💻 computer science

What You Train Is What You Get: Gender Bias, Training Composition, and Post-Hoc Mitigation in Audio Deepfake Detection

This study demonstrates that gender bias in audio deepfake detection is primarily driven by training data composition rather than post-hoc threshold calibration, as imbalanced datasets cause underrepresented groups to perform worse and post-processing methods fail to correct the resulting score distribution disparities.

Original authors: Aishwarya R. Fursule, Vamshi Nallaguntla, Shruti Kshirsagar, Anderson R. Avila

Published 2026-07-14

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Aishwarya R. Fursule, Vamshi Nallaguntla, Shruti Kshirsagar, Anderson R. Avila

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you're building a super-smart security guard for a digital fortress. This guard's job is to listen to a voice and shout, "Real human!" or "Fake robot!" to stop audio deepfakes. Sounds cool, right? But here's the twist: even if this guard is 99% accurate overall, it might be secretly terrible at its job for half the people it protects.

That's exactly what a team of researchers discovered when they put audio deepfake detectors through a massive, controlled stress test. They didn't just look at the final score; they peeked under the hood to see how the guard was trained and whether it treated men and women fairly.

The "What You Train Is What You Get" Rule

The biggest surprise? The guard's bias isn't random. It's a direct mirror of who it hung out with during training.

Think of the training data like a school cafeteria. If the guard only eats lunch with girls for a month, it becomes an expert at spotting fake girls but gets confused when a boy tries to sneak in. If it only eats with boys, it gets confused by girls. The researchers found that the gender that was underrepresented in the training "cafeteria" was the one that got the worst treatment at test time.

They tested this by creating nine different "cafeterias" (training sets), ranging from "Girls Only" to "Boys Only" to "Perfectly Balanced." The result was crystal clear: if you trained the model mostly on female voices, the male voices got tricked more often. If you trained it mostly on male voices, the female voices suffered. It's like a sports coach who only practices with left-handed players; when a right-handed player steps onto the field, the coach has no idea what to do.

The "Magic Glasses" vs. The "Deep Brain"

The researchers also tested two different types of "eyes" (feature representations) for their guard to see what it was actually looking at.

LogSpectrogram: Think of this as a pair of glasses that just looks at the surface patterns of the sound waves. When they balanced the training cafeteria, these glasses worked much better. The average bias gap dropped to a tiny 0.063 pp, and for 30 out of 32 different attack types, the bias was nearly gone.
WavLM-Base+: This is like a deep-brain AI that learned to understand speech by reading millions of hours of audio before it even met the guard. Even when the researchers gave it a perfectly balanced cafeteria, this AI still held onto its bias. The average gap between men and women stayed stubbornly high (0.273 pp), which is 3.0 to 4.3 times larger than the glasses.

The paper suggests that this deep AI learned "gender" as a secret code during its early training, and no amount of balancing the cafeteria later could erase that code. It's like teaching a student who already memorized the wrong answers; giving them a balanced textbook doesn't help if they're still using the old, biased notes. For this specific type of AI, simply balancing the training data is not enough to fix the problem.

The "Magic Fix" That Wasn't

Here is the part that might make you sigh: The researchers tried everything to fix the bias after the training was done. They tried six different "post-hoc" strategies, which are like adjusting the guard's decision threshold after the fact.

They even tried an "Oracle" strategy. Imagine a super-powerful cheat code where the guard gets to see the correct answers before making its final decision. You'd think this would fix everything, right?

Nope.

Even with the cheat code, the gap in performance (called the Equal Error Rate, or EER) stayed stuck at 1.317 pp. The researchers proved that you can't fix a broken foundation just by painting the walls. If the guard's internal score distribution is biased, moving the "pass/fail" line doesn't change the fact that one group is consistently getting lower scores than the other. The paper explicitly rules out the idea that post-training tweaks can solve this; the fix has to happen during the training, not after.

One Size Does Not Fit All

Finally, the team discovered that "fairness" is a tricky word. Depending on which rule you use to measure fairness, the "worst" attacker changes.

If you care about how often real people get falsely accused (False Positive Rate), one type of fake voice is the worst villain.
If you care about how often fake voices slip through the cracks (False Negative Rate), a different fake voice is the worst.

It's like judging a movie: one critic might say it's the best comedy ever, while another says it's the worst drama. The paper shows that you can't just pick one number and say, "We're fair!" You have to know exactly what kind of mistake you can't afford to make.

The Bottom Line

So, what's the takeaway for our digital world?

Don't trust the average: A high overall accuracy score can hide the fact that the system is failing specific groups.
Balance the cafeteria (but be careful): You must train your AI with a perfectly balanced mix of voices from the start, but be aware that for some advanced AI models (like WavLM), balancing alone might not be enough to fix deep-seated biases.
Watch out for "pre-trained" brains: Some AI models come with built-in biases from their massive pre-training that are hard to wash out, even with perfect training data.
No magic wands: You can't just tweak the settings later to fix deep-seated bias. If the training data is skewed, the results will be skewed.

The researchers conclude that to build truly trustworthy AI, we have to bake fairness into the recipe from the very first step, because once the cake is baked, you can't just add more flour to fix the taste.

Technical Summary: Gender Bias, Training Composition, and Post-Hoc Mitigation in Audio Deepfake Detection

Problem Statement

Audio deepfake detection models are increasingly critical for verifying human identity, yet high aggregate accuracy often masks substantial performance disparities across demographic groups. Prior research has documented conflicting findings regarding gender bias: some studies suggest models trained on female voices outperform those trained on male voices due to spectral artifacts, while others indicate male speakers face higher false positive rates regardless of architecture. These contradictions arise because previous works failed to control the gender composition of training data, leaving it unknown whether bias direction is predictable from composition, how this interacts with attack types, and whether the method of achieving balance matters. Furthermore, it remains unclear if post-hoc threshold calibration can fundamentally reduce gender disparities or if there is a hard limit to its efficacy.

