# Every Breath You Don’t Take: Deepfake Speech Detection Using Breath

Seth Layton<EMAIL_ADDRESS>,  Thiago De Andrade<EMAIL_ADDRESS>,  Daniel Olszewski<EMAIL_ADDRESS>,  Kevin Warren<EMAIL_ADDRESS>,
Kevin Butler<EMAIL_ADDRESS>and  Patrick Traynor<EMAIL_ADDRESS>University
of FloridaGainesvilleFloridaUSA

###### Abstract.

Deepfake speech represents a real and growing threat to systems and society.
Many detectors have been created to aid in defense against speech deepfakes.
While these detectors implement myriad methodologies, many rely on low-level
fragments of the speech generation process. We hypothesize that breath, a
higher-level part of speech, is a key component of natural speech and thus
improper generation in deepfake speech is a performant discriminator. To
evaluate this, we create a breath detector and leverage this against a custom
dataset of online news article audio to discriminate between real/deepfake
speech. Additionally, we make this custom dataset publicly available to
facilitate comparison for future work. Applying our simple breath detector as
a deepfake speech discriminator on in-the-wild samples allows for accurate
classification (perfect 1.0 AUPRC and 0.0 EER on test data) across 33.6 hours
of audio. We compare our model with the state-of-the-art SSL-wav2vec model and
show that this complex deep learning model completely fails to classify the
same in-the-wild samples (0.72 AUPRC and 0.99 EER).

breath, synthetic, speech, audio, detection, deepfake

##  1\. Introduction

Deepfake speech (e.g., text-to-speech, deepfakes, voice assistants) aims to
make the differentiation between synthetic and organic speech difficult
(Lorenzo-Trueba et al., 2018; Saunders, 2019). While such audio has many
benign uses, the potential for dangerous applications has created the need for
accurate and automated demarcation of human-spoken from synthetically-
generated audio.

The research community has responded with competitions such as ASVspoof (Wu et
al., 2015; Kinnunen et al., 2017; Todisco et al., 2019; Yamagishi et al.,
2021), ADD (Yi et al., 2022), and SASV (Jung et al., 2022). These competitions
curate datasets of deepfake and real speech and invite participants to create
detection algorithms to test on these datasets. Subsequently, these datasets
are the de facto standard for deepfake speech and give a baseline of
comparison for all current and future deepfake speech detectors. Most of the
currently existing speech deepfakes detectors focus on low-level spectral
(e.g., spectrogram, MFCC, LFCC, and CQCC) imperfections created during the
audio generation pipeline and show starkly different classification results
vs. human interpreters (Warren et al., 2024). This technique of low-level
spectral detection will be rendered obsolete due to the rapid advancement of
the speech generation field. Thus, a paradigm shift towards high-level speech
features such as prosody detection (Attorresi et al., 2022), emotion detection
(Hosler et al., 2021), and anatomical shape detection (Blue et al., 2022) is
underway.

One promising avenue for high-level speech feature exploration is breath, as
breathing is one of the subtle ways that humans subconsciously perceive
naturalness in speech (Braunschweiler and Chen, 2013; elm, 2021; Székely et
al., 2020). Additionally, the demand for automatic breath detection methods
for medical research purposes is elevated due to COVID-19 (Deshpande and
Schuller, 2020). This demand influenced the INTERSPEECH 2020 Computational
Paralinguistics Challenge to create the Breathing Sub-Challenge, a track
dedicated to breath detection (Schuller et al., 2020). Current state-of-the-
art breath detection methods include spectral-based models (Hamke et al., [n.
d.]; Nallanthighal et al., 2021), acoustic models (Braunschweiler and Chen,
2013), and raw speech waveform deep learning (Nallanthighal et al., 2021).
While these methods automatically detect breath in audio, applying these
techniques to the realm of deepfake speech to demarcate real from speech
deepfakes is an open challenge. Towards this, we explore the viability of
breaths as a detection mechanism for deepfake speech.

Our work focuses on in-the-wild deepfake speech. News outlets inherently opt
for industry-standard high-quality synthetic speech to not deter listeners. We
note that there is a distinction between industry-standard and state-of-the-
art. This distinction creates a mismatch between academically-created and in-
the-wild deepfakes. Specifically, academia produces cutting-edge deepfakes,
but these deepfakes are rarely seen en masse on the internet. It is thus
important to study what is currently affecting the largest population and is
the focus of this work. Towards this, we gather speech samples from online
news vendors that employ a text-to-speech or human-read audio listening option
for online text articles. We then determine the efficacy of breath detection
as a deepfake speech discriminator using simple models. We compare our simple
models against a state-of-the-art model and highlight the shortcomings of
complex machine learning techniques. We focus on currently deployed deepfake
speech, which gives a measure for the industry standard in the field and as
such, we argue against the use of popular academic datasets such as ASVspoof.

Our main contributions are:

  * •

We perform a study of currently deployed in-the-wild synthetic speech.

  * •

We create a generation-agnostic deepfake speech detector based solely on
breaths.

  * •

We publish a dataset of in-the-wild text-to-speech and human-read speech.

  * •

We highlight shortcomings and over-reliance on complex deep learning detection
models.

The remainder of this paper is organized as follows: Section 2 states our
hypothesis; Section 3 details our methodology; Section 4 presents our
experimental results; Section 5 offers discussion and insights based on our
findings; Section 6 discusses related work; and Section 7 presents our
concluding remarks.

