ASVspoof 5: 53 teams' deepfake speech detectors on 680,774 crowdsourced utterances and 16 attacks

The record is the first voice entry in the studies index. No product sold under a card in this index is a named participant.

Participants, not products, are the detectors here. The 2026 paper counts 53 teams and the 2024 paper 54 participants; Table 4 of the 2024 paper lists 33 closed-condition and 34 open-condition Track 1 submissions, baselines included. Teams are anonymised by policy: "neither the team name nor the names of team members can be revealed" (arXiv 2601.03944, Section IV footnote 8, read 9 November 2026). Table III of the 2026 paper nonetheless cites the top entries' system-description papers.

Ranks from Table 4 of arXiv 2408.08739; system descriptions from Table III of arXiv 2601.03944.

None of the voice cards in this index, Pindrop Pulse, Resemble Detect, Reality Defender, Hive, Sensity or AI or Not, appears as a participant. Pindrop appears on the other side of the table: co-author Hemlata Tak's affiliation is Pindrop, and Pindrop co-sponsored the ASVspoof 2024 Workshop (arXiv 2601.03944, author affiliations; arXiv 2408.08739, Acknowledgements, read 9 November 2026). The Pindrop card quotes the vendor's "99% (accuracy)" footnoted to "the ASVspoof5 dataset of 32 engines"; the database carries 32 attack identifiers, A01 to A32, but neither paper prints a Pindrop result.

The data come from the English partition of Multilingual LibriSpeech, crowdsourced audiobook recordings from almost 2,000 speakers, speaker-disjoint across training (18,797 bona fide and 163,560 spoofed utterances, 8 attacks), development (31,334 and 109,616, 8 attacks) and the Track 1 evaluation set (138,688 and 542,086 from 737 speakers, 16 attacks). Spoofed speech was built by data contributors with text-to-speech and voice conversion systems from a legacy MaryTTS unit-selection system to zero-shot YourTTS and XTTS, tuned against surrogate detectors, and seven of the 16 evaluation attacks add Malafide or Malacopula adversarial filters. Evaluation audio is also passed through MP3, Opus, AMR, Speex, M4A, the neural codec Encodec, MP3 plus Encodec, and an 8 kHz telephone condition (arXiv 2408.08739, Section 2 and Tables 1 to 3, read 9 November 2026).

The primary Track 1 metric is the minimum detection cost function with a miss cost of 1, a false alarm cost of 10 and a spoof prior of 0.05, so missing a genuine utterance costs about 1.9 times a false accept; the equal error rate, actual DCF and Cllr are also printed. Track 2 uses the minimum a-DCF. The closed condition allows only challenge data; the open condition allows pre-trained speech foundation models (arXiv 2408.08739, Section 3, read 9 November 2026).

Every figure below is printed in Tables 4 and 5 of the 2024 paper or in the text and Table IV of the 2026 paper.

Values as printed in arXiv 2408.08739, Tables 4 and 5, and arXiv 2601.03944, Sections IV and V-B and Table IV, read 9 November 2026. Per-attack and per-codec minDCFs for the full field appear only as box plots.

Two findings carry beyond the leaderboard. First, calibration: the top systems in both conditions posted an actual DCF of 1.0, meaning that at the pre-set decision threshold they accepted or rejected everything, because their scores were probabilities rather than log-likelihood ratios; T27, which calibrated its scores, posted a Cllr of 0.1927 against T45's 0.7923 (arXiv 2408.08739, Table 4 and Section 6.1, read 9 November 2026). Second, generalisation: when four of the five best open-condition systems were re-run on other databases, every EER but one (T43 on In-the-Wild, 6.85%) rose above 10%, and the authors conclude that "current detection solutions overfit to the acoustic or generative traits of specific datasets" (arXiv 2601.03944, Table IV and Section VI, read 9 November 2026).

Adversarial filters raised error on the attacks they were applied to, and the legacy MaryTTS system (A19) was the hardest attack in the closed condition: "robust performance for relatively advanced attacks is no guarantee of protection against attacks implemented with legacy technology" (arXiv 2601.03944, Section IV-A-1, read 9 November 2026).

The organisers list them in Section V-D of the 2026 paper: the task is binary and does not trace the source generator; the data are English-only audiobook-style read speech from one corpus, so "the scenario remains somewhat narrow"; top systems share near-identical architectures, which "may be reaching a bottleneck"; and replayed or re-recorded spoofs were out of scope (arXiv 2601.03944, Section V-D, read 9 November 2026). Evident from the papers: the two give different participant counts (53 and 54); per-attack and per-codec figures for most systems are plotted, not tabulated; and nothing identifies a commercial product.

What this record does not say: a 2.59% equal error rate belongs to an anonymised research ensemble on a 2024 challenge set of read English speech, and the same systems posted 10% to 27% on other databases; no figure here describes Pindrop Pulse or any other product in this index.

No card takes a result line from this record, because no indexed product is a scored participant. The record is linked from the Pindrop Pulse card as the primary source behind the vendor's "ASVspoof5 dataset of 32 engines" footnote, which the papers neither confirm nor score. It counts toward the voice column of studies by modality as a record with zero indexed detectors, and the content type view lists the eleven cards that state voice. No figure enters the false positive rate ranking or the adversarial robustness ranking, which rank cards. The home page lists which AI detectors exist and who has tested them.

Related records: SAFE 2025 is the other audio challenge in the index, blind and with named teams; RAID 2024 is the shared text benchmark.

Speech is not music: the music detectors question records that none of the five music cards is scored by this or any record, and the Pindrop vs Resemble Detect comparison sets the organiser affiliation noted above beside Resemble Detect's absence from the challenge, both read 10 November 2026.