Methodology

The authors conducted a systematic study using the ASVspoof5 dataset, which includes 32 distinct spoofing attacks (Text-to-Speech, Voice Conversion, and Adversarial Perturbation). To isolate the effects of training composition, the researchers constructed a custom, controlled split of the data, pooling utterances from all official partitions and re-partitioning them into 70% training, 10% development, and 20% evaluation sets for each attack and gender group.

Experimental Design:

Training Configurations: Nine distinct gender-composition configurations were tested:
- Baseline: Female-only (F), Male-only (M), and Combined (100% F + 100% M).
- GenderMix: Six partial-mix configurations (e.g., F+25%M, M+75%F) to create a gradient of imbalance.
Models & Features: A total of 384 attack-specific models were trained:
- 288 models using WavLM-Base+ features (selected for exhibiting larger gender gaps in prior work).
- 96 models using LogSpectrogram features (for baseline comparison).
- All models utilized a ResNet18 classifier.
Evaluation: Models were evaluated on same-attack and cross-attack scenarios. Performance was measured using the Equal Error Rate (EER) and six group fairness metrics: Statistical Parity Difference (SPD), Equal Opportunity Difference (EOpD), Equalized Odds Difference (EOD), False Positive Rate gap (FPR gap), Positive Predictive Value Difference (PPD), and Threshold Error Difference (TED).
Mitigation: Six post-hoc threshold calibration strategies were applied, including standard global thresholding, per-gender EER/FPR/TPR/DP calibration, and an Oracle calibration (using full test-set labels) to establish the theoretical upper bound of post-hoc correction.
Validation: Statistical significance was verified using Poisson bootstrap resampling ( $N=1000$ ) with Benjamini–Hochberg correction.

Key Contributions

Controlled Composition Study: This is the first study to systematically vary training gender composition as a controlled independent variable in audio deepfake detection, training 384 models across nine configurations.
Composition-Bias Causality: The study demonstrates that the underrepresented gender in training consistently suffers higher error rates at test time across 31 of 32 attacks, regardless of which gender is in the minority.
Feature Representation Disparity: The authors show that WavLM-Base+ produces gender performance gaps 3.0 to 4.3 times larger than LogSpectrogram under identical conditions. Crucially, balanced training nearly eliminates LogSpectrogram bias but leaves WavLM bias largely intact, suggesting that gender correlations embedded during self-supervised pre-training persist through fine-tuning.
Attack-Type Specificity: Voice conversion attacks were found to produce the largest gender gaps, while adversarial perturbation attacks produced the smallest EER gaps but the largest demographic parity disparities, highlighting that no single metric captures all fairness dimensions.
Limits of Post-Hoc Mitigation: The study proves that all six calibration strategies, including Oracle calibration, fail to reduce the EER gap, which remains fixed at 1.317 pp. This confirms that threshold adjustment cannot correct underlying score distribution disparities.

Results

Training Composition: The dominant gender in the training set is advantaged at test time. For instance, in female-anchored configurations, male speakers face significantly higher EERs. Increasing the minority gender's proportion reduces the EER gap monotonically but with diminishing returns; only fully combined training (100% of both genders) achieves a low gap (0.273 pp for LogSpectrogram, 0.273 pp for WavLM).
Feature Sensitivity: While LogSpectrogram bias is neutralized by balanced data, WavLM-Base+ bias persists. This indicates that WavLM encodes gender information during its pre-training phase (on 94,000 hours of unlabeled speech) that is not removable by fine-tuning on balanced data.
Cross-Attack Generalization: Under cross-attack evaluation, the monotonic trends observed in same-attack evaluation break down. The disadvantaged gender can flip depending on the attack type, and the EER gap remains high (1.491–1.963 pp) even with combined training, suggesting that bias is deeply embedded in the feature representations.
Calibration Failure: Post-hoc threshold calibration strategies successfully equalize specific metrics (e.g., TC FPR equalizes false alarm rates) but do so at the cost of other metrics (e.g., reduced True Positive Rates). Most critically, no strategy reduced the EER gap, which remained constant at 1.317 pp across all configurations and strategies.
Metric Divergence: The choice of fairness metric significantly alters the ranking of attack fairness. For example, A28 (pre-trained YourTTS) is the most biased by rate-based metrics but not by TED, while A19 (MaryTTS) is the fairest by rate-based metrics but worst by TED.

Significance and Claims

The paper argues that gender fairness in audio deepfake detection is not merely an artifact of threshold selection but arises from the interaction between training composition, attack type, and feature representation.

The authors claim that:

Bias is Structural: Disparities are rooted in the data composition and the pre-trained representations (specifically in SSL models like WavLM), not just in the final classifier.
Post-Hoc Limits: There is a fundamental limit to what post-hoc calibration can achieve. Because threshold adjustment only shifts the operating point along the ROC curve without altering its shape, it cannot resolve distribution-level EER disparities.
Training-Time Necessity: Fairness must be addressed at training time. The study suggests that for SSL-based detectors, simply balancing training data is insufficient; interventions must occur at the representation or pre-training level.
Deployment Guidelines: Practitioners should report per-gender EERs for specific attacks rather than aggregate metrics, document training gender composition as metadata, and select calibration strategies based on the specific failure mode they wish to mitigate (e.g., false alarms vs. missed detections), acknowledging that no single strategy satisfies all fairness criteria simultaneously.

The paper concludes that while post-hoc methods can partially mitigate disparities in specific metrics, they cannot fix the underlying structural bias, necessitating a shift toward data- and representation-level interventions for trustworthy AI in spoofing countermeasures.