Genuine Human Speech, Called Synthetic. Nothing Was Generated.

Thirteen frozen synthetic-speech detectors, declared and hashed before any of them was scored. Take real studio recordings, hold the speaker, the words, the performance, the room and the microphone fixed, and apply an ordinary transformation that generates no speech at all. A codec encode-decode moved 9 of 13 detectors past multiple-comparison correction. An algorithm from 1984 with no neural network moved 12 of 13. No mechanism is identified, no listening test was run, and thirteen of my own claims were withdrawn on the record.

A synthetic-speech detector is used as though its score answers one question: was this audio generated? Those scores are entering forensic, journalistic and platform-moderation settings on that reading. In those settings a false positive is not a benchmark loss. It is a genuine recording being called fake, with consequences for the person who made it.

I did not set out to test detectors. I was validating my own voice pipeline and needed to know whether the processing stage changed what a provenance checker would say. It did — and it did so on recordings where nothing had been generated at all.

The confound, run backwards

Detectors are trained on corpora where synthetic audio and particular signal-processing histories are almost perfectly confounded. Every generated clip in a text-to-speech corpus has passed through a vocoder or a neural codec. Almost no bona fide clip has. A model minimising training loss has no incentive to separate what its training data never separated.

So run it backwards. Hold everything fixed — speaker, words, performance, room, microphone — apply a benign transformation that produces no generated speech tokens, and measure the paired change in a frozen pretrained detector's score on the same utterance. The transformations are deliberately unremarkable and the statistics deliberately conservative. The question is whether ordinary processing of genuine speech is enough to move a deployed classifier, not whether an adversarial perturbation can.

Four pre-registered experiments on the same 47 utterances from three speakers:

Genuine speech, called synthetic, with zero generation

A codec encode-decode of real recordings moved 9 of 13 detectors past Holm correction. Three of them were fully prospective — nothing about their behaviour had been seen when the protocol was frozen — and all three moved on 47 of 47 utterances, at matched-pairs rank-biserial of exactly −1.000, the maximum a rank statistic can reach.

It held across three professional microphones capturing the same physical performance simultaneously, so it is not a capture-channel artefact. It held on a speaker outside the corpus.

And it is not about neural codecs. Griffin-Lim — phase retrieval published in 1984, no neural network anywhere — moved 12 of 13 detectors in the same direction. An ordinary denoise-and-master chain, the kind any production pipeline applies, moved two detectors by −2.95 and −4.22 native units. The phenomenon is about reconstruction and processing history, not about codecs being special.

There is no best detector to pick

The obvious mitigation is to choose a better detector. The measurements close that door.

The two families fail on opposite inputs. The ASVspoof-era models could not separate real speech from synthetic speech on this material at all — and ordinary mastering still moved them on 41 and 46 of 47 genuine human recordings. Choosing a detector is choosing which false positive to accept, not avoiding one.

Which transformation moves which detector tracks each checkpoint's documented training exposure across three architectures. I report that as an association among frozen checkpoints, not as a causal effect of training data: the checkpoints differ in frontend construction and optimisation as well as in corpus, and no isolating intervention was performed.

The prediction I got wrong, published anyway

I predicted that a detector trained on codec audio would resist a codec pass. It collapsed hardest of anything in the panel.

The panel also included, on purpose, a detector already known to be inverted — a negative control, so the panel is visibly not a set of models chosen to agree. It behaved as an inverted detector should.

An independent adversarial audit ran three rounds against the frozen estate, parsing the stored raw scores directly rather than executing my code. It reproduced every statistic. Thirteen of my own claims were withdrawn as a result, and the withdrawals are published in the paper — a corrected claim is more informative than one that was never challenged. Among them: "the mechanism is analysis–resynthesis" became no mechanism identified; "any operation that discards phase flips these detectors" became the tested operations do.

What this does not establish

• Detectors are not broken in general. The supported claim is narrower: on this material, detector output can be strongly affected by a recording's reconstruction and signal-processing history rather than uniquely identifying synthetic provenance.
• No mechanism is identified. The paper says so explicitly.
• No listening test was run. Nothing here says any transformation is perceptually transparent, and no perceptual claim appears anywhere.
• Three speakers, 47 utterances, neutral speech, one language. Enough for a paired effect. Not a population claim.
• Seven of the thirteen detectors come from one research group. That is not seven replications.
• Training-corpus overlap was not measured, so the association with training exposure is not a controlled comparison.

The part that generalises

This is a detector-robustness and forensic-attribution result, not an evasion method, and I do not present it as one. No parameter anywhere in this work was chosen, searched or tuned against a detector output. The one time an intervention was tuned to a statistic, it made the audio more separable rather than less — that experiment is retained in the paper deliberately.

The wider lesson is the same one my decoder work ran into from a different direction: an instrument's score is not interpretable without knowing the provenance of what it was computed on. Before trusting a detector panel, the question worth asking is which detectors on it can do the task on your material at all — and what else, besides generation, moves them.

Paper: Reconstruction history, not synthesis: benign processing moves frozen detectors on genuine human speech — Zenodo, September 2026, CC-BY-4.0.

DOI: 10.5281/zenodo.22819223 · all versions: 10.5281/zenodo.22819222

Deposit: 26 files — the paper, the frozen per-utterance detector scores, the result and pre-registration freeze records, the five figures, and the two scripts that regenerate the figures and the bootstrap intervals. Both scripts were verified to run from the deposit alone and reproduce every figure and interval file byte-for-byte.

The 11.5 GiB audio evidence estate is not released. Speaker and sample identifiers are retained deliberately as provenance under signed contract; only workstation path prefixes are stripped.