Detecting Coqui XTTS
Coqui XTTS is an open-weight speech synthesis model that reproduces a voice from a short reference sample. The audio problem it poses is much like any other cloning system. The defensive problem is not, because the weights sit on the user’s own machine and every mechanism that normally sits between a person and a cloned voice — the account, the consent checkbox, the quota, the billing trail — is simply absent.
Measured on [VERIFY: n] clips spanning [VERIFY: n] checkpoints and [VERIFY: n] community fine-tunes, held out of training. Dataset composition: research dataset and benchmark.
Open weights are a different threat model, not a harder one
It is tempting to treat open models as the dangerous end of a spectrum, with hosted products at the safe end. That framing is wrong in both directions. The audio a good open model produces is not automatically more convincing than a commercial system’s, and quite often it is less so. What changes is everything around the audio.
A hosted product has a customer. Someone agreed to terms, entered a payment method, generated from an IP address, and left a row in a database. None of that stops the first misuse, but it gives an investigator somewhere to send a request and gives the provider somewhere to apply a ban. When a model is downloaded and run offline, the entire apparatus disappears at once. There is no account to suspend, no log to preserve, no company to notify, and no rate limit to make bulk generation expensive.
The consequence for anyone on the receiving end is blunt: the recording in front of you may be the only artefact that will ever exist. This is why we treat the clip itself as the primary evidence rather than as a pointer to a record held elsewhere.
Evidence exists in two places
The clip, and the provider’s record of who generated it. A verdict on the clip can be corroborated, or contradicted, by the second copy. Terminating an abusive account has an effect.
Evidence exists in one place
The clip. Nothing else. There is no second record to reconcile it against, no takedown that removes the capability, and no way to establish how many other clips came from the same machine.
Why our signatures for XTTS age differently
Signatures for commercial generators decay on a schedule you can almost set a calendar by. A vendor ships a new model, the fine structure of the output shifts, attribution rates drop, and we retrain. The failure mode is predictable and the fix is routine.
Open weights break that rhythm in two ways at once.
Nothing is ever retired. When a hosted vendor replaces a model, the old one stops being reachable and clips from it stop appearing. A downloaded checkpoint has no expiry. Files generated with an early release will keep arriving for years after anyone would call that release current, so a signature we might otherwise have dropped stays useful far longer than it would for a commercial system.
Everything branches. Instead of one publisher shipping one successor, an open model accumulates fine-tunes: adapted to a language, to a speaking style, to one particular person’s voice. Each of those shifts the signature a little, and none of them is announced. Attribution therefore does not fail cleanly on a known date. It frays, and it frays unevenly across variants.
The practical result is that our synthetic or not verdict on this family holds up better over time than our which system was it verdict does. That is true generally, but the gap is wider here than for any hosted product we cover.
What the analysis leans on here
Recording chain
Whether the file behaves like something captured by a microphone in a room or something written straight to disk. Locally generated audio typically has no capture history at all, which makes this pass unusually informative for open models — and unusually easy to defeat by playing a clip aloud and re-recording it.
Family signature rather than version signature
Because variants proliferate, we hold a signature for the shared architecture and treat individual checkpoints as members of it. This is why a verdict may name the family without naming the checkpoint. We would rather return a true statement about the family than a precise-sounding claim about a build we cannot distinguish.
Reference-sample bleed
A model conditioned on a short reference clip sometimes carries characteristics of that reference — its room, its noise floor, its recording quality — into every sentence it later produces, including sentences that were never in the original. Consistency of the wrong kind is a cue.
Where this fails
- Fine-tunes we have never seen. A variant trained on material unlike anything in our test set can read as synthetic with lowered confidence, or attribute to no family at all.
- Re-recording through a speaker. The single cheapest defeat, and it costs an attacker nothing but a phone and a quiet room.
- Post-processing chains. Local generation is usually followed by local editing. Noise added deliberately, a reverb plug-in, a loudness normaliser — each step removes some of what the first pass reads.
- Very short clips. Under [VERIFY: n] seconds there is not enough material for the family signature to carry weight, and the verdict rests almost entirely on the recording chain.
Fuller treatment: where Truthring is wrong.
The asymmetry worth understanding. Likely synthetic is the stronger verdict, because it is only reached when positive evidence is present in the file. Likely human is weaker: it can mean the clip is genuine, or it can mean the evidence was destroyed in transit by compression, re-recording or editing. On an open-weight model, where post-processing is entirely under the generator’s control, that second reading deserves more weight than usual.
What defenders can still do
Nothing here is solved by policy applied to a vendor, because there is no vendor in the loop. What still works is unglamorous and mostly procedural: verify through a channel the caller did not choose, keep original files rather than forwarded copies, and treat an unexpected voice request for money or credentials as a process failure rather than a judgement call about how real it sounded.
Questions
Can XTTS output be detected?
Yes, at a rate not yet measured on clean audio from the reference checkpoint and a rate not yet measured across the community fine-tunes we hold. The family is named in a share of detected clips that has not been measured yet.
Can anyone tell me who generated a clip?
Not from the audio, and usually not from anywhere else either. With no hosted service in the chain there is no account record, no billing trail and no server log to request. The file is generally the only artefact that exists.
Do the safety features of hosted tools apply to a local copy?
No. Consent prompts, quotas and refusal behaviour live in a product, not in a set of weights. A downloaded model does what it is asked, as many times as it is asked.
Is a fine-tuned variant harder to detect than the base model?
Usually somewhat, and the difficulty falls on attribution more than on the synthetic-or-not verdict. We report the two rates separately on this page for exactly that reason.
Does an open model produce better clones than a commercial one?
Not reliably, and often the opposite. The reason open weights matter is not audio quality — it is the removal of every constraint that sits around the audio.
Signature last retested [VERIFY: date] against checkpoint [VERIFY: which] and [VERIFY: n] community fine-tunes. Rates on this page are re-measured monthly; for open models they move when the community ships, not when a vendor does.
Reviewed