLM_USE_FLASHINFER_SAMPLER=0.

Results

Speech-DF-Arena leaderboard

Public snapshot of 31 Oct 2026, ordered by pooled EER as on the board; every line of the official protocols (speech_df_arena, commit 97a4445) is scored.

System	Availability	Params	Average EER	Pooled EER
Modulate VELMA-2	Proprietary	0.3 B	1.10	1.59
Resemble Detect-3B-Omni	Proprietary	3 B	2.60	2.10
🥇 VeriSpoof-Plus	Open-weight	2.9 B	1.79	2.14
Hiya Authenticity Verification	Proprietary	1 B	2.11	2.32
🥈 VeriSpoof-Base (this model)	Open-weight	2.9 B	4.28	4.43
DLMSL SpeakSure	Proprietary	0.7 B	3.80	6.14
Whispeak	Proprietary	0.1 B	3.05	8.06
DF Arena 1B	Open-weight	1 B	5.66	9.52
XLS-R + SLS	Open-weight	0.3 B	14.01	16.08

Average = mean of the 14 set EERs. Each VeriSpoof model is ranked on its own (Plus third of 28, Base fourth of 28).

Per test set

Dataset	Trials	EER (%)	Accuracy (%)
asvspoof_2019	71,237	0.49	99.25
asvspoof_2021_la	148,176	5.48	93.54
asvspoof_2021_df	533,928	0.97	99.40
asvspoof_2024	680,774	2.59	98.42
in_the_wild	31,779	1.20	98.93
fake_or_real	4,528	5.39	90.02
codecfake	304,241	4.97	89.51
add_2022_track_1	109,199	14.05	88.42
add_2022_track_3	126,861	3.87	96.84
add_2023_round_1	111,976	5.01	90.35
add_2023_round_2	118,477	10.61	92.87
dfadd	3,755	0.00	99.97
librisevoc	92,407	0.02	99.99
sonar	3,948	5.19	83.11
Average		4.28	94.33
Pooled	2,341,286	4.43

Accuracy at threshold 0.

SpoofRadar v1.0 leaderboard

16 test sets; pooled EER, and accuracy and macro-F1 at the pooled-EER threshold, as SpoofRadar defines them. Other rows from the published leaderboard (v1.0); ours computed with the same protocol files.

System	Availability	Pooled EER	Accuracy	Macro-F1	Average EER
Teffic-Audio	Commercial	1.37	98.63	98.12	1.09
WavLM-L (Teffic)	Closed source	3.65	96.35	95.06	2.88
🥇 VeriSpoof-Plus	Open-weight	4.04	95.96	94.54	1.65
🥈 VeriSpoof-Base (this model)	Open-weight	4.23	95.77	94.29	3.76
Whisper (Teffic)	Closed source	5.75	94.25	92.33	3.94
DF Arena 500M V1	Open-weight	9.96	90.04	87.08	5.19
GRL	Open-weight	13.25	86.75	83.17	9.90

Beyond detection

On VeriSpoof-Bench; details in the tech report.

Task	Result
Detection, SpoofCeleb / CodecFake+ / CodecFake+ CoSG (unseen generators)	EER 0.20 / 3.95 / 4.84%
Detection under added noise, reverberation and codecs (6 sets)	mean EER 5.23%
Same-generator verification, MLAAD seen / unseen model / unseen architecture	EER 17.23 / 13.80 / 20.25%
Same-generator verification, SpoofCeleb / ASVspoof 2019 LA	EER 11.25 / 8.22%
Generator identification (MLAAD, closed set)	95.4% accuracy
Acoustic model under an unseen vocoder (SpoofCeleb)	84.7% accuracy
Recording condition (noise / reverberation / codec)	75.9% accuracy
Partial fakes caught after reasoning vs one-step answer (PartialEdit / HAD)	99.6 vs 78.4 / 99.0 vs 99.0%
Decision after reasoning, 11 sets	91.2–99.6% accuracy
Partial-spoof localization, text spans (HAD / PartialEdit / PartialSpoof)	IoU 0.61 / 0.58 / 0.25
Per-token head (HAD / PartialEdit / PartialSpoof)	F1 0.91 / 0.79 / 0.74
Decision follows inverted localization (trained / new wording / inserted span)	1.00 / 0.995 / 1.00
Source-verification reasoning, verdict EER (SpoofCeleb / STOPA / CoSG / LA19 cond.)	20.20 / 13.65 / 21.60 / 29.65%

Intended use

Research on audio deepfake detection, source tracing and explainable forensics. Not intended as the only basis for decisions about people; a forensic decision should combine this score with other evidence and human review.

License

CC BY-NC 4.0 (non-commercial use). The base models keep their Apache-2.0 licences.

Citation

@misc{verispoof2026,
  title         = {{VeriSpoof}: Beyond Real or Fake with One Audio {LLM}},
  author        = {Xiao, Yang and Dang, Ting},
  year          = {2026},
  eprint        = {2611.04634},
  archivePrefix = {arXiv},
  primaryClass  = {eess.AS},
  url           = {https://arxiv.org/abs/2611.04634}
}