##  2\. Hypothesis

We hypothesize that current speech deepfakes generation techniques do _not_
sufficiently incorporate breaths.

To investigate this claim, we must first determine if breath is a
generalizable speech feature. Thus, we define our first research question:
_RQ1 $\cdot$ Are breaths automatically detectable, intra and inter-speaker?_

As breath is one of the ways that humans determine naturalness in speech; we
define our second research question:
_RQ2 $\cdot$ Do current deepfake voices generate breaths?_

Combining the previous research questions we define our final research
question:
_RQ3 $\cdot$ Are breaths able to accurately discriminate between in-the-wild
deepfake and real samples?_

##  3\. Methodology

To determine if breaths are a generalizable feature between speakers and
subsequently useful as a discriminator against real and fake speech we define
deepfake speech, gather real and fake data, implement and test detection
models, and evaluate the performance of breathing.

###  3.1. Cheapfake vs. Deepfake

Synthetic media is a spectrum that spans from generative (e.g., machine
learning and artificial intelligence) to manually altered (e.g., Photoshop and
speech waveform manipulation) samples. The use of deep neural networks creates
a deepfake and using cheap manual software manipulation creates a cheapfake
(Paris and Donovan, 2019). Specifically, a cheapfake requires a pre-existing
sample of a specific individual for manual modification; whereas, a deepfake
may be fully generative and not require a source sample. While both forms of
synthetic media influence society, we focus on the dominant form of synthetic
media known as deepfakes for the remainder of this paper. More critically, we
only consider media samples that are entirely real or entirely fake (i.e., no
partially fake samples with segments altered). Additionally, this extends to
manipulation techniques such as altering the rate of speech or changing the
pitch.

###  3.2. Dataset

We employ a multi-tiered model pipeline that requires independent datasets
during the training phase. We gather single-speaker podcast audio for training
the breath detector and online news articles read by humans and text-to-speech
algorithms for the final deepfake speech detection training and testing.

####  3.2.1. Why not ASVspoof

ASVspoof is the de facto standard dataset when creating and testing a deepfake
speech detector and it gives a community baseline for comparison. However, for
our task, this dataset is not representative, sufficient, or realistic. First,
our model relies on features of breathing and thus samples must be
sufficiently long to contain a breath (_93%_ of ASVspoof 2021 samples are
shorter than 5 seconds). As breaths in read and spontaneous speech are
expected at a rate of 8-14 per minute (Nallanthighal and Strik, 2019), each
ASVspoof sample is not expected to contain any of these important high-level
features. Additionally, many of the samples longer than 5 seconds are filled
with incoherent speech due to generation issues. Moreover, the class
distribution of the ASVspoof 2021 samples is unrealistic (_97%_ deepfake and
3% real in the evaluation set). This class distribution is vastly different
from the expected in the wild distribution and would require multiple
resampling techniques to correct, which could bias the results due to the vast
imbalance of the dataset (Layton et al., 2024). Finally, we opt to gather
samples that are _currently_ in the wild today as a better representation of
deepfake speech and contain a balanced real/fake class distribution.

####  3.2.2. Podcasts

We curate a training dataset of podcasts that meet specific criteria and
manually annotate these podcasts for breath locations. Each podcast is single-
speaker, contains no background music, is free from obvious background noise,
and breathing is noticeable. In total, we selected 10 podcasts from 4 speakers
totaling just over 5 hours. Each podcast is manually annotated for precise
breath locations by two independent annotators and a third annotator verifies
and reconciles any discrepancies in the annotations from each initial
annotator to ensure all breaths are captured.

####  3.2.3. News Articles

We gather news article audio from online news vendors for training and testing
our deepfake speech detector. We search for news articles with strings like
“Listen to this article” and “Hear the full article” keywords on the webpage
to indicate that there is an audio version of the transcript available. Manual
checking of the news vendor is required to determine if the news articles
provided are text-to-speech generated, or spoken by a human. In total, we
collected 277 TTS (26.94 hours) and 56 human-read (25.54 hours) news articles
from four different news outlets (two TTS sets and two human-read
sets).111Each sample is entirely deepfake, or entirely real. There is no
scenario for deepfake speech injected into real audio. We do not redistribute
the audio; however, links to news article websites are freely available at:
https://sites.google.com/view/ebydt/.

###  3.3. Breath Detection

First, we create a breath location detector to highlight breaths in a given
audio sample. Towards this, we take inspiration from rare-event detection
(Székely et al., 2019; Amiriparian and Schuller, [n. d.]) to create our
pipeline for breath detection. Unlike these works, however, we do not perform
image analysis on spectrograms, but instead use the raw values computed from
the spectrogram. Thus, all the layers of our model lose a dimension, reducing
model complexity and providing speed increases to training and inference which
helps real-time predictions.

Figure 1. A visual representation for a segment of speech containing a breath
using a $window\\_length$ of 20ms and a $hop\\_length$ of 2.5ms. During the
spoken segments before and after the breath RMSE is at peak values while the
ZCR is at minimum values. Immediately surrounding a breath is a non-voiced
segment where the RMSE values drop and ZCR values rise, but then both move to
a medium value during the breath. Additionally, the background mel spectrogram
shows higher energy across all frequencies during spoken segments, medium
energy at lower frequencies during breaths, and relatively little energy at
all frequencies for silence.

