SNAP: Speaker Nulling for Artifact Projection in Speech Deepfake Detection

ArXiv: 2603.20686

🎯 Pitch

State-of-the-art speech deepfake detectors don't actually hear fakes—they memorize voices. This paper reveals that WavLM features are so dominated by speaker identity that classifiers confuse a speaker with authenticity, then shows that simply projecting out speaker information via orthogonal subspace nulling turns a logistic regression model with 2,049 parameters into the most robust detector available, slashing error rates by over half.

1. Executive Summary

This paper introduces SNAP (Speaker Nulling for Artifact Projection), a framework that addresses a phenomenon the authors term speaker entanglement—the dominance of speaker identity over synthesis artifacts in self-supervised speech representations—by estimating a speaker subspace via PCA on per-speaker centroids and applying orthogonal projection to nullify speaker-dependent components (projecting WavLM-Large features onto the orthogonal complement of the speaker subspace). Evaluated on ASVspoof 2019/2021 LA/DF and In-the-Wild benchmarks, SNAP achieves state-of-the-art performance using only logistic regression with 2,049 parameters, reducing EER by 56.25% over WavLM-ECAPA-TDNN on ASV19 LA (0.35% vs. 0.80%) and substantially outperforming all baselines on In-the-Wild data (15.39% vs. 22.22% for the WavLM baseline), while maintaining flawless detection in cross-domain evaluations between CosyVoice2 and F5-TTS architectures, establishing that artifact-focused representations generalize robustly across unseen speakers and TTS models only when speaker information is explicitly suppressed through subspace decomposition.

2. Context and Motivation

The Core Problem: Speech Deepfake Detectors Exploit the Wrong Signal

At its surface, this paper addresses a familiar problem: detecting whether a given audio sample is a real human utterance or a synthetically generated one. The task is well-established, with benchmark evaluations dating back to the ASVspoof challenges (Yamagishi et al., 2021; Todisco et al., 2019). What makes this paper distinctive is not that it builds another detector, but that it diagnoses and attempts to fix a fundamental misalignment in how modern detection systems derive their discriminative power.

The paper's central diagnosis is this: state-of-the-art self-supervised learning (SSL) speech encoders—particularly WavLM (Chen et al., 2021)—produce representations that are dominated by speaker identity rather than synthesis artifacts. When a downstream classifier is trained on top of these representations, it learns to discriminate real from fake speech primarily by recognizing who is speaking and associating certain speakers with "real" and others with "fake" based on the training distribution. The decision boundary fragments along speaker clusters rather than along the real/synthetic distinction. This is what the paper calls speaker entanglement.

The consequence is a detector that performs well on speakers seen during training but collapses when encountering unseen speakers—exactly the scenario that matters in practice, since deepfake detectors deployed in the wild will face speakers the system has never encountered. The paper's quantitative experiments (Section 2.1, Figure 1) make this concrete: t-SNE visualizations of WavLM-Large features show that samples cluster by speaker identity, with the real/synthetic distinction appearing as a secondary, often scrambled signal within each speaker cluster. When the same embeddings are evaluated by speaker clustering quality (silhouette coefficient of 0.026 for speaker identity vs. the real/synthetic distinction, Figure 2), speaker information dominates.

This is not merely a nuisance—it is a structural failure mode that explains why models with strong benchmark numbers on speaker-overlapping evaluation sets often degrade dramatically under speaker-disjoint evaluation, and why generalization to entirely novel TTS architectures remains poor despite years of benchmark-driven progress.

Why This Problem Matters: The Deployment Reality

The practical stakes are straightforward but high. Speech deepfake detection is not an academic exercise; it is a countermeasure against real-world harms that have already materialized. The paper cites documented cases of fraudsters using AI-generated voice imitation to impersonate CEOs and execute financial fraud (Stupp, 2019), and the broader landscape of deepfake-enabled disinformation (Chesney and Citron, 2019; Rahman et al., 2022) and social engineering attacks. These are not hypothetical threats—they require detection systems that work on voices the system has never heard before, generated by TTS architectures that did not exist when the detector was trained.

A detector that exploits speaker-specific correlations in the training data is fundamentally fragile. It may achieve low equal error rates (EERs) on benchmark splits where speakers overlap between training and evaluation, but it will fail when deployed against a new speaker—a fraud victim whose voice has been cloned but who was not in the training set—or a new TTS model whose artifact fingerprint differs from those seen during training. The paper explicitly demonstrates this fragility in Section 4.5 (Figure 3): as the number of training speakers increases, the baseline WavLM detector's EER does not reliably decrease and can even fluctuate or degrade, because more speakers compound the entanglement problem rather than resolving it. The model is learning more speaker identities, not better artifact discrimination.

The theoretical significance is equally important. The paper's framing of the problem as subspace decomposition—the feature space $\mathcal{H}$ is the sum of a speaker subspace $\mathcal{S}$ , an artifact subspace $\mathcal{A}$ , and a residual context subspace $\mathcal{C}$ (Equation 1)—elevates the issue from a heuristic observation to a principled mathematical structure. If correct, this decomposition implies that speaker information is not just correlated with the features used by detectors, but occupies a separable, identifiable subspace that can be removed analytically. This is a much stronger claim than simply observing that speaker identity matters; it asserts that speaker identity can be nullified without losing the artifact signal needed for detection.

Prior Approaches and Where They Fall Short

End-to-end deepfake detectors. The ASVspoof challenges have driven a line of work on specialized architectures for audio deepfake detection. RawNet2 (weon Jung et al., 2020) processes raw waveforms directly, learning filter-like representations from the time-domain signal. AASIST (Jung et al., 2022) incorporates spectro-temporal graph attention networks to capture artifacts across both frequency and time. These systems are trained end-to-end on the detection task and can achieve strong performance on in-domain evaluation. However, as Table 1 shows, their generalization is limited: AASIST achieves a strong 0.82% EER on ASVspoof 2019 LA but degrades to 16.94% on ASVspoof 2021 DF and 43.52% on In-the-Wild data, where speakers, channel conditions, and TTS architectures differ from training. The paper's diagnosis implies that these models, despite being trained from scratch on the detection objective, may still be implicitly learning speaker-dependent features because the raw audio or spectro-temporal representations carry speaker identity as a dominant signal.

SSL-based detectors with large speaker-discriminative backbones. The more recent and relevant line of work leverages pre-trained SSL speech encoders—Wav2Vec 2.0, WavLM, and related models—as feature extractors, with a lightweight classification head (e.g., ECAPA-TDNN; Desplanques et al., 2020) trained on top. These models achieve strong performance because SSL pre-training on massive unlabeled speech corpora produces rich representations that capture both linguistic content and paralinguistic attributes. WavLM in particular (Chen et al., 2021) was designed with a denoising pre-training objective that explicitly preserves speaker characteristics while removing background noise and overlapping voices—exactly the property that makes it excellent for speaker verification but potentially harmful for deepfake detection.

This is the paper's central critique of the SSL-based paradigm. WavLM-ECAPA-TDNN achieves 0.80% EER on ASVspoof 2019 LA (Table 1)—an exceptionally strong result—but degrades to 15.94% on ASVspoof 2021 DF and 34.64% on In-the-Wild. The paper argues that this degradation pattern is not merely due to distribution shift in channel conditions or TTS architectures, but specifically due to speaker entanglement: the features that make WavLM good at speaker verification make it bad at speaker-agnostic artifact detection. The model cannot distinguish between "this audio is fake" and "this speaker is associated with fake samples in my training set."

The paper's critical insight is that prior SSL-based approaches treated the speaker-discriminative nature of these representations as a feature—a source of rich information that the classifier could learn to use or ignore as needed—when in fact it is a bug: the classifier cannot help but exploit speaker cues because they dominate the variance in the representation space.

Speaker disentanglement in related domains. The paper is not the first to observe that speaker identity can interfere with paralinguistic tasks. Prior work has addressed speaker disentanglement for depression detection (Wang et al., 2023) and other speech health applications. The ETA-WavLM approach (Ruggiero et al., 2025) is particularly relevant: it proposes removing speaker identity from SSL representations using a simple linear equation. However, the paper positions SNAP differently by targeting the specific failure mode in deepfake detection—not just generic speaker removal, but speaker nulling in service of artifact amplification—and by providing quantitative evidence that the residual signal after projection genuinely improves artifact discriminability (Figure 2: silhouette score for real vs. synthetic increases from 0.118 to 0.181 after projection).

The gap: no principled artifact isolation. The critical gap the paper identifies is that prior work either (a) used SSL features as-is, accepting the entanglement as an unavoidable cost of using powerful pre-trained representations, or (b) applied generic disentanglement techniques without verifying that the residual features actually capture synthesis artifacts specifically. The paper's contribution is the explicit hypothesis that the feature space decomposes additively into speaker, artifact, and context subspaces (Equation 1), and the demonstration that nulling only the speaker subspace (via orthogonal projection) leaves behind features that are not just "not-speaker" but actively better at discriminating real from synthetic speech, even to the point where a logistic regression classifier with only 2,049 parameters suffices for state-of-the-art performance.

How the Paper Positions Itself

The paper frames its contribution not as a new detector architecture but as a preprocessing framework that transforms existing SSL representations into a form more suitable for artifact-focused detection. This positioning is important: SNAP is not a competitor to WavLM or ECAPA-TDNN but a correction applied to their output. The paper uses WavLM-Large as its backbone (Section 3.1), extracts features from two specific layers (8 and 22, selected based on prior layer-wise analyses showing that shallow layers capture acoustic details while deep layers encode semantic content; Pasad et al., 2022, 2023), and then applies the speaker nulling projection before feeding the result to the simplest possible classifier.

