Contents
Two AI voice detectors can read the same clip and return opposite verdicts, and most of the time neither one is broken. They are simply not measuring the same thing. Each was trained on a different set of generators, keys on a different trace in the audio, and draws its own line between real and synthetic, so disagreement is the normal outcome rather than a malfunction, and the split itself is worth reading.
They are reading different signals
A voice detector is a family of methods that share an interface. One learns directly from the raw waveform (RawNet2, Tak, Patino, Todisco et al., ICASSP 2021). Another models artifacts across the spectral and temporal structure of a clip at once (AASIST, Jung, Heo, Tak et al., ICASSP 2022). A third starts from a large self-supervised speech model such as wav2vec 2.0 and fine-tunes it (Tak, Todisco, Wang et al., 2022). A fourth ignores general fingerprints and compares a clip against reference audio of one known speaker’s vowels (Yang, Sun, Lyu, Rose, 2025). These tools can hear the same recording and genuinely notice different things, because each was built to read a different trace. How each family works is covered in how do AI voice detectors work.
They were trained on different generators
Even two detectors of the same kind can split, because a detector mostly knows the generators in its training set. The gap shows up the moment a clip comes from a system a tool never saw: a neural-vocoder detector scoring 0.13% equal error rate on the vocoder it learned degrades to between 4.6 and 45.35 percent on unseen vocoders (Sun, Jia, Hou, Lyu, CVPRW 2023). On real audio collected outside the lab, the survey by Yi, Wang, Tao and colleagues (2023) reports the same tools climbing into the 35 to 55 percent range, with RawNet2 rising from 24.32% to 36.74% and AASIST from 19.77% to 34.81%. So a voice note from a brand-new cloning system can read as synthetic to a detector that happens to cover it and clean to one that does not, purely because of what each was fed.
One of them may be reading the recording, not the voice
Part of the disagreement is not about synthesis at all. Detectors often learn a shortcut in the recording rather than the speaker. Negroni, Cuccovillo, Bestagini and colleagues (ICASSP 2026) found that many models “base their decisions on unvoiced timesteps, frequency bands where no speech occurs, or even background noise, rather than the actual speech.” When one tool is effectively scoring the microphone, the room tone, or the silence at the start of a clip while another is reading the voice, they can land on different labels for reasons that have nothing to do with whether the speaker is real.
They set the line in different places
Every detector ends in one decision: is the score high enough to call “AI”? That threshold is a choice, and different vendors choose differently. Research reports the threshold-neutral figure, equal error rate, the point where false accepts and false rejects balance, but a deployed tool has to pick an actual operating point, and away from the equal-error point the two errors diverge. A tool tuned to catch as many fakes as possible flags more real voices; a tool tuned to avoid false accusations waves more fakes through. Two tools reading the identical underlying score can therefore print different verdicts simply because their lines sit in different places, the same operating-point problem set out in what does an AI voice-detector score mean.
Commercial and research tools disagree most
You cannot assume a consumer tool behaves like a published benchmark number. In our internal testing, one widely used commercial voice detector’s score barely moved even on audio we had altered in ways that clearly change how it sounds, which points to a narrow underlying feature set; the method behind that test stays in-house, but the finding is ours to report. A published equal error rate from a research benchmark is a poor predictor of how a commercial tool will score any given clip, so a research detector and a consumer product can split with ease. First-party tools narrow the field further: the ElevenLabs classifier inspects only the first minute of a clip and “does not reliably classify ElevenV3,” and it targets ElevenLabs-made speech rather than other systems, so it will disagree with a general detector by design.
How to use disagreement instead of being confused by it
Disagreement is information, not noise to be averaged away. When independent detectors that read different signals all agree, that convergence is worth something, because they are unlikely to share the same blind spot. When they split, the split is telling you the clip sits near the edge of what these tools can resolve, and no single score should be treated as the answer. Preserve the original file, run more than one method, look for provenance, and weigh the source. A verdict that survives two methods reading different traces is far stronger than a confident number from one. For how far any of these tools can be trusted across media, see are AI detectors accurate.
Sources
- Tak, Patino, Todisco et al. (2021). End-to-End Anti-Spoofing with RawNet2. ICASSP 2021.
- Jung, Heo, Tak et al. (2022). AASIST: Audio Anti-Spoofing Using Integrated Spectro-Temporal Graph Attention Networks. ICASSP 2022.
- Tak, Todisco, Wang et al. (2022). Automatic Speaker Verification Spoofing and Deepfake Detection Using wav2vec 2.0 and Data Augmentation.
- Yang, Sun, Lyu, Rose (2025). Forensic Deepfake Audio Detection Using Segmental Speech Features.
- Sun, Jia, Hou, Lyu (2023). AI-Synthesized Voice Detection Using Neural Vocoder Artifacts. CVPRW 2023.
- Yi, Wang, Tao et al. (2023). Audio Deepfake Detection: A Survey.
- Negroni, Cuccovillo, Bestagini et al. (2026). Multi-Task Transformer for Explainable Speech Deepfake Detection via Formant Modeling. ICASSP 2026.
- ElevenLabs (2026). AI Speech Classifier.