Spooftral: Can Voxtral Audio-Language Model Detect Speech Spoofing?
Avishai Weizman, Yehuda Ben-Shimol, Itshak Lapidot
eess.AS · cs.CL
Quick verdict
Adapts Voxtral ALM to speech spoofing via label-likelihood scoring + DoRA, hitting 4.25% EER on ASVspoof5; solid analysis, thin baselines and significance.
Summary
The paper adapts the Voxtral audio-language model (ALM) to speech spoofing detection. The task is reformulated as instruction-guided generative label-likelihood classification: length-normalized log-likelihoods of the label sequences 'bonafide' and 'spoof' are differenced to yield an EER-compatible detection score, with training via class-weighted cross-entropy plus an optional margin term. Linear probing of frozen representations (Table II) shows spoof cues are more separable at the Whisper-based audio-adapter output than after the LLM decoder (5.48% vs 7.17% EER on ASVspoof2019 LA eval; 9.75% vs 19.09% on ASVspoof5 eval), supporting the claim that semantic LLM processing attenuates acoustic spoofing cues. Lightweight DoRA adaptation of attention layers yields Spooftral, reaching 4.25% EER on the ASVspoof5 evaluation set (4.50% dev) with ~55.1M trainable parameters (1.17%), and 0.41%/6.46%/3.88% on ASVspoof2019 LA/2021 LA/2021 DF eval sets. Against ASVspoof5 SSL baselines (Table V), Spooftral beats S10 fusion (11.24%), WavLM-ResNet18-SA fusion (7.01%), SSL-IVSPT (5.99%) and SLIM (5.50%), but trails the best open-condition submission (2.59%). Main limitations: baselines are not matched for training data and fusion; differences between Spooftral and its encoder-only variant are small, with overlapping confidence intervals on some sets; only Voxtral-mini-3B is tested. Code is released.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Without task-specific adaptation, Voxtral's LLM layers attenuate spoof-discriminative acoustic cues relative to its Whisper-based audio encoder/adapter representations (Table II).
- Spoofing detection can be cast as instruction-guided label-likelihood scoring over fixed 'bonafide'/'spoof' token sequences, yielding an EER-compatible continuous decision score (Eqs. 1–2).
- Lightweight DoRA adaptation (~1.17% of parameters trainable) yields Spooftral with 4.25% EER on the ASVspoof5 evaluation set, competitive with SSL countermeasures that use fusion or additional training data (Table V).
- After task-specific adaptation, the LLM component contributes beyond the acoustic encoder alone, as shown by Spooftral vs Spooftral-Enc (Table III).
- The choice of instruction interface (bonafide/spoof vs real/fake labels) measurably affects generative label-likelihood performance (Table IV).
Strengths
Clear representational analysis of where spoof cues survive in an ALM
Linear probing of frozen representations at the audio-adapter vs LLM-decoder stages (Table II) isolates where spoof cues live: 5.48% vs 7.17% EER on ASVspoof2019 LA eval, 9.75% vs 19.09% on ASVspoof5 eval, with bootstrap CIs and PaCMAP support (Fig 2).
ALM-native scoring formulation compatible with EER evaluation
Length-normalized log-likelihood difference over fixed 'bonafide'/'spoof' token sequences (Eqs. 1–2) yields a continuous score comparable with conventional CMs, avoiding brittle free-text generation from a model not trained for the task.
Strong efficiency-results tradeoff
Honest comparison framing
Useful ablations
Weaknesses
Small, statistically unsupported advantage over the encoder-only variant
Unmatched baselines in the headline comparison
Single ALM, single scale
Protocol ambiguities
Unverifiable comparison to ref [29]
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Review: Spooftral — Voxtral ALM for Speech Spoofing Detection
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What EER does Spooftral achieve on ASVspoof5?
Spooftral reports a 4.25% equal error rate on the ASVspoof5 evaluation set (4.50% on the development set). It is a DoRA-adapted Voxtral-mini-3B with only ~55.1M trainable parameters (1.17% of 4.71B). Its encoder-only variant Spooftral-Enc reaches 5.08% on the same set, while the best open-condition ASVspoof5 challenge submission remains lower at 2.59%.
What is Spooftral?
It is a speech spoofing (audio deepfake) detector built on the Voxtral audio-language model. It scores each utterance by comparing length-normalized token-sequence likelihoods of the labels 'bonafide' and 'spoof' under a fixed instruction prompt, and is adapted to the task using DoRA, a low-rank parameter-efficient fine-tuning method applied only to attention layers.
Can audio-language models detect deepfake speech without fine-tuning?
According to this paper, not out of the box: linear probing of frozen Voxtral shows spoofing cues become less separable after the LLM decoder than at the Whisper-based audio-adapter output (e.g., 19.09% vs 9.75% EER on ASVspoof5 eval). Only after lightweight DoRA task training does the full model outperform its encoder-only variant on most evaluation sets.
Is Spooftral code available?
Yes, the paper links a public GitHub repository (github.com/avishai111/Spooftral). All experiments use publicly released ASVspoof databases; note that fine-tuning the 4.7B-parameter model in bfloat16 requires GPU resources, and checkpoint availability is not stated in the text.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures 1–3 (architecture, PaCMAP projections, per-attack detection rates) cannot be inspected from extracted text; figure-dependent conclusions rest on captions and prose.
- The quantitative Whisper baseline of ref [29] is absent from the text, so that specific comparison could not be verified.
- Equations were reconstructed from linearized extraction; minor notation ambiguities possible.
- arXiv v1 carries IEEE copyright (© 2026 IEEE); the published version may differ slightly.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.