This positions SNAP as a plug-in for existing detection pipelines. The orthogonal projection matrix $P^{\perp}$ (Equation 8) is computed once from the training data's per-speaker centroids and then applied deterministically at inference time. The speaker subspace estimation uses PCA on speaker centroids (Equations 5–7), a standard technique from hyperspectral image analysis (Harsanyi and Chang, 1994) that the paper adapts to the speech domain. The mathematical machinery is well-understood; the novelty is in applying it to the specific failure mode of speaker entanglement in deepfake detection and demonstrating that it works.

The paper also positions itself as an efficiency argument: state-of-the-art detection does not require complex neural architectures if the input representations are properly conditioned. The logistic regression classifier (Equation 10) has only 2,049 parameters—orders of magnitude fewer than the ECAPA-TDNN or AASIST backbones—yet achieves better performance. This is a deliberate rhetorical move: if a linear classifier on projected features outperforms deep networks on raw features, the projection is doing the meaningful work, and the complexity of prior architectures was partly compensating for a representation problem that should have been addressed at the feature level.

Finally, the paper connects to the broader theme of robustness through invariance. By enforcing speaker invariance explicitly (through projection) rather than hoping the model learns it implicitly (through data augmentation or architectural inductive biases), SNAP guarantees that the detector cannot use speaker identity as a shortcut. This connects to the growing literature on invariant risk minimization and shortcut learning in deep learning, though the paper does not explicitly cite this literature, focusing instead on the speech-specific mechanisms.

3. Technical Approach

3.1 Reader Orientation

SNAP is a preprocessing framework that takes speaker-dominated speech representations from a pre-trained SSL model (WavLM) and projects them onto a subspace where speaker identity has been mathematically removed, yielding residual features that isolate synthesis artifacts. The system solves the problem of speaker entanglement—where deepfake detectors exploit speaker-specific correlations rather than genuine artifact cues—by explicitly decomposing the feature space into speaker and non-speaker components, nullifying the speaker subspace via orthogonal projection, and training only a simple logistic regression classifier on the resulting artifact-enriched residuals.

3.2 Big-Picture Architecture (Diagram in Words)

The system has five major processing stages, executed in sequence from raw audio to a real vs. fake decision:

Feature Extraction (WavLM Backbone): A frozen, pre-trained WavLM-Large encoder processes the 16 kHz input waveform and outputs hidden states from two specific transformer layers (layer 8 and layer 22). These hidden states are concatenated, temporally pooled, and L2-normalized to produce a single fixed-dimensional utterance embedding.
Speaker Subspace Estimation (Training Only): Using only the real (bona fide) training samples, per-speaker centroid vectors are computed by averaging the normalized embeddings of all utterances belonging to each speaker. PCA is applied to the matrix of these centroids to identify the top-K principal directions of inter-speaker variation. These K eigenvectors form the orthonormal basis of the speaker subspace.
Orthogonal Projection (Inference): The speaker subspace projection matrix is constructed as $P_{\text{spk}} = U_K U_K^\top$ , and its orthogonal complement projection matrix is computed as $P^{\perp} = I - P_{\text{spk}}$ . Each utterance embedding is multiplied by $P^{\perp}$ , which subtracts out the component lying in the speaker subspace, leaving only the residual components orthogonal to all speaker-direction vectors.
Logistic Regression Classification: The projected, speaker-nullified feature vector is fed into a linear classifier with sigmoid activation. The classifier has exactly $2D + 1$ parameters (where $D$ is the WavLM hidden dimension), producing a scalar probability that the input is bona fide (real) speech.
Inference Pipeline: At test time, the frozen WavLM encoder extracts features, the pre-computed projection matrix $P^{\perp}$ nullifies speaker information, and the trained logistic regression weights produce the final real/synthetic decision—all in a single forward pass with no sequential or iterative components.

Information flows strictly forward: raw audio → WavLM hidden states → concatenated multi-layer features → temporal pooling → L2 normalization → orthogonal projection → logistic regression → binary prediction.

3.3 Roadmap for the Deep Dive

First, the feature extraction pipeline (Section 3.1 of the paper, Equations 2–4): how raw audio becomes an utterance-level embedding, including the dual-layer extraction strategy, temporal pooling, and normalization. This establishes the input representation that the rest of the method transforms.
Second, the speaker subspace estimation procedure (Section 3.2, Equations 5–7): how per-speaker centroids are computed from the training data, how PCA extracts the principal directions of speaker variation, and how the top-K eigenvectors define the speaker subspace basis. This is the core mathematical machinery that makes nullification possible.
Third, the orthogonal projection mechanism (Section 3.2, Equations 8–9): how the projection matrix onto the orthogonal complement of the speaker subspace is constructed and applied, what it means geometrically to nullify speaker-dependent components, and why orthogonal projection (rather than alternatives like adversarial training or feature gating) is the appropriate operation.
Fourth, the classifier design (Section 3.3, Equations 10–11): the logistic regression model, the binary cross-entropy training objective, and the deliberate choice of extreme simplicity to validate that the projection—not the classifier—is doing the meaningful discriminative work.
Fifth, the inference procedure (Section 3.4): how the frozen components (WavLM, projection matrix, classifier weights) are assembled at test time.
Sixth, the design rationale: why each component was chosen over alternatives, synthesizing the paper's explicit justifications and implicit engineering logic.

3.4 Detailed, Sentence-Based Technical Breakdown

This is primarily a feature engineering and representation learning paper whose core idea is that speaker identity occupies an identifiable linear subspace within SSL speech representations, and that explicitly removing this subspace via orthogonal projection produces features where synthesis artifacts become the dominant variance—enabling even a linear classifier to achieve state-of-the-art detection performance.

Feature Extraction and Normalization (Section 3.1)

The feature extraction stage transforms a variable-length raw audio waveform into a fixed-dimensional embedding vector suitable for subspace projection and classification. The backbone is WavLM-Large (Chen et al., 2021), a 24-layer Transformer encoder pre-trained on 94,000 hours of unlabeled speech with a denoising objective that masks portions of the input and requires the model to reconstruct the clean speech while simultaneously separating overlapping speakers. The paper uses WavLM in frozen mode—no fine-tuning of the encoder weights occurs at any point. This is a deliberate design choice: the method treats WavLM as a fixed feature extractor and solves the entanglement problem through post-hoc projection rather than by modifying the encoder's internal representations.

Input preprocessing. All audio is resampled to 16 kHz monaural before being fed to WavLM. The paper does not specify the original sampling rates of the datasets used, but 16 kHz is the standard input rate for WavLM and most SSL speech models. No other preprocessing (normalization, filtering, augmentation) is described.

Layer selection. Rather than using the final hidden state (layer 24) as a representation—which is the default in many SSL-based detection systems—the paper extracts hidden states from two specific intermediate layers: layer 8 ( $l = 8$ ) and layer 22 ( $l = 22$ ). The justification draws on prior layer-wise analyses of SSL speech models (Pasad et al., 2022, 2023), which established that shallow layers primarily capture low-level acoustic and phonetic properties (e.g., spectral shape, formant structure, prosodic details) while deeper layers encode higher-level linguistic and semantic representations (e.g., phoneme sequences, word identity, utterance meaning). The paper hypothesizes that synthesis artifacts manifest at both levels: vocoder-specific spectral distortions and unnatural prosody appear in shallow representations, while semantic inconsistencies or unnatural linguistic patterns appear in deep representations. Concatenating both layers therefore provides a richer artifact signature than either layer alone.

The specific choice of layers 8 and 22 was determined empirically:

"These layers were selected based on empirical validation, as this combination yielded the most discriminative representations for synthetic speech detection in our preliminary experiments."

The paper does not report the sweep range or the performance of alternative layer pairs, which is a minor transparency limitation. However, the dual-layer strategy is well-motivated by the known layer-wise property gradient in Transformer speech encoders.

Hidden state concatenation. For an input waveform, WavLM produces a sequence of hidden states at each layer. Let $H^{(l)} \in \mathbb{R}^{T \times D}$ denote the matrix of hidden states from layer $l$ , where $T$ is the number of time frames (determined by the waveform length and the model's downsampling factor) and $D$ is the hidden dimension of WavLM-Large (1,024 dimensions). The paper concatenates the hidden states from layers 8 and 22 along the feature dimension:

$H = \big[ H^{(8)} ;\ H^{(22)} \big] \in \mathbb{R}^{T \times 2D}$

where $[\cdot\ ;\ \cdot]$ denotes concatenation along the last axis.

What it computes: Each time frame $t$ now has a $2D = 2{,}048$ -dimensional representation that stacks the acoustic-level features from layer 8 on top of the semantic-level features from layer 22. The temporal dimension $T$ varies per utterance depending on its duration.

Why this form: Concatenation (as opposed to averaging or weighted summation) preserves all information from both layers without imposing any prior on their relative importance. The subsequent classifier can learn to weight acoustic and semantic artifact cues differently. Averaging would force equal contribution, and summation would require the representations to occupy compatible subspaces, which may not hold given the known representational differences between shallow and deep layers.

Temporal pooling. To obtain a fixed-dimensional utterance-level representation, the paper applies mean pooling along the time axis:

$f = \frac{1}{T} \sum_{t=1}^{T} H_t \in \mathbb{R}^{2D}$

where $H_t$ is the $2D$ -dimensional feature vector at time frame $t$ .

What it computes: The arithmetic mean of all time-frame representations, collapsing the $T \times 2D$ matrix into a single $2D$ -dimensional vector. Each dimension of $f$ is the average activation of that feature across the entire utterance.