####  3.3.1. Feature Selection

We first calculate raw values of the mel-spectrogram (dB converted), zero
crossing rate (ZCR), and root mean squared energy (RMSE) (dB converted). Each
of these features slides a window over a waveform to calculate an overlapping
temporal-based value. As the size of the window and the duration between
windows may be optimized we test a variety of values ranging from 5ms – 200ms
$window\\_length$ and 2.5ms – 25ms $hop\\_length$. The result of this feature
extraction is an array of frames that contain spectrogram, ZCR, and RMSE
values for an entire audio sample. The number of frames in an array is
calculated as
${num_{frames}=\frac{sample\\_duration(milliseconds)}{hop\\_length}}$, and the
value of each frame is the aggregated mel-spectrogram, ZCR, and RMSE for
$window\\_length$ duration. For example, a 5-second excerpt of audio with a
$window\\_length$ of 50ms and a $hop\\_length$ of 5ms creates a 1000-frame
array. We test a spectrum of sizes, shapes, and durations for these features
and select a $window\\_length$ of 20ms, a $hop\\_length$ of 2.5ms, and 128
mel-spectrogram buckets for our final model as these produce the best results.

Next, using the manually annotated location of breath we denote each frame in
the array as either a breath (i.e., positive class) or not a breath (i.e.,
negative class). A frame is considered to contain breath if more than half the
$window\\_length$ of that frame is annotated as a breath. Figure 1 shows our
selected features and how they change during a breath and speaking
before/after breathing. For breaths, ZCR and RMSE tend towards medium values
between silence and spoken segments and the mel-spectrogram shows only energy
at lower frequencies.

####  3.3.2. Model Architecture

Based on Székely et al. (Székely et al., 2019) we build a multi-tiered
convolutional and recurrent neural net detection model. The model architecture
starts with two 1D convolutional layers (16 and 8 filters, 3 and 1 kernel
sizes, same padding, and ReLU activation); each convolutional layer is
followed by batch normalization, max pooling (pool size of 3), and 0.2
dropout. These initial layers are used as input to a bidirectional-LSTM layer
which feeds into a dense layer with a sigmoid activation for final prediction.
We use a binary cross-entropy loss as the loss function and Adam as the
optimizer function. The pipeline for this model is shown in Figure 2 (using a
$window\\_length$ of 20ms, a $hop\\_length$ of 2.5ms, 128 mel-spectrogram
buckets, and a batch size of 32). We experimented with many different shapes
and sizes for our breath detection model architecture such as changing the
total number of convolutional layers, adjusting the number of filters and
kernel sizes of each convolutional layer, altering the default max pool size,
and changing the size of the dropout layer. Ultimately we select the sizes and
parameters defined in Figure 2.

As input to our breath detection model, an entire audio sample is sectioned
off into 2-second segments and sequentially fed to the model with predictions
given for every 50ms (i.e., 40 predictions per 2-second chunk). We opt for
2-second slices of audio as increasing the duration of the slices subsequently
increased training and inference time without improving performance. A
2-second segment is 800 2.5ms slices of features and there are 128 values from
the mel-spectrogram and 1 feature from each of the ZCR and RMSE giving a total
of 130 features. The shape of (32 x 800 x 130) is given as input to our breath
detector as we use a batch size of 32. The output for a 2-second chunk of
audio is 40 sequential binary classifications as to whether or not there is a
breath located in each 50ms slice.

####  3.3.3. Model Result Post-Processing

Our pipeline implements a simple mechanism on the resultant predictions. We
remove any predicted breaths that are shorter than 150ms as we measured no
breaths shorter than 150ms in any of our podcasts. This post-processing
affects few samples, yet helps smooth out the resultant breath locations. We
then use these breath locations as input features for the deepfake speech
detection algorithm.

####  3.3.4. Metrics

We use a multitude of metrics for our full pipeline and evaluation of
intermediary and final results. For breath detection, we use the binary cross
entropy loss function for hyperparameter tuning and use Area Under the
Precision-Recall Curve (AUPRC) for evaluating model performance. We use AUPRC
as our main metric as it is robust to imbalanced data (Arp et al., 2022; Fu et
al., 2019) and effectively highlights performance on the important class. As
breaths are an imbalanced class distribution problem (i.e., non-breathing
heavily outweighs breathing in normal speech) and are the important class,
AUPRC is a suitable metric for honestly evaluating performance.

Figure 2. A visual representation of the breath detection model architecture.

###  3.4. Deepfake Speech Detection

The final component of our pipeline uses the predicted breath locations as
input. For an audio sample, we use the predicted breath locations to calculate
three features: average breaths per minute, average breath duration, and
average spacing between breaths. With these features, we create multiple
simple deepfake speech detectors to test the viability of computationally
inexpensive methods and compare models to a complex deep learning model
(Section 4.2.3). The first is a thresholding classifier that uses previously
measured breath statistics. The second is a C-Support Vector Classification
(SVC) algorithm with a poly kernel, a regularization parameter of 1, and a
degree of 2. Finally, we implement a three-tiered decision tree with default
parameters. Each of these mechanisms produces a single binary prediction for
the entire audio sample. The pipeline for this deepfake detection model is
shown in Figure 3.

The thresholding method should be sufficient as a final discriminator if
deepfake speech does not produce any breaths. However, if breaths are
produced, then a more robust mechanism would be required to accurately
discriminate between real and fake samples. Thus, we apply both techniques and
compare the results to determine viability and then compare them to complex
and computationally expensive state-of-the-art.

