Detection-Guided Adaptive Purification with Diffusion Models for Robust Audio Deepfake Detection

Authors: Muhammed Salih Kayhan, Qiben Yan

Published: 2026-10-07 18:19:55+00:00

Comment: Accepted at the 4th EAI International Conference on Security and Privacy in Cyber-Physical Systems and Smart Vehicles (EAI SmartSP 2026)

AI Summary

This paper introduces Detection-Guided Adaptive Purification (DGAP), a diffusion-based defense against adversarial perturbations in audio deepfake detection. DGAP adaptively adjusts purification strength based on detector score shifts, applying stronger purification only to flagged adversarial inputs. This approach improves robustness across various deepfake detectors and adversarial attacks while preserving benign inputs.

Abstract

Audio deepfake detectors remain vulnerable to adversarial perturbations that suppress the acoustic cues used for detection, allowing manipulated utterances to evade the detector. Although existing defenses can improve robustness, they require retraining the detector or introduce additional distortion. Diffusion-based purification instead leaves the pretrained detector unchanged, but existing methods use the same purification strength for all inputs, creating a trade-off between removing adversarial perturbations and preserving the subtle spoofing cues needed for detection. In this paper, we propose Detection-Guided Adaptive Purification (DGAP), a diffusion-based defense that adjusts purification strength per input. Building on the observation that a light purification perturbs the detector score of an adversarial input far more than that of a benign one, the framework uses the resulting score shift as a reference-free indicator of adversarial manipulation. Inputs with small shifts are passed unchanged, whereas flagged inputs undergo stronger purification before final detection. We evaluate the framework against three adversarial attack settings across three deepfake detectors, and compare it with nine existing defenses. Our results show that DGAP achieves the best defense performance across all detectors while leaving benign inputs nearly unaffected, and remains effective under the defense-aware adaptive attack.

Key findings

DGAP achieved the best overall defense performance across all three tested deepfake detectors (AASIST, RawGAT-ST, Res-TSSDNet) against three adversarial attack settings. It effectively removes adversarial perturbations while leaving benign inputs nearly unaffected, and remains robust even against defense-aware adaptive attacks. The adaptive gating mechanism is crucial for decoupling strong attack removal from distortion of benign inputs.

Approach

DGAP uses a diffusion model fine-tuned on audio spectrograms to purify audio. It first applies a light purification and measures the detector score shift; a significant shift flags the input as adversarial. Flagged inputs then undergo stronger purification before final detection, while others pass unchanged.

Datasets

ASVspoof 2019 LA partition

Model(s)

AASIST, RawGAT-ST, Res-TSSDNet (as target detectors); OpenAI's guided-diffusion model (as purification backbone)

Author countries

USA

← Previous