Why mean pooling: Mean pooling is the simplest temporal aggregation strategy and is widely used in speaker verification and audio classification when the goal is to capture global utterance-level properties rather than fine-grained temporal dynamics. The paper's choice is consistent with its overall philosophy of simplicity: if the feature representation after projection is sufficiently discriminative, even crude temporal aggregation should suffice. Alternatives like attentive pooling or learned aggregation (used in ECAPA-TDNN) add parameters and complexity that the paper explicitly argues are unnecessary once speaker information is removed. A subtle advantage of mean pooling is that it acts as a low-pass filter over time, smoothing out transient artifacts while preserving persistent ones, which may be beneficial since synthesis artifacts (e.g., vocoder fingerprinting, consistent spectral distortions) tend to be stationary or slowly varying across an utterance.

L2 normalization. The pooled vector is projected onto the unit hypersphere:

$z = \frac{f}{\|f\|_2}$

where $\|f\|_2 = \sqrt{\sum_{i=1}^{2D} f_i^2}$ is the Euclidean norm of $f$ .

What it computes: Each feature vector is scaled to have unit Euclidean length. Geometrically, all utterance embeddings are mapped to the surface of a $(2D-1)$ -dimensional hypersphere. The operation preserves the direction of the vector while discarding its magnitude.

Why this form: There are two motivations. First, numerical stability: normalizing embeddings prevents features with large magnitudes from dominating the subsequent PCA and projection steps, which are sensitive to scale. Second, and more fundamentally, L2 normalization is standard practice in speaker verification and other tasks where cosine similarity (which depends only on angle, not magnitude) is the primary similarity metric. Since the speaker subspace is estimated from the directions of per-speaker centroids (via PCA, which is rotation-sensitive but scale-insensitive under common normalizations), mapping all embeddings to the unit sphere ensures that the centroid computation reflects only directional speaker consistency, not variation in utterance-level activation magnitudes. A speaker who consistently produces embeddings pointing in a particular direction but with varying magnitudes (due to different utterance lengths, loudness, or background noise) will have a centroid that accurately captures that direction after normalization, whereas without normalization the centroid could be pulled toward louder or longer utterances.

Design rationale summary. The feature extraction pipeline is deliberately minimal: frozen WavLM, two hand-selected layers, concatenation, mean pooling, L2 normalization. Every step is linear or has a well-understood geometric interpretation. There are no learned aggregation parameters, no attention mechanisms, no fine-tuning. This minimalism is not a limitation but a strength for the paper's argument: if the method works despite this simplicity, the projection step must be doing the heavy lifting. Any complexity introduced prior to projection would confound the claim that speaker nulling is the key innovation.

Speaker Subspace Estimation (Section 3.2, Equations 5–7)

This is the conceptual core of SNAP. The goal is to identify a low-dimensional linear subspace within the $2D$ -dimensional normalized embedding space that captures speaker identity variation, so that this subspace can subsequently be removed from all embeddings.

Per-speaker centroid computation. For each unique speaker $u$ in the training set, the paper computes the centroid (arithmetic mean) of all normalized embeddings belonging to that speaker:

$\mu_u = \frac{1}{|\mathcal{I}_u|} \sum_{j \in \mathcal{I}_u} z_j$

where $\mathcal{I}_u = \{j : s_j = u\}$ is the set of sample indices belonging to speaker $u$ , $s_j$ is the speaker label for sample $j$ , $z_j \in \mathbb{R}^{2D}$ is the L2-normalized embedding of sample $j$ , and $|\mathcal{I}_u|$ is the number of utterances from speaker $u$ .

What it computes: For each speaker, a single $2D$ -dimensional vector representing the "average embedding direction" of all their utterances. If a speaker has 10 training utterances, their centroid is the vector average of those 10 normalized embeddings. Since all $z_j$ lie on the unit hypersphere, the centroid $\mu_u$ will typically have norm less than 1 (it lies inside the sphere) unless all utterances from speaker $u$ produce identical embeddings—an impossibility in practice.

Why this form: The centroid captures the consistent directional component shared across a speaker's utterances while averaging out utterance-specific variation (e.g., different phoneme content, different recording conditions within the same speaker). The underlying assumption is that what varies between speakers is captured by the mean direction of their embedding clusters, while what varies within a speaker (different sentences spoken by the same person) is orthogonal to these between-speaker directions. This assumption is plausible because WavLM was explicitly trained to preserve speaker identity (via its utterance-mixing pre-training strategy), meaning that the principal axes of variation in its embedding space should align with speaker-discriminative directions.

A critical detail: the paper does not specify whether centroids are computed from all training samples (both real and synthetic) or only from real samples. The speaker labels in the ASVspoof dataset apply to the bona fide utterances, but synthetic utterances are generated to mimic specific speakers. The most natural interpretation—and the one consistent with the paper's goal of removing speaker identity—is that centroids are computed from real utterances only, since these are the ground-truth exemplars of each speaker's voice. Computing centroids from synthetic utterances would potentially contaminate the speaker subspace estimate with synthesis artifacts, undermining the goal of isolating artifacts in the residual. However, the paper is ambiguous on this point, which is a minor documentation gap.

Centroid matrix and centering. The per-speaker centroids are stacked to form a matrix $C \in \mathbb{R}^{|S| \times 2D}$ , where $|S|$ is the number of distinct speakers in the training set. The paper then centers this matrix by subtracting the mean across speakers, producing $\bar{C}$ . The paper does not provide an explicit equation for the centering operation, but it is standard PCA preprocessing: each dimension of the centroid vectors is mean-subtracted so that the data has zero mean.

PCA on speaker centroids. Principal Component Analysis is applied to the centered centroid matrix to identify the directions of maximum variance in the speaker embedding space:

$\Sigma = \frac{1}{|S| - 1} \bar{C}^\top \bar{C}$

where $\Sigma \in \mathbb{R}^{2D \times 2D}$ is the covariance matrix of the speaker centroids, and the denominator $|S|-1$ gives the unbiased estimate.

What it computes: The covariance matrix captures pairwise linear relationships between the $2D$ embedding dimensions, computed across the $|S|$ speaker centroids. Each entry $\Sigma_{ij}$ is the covariance between dimension $i$ and dimension $j$ of the centroid vectors. The diagonal entries are the variances of individual dimensions; the off-diagonal entries are the covariances.

Why this form: The covariance matrix is the sufficient statistic for PCA. By computing it from speaker centroids rather than from individual utterance embeddings, the analysis specifically captures between-speaker variation while ignoring within-speaker variation. This is the crucial design choice: the paper wants to identify directions along which different speakers' embedding clusters are separated, not directions along which individual utterances (potentially including synthetic ones) vary. The standard unbiased estimator with $|S|-1$ in the denominator is used rather than the maximum-likelihood estimator (with $|S|$ ) for numerical reasons.

Eigendecomposition. The covariance matrix is decomposed into its eigenvalues and eigenvectors:

$\Sigma = V \Lambda V^\top$

where $V \in \mathbb{R}^{2D \times 2D}$ is an orthogonal matrix whose columns are the eigenvectors $v_1, v_2, \ldots, v_{2D}$ , and $\Lambda = \text{diag}(\lambda_1, \lambda_2, \ldots, \lambda_{2D})$ is a diagonal matrix of eigenvalues sorted in descending order ( $\lambda_1 \geq \lambda_2 \geq \cdots \geq \lambda_{2D} \geq 0$ ).

What it computes: The eigenvectors $V$ form a new orthonormal basis for the embedding space, rotated such that the first basis vector (first principal component) points in the direction of maximum variance in the speaker centroid data, the second basis vector points in the direction of second-maximum variance (subject to being orthogonal to the first), and so on. The corresponding eigenvalues $\lambda_i$ give the amount of variance explained by each direction.

Why this form: Eigendecomposition of the covariance matrix is the standard solution to finding the principal axes of variation. The orthogonality of $V$ (guaranteed because $\Sigma$ is symmetric and positive semi-definite) is essential for the subsequent projection step: it means the speaker subspace identified by the top $K$ eigenvectors is geometrically a linear subspace spanned by mutually orthogonal basis vectors, and the projection onto its orthogonal complement is well-defined (Equation 8).

Speaker subspace basis selection. The top- $K$ eigenvectors form the speaker subspace basis:

$U_K = [v_1, v_2, \ldots, v_K] \in \mathbb{R}^{2D \times K}$

where $K$ is a hyperparameter controlling the dimensionality of the speaker subspace.

What it computes: The $K$ orthonormal basis vectors that span the $K$ -dimensional subspace capturing the most prominent directions of speaker variation in the embedding space. Intuitively, $v_1$ captures the single direction along which speakers differ most (perhaps corresponding to fundamental frequency range, or vocal tract length, or some other global speaker property), $v_2$ captures the second-most-important direction, and so on.

Why this form: Selecting the top $K$ eigenvectors (rather than all eigenvectors) implements a low-rank approximation of the speaker variation. The assumption is that speaker identity is a relatively low-dimensional phenomenon compared to the full $2D = 2{,}048$ embedding space—there are far fewer meaningful speaker-discriminative directions than there are total dimensions. The remaining $2D - K$ dimensions capture non-speaker variation: synthesis artifacts, linguistic content, channel effects, and noise. The selection of $K$ is critical: too small, and residual speaker information will remain in the projected features, allowing the classifier to exploit speaker cues; too large, and artifact-relevant dimensions will be inadvertently removed, degrading discriminability. The paper uses $K = 5$ (stated in Section 4.1) across all experiments, but does not report a sweep over $K$ values or provide a principled selection criterion (e.g., based on the eigenvalue elbow or cross-validation performance). This is a notable omission—the sensitivity of results to $K$ is a key empirical question that the paper leaves unanswered.

