Skip to content
GraphSeal: Graph-Augmented Speech Deepfake Detection via Temporal-Spectral Artifact Propagation

GraphSeal: Graph-Augmented Speech Deepfake Detection via Temporal-Spectral Artifact Propagation

Authors: Seung-woo Lee¹, Bowen Qi², Min-jun Kim³, Won-young Jang³

Affiliations: 1. Pusan National University 2. Shanghai Jiao Tong University
3. Hanyang University

Venue: arXiv cs.CY, November 2026 — arxiv

TL;DR

GraphSeal proposes a dynamic temporal-spectral graph neural network for speech deepfake detection that outperforms fixed-topology baselines on generalization tasks. Unlike prior graph-based anti-spoofing methods that use feature-extraction-determined topologies, GraphSeal constructs utterance-specific edges from both temporal adjacency and learned spectral similarity, allowing distant spectrally-related frames to share artifact evidence. With only 2.1M parameters on top of a frozen self-supervised encoder, GraphSeal achieves state-of-the-art or competitive equal error rates (EER) on four benchmarks: 0.52% (ASVspoof 2019 LA), 2.41% (ASVspoof 2021 LA), 8.17% (ASVspoof 5), and 5.24% (In-the-Wild).

Contributions

  • Dynamic temporal-spectral graph construction that creates data-dependent edges based on temporal adjacency (±k_t neighbors) and spectral similarity (k_s nearest in embedding space), enabling adaptive topology per utterance.
  • Graph attention propagation with edge attributes encoding temporal distance and spectral similarity; GATv2 formulation allows attention weights to change dynamically based on both source and target node content, critical for deepfake detection.
  • Hierarchical readout combining mean pooling and learned attention weighting to aggregate variable-size node embeddings into fixed-size utterance representations.
  • Comprehensive evaluation and ablations confirming that spectral edges, temporal edges, edge attributes, paralinguistic features (F0, energy, spectral centroid), and multi-layer propagation each contribute meaningfully to performance.

Method

GraphSeal operates in four stages:

  1. Frame encoding: A frozen self-supervised speech encoder (WavLM, wav2vec 2.0, or Whisper) produces d-dimensional frame embeddings from the waveform.

  2. Segmentation and initial embeddings: Frames are partitioned into overlapping segments of w frames (default w=32) with stride s=16. Each segment is mean-pooled and augmented with three paralinguistic features: fundamental frequency F0, RMS energy, and spectral centroid. These are linearly projected and concatenated to form initial node embeddings.

  3. Graph construction: Two edge types:

  4. Temporal edges: Each node connects to its k_t nearest temporal neighbors on each side (default k_t=3), preserving sequential structure.
  5. Spectral edges: Each node connects to its k_s most spectrally-similar non-adjacent nodes (default k_s=5), computed via cosine similarity in the SSL embedding space. These long-range edges enable the model to compare regions with shared synthesis artifacts despite temporal separation.

Edge attributes combine temporal distance and spectral similarity: e_ij = λ_t · exp(-|i-j|/τ) + λ_s · sim(v_i, v_j), where λ_t, λ_s are learned parameters initialized to 0.5.

  1. Graph attention propagation: L=3 graph attention layers (M=4 heads) propagate artifact cues. Each layer updates nodes via GATv2 attention:
  2. Attention scores depend on both source and target node representations plus edge attributes.
  3. Outputs are concatenated across heads, then normalized with residual connections and layer normalization.

  4. Dropout (0.1) is applied to attention coefficients during training.

  5. Hierarchical readout: After L layers, two complementary aggregations:

  6. Mean pooling: u_mean = (1/N) ∑ h_i^(L)
  7. Attention-weighted: u_att = ∑ β_i h_i^(L), where β_i = softmax(w_r^T h_i^(L))
  8. Utterance embedding: u = [u_mean ∥ u_att]
  9. Binary classification via 2-layer MLP with GELU activation, trained with weighted cross-entropy to handle class imbalance.