####  3.4.1. Metrics

For the final deepfake speech detector, we implement a range of metrics to
help contextualize model performance, as single metrics may fail to honestly
describe model performance. These metrics are accuracy, F1-score, precision,
recall, AUPRC, equal error rate (EER), true positives, true negatives, false
positives, and false negatives. For the thresholding method, we are unable to
use AUPRC and EER as these metrics require probabilities, and only a
prediction is generated. Finally, we note that the use of EER as a performance
metric is deprecated by ISO/IEC standards (Delgado et al., 2021) and has been
shown to obfuscate results (Brümmer et al., 2021; Sugrim et al., 2019);
however, EER remains the current community standard for deepfake speech
detection.

Figure 3. A visual representation of the final stage of the detection
pipeline. We use/compare three different simple classifiers in the last stage
to showcase the relative interchangeability of models for final prediction.

##  4\. Experiments

To sufficiently answer our research questions defined in Section 2 we perform
two experiments starting with breath generalizability and finishing with
deepfake speech (deepfake) detection.

###  4.1. Breath Generalizability (RQ1)

To understand if breath sounds are generalizable between different individuals
(thereby justifying them as a deepfake speech discriminator), we create three
tests. RQ1 tests the generalizability of breathing with Test 1 obtaining a
comparative baseline for successive tests, Test 2 examining the performance of
each podcast, and Test 3 examining the performance of each speaker. Each test
uses our breath detection model defined in Section 3.3 without any changes.

####  4.1.1. Test 1

Test 1 creates a best-case baseline for comparison with Tests 2 and 3
employing k-fold cross-validation. Test 1 takes $(\frac{1}{x}*100)\%$
consecutive frames, where $x$ is the total number of podcasts, randomly from
each podcast to use as the validation set and uses the remaining
$100-(\frac{1}{x}*100)\%$ from each podcast as the training set. We do this
process 100 times and calculate the validation AUPRC to obtain a baseline for
comparison. This test gives the best-case scenario due to having a subsample
of every podcast/speaker in each training and validation batch. This is in
contrast to the following two tests which avoid overlapping training and
validation speakers/podcasts.

####  4.1.2. Test 2

Test 2 employs a leave-one-out strategy to determine the impact on breath
detection for each podcast. A podcast is set aside individually as the
validation set and the remaining $x-1$ podcasts become the training set. We
retrain our breath detection model using the training set and calculate the
AUPRC for the validation set. We do this for all $x$ podcasts and compare the
results to Test 1 to highlight any podcasts that may be problematic, or not
generalizable.

####  4.1.3. Test 3

While similar to Test 2, Test 3 evaluates the impact on breath detection for a
single speaker. Towards this, all podcasts from a specific speaker are set
aside as the validation set and the remaining speaker’s podcasts become the
training set. Again we retrain our breath detection model using the training
set and calculate the AUPRC for the validation set. This process is repeated
for each speaker and compared against Test 1 to determine if breaths are
generalizable between speakers.

Figure 4. The baseline validation testing on all podcasts vs. the leave-one-
out testing for each podcast and each speaker. Each point is a specific
speaker/podcast as the validation set. We show that breath measured in this
capacity is generalizable and thus useful as a deepfake speech discriminator.

####  4.1.4. Results

Figure 4 shows the results of these three tests. We use the baseline AUPRC of
$\sim$0.93 from Test 1 to compare Tests 2 and 3. Test 2 shows podcast-specific
leave-one-out performance between $\sim$0.84 and $\sim$0.95, which is a marked
reduction in performance from the baseline (Test 1). Test 3 shows speaker-
specific leave-one-out performance between $\sim$0.78 and $\sim$0.94, which is
also a reduction in performance from the baseline. This reduction is expected
as in Test 1 there is training data of similar distribution to the validation
in every iteration since validation is derived as a subset of each podcast as
described in Section 3.3. However, we see an AUPRC mean and standard deviation
of 0.931$\pm$0.008, 0.911$\pm$0.041, and 0.84$\pm$0.062 for Test 1/2/3
respectively. This indicates that breaths are generalizable and thus usable as
a general discriminator for deepfake speech (RQ1).

###  4.2. Deepfake Speech Detection (RQ2, RQ3)

####  4.2.1. Setup

Now that we have shown the generalizability of breaths between individuals, we
apply this methodology as a discriminator for deepfake and real speech using
the three methods described in Section 3.4. First, we train our breath
detection model on all the podcast data to ensure the best possible final
model. Next, we pass the news article data outlined in Section 3.2.3 to this
final model to get breath locations for each news article. We then use the
breath locations and calculate the three features detailed in Section 3.2.
Figure 5 shows the clear delineation between the deefpake and real news
article breath features. We demonstrate that deepfake speech, as seen in the
wild today, _does not appropriately produce breaths_ , which indicates a
strong discriminator using these features (RQ2). Finally, we split the news
articles into a training and testing set where no samples from the same news
outlet are in the training and test sets. This split comes out to 101 training
samples (18.9 hours) and 232 testing samples (33.6 hours) and ensures no bias
when testing.