Design rationale summary. The speaker subspace estimation procedure identifies a low-dimensional linear subspace capturing between-speaker variation by applying PCA to per-speaker centroids computed from normalized WavLM embeddings. This approach has several attractive properties: it requires only speaker labels (no adversarial training, no auxiliary speaker classification loss), it is computationally cheap (PCA on at most a few hundred centroids in 2,048 dimensions), it produces an orthonormal basis that enables clean orthogonal projection, and it is entirely unsupervised within the speaker structure—no speaker classification model is trained, only a geometric decomposition of the embedding space is performed.

Orthogonal Projection for Speaker Nulling (Section 3.2, Equations 8–9)

Once the speaker subspace basis $U_K$ is estimated, the paper constructs a projection operator that removes any component of an embedding lying within this subspace, producing speaker-nullified residual features.

Projection matrix construction. The projection matrix onto the speaker subspace is:

$P_{\text{spk}} = U_K U_K^\top \in \mathbb{R}^{2D \times 2D}$

What it computes: The matrix that projects any vector $z \in \mathbb{R}^{2D}$ onto the $K$ -dimensional subspace spanned by the columns of $U_K$ . For any input vector $z$ , the product $P_{\text{spk}} z$ produces the component of $z$ that lies within the speaker subspace—the part of the embedding that can be expressed as a linear combination of the speaker-discriminative basis vectors.

Why this form: The matrix $U_K U_K^\top$ is the standard formula for orthogonal projection onto the column space of $U_K$ when $U_K$ has orthonormal columns (which the PCA eigenvectors do). The computation $U_K U_K^\top z$ can be understood in two steps: first, $U_K^\top z \in \mathbb{R}^K$ computes the coordinates (scores) of $z$ along each speaker basis vector (the dot product $v_i^\top z$ for each $i = 1, \ldots, K$ ); second, $U_K (U_K^\top z)$ reconstructs the vector in the original $2D$ -dimensional space using only those $K$ coordinates. The resulting vector is the orthogonal projection of $z$ onto the speaker subspace—it is the closest point in that subspace to $z$ under Euclidean distance.

Orthogonal complement projection. The projection matrix onto the orthogonal complement (the subspace of all vectors orthogonal to every speaker basis vector) is:

$P^{\perp} = I_{2D} - U_K U_K^\top$

where $I_{2D}$ is the $2D \times 2D$ identity matrix.

What it computes: The matrix that projects any vector onto the subspace orthogonal to the speaker subspace. For any input $z$ , the product $P^{\perp} z$ subtracts out the speaker-subspace component of $z$ , leaving only the residual component that cannot be expressed as a linear combination of speaker-discriminative directions.

Why this form: This is the standard formula for the orthogonal complement projection, derived from the fact that any vector can be uniquely decomposed as $z = z_{\parallel} + z_{\perp}$ , where $z_{\parallel} = P_{\text{spk}} z$ is the component parallel to the speaker subspace and $z_{\perp} = z - z_{\parallel} = (I - P_{\text{spk}}) z$ is the component orthogonal to it. The operator $P^{\perp}$ is itself a projection matrix (it is symmetric and idempotent: $P^{\perp} P^{\perp} = P^{\perp}$ ), and its null space is exactly the speaker subspace spanned by $U_K$ . This means that for any vector $z$ , $P^{\perp} z$ is guaranteed to have zero projection onto any of the speaker basis vectors—i.e., $U_K^\top (P^{\perp} z) = 0$ .

Geometrically, $P^{\perp}$ acts as a linear "filter" that passes only the components of the embedding that are uncorrelated with the dominant directions of speaker variation. If the paper's subspace decomposition hypothesis (Equation 1) is correct— $\mathcal{H} = \mathcal{S} + \mathcal{A} + \mathcal{C}$ , where $\mathcal{S}$ is the speaker subspace, $\mathcal{A}$ is the artifact subspace, and $\mathcal{C}$ is the context (content/channel/noise) subspace—then $P^{\perp}$ removes $\mathcal{S}$ entirely while preserving (most of) $\mathcal{A}$ and $\mathcal{C}$ . The key assumption is that $\mathcal{A}$ and $\mathcal{C}$ are approximately orthogonal to $\mathcal{S}$ , meaning that removing speaker information does not also remove artifact information. This is an empirical question that the paper's results (especially Figure 2) address: the increased silhouette coefficient for real vs. synthetic after projection (0.118 → 0.181) provides evidence that artifact discriminability is not just preserved but enhanced, suggesting that the artifact subspace $\mathcal{A}$ genuinely lies largely in the orthogonal complement of the speaker subspace.

Application to embeddings. The speaker-nullified residual feature is computed by multiplying any utterance embedding by the projection matrix:

$\tilde{z} = P^{\perp} z$

where $z \in \mathbb{R}^{2D}$ is the L2-normalized WavLM embedding (from Equation 4) and $\tilde{z} \in \mathbb{R}^{2D}$ is the projected feature vector.

What it computes: For each utterance, the component of its WavLM embedding that lies along speaker-discriminative directions is subtracted out. The resulting vector $\tilde{z}$ has the property that its dot product with each speaker basis vector is zero: $v_i^\top \tilde{z} = 0$ for $i = 1, \ldots, K$ . In other words, $\tilde{z}$ is mathematically orthogonal to the speaker subspace—it contains no linear information about which of the $K$ speaker-discriminative axes the utterance aligns with.

Why this form (subspace projection vs. alternatives): The paper explicitly chooses orthogonal projection over several alternatives for removing speaker information:

Adversarial training (training a speaker classifier adversarially alongside the detector) is widely used for domain-invariant representation learning but requires careful tuning of the adversarial weight, can be unstable, and typically achieves only approximate invariance—the learned representation may still contain residual speaker information exploitable by a sufficiently powerful adversary. Orthogonal projection provides guaranteed invariance along the identified speaker directions: by construction, $\tilde{z}$ has exactly zero projection onto the speaker subspace.
Feature dropping or gating (removing specific dimensions from the embedding) is a common heuristic but is coarse; individual dimensions of WavLM embeddings likely mix speaker, content, and artifact information. Orthogonal projection operates in a rotated basis where the speaker information has been concentrated into specific axes (the principal components), allowing precise removal of speaker information while preserving the remaining variance.
Instance normalization or simple mean subtraction removes global offsets but does not account for the multi-dimensional structure of speaker variation. A speaker's embedding could differ from the global mean along many correlated dimensions; PCA identifies these directions and removes them collectively.
Learning a speaker-removal transformation (e.g., via a neural network trained to maximize artifact discriminability while minimizing speaker discriminability) introduces additional parameters and training complexity without providing the geometric interpretability and guaranteed invariance of projection.

The choice of orthogonal projection is also computationally appealing: $P^{\perp}$ is a $2D \times 2D$ matrix (approximately $4{,}096 \times 4{,}096$ for WavLM-Large with dual layers), but the actual computation $\tilde{z} = z - U_K (U_K^\top z)$ requires only $O(KD)$ operations (multiplying a $K \times D$ matrix by a $D$ -dimensional vector twice), which is negligible compared to the WavLM forward pass.

The "speaker nulling" terminology. The paper uses the term "nulling" deliberately: the speaker information is not merely attenuated or suppressed, but set to exactly zero along the $K$ identified speaker directions. This is a stronger claim than "speaker disentanglement" or "speaker removal," which could refer to softer forms of invariance. The nulling operation ensures that the classifier cannot use speaker-aligned information, because that information has been mathematically removed from its input.

Design rationale summary. The orthogonal projection step is the algorithmic centerpiece of SNAP. It transforms speaker-dominated WavLM embeddings into speaker-nullified residuals that preserve only components orthogonal to the estimated speaker subspace. The operation is linear, deterministic, computationally cheap, and—crucially—provides a mathematical guarantee of invariance along the identified directions, something that learned invariance methods cannot provide. The effectiveness of the entire framework depends on two assumptions: (1) that the speaker subspace estimated from training speakers generalizes to unseen speakers (i.e., the principal directions of inter-speaker variation are consistent across speaker populations), and (2) that the artifact subspace $\mathcal{A}$ is largely orthogonal to the speaker subspace $\mathcal{S}$ , so that nulling the latter preserves the former.

Logistic Regression Classification (Section 3.3, Equations 10–11)

With speaker information nullified, the paper argues that a simple classifier suffices to discriminate real from synthetic speech. The classifier is logistic regression—a linear model with sigmoid activation—trained on the projected features $\tilde{z}$ .

Model specification. The logistic regression model computes:

$\hat{y} = \sigma(w^\top \tilde{z} + b)$

where $\sigma(x) = \frac{1}{1 + e^{-x}}$ is the sigmoid function, $w \in \mathbb{R}^{2D}$ is the weight vector, $b \in \mathbb{R}$ is the bias scalar, and $\hat{y} \in (0, 1)$ is the predicted probability that the input is bona fide (real) speech.

What it computes: A linear combination of the $2D$ projected features, shifted by a bias, and squashed through the sigmoid to produce a probability. If $w^\top \tilde{z} + b$ is large and positive, $\hat{y}$ is close to 1 (high confidence in "real"); if it is large and negative, $\hat{y}$ is close to 0 (high confidence in "synthetic"); if it is near zero, $\hat{y}$ is near 0.5 (maximum uncertainty). The decision boundary is the hyperplane $w^\top \tilde{z} + b = 0$ in the $2D$ -dimensional projected feature space.

