# Clean Accuracy Does Not Guarantee Provenance Robustness: A Prospective Codec-Stress Evaluation of Audio Attribution

arXiv: https://arxiv.org/abs/2609.07981 · HTML: https://mlsanity.com/paper/2609.07981/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 22 of its 24 references that are in the map.
- First posted on arXiv 7 Sep 2026.

## Builds on (most cited first, 22 of 22)

- [High Fidelity Neural Audio Compression](https://mlsanity.com/paper/2210.13438/) (2022)
- [High-Fidelity Audio Compression with Improved RVQGAN](https://mlsanity.com/paper/2306.06546/) (2023)
- [MLAAD: The Multi-Language Audio Anti-Spoofing Dataset](https://mlsanity.com/paper/2401.09512/) (2024)
- [A Study On Data Augmentation In Voice Anti-Spoofing](https://mlsanity.com/paper/2110.10491/) (2021)
- [The Impact of Silence on Speech Anti-Spoofing](https://mlsanity.com/paper/2309.11827/) (2023)
- [CodecFake+: Codec-Based Resynthesized Data as a Proxy for Detecting CodecFake Speech](https://mlsanity.com/paper/2501.08238/) (2025)
- [Codec-Based Deepfake Source Tracing via Neural Audio Codec Taxonomy](https://mlsanity.com/paper/2505.12994/) (2025)
- [STOPA: A Database of Systematic VariaTion Of DeePfake Audio for Open-Set Source Tracing and Attribution](https://mlsanity.com/paper/2505.19644/) (2025)
- [Dataset artefacts in anti-spoofing systems: a case study on the ASVspoof 2017 benchmark](https://mlsanity.com/paper/2010.07913/) (2020)
- [Open-Set Source Tracing of Audio Deepfake Systems](https://mlsanity.com/paper/2507.06470/) (2025)
- [Forensic Analysis and Localization of Multiply Compressed MP3 Audio Using Transformers](https://mlsanity.com/paper/2203.16499/) (2022)
- [Lightweight Model Attribution and Detection of Synthetic Speech via Audio Residual Fingerprints](https://mlsanity.com/paper/2411.14013/) (2024)
- [Probing the Robustness Properties of Neural Speech Codecs](https://mlsanity.com/paper/2505.24248/) (2025)
- [AFSS: Artifact-Focused Self-Synthesis for Mitigating Bias in Audio Deepfake Detection](https://mlsanity.com/paper/2603.26856/) (2026)
- [Measuring the Robustness of Audio Deepfake Detection under Real-World Corruption](https://mlsanity.com/paper/2503.17577/) (2025)
- [Perturbed Public Voices (P2V): A Dataset for Robust Audio Deepfake Detection](https://mlsanity.com/paper/2508.10949/) (2025)
- [Towards Neural Audio Codec Source Parsing](https://mlsanity.com/paper/2506.12627/) (2025)
- [ML-ITW: A Multilingual in-the-wild Benchmark for Speech Deepfake Detection](https://mlsanity.com/paper/2603.05852/) (2026)
- [Neural Encoding Detection is Not All You Need for Synthetic Speech Detection](https://mlsanity.com/paper/2604.16700/) (2026)
- [Anchoring the Unknown: Open-Set Model Attribution via Proxy-Anchor Learning](https://mlsanity.com/paper/2606.10758/) (2026)
- [Open-Set Source Tracing as Compositional Factors via Structured Prototypes](https://mlsanity.com/paper/2607.03134/) (2026)
- [Language-Statistical Analysis of Neural Audio Codec Tokens Across Architectures, Corpora, and Noise Conditions](https://mlsanity.com/paper/2608.31037/) (2026)

## Abstract (arXiv)

Audio provenance attribution - which system produced a synthetic utterance - is reported at near-ceiling accuracy on clean benchmarks, yet audio reaching an analyst has usually been transcoded. We report a prospectively registered measurement of closed-set attribution after single-stage codec transport, with the analysis region fixed from fidelity metadata before any attribution model was trained. On two corpora, in-support losses reach 53.5 [43.5, 63.6] and 70.3 [63.0, 77.5] Macro-F1 points for WavLM-Base+, and 61.0 [56.8, 65.1] and 49.8 [41.6, 57.9] for W2V2-BERT 2.0, under simultaneous component-level bands. Degradation is strongly condition- and representation-dependent: within one in-support grid WavLM losses run from -0.4 to +53.5 points, and the two encoders differ beyond a prespecified +/-5-point margin at six of twelve conditions. A clean-qualified ECAPA-TDNN and a Proxy-Anchor head degrade comparably, so the effect is not confined to one representation family or a weak linear head. The registered matched-fidelity comparison was not estimable on this grid, and waveform and perceptual measures order the conditions differently: MP3 at 8 kbit/s ranks mid-grid on SI-SDR but last on PESQ-WB while causing the largest loss. For the tested tasks, corpora, representations and codec grid, a clean accuracy figure does not by itself characterise deployment robustness.