For the poly SVC and decision tree methodologies, we train our model (Section
3.4) with the training set and evaluate performance on the test set. Whereas
for the thresholding methodology, we do not need to split the news articles
into a training and test set as there is no training taking place since this
is not a machine learning model; however, we show results for both the
training and test sets to compare against the poly SVC method. Observing
Figure 5 we show that in each calculated metric real samples have a non-zero
value. We use this as our guideline and set the threshold for each metric to
be $Value>0.0=Real,Value<=0.0=Fake$. For this simple thresholding, we require
that all features (i.e., avg. bpm, avg. breath spacing, and avg. breath
duration) be $>0.0$ to be considered real. Stated concisely, for any sample
feature that contains a zero value that sample is considered fake.

Figure 5. We show that there is a clear distinction (i.e., virtually no
overlap) between human-read and synthetically-generated news articles with
respect to breath statistics. The only overlap present is in outliers from
each type of speech.

####  4.2.2. Results

Table 1 shows the training and test results for the news article dataset. We
show that a simple SVC model can accurately discriminate between real/deepfake
speech samples without overfitting the training set. We show substantial
performance across all metrics, and most importantly, _perfect_ performance
against the test set. Using breaths, we correctly predict all deepfake samples
without falsely predicting any real samples (RQ3). Additionally, we show
performant results on a varying distribution of data, as the generation
techniques for each of the news articles are unknown. Additionally, Table 1
contains the results for our thresholding methodology. We only display results
for the testing set as there is no training required by this technique.
Through this, we show that simple thresholding obtains performant results
against all news articles. While these results are slightly worse than the
results of the SVC model, they do not require any training or testing
differentiation and as such, no training time. We posit that simple
thresholding is sufficient to capture the nuance in breathing for real and
synthetically generated audio samples (RQ3).

| Model | Dataset | EER | AUPRC | Accuracy | F1 | Precision | Recall | TP | FP | TN | FN
---|---|---|---|---|---|---|---|---|---|---|---|---
Simple Models | $Poly\>SVC$ | Train | 0.14 | 0.90 | 0.92 | 0.94 | 0.95 | 0.91 | 71 | 5 | 24 | 1
$(OurModel)$ | Test | 0.00 | 1.00 | 1.00 | 1.00 | 1.00 | 1.00 | 205 | 0 | 27 | 0
$Decision\>Tree$ | Train | 0.11 | 0.95 | 0.92 | 0.94 | 0.96 | 0.90 | 72 | 6 | 23 | 0
$(OurModel)$ | Test | 0.02 | 0.98 | 0.98 | 0.99 | 1.00 | 0.96 | 205 | 2 | 25 | 0
$Thresholding$ | Train | – | – | – | – | – | – | – | – | – | –
$(OurModel)$ | Test | – | – | 0.90 | 0.91 | 0.95 | 0.90 | 182 | 0 | 32 | 18
Complex Models | $wav2vec-_{P}$ | Train | – | – | – | – | – | – | – | – | – | –
($Pretrained$) | Test | 0.99 | 0.72 | 0.57 | 0.9 | 0.95 | 0.56 | 205 | 24 | 3 | 0
$wav2vec-_{R}$ | Train | 0.00 | 0.95 | 1.00 | 1.00 | 1.00 | 1.00 | 72 | 0 | 29 | 0
($Retrained$) | Test | 0.77 | 0.06 | 0.10 | 0.12 | 0.06 | 0.50 | 0 | 0 | 27 | 205
Table 1. Results for all simple detection models (poly SVC, decision tree, and
thresholding). With the poly SVC model, we obtain performant results on all
metrics for the training set, accompanied by a perfect performance on the test
set. We demonstrate that the pretrained wav2vec model falls short compared to
our model in every metric and augmenting the train set with “in-distribution”
data and retraining does not solve these shortcomings.

####  4.2.3. Experimental Comparison to Other Detectors

To fully contextualize the performance of our breath detector we compare our
models against a highly complex and heavily trained model: SSL-wav2vec2.0.
Towards this, we implement the XLS-R-based deepfake detector (Tak et al.,
2022), as this model is the current best performer on the ASVspoof 2021
dataset by a substantial margin. While we do not use the ASVspoof 2021 dataset
in any capacity, the XLS-R model was pretrained on 436,000 hours of non-
ASVspoof speech data and is sufficiently performant on non-ASVspoof datasets.

We deploy the pretrained ($wav2vec-_{P}$) model and additionally, to ensure a
fair comparison, we fine-tune SSL-wav2vec2.0 with additional training
($wav2vec-_{R}$). We implement this fine-tuning by augmenting the SSL-
wav2vec2.0 training data with the 18.9 hours of news articles from our
training set. This is the same methodology used to retrain SSL-wav2vec2.0 for
ASVSpoof 2021.

We pass the test set of news articles to both versions of SSL-wav2vec (in
4-second chunks, due to model requirements) and use a probability soft voting
scheme to get a single prediction for each audio file. Table 1 shows the
results of these models and shows that our model outperforms in every metric.
The pretrained SSL-wav2vec predicts nearly the entire test set as deepfake
speech whereas the retrained model predicts all the test data as real speech
(while predicting the train set with 100% accuracy). The highlighted sections
in Table 1 show the classification decision for all news articles in the test
set for each of the model types (i.e., SVC, Decision Tree, SSL-wav2vec2.0). We
note that $wav2vec-_{R}$ predicts all news articles as real and may seem as
though the training phase was incorrectly handled; however, looking at the
results of $wav2vec-_{R}$ on the training data shows that it indeed picks up
the signal in the data. Through this, we show that our models perform
substantially better in every category than the complex models, specifically
looking at the false positives it is clear to see that alarm fatigue (Cvach,
2012) would overwhelm $wav2vec-_{P}$. Comparing this to our models which have
essentially no false positives, it is clear to see the potential shortcomings
of complex models.