Why this form: Logistic regression is the simplest possible classifier that produces calibrated probability estimates. Its linear nature means that the decision boundary is a single hyperplane—the model can only separate real from synthetic if the projected features $\tilde{z}$ are approximately linearly separable. This is an intentionally strong constraint that serves as a "litmus test" for the quality of the projection: if speaker-nullified features can be separated by a linear boundary, then the projection has successfully isolated artifact information into a form that is linearly accessible. If a complex nonlinear classifier were used (e.g., a deep neural network), it would be unclear whether the performance gains came from the projection or from the classifier's capacity to find nonlinear patterns in residual speaker information.

The total number of parameters is $2D + 1$ : $2D$ weights (one per feature dimension) plus one bias term. With $D = 1{,}024$ and dual-layer concatenation, $2D = 2{,}048$ , giving $2{,}049$ parameters. The paper emphasizes this number explicitly:

"utilizing a simple logistic regression with only 2,049 parameters"

This is three to four orders of magnitude fewer than the ECAPA-TDNN or AASIST backbones, making the point that model capacity is not the driver of performance—feature quality is.

Training objective. The model is trained to minimize the binary cross-entropy loss:

$\mathcal{L}_{\text{BCE}} = -\frac{1}{N} \sum_{i=1}^{N} \left[ y_i \log(\hat{y}_i) + (1 - y_i) \log(1 - \hat{y}_i) \right]$

where $N$ is the number of training samples, $y_i \in \{0, 1\}$ is the ground-truth label ( $1$ for real, $0$ for synthetic), and $\hat{y}_i = \sigma(w^\top \tilde{z}_i + b)$ is the model's predicted probability for sample $i$ .

What it computes: The average negative log-likelihood of the training labels under the model's predicted probabilities. For a real sample ( $y_i = 1$ ), the loss is $-\log(\hat{y}_i)$ , which penalizes the model heavily when it assigns low probability to a real utterance. For a synthetic sample ( $y_i = 0$ ), the loss is $-\log(1 - \hat{y}_i)$ , which penalizes the model when it assigns high probability to a synthetic utterance. The loss is always non-negative, reaching zero only when the model predicts with perfect confidence and perfect accuracy on all samples.

Why this form: Binary cross-entropy is the maximum-likelihood objective for a Bernoulli-distributed binary target, which is the canonical choice for binary classification. It has the desirable property that the gradient is larger when the prediction is confident but wrong (e.g., predicting 0.99 for a synthetic sample) than when it is uncertain (e.g., predicting 0.5), which drives the model toward well-calibrated probabilities. The loss is convex in the model parameters $(w, b)$ for linearly separable data, guaranteeing convergence to a unique global minimum (assuming sufficient regularization).

Training details. The paper is notably sparse on optimization details for the logistic regression. No learning rate, optimizer, batch size, number of epochs, regularization strength, or convergence criterion is specified. Given that logistic regression on 2,049-dimensional features is a standard convex optimization problem, the specific solver (e.g., L-BFGS, SGD, Adam) matters primarily for convergence speed rather than final performance, but the omission of any hyperparameters is a minor documentation gap that would complicate exact reproduction.

Design rationale summary. The classifier is deliberately trivial: linear model, sigmoid output, binary cross-entropy loss, no hidden layers, no nonlinearities, no feature interactions beyond what the linear combination captures. This design serves the paper's narrative purpose: SNAP achieves state-of-the-art performance because of the projection, not because of a clever classifier. If a logistic regression on projected features outperforms ECAPA-TDNN on raw features, then the projection has successfully transformed the representation problem into one that is linearly solvable—which is the strongest possible validation of the speaker-nulling hypothesis.

Inference Pipeline (Section 3.4)

At inference time, the pipeline assembles all frozen components into a single deterministic forward pass. No training, adaptation, or iterative computation occurs.

Step 1: Feature extraction. The test waveform is resampled to 16 kHz and fed through the frozen WavLM-Large encoder. Hidden states from layers 8 and 22 are extracted, concatenated (Equation 2), mean-pooled (Equation 3), and L2-normalized (Equation 4) to produce the utterance embedding $z \in \mathbb{R}^{2D}$ .

Step 2: Speaker nulling. The embedding $z$ is multiplied by the pre-computed orthogonal projection matrix $P^{\perp} = I - U_K U_K^\top$ (Equation 8) to produce the speaker-nullified feature $\tilde{z} = P^{\perp} z$ (Equation 9). The projection matrix $P^{\perp}$ was computed once from the training data's speaker centroids during the training phase and is stored as a $2D \times 2D$ matrix. The matrix multiplication $\tilde{z} = P^{\perp} z$ is an $O(D^2)$ operation but is negligible in wall-clock time compared to the WavLM forward pass (which involves 24 Transformer layers with self-attention).

Step 3: Classification. The projected feature $\tilde{z}$ is classified by the trained logistic regression model: $\hat{y} = \sigma(w^\top \tilde{z} + b)$ (Equation 10). The weight vector $w$ and bias $b$ were learned during training and are stored as $2D + 1$ scalars.

Step 4: Decision. The predicted probability $\hat{y}$ is thresholded (typically at 0.5, though the paper evaluates using EER, which determines the optimal threshold post-hoc on the evaluation set) to produce a binary real/synthetic decision.

The entire pipeline is feedforward and deterministic (assuming the WavLM forward pass is deterministic; the paper does not specify whether dropout is disabled at inference, but this is standard practice). There is no sequential dependency, no iterative refinement, and no adaptive computation—the same fixed projection matrix and classifier weights are applied to every test utterance regardless of its characteristics.

What makes this noteworthy. The inference pipeline is extraordinary in its simplicity relative to its performance. State-of-the-art deepfake detection typically involves complex architectures (graph attention networks for AASIST, TDNN with channel attention for ECAPA-TDNN) with millions of parameters and carefully designed inductive biases for audio processing. SNAP replaces all of this with a linear projection followed by a linear classifier, achieving better performance through a representation-level fix rather than an architectural one. This has practical implications for deployment: the SNAP projection matrix and classifier weights can be stored in a few kilobytes, the projection and classification steps add negligible latency to the WavLM forward pass, and the entire system can run on resource-constrained devices once the WavLM encoder is deployed.

Design Rationale Synthesis

The paper makes a series of deliberate, mutually reinforcing design choices that together constitute the SNAP framework's philosophy:

1. Frozen SSL backbone over fine-tuning. The paper uses WavLM-Large in frozen mode, never updating its weights. The rationale is twofold: (a) WavLM's pre-training objective explicitly preserves speaker characteristics, meaning that fine-tuning on a detection task would likely produce a model that still exploits speaker cues but in a less interpretable way; (b) keeping the backbone frozen isolates the effect of the projection step—any performance improvement can be attributed to speaker nulling, not to the backbone learning better artifact representations. The trade-off is that frozen features may be suboptimal for artifact detection compared to fine-tuned features, but the paper accepts this cost in exchange for clean experimental ablations and interpretability.

2. Multi-layer feature concatenation over single-layer extraction. By concatenating shallow (layer 8, acoustic) and deep (layer 22, semantic) representations, the paper captures artifact information at multiple levels of the processing hierarchy. This is motivated by the layer-wise property gradient known from SSL speech model analysis (Pasad et al., 2022, 2023) and by the intuition that different TTS architectures leave fingerprints at different representational levels (e.g., vocoder artifacts in spectral details at shallow layers vs. unnatural prosody patterns at deeper layers). The alternative—using only the final layer (as in the WavLM baseline in Table 1)—would lose fine-grained acoustic information that has been compressed away by the deep layers.

3. PCA on speaker centroids over alternative speaker subspace estimation methods. The paper could have estimated the speaker subspace using: (a) Linear Discriminant Analysis (LDA), which explicitly maximizes between-class (between-speaker) separation relative to within-class variation—this would require computing within-speaker covariance matrices and might be more sensitive to outliers; (b) training a speaker classifier and using its weight matrix to define speaker-discriminative directions—this requires labeled data and optimization but could capture nonlinear speaker structure; (c) adversarial training to learn a speaker-invariant projection—this is optimization-heavy and provides only approximate invariance. PCA on centroids is chosen because it is non-parametric (no optimization beyond eigendecomposition), computationally cheap, mathematically clean (orthonormal basis), and directly captures between-speaker variation as the dominant modes of the centroid covariance matrix. The implicit assumption is that between-speaker variation dominates within-speaker variation in the normalized embedding space, which is consistent with WavLM's design as a speaker-discriminative model.

4. Orthogonal projection over soft suppression. The paper chooses hard nulling (exactly zero projection onto the speaker subspace) over soft suppression (e.g., multiplying speaker-aligned components by a factor $\alpha < 1$ ). Hard nulling provides a mathematical guarantee that the classifier cannot use the identified speaker directions, which is valuable for the paper's ablation argument: if performance remains high after hard nulling, speaker information along the identified directions cannot be driving performance. Soft suppression would leave open the possibility that the classifier is still exploiting attenuated speaker cues. The trade-off is that hard nulling might remove some artifact information that happens to be correlated with speaker directions—the paper bets that the overlap is small enough that the residual features retain sufficient discriminative power.

5. Linear classifier over deep classifier. The choice of logistic regression over more expressive classifiers (neural networks, ECAPA-TDNN, etc.) is a deliberate rhetorical and experimental device. It demonstrates that the projected features are sufficiently well-structured that a linear boundary suffices, which implies that the projection has successfully linearized the real/synthetic separation. If a deep classifier were necessary to achieve strong performance on projected features, it would suggest that residual speaker information or complex nonlinear artifact patterns remain in the features, weakening the claim that projection isolates artifacts. The paper's results (Table 1) validate this choice: the linear classifier on projected features outperforms deep classifiers on raw features, confirming that the projection—not classifier capacity—is the source of the performance gain.

