DeepBlocker Detect

We started from XLSR-Mamba-LA (MIT, 2024), an academic detector that performs strongly on clean studio audio (ASVspoof 2021 Logical Access). When deployed to a live G.711 telephony pipeline, the published model was effectively inverted: real human voices on phone lines were flagged as deepfakes, and smooth synthetic voices were called real.

Diagnosis: the model had learned vocoder artefacts on clean audio. G.711 lossy compression introduces spectral distortions that look superficially similar. Solution: fine-tune the classification head on G.711-encoded audio with correct labels, keeping the SSL frontend frozen so the rich multilingual feature representation is preserved.

The second problem showed up in the field: attackers play office or cafe ambience under a synthetic voice, and a detector that has only heard clean audio reads the room as proof of a real person. v8 was trained with a bank of real background recordings mixed under both real and fake voices, so the model learns that a room is not evidence of a real speaker. One head cannot master two codecs, so two specialists sit behind a router: one for phone lines, one for Opus.

Measured the way production scores calls: 207 real phone calls taken off the carrier (113 real callers, 94 AI callers over the same phone leg), each with at least 5 seconds of caller speech, production thresholds. The previous production model (v5) is scored on the same calls, so the two columns are directly comparable.

Caught and slipped through are not mirror images, because a third answer sits between them: UNCERTAIN, which goes to human review. v8 moved AI callers out of REAL and UNCERTAIN into FAKE, so catching went up and slipping went down, and it does not wrongly accuse more real people. The price is that about one real caller in five goes to review instead of one in ten. That is a deliberate trade for a fraud product: missing a fake costs more than reviewing a real person.

One 4-second window of processed audio per sample, Reporting set held out of training and SHA-256 pinned. Scores are fake probability. Lab figures are not comparable with the real-call figures above: the earlier public figure of 94.7% recall for v5 was a lab figure of this kind.

Production bands on phone lines: REAL below 0.71, FAKE above 0.96. Between the two: UNCERTAIN, sent to human review. Calls with under 5 seconds of caller speech are returned as UNCERTAIN with an insufficient speech flag.

The 18,062-sample corpus is split 6.2 : 1 REAL : FAKE. Provenance and licences below. Stratified group splits prevent speaker, voice, and call-id leakage across train, val, test, and Reporting partitions.

Augmentation chain (applied identically to every sample): bandlimit to 300 to 3,400 Hz, optional simple reverb, AGC plus hard limiter, random codec round-trip across G.711 µ-law, G.711 A-law and G.722. From v8, a bank of real background recordings (MUSAN noise and babble, DEMAND office, meeting, cafeteria and station rooms, and the office beds attackers use on voice platforms) is mixed under both real and fake voices at 5 to 20 dB.

• Base: XLSR-Mamba-LA (MIT, 2024). SSL frontend (XLSR-300M Wav2Vec2, 315 M params) frozen.
• Trainable head: DuaBiMamba (12 stacked Mamba blocks, hidden 256) plus a 2-class classifier, 1.9 M trainable parameters.
• Loss: BCEWithLogitsLoss with pos_weight = n_real / n_fake. Optimiser: AdamW, weight decay 0.01. Learning rate 5e-5 with cosine decay to 5e-7, 100-step warmup.
• Effective batch size 32 (8 × 4 grad-accumulation). Window length 4 s. Patience-5 early stop. v8 warm-started from v5 and stopped at epoch 6.
• Checkpoint selection: FAKE recall at 5% real false positives on the noisy validation set, not AUC. An earlier v8 run selected on AUC pushed real callers towards FAKE and was rejected.
• Hardware: A100-40GB. Total wall-clock for v8 on G.711: about 70 minutes.

1. ElevenLabs over G.711 sits just above the FAKE floor in the lab (0.953); v5 was stronger on that one source. On real calls v8 is better overall.
2. The real-call set is our own test calls. A few real-labelled calls score as fake under every model and are awaiting a listening check (possible IVR or voicemail mislabels).
3. Real callers over the Opus path have not been measured directly. No labelled recordings of real people calling through WebRTC platforms exist yet; the REAL-side Opus numbers come from phone audio converted to Opus.
4. Reporting set size is about 634 samples with a per-source minimum of 50. Adequate for headline numbers but with wider confidence intervals than a 1,000-sample academic benchmark.
5. TTS providers we did not train on (Bark, Coqui XTTS-v2, Vall-E, custom voice clones) are not represented in evaluation.
6. Multilingual support is not in v8. The corpus is English-only; separate fine-tunes per language are on the roadmap.

Every claim on this page is backed by a measurement against a Reporting set held out of training, or against a fixed set of real phone recordings scored on the production path. The Reporting set is locked via SHA-256 hash of the sorted per-sample (path, label) tuples. Future re-evaluations are measurements of the same population, with no silent re-use. Model weights are SHA-256 pinned and checked before every deploy.

The base model (XLSR-Mamba-LA) is MIT-licensed and published with paper. Our fine-tune procedure, augmentation chain, training hyperparameters, and Reporting SHA-256 are documented in the internal model cards. Available under NDA for technical evaluation.

v8 has been live on the phone-line endpoint since 2026-10-20 and on the Opus endpoint since 2026-10-12. v5 and v7 are kept untouched as rollback targets. Next: labelled real callers over the Opus path, continuous evaluation on production traffic, defence against TTS providers we do not currently see, and multilingual fine-tunes.