As the thesis of our paper argues, we demonstrate that models focused on low-
level speech features can completely fail when tasked with predicting new data
as seen by the contradicting results between $wav2vec-_{P}$ and
$wav2vec-_{R}$. Simply put, using a complex and highly-trained model trained
on low-level speech features provides unpredictable results, even when
augmenting additional “in-distribution” training data; whereas higher-level
speech features can help prevent failure.

###  4.3. Summary of Research Questions

Through our experiments, we show that breaths are automatically and accurately
detectable between the same speaker and throughout different speakers (RQ1),
current in-the-wild deepfake speech does not produce breaths (RQ2), and using
breaths as a discriminator between real and fake samples obtains performant
results (RQ3).

##  5\. Discussion

We discuss additional material that is important to the fundamental science of
machine learning and deepfake discrimination.

###  5.1. Reproducibility

Reproducibility is a growing concern, especially for machine learning
(Olszewski et al., 2023). To alleviate these issues and to aid future work and
comparison, we make efforts to increase the reproducibility of our work.
First, we publish the code and framework we use for our entire
pipeline.222Code available upon publication. Second, we publish the trained
models and raw model scores files.333Scores file available upon publication.
We release the trained model and scores file as an additional artifact as it
has been shown that retraining the same model on different GPUs may produce
different results (Abdullah et al., 2021). This gives future researchers the
ability to calculate _any and all_ metrics that may be desired for comparison.

###  5.2. Limitations and Future Work

If these deepfake samples start producing frequent breathing, our relatively
simple discriminators will likely produce worse results. To accommodate this,
a shift towards natural language processing (NLP) could be combined with our
work. This combination would allow contextualization between the breaths that
are identified and the intra-speech location relative to other parts of
speech. This contextualization would minimize false positive breath detection
and improve the results of a deepfake detector.

##  6\. Related Work

Recently, multiple papers have begun the exploration of breath importance in
deepfake speech. However, none of these papers make any claims on _current_
deepfake speech deployed in the wild. Mostaani et al. investigated whether
breathing patterns are present in text-to-speech (TTS) and voice conversion
(VC) algorithms using ASVspoof 2019 (Mostaani and Doss, 2022). This work
showed that TTS algorithms fail to properly generate breaths while VC
algorithms seem to retain breath pattern-related information. As TTS is
rapidly dwarfing VC as the main proponent of deepfake speech, this work shows
promise for breath usage as a speech deepfakes discriminator. Additionally,
the Breathing-Talking-Silence Encoder (BTS-E) algorithm was proposed as an
addition to existing countermeasures (CM) for voice spoofing attacks that use
breath and silence event detection to enhance existing CM performance by up to
46% (Doan et al., 2023). BTS-E leverages three Gaussian Mixture Models (GMM)
to segment/label input audio into talking, silence, and breath segments. This
segmentation is then translated into a latent feature space and combined with
the last hidden layer in an existing CM to focus that CM on
talking/breathing/silence events. However, the feature importance of breathing
vs. silence is not explored in BTS-E; which is problematic as Müller et al.
(Müller et al., 2021) identify an uneven distribution of leading and trailing
silence duration in the ASVspoof 2019 and 2021 datasets, which correlate with
the target prediction label. Thus, simply examining the silence patterns in
the files allows for accurate classification of real/speech deepfakes. As
such, it is unclear whether the breath features in BTS-E are important and the
value of breaths is unknown.

Our work, instead, focuses solely on the prevalence of breaths and on samples
gathered from real-world use. These real-world samples give an accurate
measure of the landscape of deepfake speech as it stands currently. We make
the first attempts at discriminating between real and fake in-the-wild speech
using breathing.

##  7\. Conclusion

Deepfake speech generation advancements are reducing the gap between human-
spoken and human-sounding audio. Deepfake speech will become imperceivable to
human speech, as such a focus needs to be placed on _how_ this speech is
performed. Toward this, we employ a multi-tiered pipeline that focuses on
breathing to discriminate between real/deepfake speech samples. We show that
breaths are generalizable between speakers and that simple calculated breath
features provide accurate classification results (perfect 1.0 AUPRC and 0.0
EER) on a dataset of in-the-wild real and synthetically-generated speech.
Furthermore, we show the shortcomings of a complex deep learning model that
fails to classify the same in-the-wild samples (0.72 AUPRC and 0.99 EER).