6. Explicit speaker subspace decomposition over implicit invariance learning. Many modern approaches to invariant representation learning use adversarial training, domain-adversarial neural networks, or information-theoretic regularization to encourage a representation to be invariant to a nuisance variable (here, speaker identity). SNAP takes the opposite approach: it explicitly identifies and removes the invariant subspace through geometric operations, with no learned invariance penalties. The advantage is that invariance is guaranteed (for the identified directions) rather than hoped for, and the process is transparent and auditable. The disadvantage is that the invariance is only as good as the speaker subspace estimate—if there are speaker-discriminative directions not captured by the top $K$ PCA components (e.g., nonlinear speaker manifolds, or speaker information distributed across many low-variance directions), they will remain in the projected features and the classifier may still exploit them. The paper's empirical results suggest this residual leakage is small, but the possibility is inherent in the linear subspace assumption.

4. Key Insights and Innovations

Innovation 1: Speaker Entanglement as a Diagnosed Failure Mode, Not an Assumed Limitation

The paper's most fundamental conceptual contribution is not the nulling mechanism itself, but the diagnosis that precedes it: the identification and quantitative characterization of speaker entanglement as the specific reason SSL-based deepfake detectors fail to generalize. This shifts the problem from "detectors don't generalize well" (a known empirical observation) to "detectors don't generalize because they exploit the wrong structure in the representation space" (a mechanistic explanation with actionable implications).

Prior work in speech deepfake detection treated generalization failure as a standard domain-shift problem: models trained on one set of TTS architectures, speakers, and recording conditions perform poorly on another set. The dominant responses were architectural (design better inductive biases; Jung et al., 2022; Desplanques et al., 2020), data-driven (train on more diverse data), or ensemble-based (Combei et al., 2024). The field implicitly assumed that SSL representations like WavLM provided rich, generally useful features, and that the classifier's job was to extract the artifact-relevant components while ignoring irrelevant variation. The possibility that the representation itself was structurally biased toward the wrong signal—that speaker identity was not just a nuisance variable but the dominant organizing principle of the feature space—was not systematically investigated.

The paper's t-SNE visualizations (Figure 1) and silhouette coefficient analysis (Figure 2) make this diagnosis concrete. Figure 1 shows that WavLM-Large embeddings cluster by speaker identity, with the real/synthetic distinction appearing as a secondary, often fragmented signal within each speaker cluster. Figure 2 quantifies this: the baseline features have a mean silhouette coefficient of 0.026 when clustered by speaker identity and 0.118 when clustered by real vs. synthetic—speaker clustering is weaker than class clustering in absolute terms, but the critical finding is that removing speaker information (via projection) increases class clustering to 0.181 while driving speaker clustering to −0.002 (essentially random). This is the central evidence for the paper's claim: speaker identity and artifact information are in tension, and suppressing the former amplifies the latter.

This diagnosis matters beyond the specific solution (SNAP) because it reframes what "good" speech representations mean for deepfake detection. A representation that is excellent for speaker verification (low EER on VoxCeleb) may be inherently problematic for artifact detection because the properties that make it speaker-discriminative—sensitivity to vocal tract characteristics, fundamental frequency, speaking style—are precisely the properties that dominate the feature variance and obscure the subtle, speaker-independent signals left by vocoders and neural TTS decoders. The paper's insight is that speaker-discriminative power and artifact-discriminative power are competing objectives in SSL representations, and that optimizing for both simultaneously (as WavLM's pre-training does) creates a representation where the speaker signal wins.

This is a fundamental reframing rather than an incremental improvement. It changes the question from "how do we build a better classifier on top of WavLM?" to "how do we transform WavLM's output so that the artifact signal, not the speaker signal, becomes the dominant source of discriminative variance?" The SNAP framework is one answer to that reframed question, but the diagnosis itself is the more durable contribution—it applies to any SSL backbone with strong speaker-discriminative properties and suggests that future work on speech representations for paralinguistic tasks should explicitly measure and mitigate speaker dominance.

Innovation 2: Guaranteed Invariance Through Subspace Projection, Replacing Learned Approximations

The second conceptual innovation is methodological: SNAP enforces speaker invariance through explicit geometric removal of a pre-identified subspace, rather than through the learned approximate invariance that dominates the representation-learning literature. This is a fundamentally different philosophy for handling nuisance variables, with distinct guarantees and failure modes.

The standard approach to building invariant representations in deep learning is adversarial training: train a primary task classifier while simultaneously training an adversary to predict the nuisance variable (here, speaker identity) from the representation, and update the encoder to minimize the primary loss while maximizing the adversary's loss. This approach, instantiated in domain-adversarial neural networks and their variants, has been applied to speaker disentanglement in related domains (Wang et al., 2023, for depression detection). The appeal is that it requires no explicit model of the nuisance variable's structure—the adversary learns to extract whatever speaker information remains in the representation, and the encoder learns to suppress it.

The problem, which the paper implicitly critiques by choosing a different path, is that adversarial invariance is approximate, optimization-dependent, and unverifiable. The degree of invariance achieved depends on the adversary's capacity, the adversarial weight hyperparameter, and the optimization dynamics—a stronger adversary could potentially extract speaker information that a weaker one missed, and there is no guarantee that the representation is truly speaker-invariant, only that the specific adversary used during training could not exploit it. Moreover, adversarial training adds instability (the min-max optimization is notoriously sensitive to hyperparameters) and computational cost (training an additional network).

SNAP's subspace projection approach provides something adversarial methods cannot: a mathematical guarantee that the projected features contain zero information along the identified speaker directions. For any utterance embedding $z$ , the projected feature $\tilde{z} = P^{\perp} z$ satisfies $U_K^\top \tilde{z} = 0$ exactly—the dot product with each of the $K$ speaker basis vectors is identically zero. This is not a property that emerges from training dynamics or that holds only on average; it is a deterministic consequence of the projection operator, true for every individual sample. A classifier trained on $\tilde{z}$ cannot use linear combinations of the top- $K$ speaker directions to make its decision, because those directions have been removed from its input space.

This guarantee comes with an important caveat that the paper acknowledges only implicitly: the invariance is with respect to the estimated speaker subspace, not the true speaker subspace. If there are speaker-discriminative directions not captured by the top $K$ PCA components—because $K$ is too small, because the training speakers don't span the full speaker variation, or because speaker information is distributed across many low-variance directions—then residual speaker information will remain in $\tilde{z}$ . The empirical results (Figure 2: speaker silhouette drops to −0.002, effectively chance level) suggest this residual is small, but the guarantee is conditional on the subspace estimate's completeness.

The comparison to ETA-WavLM (Ruggiero et al., 2025), which proposes a linear equation for speaker removal, highlights SNAP's distinctiveness. ETA-WavLM also removes speaker information via a linear operation, but SNAP's PCA-on-centroids approach provides an explicit geometric interpretation (the speaker subspace is the span of between-speaker variation directions) and a principled hyperparameter ( $K$ , the subspace dimensionality) that controls the tradeoff between speaker removal and artifact preservation. This makes SNAP more of a framework than a fixed recipe—the subspace estimation method could be replaced with alternatives (LDA, nonlinear manifold learning) while preserving the nulling-by-projection philosophy.

This is a fundamental methodological contribution with significance beyond deepfake detection. The idea that nuisance variation occupies identifiable linear subspaces within learned representations, and that these subspaces can be removed via orthogonal projection without destroying task-relevant signal, is a general principle that could apply to any domain where a pre-trained encoder produces features dominated by an identifiable confounder—for instance, removing recording-device fingerprints from audio representations for emotion recognition, or removing font/style information from vision representations for optical character recognition. The paper demonstrates this principle in one domain but provides a template that is transferable.

Innovation 3: The Sufficiency of Linearly Separable Artifact Features as Evidence for Correct Subspace Decomposition

The third insight is more subtle but equally important: the paper uses the simplicity of the downstream classifier as an evidentiary tool, not just an efficiency claim. The fact that logistic regression on projected features achieves state-of-the-art performance is presented not as a methodological contribution (logistic regression is not novel) but as validation of the subspace decomposition hypothesis.

The logic works as follows. If the paper's hypothesis (Equation 1) is correct—the WavLM feature space decomposes additively into speaker, artifact, and context subspaces—then removing the speaker subspace should leave features where the artifact signal is not just present but dominant. A dominant, well-separated signal should be detectable by a simple linear classifier; if a complex nonlinear classifier were required, it would suggest that residual speaker information, complex artifact-speaker interactions, or other entangled structure remains in the features, weakening the claim that the projection successfully isolated artifacts.

The paper's results (Table 1) bear this out: a 2,049-parameter logistic regression on SNAP-projected features achieves 0.35% EER on ASVspoof 2019 LA, outperforming AASIST (a graph attention network with orders of magnitude more parameters), WavLM-ECAPA (an ECAPA-TDNN on raw WavLM features), and every other baseline. On In-the-Wild data—the most challenging benchmark with diverse speakers, channel conditions, and TTS models—SNAP achieves 15.39% EER, a ~31% relative reduction from the WavLM baseline (22.22%) and a ~56% reduction from AASIST (43.52%).

This is not an argument that simple classifiers are always sufficient for deepfake detection. It is a specific evidentiary claim: if the projection correctly isolates artifacts, then a linear classifier should work well; a linear classifier does work well; therefore the projection is doing something structurally correct. The paper is using the classifier's success as a probe into the representation's structure, not as the primary contribution. This is methodologically sophisticated—it echoes the logic of probing classifiers in NLP interpretability research, where the trainability of a simple classifier on a representation to predict a linguistic property is taken as evidence that the property is encoded in the representation.

