FoeGlass: Simple In-Context Learning Is Enough for Red Teaming Audio Deepfake Detectors

Authors: Sepehr Dehdashtian, Jacob H Seidman, Vishnu N Boddeti, Gaurav Bharaj

Published: 2026-06-03 17:04:26+00:00

Comment: Accepted at ICML 2026

AI Summary

FoeGlass is introduced as the first black-box automated red-teaming method for Audio Deepfake Detectors (ADDs). It leverages an LLM's in-context learning with realness and diversity feedback to generate diverse, natural adversarial audio samples that effectively discover ADD failure modes. This approach significantly increases false negative rates, generates transferable attacks, and improves ADD robustness without manual supervision.

Abstract

Audio deepfake detection (ADD) models are critical for countering the malicious use of text-to-speech (TTS) models. Evaluating and strengthening ADD models requires developing datasets that span the space of generated audio and highlight high-error regions. Existing dataset development strategies face two challenges: (i) manual collection, and (ii) inefficient discovery of blind spots in the ADD models. To address these challenges, we propose FoeGlass, the first black-box automated red-teaming method for ADDs, which effectively discovers ADD failure modes in the space of generated audio underexplored by state-of-the-art deepfake benchmarks. FoeGlass uses the in-context learning capabilities of an LLM to explore the input space of a TTS model, generating audio samples that fool the target ADD using only black-box access to all components. By using a carefully designed context based on diversity measurements, FoeGlass mitigates the common problem of mode collapse in automated red-teaming systems. Empirical evaluations on several open-source ADD and TTS models demonstrate that data generated from FoeGlass substantially improves the false negative rates over unconditional sampling baselines and recent spoofing datasets by up to 94%, while requiring no manual supervision. Furthermore, we show that the attacks generated by FoeGlass are transferable across different target ADDs, demonstrating its broad applicability and ease of use for the automated red teaming of ADD systems. Finally, fine-tuning ADD models on FoeGlass-generated samples notably enhances the robustness of the detectors (up 41%).

Key findings

FoeGlass-generated data substantially improved false negative rates (FNRs) by up to 94% over unconditional sampling baselines and recent spoofing datasets, effectively discovering underexplored failure modes. The attacks created were transferable across different ADDs and, when used for fine-tuning, notably enhanced the robustness of these detectors by up to 41%.

Approach

FoeGlass employs a black-box reasoning Large Language Model (LLM) to iteratively generate diverse inputs for Text-to-Speech (TTS) models. The LLM's prompt generation is guided by two feedback signals: a realness score from the target ADD and a diversity score calculated from WavLM embeddings of the generated audio. This process efficiently explores the TTS input space to find audio samples that fool the ADD and mitigates mode collapse.

Datasets

ASVspoof5, VoxCelebSpoof

Model(s)

Vision Transformer (ViT) based detectors (using Constant-Q Transform, Mel-spectrograms, MFCC features), Audio Spectrogram Transformer (AST) based detectors, RawNetLite, RawNet2, AASIST, DF_Arena_500M, DF_Arena_1B

Author countries

USA

← Previous