## References

  * (1)
  * elm (2021) 2021\.  _Take a Breath: Respiratory Sounds Improve Recollection in Synthetic Speech_.  https://doi.org/10.21437/Interspeech.2021-1496 Pages: 3200.
  * Abdullah et al. (2021) Hadi Abdullah, Kevin Warren, Vincent Bindschaedler, Nicolas Papernot, and Patrick Traynor. 2021\.  Sok: The faults in our asrs: An overview of attacks against automatic speech recognition and speaker identification systems. In _2021 IEEE symposium on security and privacy (SP)_. IEEE, 730–747.
  * Amiriparian and Schuller ([n. d.]) Shahin Amiriparian and Björn Schuller. [n. d.].  Deep convolutional recurrent neural network for rare acoustic event detection.
  * Arp et al. (2022) Daniel Arp, Erwin Quiring, Feargus Pendlebury, Alexander Warnecke, Fabio Pierazzi, Christian Wressnegger, Lorenzo Cavallaro, and Konrad Rieck. 2022.  Dos and don’ts of machine learning in computer security. In _31st USENIX Security Symposium (USENIX Security 22)_. 3971–3988.
  * Attorresi et al. (2022) Luigi Attorresi, Davide Salvi, Clara Borrelli, Paolo Bestagini, and Stefano Tubaro. 2022.  Combining automatic speaker verification and prosody analysis for synthetic speech detection.  _arXiv preprint arXiv:2210.17222_ (2022).
  * Blue et al. (2022) Logan Blue, Kevin Warren, Hadi Abdullah, Cassidy Gibson, Luis Vargas, Jessica O’Dell, Kevin Butler, and Patrick Traynor. 2022\.  Who Are You (I Really Wanna Know)? Detecting Audio $\\{$DeepFakes$\\}$ Through Vocal Tract Reconstruction. In _31st USENIX Security Symposium (USENIX Security 22)_. 2691–2708.
  * Braunschweiler and Chen (2013) Norbert Braunschweiler and Langzhou Chen. 2013.  Automatic detection of inhalation breath pauses for improved pause modelling in HMM-TTS.  _The ISCA Speech Synthesis Workshop_ (2013), 6.
  * Brümmer et al. (2021) Niko Brümmer, Luciana Ferrer, and Albert Swart. 2021\.  Out of a hundred trials, how many errors does your speaker verifier make?  _arXiv preprint arXiv:2104.00732_ (2021).
  * Cvach (2012) Maria Cvach. 2012\.  Monitor alarm fatigue: an integrative review.  _Biomedical instrumentation & technology_ (2012).
  * Delgado et al. (2021) Héctor Delgado, Nicholas Evans, Tomi Kinnunen, Kong Aik Lee, Xuechen Liu, Andreas Nautsch, Jose Patino, Md Sahidullah, Massimiliano Todisco, Xin Wang, et al. 2021\.  Asvspoof 2021: Automatic speaker verification spoofing and countermeasures challenge evaluation plan.  _arXiv preprint arXiv:2109.00535_ (2021).
  * Deshpande and Schuller (2020) Gauri Deshpande and Björn Schuller. 2020.  An Overview on Audio, Signal, Speech, & Language Processing for COVID-19.  _arXiv:2005.08579 [cs, eess]_ (May 2020).  arXiv: 2005.08579.
  * Doan et al. (2023) Thien-Phuc Doan, Long Nguyen-Vu, Souhwan Jung, and Kihun Hong. 2023.  BTS-E: Audio Deepfake Detection Using Breathing-Talking-Silence Encoder. In _ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_. IEEE, 1–5.
  * Fu et al. (2019) Guang-Hui Fu, Lun-Zhao Yi, and Jianxin Pan. 2019.  Tuning model parameters in class-imbalanced learning with precision-recall curve.  _Biometrical Journal_ 61, 3 (2019), 652–664.
  * Hamke et al. ([n. d.]) Eric E Hamke, Ramiro Jordan, and Manel Ramon-Martinez. [n. d.].  Breath Activity Detection Algorithm.  ([n. d.]), 11.
  * Hosler et al. (2021) Brian Hosler, Davide Salvi, Anthony Murray, Fabio Antonacci, Paolo Bestagini, Stefano Tubaro, and Matthew C Stamm. 2021.  Do deepfakes feel emotions? A semantic approach to detecting deepfakes via emotional inconsistencies. In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_. 1013–1022.
  * Jung et al. (2022) Jee-weon Jung, Hemlata Tak, Hye-jin Shim, Hee-Soo Heo, Bong-Jin Lee, Soo-Whan Chung, Ha-Jin Yu, Nicholas Evans, and Tomi Kinnunen. 2022.  SASV 2022: The first spoofing-aware speaker verification challenge.  _arXiv preprint arXiv:2203.14732_ (2022).
  * Kinnunen et al. (2017) Tomi Kinnunen, Md Sahidullah, Héctor Delgado, Massimiliano Todisco, Nicholas Evans, Junichi Yamagishi, and Kong Aik Lee. 2017\.  The ASVspoof 2017 challenge: Assessing the limits of replay spoofing attack detection.  (2017).
  * Layton et al. (2024) Seth Layton, Tyler Tucker, Daniel Olszewski, Kevin Warren, Kevin Butler, and Patrick Traynor. 2024\.  SoK: The Good, The Bad, and The Unbalanced: Measuring Structural Limitations of Deepfake Datasets. In _Proceedings of the USENIX Security Symposium (Security)_.
  * Lorenzo-Trueba et al. (2018) Jaime Lorenzo-Trueba, Fuming Fang, Xin Wang, Isao Echizen, Junichi Yamagishi, and Tomi Kinnunen. 2018.  Can we steal your vocal identity from the Internet?: Initial investigation of cloning Obama’s voice using GAN, WaveNet and low-quality found data. In _Speaker and Language Recognition Workshop_.