The cross-domain experiments in Section 4.4 strengthen this evidentiary chain. When SNAP is trained on synthetic speech from one TTS architecture (e.g., CosyVoice2) and tested on another (e.g., F5-TTS)—architectures with fundamentally different vocoders (HiFi-GAN vs. Vocos)—the model maintains zero EER in mixed-domain settings and dramatically lower EER than baselines in cross-domain settings (Table 2: SNAP achieves 0.00% EER when trained on F5 and tested on F5, and 0.00% when trained on mixed data). A linear classifier achieving this cross-architecture generalization implies that the projected features capture something universal about synthesis artifacts—something that generalizes across vocoder types—rather than something specific to a particular TTS fingerprint that happens to correlate with speaker identity. This is stronger evidence for the artifact-isolation claim than in-domain performance alone would provide.

This is an incremental but elegant contribution to the methodology of representation analysis. Using classifier simplicity as an evidentiary tool is not new (linear probes are standard in NLP), but applying it to validate a geometric decomposition hypothesis in speech processing—and demonstrating that the resulting features achieve state-of-the-art performance with the probe itself—is a clean demonstration of the principle that interpretable representations can be practically superior to black-box ones.

Innovation 4: The Counterintuitive Finding That Removing Information Improves Discrimination

The fourth insight is empirical and somewhat paradoxical: nullifying speaker information does not just remove a confounder—it actively improves the representation's discriminative power for the target task. This is not a foregone conclusion. A naive expectation would be that removing speaker information might preserve artifact discriminability (if the subspaces are orthogonal) or reduce it (if artifact information overlaps with speaker directions), but would not increase it. The paper's evidence (Figure 2) shows the opposite: the real-vs-synthetic silhouette score increases from 0.118 to 0.181 after projection, a ~53% relative improvement.

The explanation, implicit in the paper's framing but worth surfacing explicitly, is that speaker identity acts as a dominant noise source in the representation space. Before projection, the variance contributed by inter-speaker differences is large relative to the variance contributed by synthesis artifacts. When a classifier operates on these features, it must learn to "see past" the speaker variation to find the artifact signal—a difficult optimization problem that requires either large amounts of speaker-diverse training data or sophisticated nonlinear architectures that can disentangle the competing signals. After projection, the speaker variance is removed, and the artifact signal becomes not just an equal contributor to the variance but the dominant contributor, making it trivially detectable by a linear boundary.

This is analogous to signal denoising: the projection operation filters out a known, high-energy interference source (speaker variation), and in doing so, it increases the signal-to-noise ratio of the target signal (synthesis artifacts). The key insight is that speaker variation functions as structured noise with a known covariance structure (estimated via PCA on centroids), which makes it amenable to targeted removal via subspace filtering—a technique that is standard in signal processing (the paper cites Harsanyi and Chang, 1994, from the hyperspectral imaging literature) but underutilized in deep learning for representation cleaning.

The practical implication is significant: SNAP does not need to learn to ignore speakers; it simply removes them as an option. This explains why SNAP continues to improve as the number of training speakers increases (Figure 3), while the baseline WavLM detector's EER fluctuates or degrades—more speakers compound the entanglement problem for the baseline (the classifier faces an increasingly complex speaker-discrimination task that interferes with artifact learning), while SNAP removes each new speaker's contribution to the variance before the classifier ever sees it. The baseline is fighting a battle on two fronts (learn to ignore speakers, learn to detect artifacts), while SNAP fights on only one.

This is a fundamental empirical insight with implications beyond speech processing. In any domain where a pre-trained representation is dominated by a known confounder with identifiable structure, explicitly removing that confounder via subspace projection may not just remove bias but actively improve task performance by increasing the effective signal-to-noise ratio. The paper demonstrates this with speaker identity, but the principle generalizes to any confounder that occupies a low-dimensional linear subspace and is orthogonal (or approximately orthogonal) to the task-relevant signal.

Innovation 5: A Unified Framework for Thinking About Representation Cleaning in Speech Tasks

The final innovation is conceptual and forward-looking: SNAP establishes a template for representation-level interventions in speech processing that generalizes beyond deepfake detection. The paper's Section 5 frames the speaker-disentanglement framework as applicable to "other paralinguistic tasks, such as emotion recognition, enabling models to focus on relevant features unencumbered by speaker-specific variations." This is not just a throwaway future-work sentence—it identifies a broader class of problems where the same logic applies.

The template is: (1) identify a pre-trained SSL speech encoder whose representations are dominated by a nuisance variable (here, speaker identity in WavLM); (2) estimate the subspace corresponding to that nuisance variable using structured data (here, per-speaker centroids, but analogous structure exists for other variables—per-emotion centroids if the goal were speaker verification, per-recording-condition centroids if the goal were channel-robust recognition); (3) apply orthogonal projection to nullify the nuisance subspace; (4) train a lightweight task classifier on the residual features.

What makes this a framework rather than a one-off method is that each component is modular. The SSL backbone could be replaced (Wav2Vec 2.0, HuBERT, XLS-R) without changing the projection logic. The subspace estimation method could be replaced (LDA instead of PCA, nonlinear manifold learning) while preserving the nulling-by-projection philosophy. The nuisance variable could be replaced (channel/recording conditions, background noise type, language/dialect) as long as it exhibits structured variation across a labeled metadata dimension. The classifier could be replaced (logistic regression for linearly separable problems, a small MLP for mildly nonlinear ones) without changing the projection's role.

The novelty is not in any individual component—PCA, orthogonal projection, and logistic regression are all decades-old techniques—but in the synthesis of these components into a principled pipeline that addresses a specific, well-characterized failure mode of SSL representations. The paper argues, implicitly, that the field has over-invested in learning-based solutions to problems that have geometric solutions. Speaker entanglement is not a problem that requires more data or more complex architectures; it requires identifying the right subspace and projecting it out.

This is a fundamental reframing of how to use pre-trained speech representations for downstream tasks. The dominant paradigm is to treat SSL encoders as frozen feature extractors and invest all design effort in the downstream classifier architecture. SNAP inverts this: invest design effort in cleaning the features, then use the simplest possible classifier. The paper's results suggest this inversion is not just intellectually satisfying but practically superior—a 2,049-parameter logistic regression on cleaned features outperforms deep architectures on raw features across multiple benchmarks. This is a strong argument that representation cleaning deserves at least as much attention as classifier design in the speech processing pipeline.

The cross-domain results (Section 4.4, Table 2) further validate the framework's generality. SNAP achieves zero EER in mixed-domain settings where it has seen diverse synthesis artifacts during training, and maintains strong performance in cross-domain settings where the test TTS architecture was completely unseen. This suggests that the artifact subspace isolated by SNAP captures something universal about the difference between real and synthetic speech—not a specific vocoder fingerprint, but a more abstract signal that generalizes across generation methods. If this finding holds across additional TTS architectures and detection tasks, it would elevate SNAP from a speaker-nulling method to a general-purpose framework for exposing the artifact structure latent in SSL speech representations.

5. Experimental Analysis

Evaluation Methodology

Dataset. The paper uses four evaluation benchmarks: (1) ASVspoof 2019 LA (Logical Access), which evaluates detection of text-to-speech and voice conversion attacks under clean channel conditions (Todisco et al., 2019); (2) ASVspoof 2021 LA, which introduces telephone channel variability including codec compression and transmission artifacts; (3) ASVspoof 2021 DF (Deep Fake), which focuses on compressed, real-world-distributed deepfake audio; and (4) In-the-Wild (Müller et al., 2022), a dataset of real-world recordings with unpredictable noise, channel variation, and diverse spoofing sources collected from public sources. Additionally, Section 4.4 introduces a custom dataset constructed from LibriSpeech (Panayotov et al., 2015) test-clean split, where 16 distinct speakers are allocated for training (800 samples) and another 16 unseen speakers for testing (200 samples), with synthetic data generated via CosyVoice2 (Du et al., 2024) and F5-TTS (Chen et al., 2024) using original audio as prompts and identical transcripts, ensuring strict speaker- and content-controlled evaluation. The ASVspoof 2019 LA training set is partitioned into an 80:20 stratified train-validation split, with no speaker overlap between training and evaluation sets by design of the ASVspoof protocol.
Base model. The feature extraction backbone is WavLM-Large (Chen et al., 2021), a 24-layer Transformer encoder with 316 million parameters, pre-trained on 94,000 hours of unlabeled speech data from LibriLight, VoxPopuli, and GigaSpeech using a masked speech denoising and utterance-mixing objective. The model is used in completely frozen mode—no fine-tuning of the encoder occurs at any stage. The paper states this model was chosen because WavLM is "well-known for its exceptional speaker identification capabilities" (Section 1), which makes it both a strong candidate for speech representation and the ideal testbed for demonstrating speaker entanglement. All audio inputs are resampled to 16 kHz monaural before processing.
Metrics. The primary evaluation metric throughout is Equal Error Rate (EER), expressed as a percentage. EER is the error rate at the operating threshold where the false acceptance rate (FAR—classifying synthetic speech as real) equals the false rejection rate (FRR—classifying real speech as synthetic). Lower EER indicates better discrimination. For the cross-domain experiments in Section 4.4 (Table 2), the paper additionally reports accuracy, precision, recall, and F1 score. The paper uses the standard ASVspoof evaluation protocol and the grading function released by the challenge organizers, though no further details on EER computation (e.g., whether scores are pooled across attack types or per-condition) are provided.
Baselines. The paper compares against five baseline systems representing the spectrum of contemporary approaches. (1) RawNet2 (weon Jung et al., 2020): an end-to-end model that processes raw waveforms directly using sinc-convolution filters and feature-map scaling, trained from scratch on the detection task without pre-training. (2) AASIST (Jung et al., 2022): an end-to-end architecture integrating spectro-temporal graph attention networks designed specifically for audio anti-spoofing, representing the state-of-the-art in specialized deepfake detection architectures at the time of the ASVspoof 2021 challenge. (3) WavLM: a simple baseline where the last hidden state of WavLM-Large (layer 24) is mean-pooled and fed to a logistic regression classifier—this is the most direct comparison point for isolating the effect of SNAP's dual-layer extraction and speaker nulling, since it uses the same backbone and classifier architecture but with different feature processing. (4) WavLM-ECAPA-TDNN (Desplanques et al., 2020; Kulkarni et al., 2024): an SSL-based system that feeds WavLM features into an ECAPA-TDNN classifier, a state-of-the-art architecture for speaker verification that uses emphasized channel attention, propagation, and aggregation in a time-delay neural network. This represents the standard approach of combining SSL features with a sophisticated downstream architecture. (5) Wav2Vec 2.0-ECAPA-TDNN (Desplanques et al., 2020; Kulkarni et al., 2024): the same ECAPA-TDNN classifier architecture but using Wav2Vec 2.0 features instead of WavLM, providing a comparison point for whether WavLM's speaker-discriminative pre-training is specifically problematic or whether the phenomenon generalizes across SSL backbones. All baselines are evaluated under identical training and testing protocols on the ASVspoof and In-the-Wild benchmarks.
Generation budget / compute accounting. The paper does not use the generation-budget terminology common in LLM literature; instead, compute is implicitly measured in standard terms of model parameters and training data requirements. SNAP's computational profile is characterized by its simplicity: the WavLM-Large backbone (316M parameters, used in frozen inference mode), the PCA computation on speaker centroids (performed once on the training set with negligible cost relative to WavLM inference), the orthogonal projection matrix $P^\perp \in \mathbb{R}^{2048 \times 2048}$ (stored as a dense matrix but applied as $O(KD)$ operations where $K=5$ and $D=2048$ ), and the logistic regression classifier (2,049 parameters). The paper emphasizes this efficiency:

