Replay Attacks Against Audio Deepfake Detection

This research introduces ReplayDF, a dataset and study of how physically replaying and re-recording synthetic speech, rather than sending a raw digital file, can help deepfakes evade detection. Authored by Resemble AI's Nicolas Müller, Piotr Kawa, and Aditya Tirumala Bukkapatnam alongside researchers at Fraunhofer AISEC, Wrocław University of Science and Technology, Technical University of Cluj-Napoca, Neodyme AG, and TU Munich. Peer reviewed and presented at INTERSPEECH 2025.

Overview

Most deepfake detectors are tested against clean digital audio, the exact file a voice-cloning tool produced. But a lot of real-world fraud doesn't work that way: a scammer plays a cloned voice through a phone or laptop speaker, and it gets picked up by a microphone on the other end, a call center line, a voice authentication system, or a recording device. That physical trip through the air, out of one speaker and into a microphone, changes the audio in ways that turn out to matter a lot.

This research shows that this "replay attack" can disguise deepfakes as genuine by removing the subtle digital artifacts detectors are trained to catch. The team built ReplayDF, a dataset of audio played and re-recorded across 109 different speaker-and-microphone setups, to measure exactly how much this hurts detection, and to test whether detectors can be hardened against it.

Dowload the full research PDF on arXiv. ‍

Methodology

The team built ReplayDF by taking real speech (from the M-AILABS dataset) and synthetic speech (from MLAAD, generated by four TTS systems: Bark, VITS, XTTS v1.1, and XTTS v2), then physically playing each clip through a loudspeaker and re-recording it with a microphone, 109 different speaker-and-microphone combinations in total, across six languages. Every setup also captured a room impulse response, essentially a fingerprint of how that specific room and hardware combination shapes sound, plus human-rated quality scores (Mean Opinion Score) and an objective audio-quality metric (PESQ) for every recording.

With that dataset built, the team ran three rounds of testing. First, they checked six existing open-source deepfake detectors against both the original digital files and the replayed versions, all six got measurably worse on replayed audio. Second, they took the best-performing architecture and retrained it from scratch on five different training datasets to rule out "maybe it just needs different training data", replay attacks still degraded every version. Third, to make sure this wasn't simply "adding noise confuses the model," they added synthetic noise directly to the original clean files and found almost no effect, confirming that replaying specifically strips out something detectors rely on, not just general audio quality.

Results

Replaying audio through real speakers and microphones convincingly disguises deepfakes, and it does so consistently. Across six open-source detectors, accuracy dropped by as much as 20 percentage points once digital files were swapped for their played-and-re-recorded versions. The best-performing model, tested and retrained across five datasets, still saw its error rate more than triple, from 4.7% to 18.2%, regardless of what data it had been trained on.

The failure is asymmetric, it fakes evading detection, not real audio being wrongly flagged. Genuine recordings' classification was essentially unaffected by the replay process; the entire performance hit came from spoofed audio suddenly looking authentic. The team also found that detection difficulty tracked recording quality: the more degraded or aggressive the replay (lower Mean Opinion Score, lower PESQ), the worse detection got, a real, measurable correlation, not just an anecdotal pattern.

On mitigation, retraining the detector with room-impulse-response data from ReplayDF recovered a meaningful chunk of the lost accuracy, improving the error rate from 18.2% back down to 11.0%. That's real progress, but it's not a full fix, 11.0% is still more than double the original 4.7% baseline. Replay attacks are a genuine, only partially-solved vulnerability.

Why this matters: This isn't a lab curiosity, it's a realistic fraud path. Voice authentication over a phone line, a call center recording a conversation, a meeting bot capturing audio through a room's microphone, all of these involve exactly the kind of speaker-to-microphone journey this research tested. A detector that only works on pristine digital files isn't sufficient for systems that receive audio secondhand, through a phone network, a room, or a recording device. Understanding this failure mode, and that today's best partial fix still leaves a real gap, is exactly the kind of finding that should shape how detection gets deployed in telecom, call centers, and voice-authentication products, not just how it performs in a benchmark.

Limitations

• All six detectors tested are open-source, publicly available models; this doesn't directly measure how any specific commercial detector, including Resemble's own, holds up against replay attacks.
• The dataset covers four TTS systems (Bark, VITS, XTTS v1.1, XTTS v2) and six languages, real-world voice cloning tools and languages extend well beyond this set.
• Room-impulse-response augmentation is a partial mitigation, not a solved problem: the best retrained result (11.0% EER) remains well above the unaffected baseline (4.7%).

How to cite this paper

APA Müller, N., Kawa, P., Choong, W.-H., Stan, A., Tirumala Bukkapatnam, A., Pizzi, K., Wagner, A., & Sperl, P. (2025). Replay attacks against audio deepfake detection. Interspeech 2025.

BibTeX @article{muller2025replaydf, title={Replay Attacks Against Audio Deepfake Detection}, author={Müller, Nicolas and Kawa, Piotr and Choong, Wei-Herng and Stan, Adriana and Tirumala Bukkapatnam, Aditya and Pizzi, Karla and Wagner, Alexander and Sperl, Philip}, journal={Interspeech 2025}, year={2025} }

Sources

A curated subset

1. Todisco et al. ASVspoof 2019: Future horizons in spoofed and fake audio detection. INTERSPEECH, 2019.
2. Wang et al. ASVspoof 5: Crowdsourced speech data, deepfakes, and adversarial attacks at scale. ASVspoof Workshop, 2024.
3. Müller et al. Does audio deepfake detection generalize? INTERSPEECH, 2022.
4. Tak et al. End-to-end anti-spoofing with RawNet2. ICASSP, 2021.
5. Baevski et al. wav2vec 2.0: A framework for self-supervised learning of speech representations. NeurIPS, 2020.
6. Jung et al. AASIST: Audio anti-spoofing using integrated spectro-temporal graph attention networks. ICASSP, 2022.
7. Luong et al. Room impulse responses help attackers to evade deep fake detection. IEEE SLT Workshop, 2024.
8. Yaroshchuk et al. An open dataset of synthetic speech (ODSS). IEEE WIFS, 2023.
9. Rix et al. Perceptual evaluation of speech quality (PESQ), a new method for speech quality assessment of telephone networks and codecs. ICASSP, 2001.

FAQs

Can replaying deepfake audio through a speaker and re-recording it fool detection systems? Yes. In this study, playing synthetic audio through a loudspeaker and re-recording it through a microphone raised the error rate of the best-tested detector from 4.7% to 18.2%, letting many fakes pass as genuine.

Does a replay attack make real audio look fake, or fake audio look real? It helps fakes evade detection. Genuine audio's classification was barely affected by the replay process, the entire accuracy hit came from spoofed samples suddenly passing as authentic.

Can detectors be hardened against replay attacks? Partially. Retraining with room-impulse-response augmentation improved the affected detector's error rate from 18.2% back down to 11.0%, real progress, but still more than double the clean baseline of 4.7%.