  * Mostaani and Doss (2022) Zohreh Mostaani and Mathew Magimai Doss. 2022.  On breathing pattern information in synthetic speech. In _Proc. Interspeech_.
  * Müller et al. (2021) Nicolas M Müller, Franziska Dieckmann, Pavel Czempin, Roman Canals, Konstantin Böttinger, and Jennifer Williams. 2021.  Speech is silver, silence is golden: What do ASVspoof-trained models really learn?  _arXiv preprint arXiv:2106.12914_ (2021).
  * Nallanthighal et al. (2021) Venkata Srikanth Nallanthighal, Zohreh Mostaani, Aki Härmä, Helmer Strik, and Mathew Magimai-Doss. 2021\.  Deep learning architectures for estimating breathing signal and respiratory parameters from speech recordings.  _Neural Networks_ 141 (2021), 211–224.
  * Nallanthighal and Strik (2019) Venkata Srikanth Nallanthighal and H Strik. 2019.  Deep sensing of breathing signal during conversational speech.  (2019).
  * Olszewski et al. (2023) Daniel Olszewski, Allison Lu, Carson Stillman, Kevin Warren, Cole Kitroser, Alejandro Pascual, Divyajyoti Ukirde, Kevin Butler, and Patrick Traynor. 2023.  ”Get in Researchers; We’re Measuring Reproducibility”: A Reproducibility Study of Machine Learning Papers in Tier 1 Security Conferences. In _Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security_. 3433–3459.
  * Paris and Donovan (2019) Britt Paris and Joan Donovan. 2019.  Deepfakes and cheap fakes.  (2019).
  * Saunders (2019) Jonathan Saunders. 2019\.  Detecting Deep Fakes With Mice : Machines vs Biology. In _Black Hat USA_.
  * Schuller et al. (2020) Björn W. Schuller, Anton Batliner, Christian Bergler, Eva-Maria Messner, Antonia Hamilton, Shahin Amiriparian, Alice Baird, Georgios Rizos, Maximilian Schmitt, Lukas Stappen, Harald Baumeister, Alexis Deighton MacIntyre, and Simone Hantke. 2020.  The INTERSPEECH 2020 Computational Paralinguistics Challenge: Elderly Emotion, Breathing & Masks. In _Interspeech 2020_. ISCA, 2042–2046.
  * Sugrim et al. (2019) Shridatt Sugrim, Can Liu, Meghan McLean, and Janne Lindqvist. 2019\.  Robust performance metrics for authentication systems. In _Network and Distributed Systems Security (NDSS) Symposium 2019_.
  * Székely et al. (2019) Éva Székely, Gustav Eje Henter, and Joakim Gustafson. 2019.  Casting to corpus: Segmenting and selecting spontaneous dialogue for TTS with a CNN-LSTM speaker-dependent breath detector. In _ICASSP 2019-2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_. IEEE, 6925–6929.
  * Székely et al. (2020) Éva Székely, Gustav Eje Henter, Jonas Beskow, and Joakim Gustafson. 2020.  Breathing and Speech Planning in Spontaneous Speech Synthesis. In _ICASSP 2020 - 2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_. 7649–7653.  ISSN: 2379-190X.
  * Tak et al. (2022) Hemlata Tak, Massimiliano Todisco, Xin Wang, Jee-weon Jung, Junichi Yamagishi, and Nicholas Evans. 2022\.  Automatic speaker verification spoofing and deepfake detection using wav2vec 2.0 and data augmentation.  _arXiv preprint arXiv:2202.12233_ (2022).
  * Todisco et al. (2019) Massimiliano Todisco, Xin Wang, Ville Vestman, Md Sahidullah, Héctor Delgado, Andreas Nautsch, Junichi Yamagishi, Nicholas Evans, Tomi Kinnunen, and Kong Aik Lee. 2019\.  ASVspoof 2019: Future horizons in spoofed and fake audio detection.  _arXiv preprint arXiv:1904.05441_ (2019).
  * Warren et al. (2024) Kevin Warren, Tyler Tucker, Anna Crowder, Daniel Olszewski, Allison Lu, Caroline Fedele, Magdalena Pasternak, Seth Layton, Kevin Butler, Carrie Gates, and Patrick Traynor. 2024.  Better Be Computer or I’m Dumb”: A Large-Scale Evaluation of Humans as Audio Deepfake Detectors. In _Proceedings of the ACM Conference on Computer and Communications Security (CCS)_.
  * Wu et al. (2015) Zhizheng Wu, Tomi Kinnunen, Nicholas Evans, Junichi Yamagishi, Cemal Hanilçi, Md Sahidullah, and Aleksandr Sizov. 2015\.  ASVspoof 2015: the first automatic speaker verification spoofing and countermeasures challenge. In _Sixteenth annual conference of the international speech communication association_.
  * Yamagishi et al. (2021) Junichi Yamagishi, Xin Wang, Massimiliano Todisco, Md Sahidullah, Jose Patino, Andreas Nautsch, Xuechen Liu, Kong Aik Lee, Tomi Kinnunen, Nicholas Evans, et al. 2021\.  ASVspoof 2021: accelerating progress in spoofed and deepfake speech detection.  _arXiv preprint arXiv:2109.00537_ (2021).
  * Yi et al. (2022) Jiangyan Yi, Ruibo Fu, Jianhua Tao, Shuai Nie, Haoxin Ma, Chenglong Wang, Tao Wang, Zhengkun Tian, Ye Bai, Cunhang Fan, et al. 2022\.  Add 2022: the first audio deep synthesis detection challenge. In _ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_. IEEE, 9216–9220.