The Perceived Fragility of Explanations in Audio Models: Manipulation of Attribution with Unchanged Predictions

Authors: Piotr Kitłowski, Dominik Wiącek, Mateusz Modrzejewski

Published: 2026-06-12 13:58:34+00:00

Comment: Accepted to the ICML 2026 Workshop on Machine Learning for Audio: 5 pages, 4 figures

AI Summary

This paper investigates the fragility of post-hoc explanation methods in audio deepfake detection by introducing a novel psychoacoustic framework. This framework optimizes for inaudible perturbations that decouple model attributions from final classifications, effectively distorting explanation heatmaps. The study demonstrates that adversaries can systematically manipulate these explanations while preserving the predicted deepfake label and perceptual audio quality.

Abstract

This paper investigates the fragility of post-hoc explanation methods in audio deepfake detection. While previous work on explanation manipulation focused on images using standard $L_p$ metrics, we introduce a psychoacoustic framework that optimizes inaudible perturbations to decouple model attributions from final classifications. We evaluate this vulnerability across state-of-the-art architectures under strict prediction-preserving constraints. By evaluating the manipulation cost through domain-specific perceptual audio quality metrics alongside explanation alignment criteria, our framework demonstrates that an adversary can systematically distort automated explanation heatmaps while preserving the predicted deepfake label. Full code available at: https://github.com/cncPomper/Audio-XAI

Key findings

The proposed psychoacoustic framework effectively manipulates explanation maps across diverse architectures while preserving high objective perceptual audio quality and the original predictions, unlike unconstrained adversarial methods. Attention-based architectures like AST were found to be more fragile to explanation manipulation than convolutional models, and dense, broadband audio characteristics correlated with higher vulnerability due to larger psychoacoustic masking budgets.

Approach

The authors developed a novel optimization framework that generates explanation-targeted adversarial attacks for the audio domain. This framework incorporates a dynamic psychoacoustic masking threshold into the loss function, penalizing perturbations that exceed human auditory perception while encouraging significant attribution-map changes and maintaining the original model prediction.

Datasets

SONICS dataset

Model(s)

VGGish, Audio Spectrogram Transformer (AST), SpecTTTra (spectttra-gamma-5s)

Author countries

Poland

← Previous