DetectifAI
Voice identity  //  2026 Live demo running

Every voice is now forgeable. Prove which ones aren't.

DetectifAI builds foundational models to detect audio deepfakes — and the test layer that puts them to work. Verify the authenticity of voice notes, calls and recordings, and prove that a live speaker is who they claim to be.

Speaker gate VoxCeleb1-O
0.27
Separation ↑

Genuine 0.624 min · impostor 0.358 max

Gates
3

Sequential — all must pass

Voiceprint
192-d

Dimensions per speaker

Engines
3

In the fallback chain

Languages
EN + HI

Challenge and transcription

01 / The problem

Voice used to be proof. Thirty seconds of audio is now enough to take that away.

Every call centre, every KYC flow, every "it's me, approve the transfer" voice note rests on an assumption that stopped being true: that a voice is hard to fake. Open cloning models reproduce timbre, cadence and accent from a short sample, and the output survives compression, phone codecs and background noise well enough to pass a human listener.

The defensive side has not kept up. Most teams either bolt on a single deepfake classifier and treat its number as truth, or they check identity and never check authenticity at all — which means a perfect clone of an enrolled user walks straight through the front door.

Cloning is commoditised

A convincing clone costs nothing and takes under a minute. The attacker does not need to be sophisticated.

Replay is the easy attack

Before anyone reaches for a generator, they simply re-submit audio the real user already produced.

One model is one blind spot

Every detector fails on some generator, some codec, some room. A single classifier is a single point of failure.

02 / What we build

We don't ship a detector. We ship the layer that tests.

Detection is not a model, it's a decision — and a decision needs a system around it. The test layer routes every sample through a ranked chain of authenticity engines, holds each one to the same calibrated threshold, falls back the moment an engine is unavailable, and records exactly which engine produced the verdict.

Priority 1 ACTIVE

Engine A

cloud · primary

Synchronous cloud inference on the raw upload. First in line, and the verdict source whenever it answers.

Priority 2 STANDBY

Engine B

cloud · fallback

A second, independently trained cloud engine. Takes over on timeout, rate limit or outage — no manual failover.

Priority 3 STANDBY

Engine C

on-device · last resort

Runs locally on CPU with no network call. Keeps a verdict available in air-gapped deployments and total cloud failure.

One verdict, always attributable

Exactly one engine's score decides the outcome — the first that answers, in priority order. No silent averaging, no ensemble hiding a disagreement.

Calibrated, not vibes-based

Thresholds move only when a measured score distribution says they should. We characterise where each engine degrades and route around it.

Engine-agnostic by design

Engines are configuration, not architecture. Adding, reordering or removing a detector is an environment change, never a rewrite.

Fails the way you choose

Fail-open with a logged warning keeps a call centre moving; fail-closed makes authenticity a hard gate. Same code, one setting.

A verdict, in full
POST /verify/single { "success": true, "reason": "verification_success", "sentence_score": 96, // gate 1 — liveness, threshold 80 "similarity": 0.782, // gate 2 — speaker, threshold 0.500 "threshold": 0.500, "deepfake_score": 0.041, // gate 3 — authenticity, reject at 0.800 "deepfake_threshold": 0.800, "deepfake_status": "AUTHENTIC" } // The engine that produced the verdict is recorded in the server-side // audit log, never in the response — the caller gets a score and a // decision, not the shape of the chain behind it.
03 / How it works

Three gates, in order. All of them must pass.

Cheapest rejects first ↓

Gates run sequentially and short-circuit: a failure at gate one means the speaker model never runs, and a speaker mismatch means we never spend an authenticity call.

01
Challenge sentence — liveness and anti-replay
The server picks a random sentence, signs it into an HMAC token bound to the user, the purpose and the language, and never trusts the client to say which sentence was expected. The token is single-use and expires in 300 seconds. Speech-to-text transcribes the recording; the transcript must match the sentence inside the token at 80% or better.
english + hindi · TTL 300s · single-use · fuzzy match ≥ 80
REQUIRED
02
Speaker identity — the voiceprint
Audio is normalised to 16 kHz mono and reduced to a 192-dimensional embedding that encodes how a person's vocal tract sounds rather than what they said. Cosine similarity against the enrolled template must clear the threshold. Enrollment builds that template from one continuous passage, or from five shorter samples merged together.
192-d embedding · cosine ≥ 0.500 · CPU inference
REQUIRED
03
Audio authenticity — the test layer
The sample enters the engine chain. The first engine to answer produces the confidence that the audio is synthetic; anything at or above the threshold is rejected as a deepfake even when the voice matches perfectly. This is the gate that stops a flawless clone of a legitimately enrolled user.
engine A → B → C · reject at ≥ 0.800 · verdict attributed
REQUIRED
Enrollment

One recording of a ~15 second passage, or five short sentences merged into a single template. Each sample passes the same liveness gate before it is allowed to shape the voiceprint, so nobody enrolls a clone.

Attack simulation

The console can submit a pre-recorded or synthetic file through the exact pipeline a live microphone uses. It's the fastest way to watch gates one and three do their job — and it's built into the demo.

04 / Findings

Thresholds come from score distributions.

Higher separation is better ↑

The speaker gate was calibrated on VoxCeleb1-O: five enrolled speakers verified cross-video, plus three speakers who were never enrolled claiming the identity they scored highest against — the worst case for an impostor.

Primary result

Score separation

Cosine similarity against the enrolled template

N = 40
PopulationnMinMeanMaxRange vs. threshold
Genuine 5 0.624 0.747 0.825
Impostor 35 −0.163 0.012 0.358

The tick marks the 0.500 operating threshold. Highest impostor 0.358 sits well below the lowest genuine 0.624 — a clean gap of 0.27 with no overlap. Every cutoff from 0.40 to 0.60 gives zero false accepts and zero false rejects.

False accept rate
0.00

35 of 35 impostors rejected.

False reject rate
0.00

5 of 5 genuine accepted, including one at 0.624 a naive 0.75 cutoff would reject.

Trials
40

A sanity calibration — not a production EER.

Forty trials is a sanity calibration, not a production EER. The full 37,611-pair protocol is the bar before go-live, and we say so rather than quoting the small number as if it were the big one.

What we know breaks

The on-device engine is highly accurate on clean audio but false-positives on compressed recordings — it flagged genuine, heavily-compressed clips at 0.98. Browser captures are compressed, which is precisely why it sits third in the chain behind two cloud engines rather than first. Knowing where an engine fails is what makes ordering it possible; this is the work the test layer exists to do.

Try it yourself

Enroll your voice. Then try to break it.

The console runs the real pipeline — the same gates, thresholds and engine chain described on this page. Record a passage, verify against it, then inject a file and watch the layer reject it.