Contents
Yes, and the uncomfortable part is how little it takes. The published record shows AI music detectors being flipped not by sophisticated attacks but by ordinary events: a small pitch shift, a low-bitrate re-encode, a resample no listener would notice, or simply a generator the detector was never trained on. There are three ways a detector gets fooled, by accident, by an unfamiliar generator, and on purpose, and all three are real. This is a reliability review of what the research measured, not a manual for beating anything.
A barely audible edit can flip the verdict
The cleanest demonstration comes from a robustness study of SpecTTTra, the detector behind the SONICS benchmark published at ICLR 2025. Sroka, Wężowicz, Sidorczuk and Modrzejewski (2025, ISMIR Late-Breaking Demo) ran it against real songs and tracks from Suno, Udio, YuE and MusicGen, then applied light augmentations. A pitch shift down two semitones, an edit near the edge of what a casual listener registers, was enough to swing the detector’s output to “highly real” on AI tracks it had previously caught. The detector was also struggling before any edit: it scored real music at 6.1 mean fakeness and Suno at 96.24, both correct, but rated Udio around 50.51, YuE at 55.5, and MusicGen at 34.83, calling AI-generated music mostly real straight out of the generator.
Why detectors default to “real”
The mechanism behind these flips is well diagnosed. Afchar, Meseguer-Brocal and Hennequin (2024) describe the dominant detector family as working by “detecting artefacts specific to each [generator] and otherwise defaulting to the real class if none is found.” That default is the vulnerability. An artifact-presence detector does not weigh evidence for and against; it looks for a known fingerprint, and anything that moves or masks that fingerprint, a pitch shift that slides it off the learned frequency bins, a codec that strips the band it lives in, produces a confident “real.” Sroka’s team reached the same diagnosis independently: the model “mistakenly learned to rely on certain artifacts present in the spectrum, instead of analyzing the audio as a whole.”
Fooled by the wrong generator
A detector can also be fooled with no edit at all. It may simply not know the generator. This is a separate failure from editing, and it is arguably the larger one. The Deezer Fourier detector reaches 100 on seen Suno v3.5 and Udio-130, then falls to 39.83 on unseen Udio-32, a different version of the same product (Afchar, Meseguer-Brocal, Akesbi, Hennequin, 2025, arXiv:2506.19108). SONICS reports the same instability inside its own benchmark: cross-partition F1 drops by 20 to 64 percent on harder or unseen partitions (Rahman, Paul, Hakim, Sarker, Fattah, 2025). A new Suno or Udio release changes the very trace a detector learned, so a tool that was near-perfect last quarter can miss this quarter’s model without anyone touching the audio.
Robust in one direction is not robust in the other
You might expect the newer, stronger detectors to have closed these holes. The record says robustness comes in two separate kinds, and having one does not buy the other. MusicDET, a 2026 density-based detector from Han Chaolei, Wang and Gui, posts one of the field’s best cross-generator results: a 4.51 percent average equal error rate on generators it never trained on (arXiv:2605.18072). Point the same system at edited audio and it collapses: its own tables report the error rate rising to 44.73 percent under a two-semitone pitch shift, 44.11 percent under added white noise, and 41.75 percent under MP3 at 64 kbps, all close to coin-flip territory. Surviving unseen generators and surviving ordinary edits are different skills, and a tool advertised for one has not demonstrated the other.
What about fooling them on purpose?
Here the honest answer is that the science has barely been done. The published music-detection record covers benign edits and unseen generators, but in the corpus we reviewed, no published study mounts a white-box adversarial attack, the gradient-based kind long standard in image and speech security research, against a music detector. Whether these systems resist a deliberate, optimized attacker is an open question, and the accidental results give little reason for optimism: Cros Vila, Sturm, Casini and Dalmazzo (2025, TISMIR) fooled a deployed commercial detector with a plain resample to 22.05 kHz, an operation available in every audio editor, applied with no knowledge of the detector’s internals at all.
What does not fool them
The picture is not uniformly fragile, and the exceptions matter. Afchar’s measurements show the same detectors that collapse under pitch and codec edits survive time-stretching, EQ and reverb almost untouched, because those edits leave the fingerprint’s frequency structure alone. Detectors trained with the damage in view hold up better: ArtifactNet, trained across WAV, MP3, AAC and Opus versions of its data, cut its cross-codec performance drift by 83 percent compared to the untrained baseline (Oh, 2026). And lyrics-based detectors, which transcribe the words and never read the signal, are largely indifferent to audio edits. Which edits break which detector family is mapped edit by edit in does light editing reduce a detector’s accuracy?, with the compression case in detail in does MP3 compression defeat AI music detectors?.
How to read a score, knowing this
Treat stability as part of the evidence. A verdict that would flip under a two-semitone shift or one more re-encode is fragile, and most music reaching you has already been through a platform codec, so the fragile case is the normal case, a gap explored in why music detectors fail in the real world. A confident score on a clean, original file from a mainstream generator means something; the same score on a compressed, edited, re-uploaded, or newly released track means much less, in either direction. A negative result deserves the same caution: “not AI” on a degraded clip or a brand-new model often means only that the detector did not find the trace it knows how to read, which is far narrower than “a human made this.” Cross-check with a second tool from a different family, expect disagreement between detectors, and read any single number against what a music detector score actually means. The tools can be fooled. The defense is not a better single score; it is refusing to let one score carry the whole verdict.
Sources
- Sroka, Wężowicz, Sidorczuk, Modrzejewski (2025). Evaluating Fake Music Detection under Audio Augmentations. ISMIR 2025 Late-Breaking Demo. arXiv:2507.10447.
- Afchar, Meseguer-Brocal, Hennequin (2024). Detecting Music Deepfakes Is Easy but Actually Hard. arXiv:2405.04181.
- Afchar, Meseguer-Brocal, Akesbi, Hennequin (2025). A Fourier Explanation of AI-Music Artifacts. ISMIR 2025. arXiv:2506.19108.
- Rahman, Paul, Hakim, Sarker, Fattah (2025). SONICS: Synthetic Or Not - Identifying Counterfeit Songs. ICLR 2025. arXiv:2408.14080.
- Han, Wang, Gui (2026). MusicDET: Zero-Shot AI-Music Detection via Frequency-Guided Normalizing Flows. arXiv:2605.18072.
- Cros Vila, Sturm, Casini, Dalmazzo (2025). The AI Music Arms Race: On the Detection of AI-Generated Music. TISMIR 8(1). DOI:10.5334/tismir.254.
- Oh (2026). ArtifactNet: Forensic Codec-Residual Detection of AI-Generated Music. arXiv:2604.16254.