Contents
Partly, and the boundary is precise: liveness detection catches the playback event, not the synthesis. A deepfake voice played through a loudspeaker into a microphone acquires replay physics, and in noisy, reverberant conditions liveness detectors read those physics well. Against a clean, near-anechoic playback the same detectors degrade several-fold, and against a deepfake injected electrically, with no playback at all, they have nothing to read.
Two attacks, two detectors
A deepfake reaching a voice-verification system arrives one of two ways. Played acoustically, it is simultaneously a synthesis attack and a replay attack, and both detector types get a shot at it. Injected directly into the signal path, it is a synthesis attack only, the scenario the ASVspoof benchmarks call logical access as opposed to physical access (Wang, Yamagishi, Todisco et al., Computer Speech & Language 2020). Liveness detection only ever adjudicates the first case. That division of labor is why production systems run a liveness check and a synthesis check side by side, as described in how live deepfake detection works. The liveness check earns its place because speaker verification alone accepts 68% of replays at its own threshold (Villalba & Lleida, BioID 2011); a synthesis detector never sees that hole, because a real recording of a real person contains nothing synthetic to flag.
Replay hides the deepfake from one layer and exposes it to the other
When a deepfake is played through a speaker, the two layers trade places. Müller and colleagues at Fraunhofer AISEC (arXiv 2025) measured the synthesis side losing its grip: replaying synthetic speech through real hardware raised a state-of-the-art detector’s equal-error rate from 4.7% to 18.2%, while accuracy on genuine speech barely moved. But the same replay stamps loudspeaker distortion, low-frequency roll-off, and a second room signature onto the file, the exact features liveness classifiers are trained on (Ren, Fang & Liu, Multimedia Tools and Applications 2019). The launder that defeats the AI-voice detector is the evidence the liveness detector runs on.
How well the liveness layer reads a replayed deepfake
Neri and Virtanen (arXiv 2025) benchmarked replay-speech detectors under controlled acoustic conditions, and their numbers draw the working boundary of the whole approach:
| Playback condition | ALRAD EER | M-ALRAD EER |
|---|---|---|
| Reverberant room | 6.6% | 2.4% |
| Anechoic (no reverb) | 18.2% | 14.9% |
In a reverberant room, the multi-channel M-ALRAD detector operates at a 2.4% equal-error rate, because the doubled room acoustics give it a strong tell. Remove the reverberation and the error rate rises to 14.9%, a six-fold degradation for the same detector, since a clean playback in a dead room leaves far less of the double-acoustic signature to find. The engine research behind this cluster reads that asymmetry as the central limit: the detector depends on the messiness of the playback, and a careful attacker controls the messiness.
Where it fails outright
Two failure modes are measured rather than hypothetical. First, the training gap: Neri and Virtanen report that detectors trained on simulated replay channels and tested on real re-recorded audio reached equal-error rates above 50% in most environments, worse than chance. Synthetic training data does not yet capture real playback physics. Second, the injection hole: a deepfake delivered line-level, through a virtual audio device or a compromised input path, never passes through a loudspeaker or a room, so every acoustic feature in this article is silent. The forensic reading of that same boundary, what re-recording resets and what survives it, is drafted from the examiner’s side in does re-recording a deepfake through a microphone make it undetectable?.
What a layered read actually buys
The evidence supports a modest, specific claim. Liveness detection is a strong second layer against the common case, a deepfake played into a microphone under ordinary acoustics, precisely because ordinary acoustics are noisy. It thins out as the playback gets cleaner, and it vanishes when there is no playback. So a liveness pass is never proof a voice is real, and a liveness flag is never proof it is synthetic; the layer adjudicates delivery, not origin. The origin question belongs to the synthesis detectors, with their own measured gaps between benchmark and deployment (see is this voice AI-generated?), and the strongest read remains the combination: liveness, synthesis detection, and provenance, each covering a failure mode the others cannot see. How attackers probe the seams between those layers is measured in can voice liveness detection be bypassed?.
Sources
- Neri, M. & Virtanen, T. (2025). Acoustic Simulation Framework for Multi-Channel Replay Speech Detection. arXiv:2509.14789.
- Müller, N., Kawa, P., Choong, W.-H., Stan, A., Tirumala Bukkapatnam, A., Pizzi, K., Wagner, A. & Sperl, P. (2025). Replay Attacks Against Audio Deepfake Detection. arXiv:2505.14862.
- Ren, Fang & Liu (2019). Replay Attack Detection Based on Distortion by Loudspeaker for Voice Authentication. Multimedia Tools and Applications. DOI: 10.1007/s11042-018-6834-3.
- Wang, Yamagishi, Todisco et al. (2020). ASVspoof 2019: A Large-Scale Public Database of Synthesized, Converted and Replayed Speech. Computer Speech & Language 2020.
- Villalba, J. & Lleida, E. (2011). Detecting Replay Attacks From Far-Field Recordings on Speaker Verification Systems. BioID 2011.