Proteus: Automated Adversarial Robustness Testing for Audio Deepfake Detectors

Authors: Nicolas M. Müller, Aditya Tirumala Bukkapatnam, Zohaib Ahmed

Published: 2026-06-28 18:14:28+00:00

AI Summary

Proteus is an automated robustness testing framework for audio deepfake detectors that systematically searches for sequences of audio transformations capable of fooling detectors while preserving speech quality. It employs both a breadth-first search and a Q-learning agent to discover these adversarial augmentation chains. The framework has been deployed against a production detector, revealing vulnerabilities that are then used for targeted retraining to harden the detection system.

Abstract

We present Proteus, a framework developed at Resemble AI for automated robustness testing of our audio deepfake detection system. Given a detector, Proteus systematically searches over sequences of everyday audio transformations (codec transcoding, additive noise, reverberation, dynamic-range compression, and VoIP simulation) to find combinations that fool the detector while preserving speech quality. We propose two complementary search strategies: (1) a breadth-first search that exhaustively maps augmentation effectiveness across the parameter space, and (2) a Q-learning agent designed to efficiently discover deeper attack chains by exploiting structural patterns in the BFS data. We report findings from continuous deployment of Proteus against our production detector, showing that specific augmentation chains can reliably flip detection verdicts while preserving speech intelligibility and speaker identity. We discuss how these findings are used to harden the detector through targeted retraining.

Key findings

The study found specific augmentation chains that reliably fool the production deepfake detector, primarily by inducing false positives on bonafide audio. There's a strong asymmetry, with bonafide samples being much easier to push towards a 'spoof' verdict than synthetic speech is to push away. These identified vulnerabilities directly inform detector retraining, creating a continuous feedback loop for model hardening.

Approach

The framework generates adversarial examples by applying sequences of audio transformations from a comprehensive library, ensuring perceptual quality is maintained. It uses two search strategies: a breadth-first search for exhaustive mapping of augmentation effectiveness and a Q-learning agent to efficiently discover deeper attack chains by exploiting structural patterns in the data. Successful attack chains are then used to retrain and harden the detector.

Datasets

M-AILABS, MLAAD

Model(s)

UNKNOWN (production deepfake detector from Resemble AI, Whisper for WER, speaker embedding model for speaker similarity)

Author countries

USA

← Previous