How AI voice detection works

This page describes the field in general, not one product. If you want the specific pipeline Truthring runs, with the pre-processing and the model families named, that is the methodology page. What follows is the reasoning underneath every serious attempt at this problem.

What could possibly tell the two apart?

Start with the question honestly. Two files arrive. In one, air moved past a set of vocal folds, bounced around a room, hit a diaphragm and was turned into numbers. In the other, a model produced the numbers directly. If both sound identical to a listener, what is left to measure?

Quite a lot, as it turns out, because the two files were made by processes with completely different constraints.

Real speech is the output of a physical system that cannot be perfectly consistent. Vocal folds do not repeat a cycle exactly. Breath supply falls across a phrase. The jaw and tongue have mass and cannot move instantly, so formants glide rather than jump. A room adds a reverberation tail whose character is fixed by that room’s geometry and stays consistent across the whole recording. A microphone adds its own self-noise, its own frequency colouration, and a bass lift when the speaker is close to it.

Generated speech is the output of a numerical process that has no reason to reproduce any of that unless it was trained to. Its irregularity is sampled rather than caused. Its high-frequency content is often produced by a component that reconstructs a waveform from a compact intermediate representation, and reconstruction of that kind leaves behaviour in the phase and in the upper bands that physical recording does not produce. Its noise floor is frequently too clean, or clean in a way that is uniform across the file rather than varying with the speaker’s distance and the room’s state.

None of these is a single tell that a person could listen for. They are statistical tendencies, individually weak, and the whole discipline consists of learning which combinations of weak signals hold up across many generators and many recording conditions.

Why “it sounds real” stopped being evidence

There is a structural reason listening fails, and it is worth understanding rather than just accepting.

Speech generators are trained against objectives that stand in for human judgement. The target is audio a person will accept. Every improvement in that direction removes the artefacts a person can hear, and only those. Anything a listener cannot perceive imposes no cost during training, so it survives untouched, generation after generation.

That produces exactly the situation detection depends on. The audible defects have been optimised away; the inaudible regularities have not, because nothing was pushing on them. So the human ear and the classifier are looking at almost disjoint parts of the signal, and the part the ear can reach has been deliberately cleaned. A recording can be perceptually flawless and statistically obvious at the same time.

It also explains the direction of travel. As systems mature, the inaudible residue starts to shrink too, not because anyone is targeting detectors but because higher-fidelity modelling narrows the gap everywhere. Detection is not a solved problem being maintained. It is a moving one, and the advice to trust your ear has already expired.

The recording chain is the real evidence

The most durable signals are not really about synthesis at all. They are about capture.

A genuine recording is a record of a whole chain of physical events, and each link deposits something. The room contributes early reflections and a decay tail. The distance between mouth and microphone sets the balance between direct and reflected sound, and it drifts as the speaker moves. Plosives overload the diaphragm briefly. Automatic gain control breathes up and down between phrases. Mains hum, a laptop fan, traffic, a refrigerator compressor: all of it sits underneath, and all of it is consistent with itself in ways that are hard to fake by accident.

A generator has no room and no microphone. Whatever ambience it produces was learned from its training data, which means it tends to be plausible in general and incoherent in detail. Reverb that does not match the apparent distance. A noise floor that stays exactly the same while the voice moves. Breath sounds inserted where a model expects them rather than where a body would have needed them.

This is why the strongest analyses look at the file as a whole rather than at the voice alone, and why what a container and its metadata say about a file’s history is worth checking before any model runs. It is also why a clip captured directly, in one piece, is worth far more than the same clip forwarded twice.

Compression is the enemy of detection

Everything above depends on fine detail surviving the journey to the analyst. Usually it does not.

An audio codec is a system for throwing away the parts of a signal a listener will not miss. That is its entire purpose, and it is very good at it. But the residue detection relies on is, almost by definition, the part a listener does not notice. Codec and detector are therefore aimed at the same material, and the codec gets there first.

A telephone connection is the extreme case. It discards nearly everything above roughly three and a half kilohertz, resamples, and applies aggressive perceptual coding at low bitrates, then packet loss concealment invents audio to cover gaps. What arrives is intelligible and evidentially thin. We treat phone audio as its own regime for that reason, and any accuracy figure measured on studio files does not transfer to it.

Ordinary handling does the same thing more slowly. Each re-upload re-encodes. A screen recording of a playing file adds a room and a second microphone on top of the first. Noise reduction, applied helpfully by someone trying to make a clip clearer, removes the exact texture that carried the answer. The practical consequence is a rule that sounds trivial and is not: keep the original file, and send that rather than a copy of a copy.

What is not publicly known

Being honest about the boundary of public knowledge is part of describing the field accurately.

The academic side is open: papers, challenge datasets and shared tasks are published, and anyone can read what features have been proposed. The commercial side largely is not. Most detectors do not disclose their architecture, their training corpus, the generators they have seen, or the conditions under which their headline figure was measured. Two products quoting similar numbers may have measured completely different things.

Some questions are genuinely open rather than merely undisclosed. How well any detector generalises to an architecture it has never seen is not reliably predictable in advance. How much adversarial effort it takes to strip a signature is not well characterised in public, and we will not be publishing on that. Whether detection remains viable at all as generation improves is an empirical question that will be answered by events, not by argument.

What we can commit to is reporting our own numbers in both directions, by condition, with the failures included. The accuracy page will carry them, the limitations page already carries the conditions where we expect to do badly, and the underlying definitions live in what AI voice detection is.

Questions about the mechanism