Results

Main benchmarks (Table 1): - ASVspoof 2019 LA: 0.52% EER (vs. 0.59% WavLM-AASIST, 0.68% SAMO) - ASVspoof 2021 LA: 2.41% EER (vs. 2.85% WavLM-AASIST) - ASVspoof 5: 8.17% EER (vs. 9.62% WavLM-AASIST) — strongest gain on unseen attack types - In-the-Wild: 5.24% EER (vs. 6.31% WavLM-AASIST) — real-world recording conditions

Front-end agnostic: GraphSeal maintains effectiveness across three SSL encoders (Table 2): - WavLM-Large: 2.41% (2021 LA), 5.24% (In-the-Wild) — best - wav2vec 2.0-Large: 2.93% (2021 LA), 6.12% (In-the-Wild) - Whisper-Medium: 3.18% (2021 LA), 6.79% (In-the-Wild)

Per-attack breakdown (Figure 2): GraphSeal improves EER on 12 of 13 attack types in ASVspoof 2019 LA. Largest gains on: - A17 (waveform concatenation): −0.46% - A10 (neural vocoder with Griffin-Lim): −0.29% - A16 (neural TTS): −0.23%

Spectral edges particularly effective at linking discontinuities at concatenation boundaries.

Ablations (Table 3): - Removing spectral edges (k_s=0): +0.71% EER (regression to 3.12%) - Removing temporal edges (k_t=0): +1.56% EER (regression to 3.97%) - Removing edge attributes (e_ij=1): +0.37% EER - Removing paralinguistic features: +0.22% EER - Mean-pool-only readout (no attention): +0.30% EER - Single GAT layer (L=1): +0.94% EER; L=5 improves marginally to 2.52% but with diminishing returns - GCN instead of GAT: +0.48% EER; GraphSAGE: +0.31% EER — dynamic attention crucial

Attention analysis: For bonafide utterances, attention distributes uniformly across neighbors (entropy H=2.31 nats). For spoofed utterances, attention concentrates on spectral edges connecting to similar-distortion regions (entropy H=1.47 nats), validating that the graph learns to route information along artifact-bearing paths.

Generalization: ASVspoof 5 and In-the-Wild improvements confirm GraphSeal captures attack-agnostic artifacts rather than memorizing specific synthesis algorithms. Per-attack variance substantially lower than WavLM-AASIST (σ²=0.18 vs. 0.34), indicating more uniform detection across spoofing methods.

Computational efficiency

The graph back end adds only 2.1M parameters (0.7% of the frozen 316M-parameter WavLM-Large encoder) and 12 ms wall-clock latency per utterance on a single NVIDIA A100 GPU. Graph construction (segment pooling, cosine similarity, top-k selection) accounts for 3 ms; GAT propagation adds 9 ms. This efficiency supports real-time deployment in full-duplex voice agents (<50 ms per-turn budget).

Connections

Notes

Strengths: - Novel dynamic graph construction meaningfully outperforms fixed-topology predecessors (AASIST, RawGAT-ST). - Strong generalization to unseen attack types and unconstrained recording conditions; rare in audio deepfake detection. - Truly front-end agnostic; works with multiple SSL encoders without retraining the graph module. - Comprehensive ablations and per-attack analysis validate design choices. - Efficient: 2.1M parameters and 12 ms latency compatible with real-time deployment.

Weaknesses: - Error analysis reveals failure modes on irregular prosody (hesitations, non-verbal vocalizations) and spectrally homogeneous neural codec attacks, where spectral edges become less informative. - Inherent limitation: as synthesis quality improves and approaches genuine speech, no detection method can maintain arbitrarily low EER—this is a fundamental problem, not unique to GraphSeal. - Limited to lab-controlled and semi-wild datasets; true in-the-wild performance on actively adversarial synthesis (voice cloning for fraud) remains understudied.

Future directions: - Combine with recurrent refinement (iterative evidence accumulation over multiple graph passes) to improve codec-attack detection. - Extend to multimodal deepfakes (audio-visual consistency checking via unified graph framework). - Privacy-preserving deployment: graph-level embeddings abstract away speaker identity while retaining artifact signatures.