Systems and subsystems

Spectra-AASIST (M3)

An off-the-shelf anti-spoofing model run with no training through the same input path as everything else. The strongest detector on every set we hold, and the one we trust least, because its training data is undisclosed. It may only lower a score.

In plain words

A published model with its own copy of XLS-R and a graph-attention back end, built for exactly this task. It separates our training rows perfectly, which is either brilliance or memory: its model card names no training set, and LJ Speech, LibriSpeech and DiffSSD are all public. So it does not vote. When it is confident a voice is real and the other detectors lean synthetic, it halves the fused rank; if it is wrong that way the cost is a miss, never the expensive false alarm. The leakage probes later supported that role.

What goes in and comes out

In: the prepared segment, cut into windows of 64,600source: src/hearsay/spectra.py line 40 (GitHub; assumes main is public) samples (about 4 s) at half-window hops, at most 16 windows, with pre-emphasis; short clips zero-padded to one window. Out: the average over windows of the spoof logit minus the bona fide logit, a margin that rises with synthetic likelihood (spectra.py, line 135). The evidence sentence: "Spectra-AASIST: spoof-minus-bonafide margin +x.xx (synthetic-like, P=0.xx)".

Where it lives

spectra.py (loader with the hub id redirected to the local weights, input preparation, padding modes, window scoring, the direction check); score_spectra.py (the export with failure and direction gates); spectra_direction.py; the runner's path in pipeline.py, lines 477–483.

Parameters and where each is set

• Output index 0 is spoof and 1 is bona fide; the exported logit is the raw margin, nothing is fitted on it (spectra.py, lines 3–11).
• Inputs above 128,000source: src/hearsay/spectra.py line 43 (GitHub; assumes main is public) samples are refused (the model's positional table); the runner uses zero-padding and at most 16 windows (pipeline.py, lines 98–99).
• The short-clip padding mode was chosen by a pilot on inner rows: zero-pad won over repeat-tiling and whole-clip; a peak-normalization arm was tried and rejected because it cost 0.033source: README.md, section what-did-not-work on real speech without removing the level correlation it targeted.
• The suppression step it feeds: margin below −3.0source: scripts/fuse_sweep.py line 172 (GitHub; assumes main is public) and fused rank above 0.5source: scripts/fuse_sweep.py line 172 (GitHub; assumes main is public) halves the rank; the constants are in the fusion rule.

Status

Shipped as a suppressor with weight zero in the blend. Its "fused" role label in the runner's code is stale; the reports and this site say suppressor.

Numbers

All possibly in-sample: inner 0.0045source: README.md, section numbers, holdout 0.012source: README.md, section numbers (EER 0.16%source: README.md, section numbers), In-the-Wild 0.065source: README.md, section numbers with 0.0%source: README.md, section numbers false alarms (its authors evaluated on that set), test share above 0.5source: README.md, section numbers 29.3%source: README.md, section numbers. As a suppressor it moved In-the-Wild from 0.322source: README.md, section what-worked to 0.260source: README.md, section what-worked in the first sweep. Probes: the most perturbation-stable detector (mean |ΔAUC| 0.0008source: README.md, section what-did-not-work against 0.0041source: README.md, section what-did-not-work for the probe), the lowest miss rate on 143source: README.md, section what-did-not-work unseen generators (14.9%source: README.md, section what-did-not-work), and a step that never raised the fused holdout cost. Giving it a full vote would score better on every labeled readout (holdout 0.0045source: README.md, section orchestration-what-routing-changes), which we ruled out beforehand.

Known limits

Under 20 dB noise its own score holds (0.116source: README.md, section what-did-not-work) but the noise pushes it out of its "strongly real" region, so the step never fires and cannot help. It disagrees with the M1 v3 probe (the pre-M1b version) on 154source: docs/STATUS.md, section where-things-stand test files. Its licence is unclear: the repository header says Apache-2.0, the model card says MIT.

Tests that pin it

tests/test_spectra.py, 39 hermetic tests with a fake torch: the input path equals prepare_segment, the band match drops a tone above the cutoff by more than 40 dB, test rows are not cropped and are capped, the crop plan reproduces the shared recipe with pinned seed-0 draws, padding modes and pad counts, the forward guard, long clips are identical across modes, pre-emphasis is applied, degenerate inputs stay finite, the direction contract, the window mean, the max-windows cap reaches the model, non-finite output is a failure, the script's export, gates and readouts; plus one weights-gated real run.

Sources

The M3 report; the leakage probes; Architecture §6.3; the run spec.