"a simple classifier with just 2,049 parameters"

The inference pipeline adds negligible wall-clock time to the WavLM forward pass. No FLOP counting or latency benchmarking is reported across methods, which is a minor limitation given that SNAP's claimed efficiency advantages are qualitative rather than quantitative. The fair comparison argument rests on evaluation protocol consistency: all methods are trained on the same ASVspoof 2019 LA training split with an 80:20 stratified split and evaluated on identical test sets.

Cross-validation / statistical protocol. The training procedure uses a single stratified 80:20 split of the ASVspoof 2019 LA training set into train and validation partitions. No k-fold cross-validation, multiple random seeds, or confidence intervals are reported for the main benchmark results in Table 1. The speaker-overlap constraint (no speakers appear in both training and evaluation) is enforced by the ASVspoof dataset design, not by an explicit cross-validation protocol—this is a property of the benchmark rather than the paper's methodology. For the custom LibriSpeech experiments (Section 4.4), the speaker split (16 training, 16 testing) is fixed and non-overlapping by construction. The paper does not report statistical significance tests, standard deviations across runs, or sensitivity to training/validation splits, which represents a limitation in the rigor of the experimental protocol—particularly for a paper whose central claims involve generalization, where variance across splits and seeds is informative.

Main Quantitative Results

Aggregate Benchmark Performance (Table 1)

The central experimental result is the comparison of SNAP against five baselines across four benchmark datasets, reported in Table 1. The headline numbers, expressed as EER (%):

On ASVspoof 2019 LA, the cleanest and most widely used benchmark, SNAP achieves 0.35% EER, representing a 56.25% relative improvement over WavLM-ECAPA-TDNN (0.80%) and substantially outperforming all other baselines: RawNet2 (12.14%), AASIST (0.82%), WavLM baseline (2.62%), and Wav2Vec 2.0-ECAPA-TDNN (29.69%). The absolute EER of 0.35% means that at the optimal operating threshold, only 0.35% of real utterances are misclassified as fake and only 0.35% of fake utterances are misclassified as real—an exceptionally low error rate that approaches the practical ceiling for this benchmark. The gap between SNAP (0.35%) and the best baseline (WavLM-ECAPA-TDNN at 0.80%) is 0.45 percentage points, which is substantial in the low-EER regime where improvements become increasingly difficult.

On the challenging In-the-Wild benchmark, which represents the most realistic deployment scenario with diverse speakers, channel conditions, noise, and unknown TTS sources, SNAP achieves 15.39% EER—a ~31% relative reduction from the WavLM baseline (22.22%) and a ~56% relative reduction from AASIST (43.52%). The full In-the-Wild column reads: SNAP 15.39%, WavLM baseline 22.22%, Wav2Vec 2.0-ECAPA 30.69%, WavLM-ECAPA 34.64%, RawNet2 40.61%, AASIST 43.52%. Two results deserve specific attention: (a) WavLM-ECAPA-TDNN, which achieved 0.80% on ASV19 LA (the second-best result), degrades dramatically to 34.64% on In-the-Wild—a ~43× increase in error rate—illustrating the fragility that the paper attributes to speaker entanglement; (b) SNAP's 15.39%, while the best result, is still a relatively high error rate in absolute terms (roughly 1 in 6.5 utterances misclassified), indicating that even with speaker nulling, real-world deepfake detection remains far from solved. This is an honest but underexplored limitation—the paper emphasizes SNAP's relative superiority without discussing the practical implications of a 15% EER in deployment.

On ASVspoof 2021 LA, SNAP achieves 9.46% EER, outperforming WavLM-ECAPA (6.67%) but trailing it by 2.79 percentage points. The full column: WavLM-ECAPA 6.67%, SNAP 9.46%, WavLM 20.02%, Wav2Vec 2.0-ECAPA 26.60%, RawNet2 29.71%, AASIST 34.22%. This is the one benchmark where SNAP does not achieve the best result—an important qualification to the paper's "state-of-the-art performance" claim. The paper does not discuss this result explicitly in the main text; it is simply present in Table 1 without commentary. The ASVspoof 2021 LA condition introduces telephone channel codec compression, which may interact with the projection step differently than the acoustic artifacts that SNAP is designed to isolate—degraded channel conditions might shift artifact information into dimensions that overlap with or are removed by the speaker nulling operation. This is a notable gap in the paper's analysis.

On ASVspoof 2021 DF, which focuses on compressed deepfake audio distributed through real-world channels, SNAP achieves 5.42% EER, substantially outperforming all baselines: AASIST (16.94%), WavLM-ECAPA (15.94%), WavLM (8.38%), Wav2Vec 2.0-ECAPA (22.43%), and RawNet2 (22.69%). The gap between SNAP (5.42%) and the second-best baseline (WavLM at 8.38%) is 2.96 percentage points—a 35% relative improvement. This is a particularly informative result because ASV21 DF is designed to evaluate robustness to compression artifacts that realistically occur when deepfake audio is shared through messaging apps, social media, or phone calls. SNAP's strong performance here suggests that the artifact subspace it isolates is robust to compression-induced distortion, which aligns with the paper's claim that the projection captures something fundamental about synthesis rather than something fragile that disappears under compression.

Pattern across benchmarks. A clear pattern emerges: SNAP's advantage over baselines is largest on the most challenging, most realistic benchmarks (In-the-Wild: SNAP beats the best baseline by 6.83 percentage points; ASV21 DF: SNAP beats the best baseline by 2.96 percentage points) and on the cleanest benchmark (ASV19 LA: SNAP beats the best baseline by 0.45 percentage points in the low-EER regime). On the intermediate benchmark (ASV21 LA, telephone codec compression), SNAP trails WavLM-ECAPA by 2.79 points. This pattern is consistent with the paper's central narrative: speaker nulling provides robustness that matters most when the evaluation conditions differ from training—exactly the generalization regime that speaker entanglement degrades. The ASV21 LA result is the anomaly that the paper leaves unexplained.

Quantification of Speaker Entanglement (Figure 2)

Section 4.3 presents a quantitative analysis designed to directly measure the paper's central diagnostic claim: that speaker identity dominates the variance in WavLM representations and that SNAP's projection successfully suppresses this dominance while amplifying artifact discriminability. The experiment computes silhouette coefficients on balanced samples from the ASVspoof 2019 LA training dataset.

Methodology. The paper performs balanced sampling to select an equal number of bona fide (real) and spoof (synthetic) utterances for each combination of attack type and speaker. The silhouette coefficient is computed using cosine distance as the dissimilarity metric. The silhouette score for a sample ranges from -1 to +1, where positive values indicate that the sample is closer, on average, to samples in its own cluster than to samples in the nearest other cluster (good clustering), values near zero indicate overlapping clusters, and negative values indicate that the sample is misassigned (closer to other clusters). The paper computes silhouette scores for two different clustering criteria: (i) by speaker identity (how well do samples from the same speaker cluster together versus samples from different speakers?) and (ii) by bona fide versus spoof class (how well do real samples separate from synthetic samples?).

Baseline vs. SNAP comparison. The baseline uses the last hidden state of WavLM-Large (layer 24) as the input feature—the same representation used by the WavLM baseline in Table 1. SNAP uses the projected features $\tilde{z}$ as described in Section 3.2.

Figure 2(a) shows the silhouette scores clustered by speaker identity for five unseen speakers. The mean silhouette coefficient drops from 0.026 (baseline) to −0.002 (SNAP). The near-zero SNAP value indicates that after projection, samples from the same speaker are not systematically closer to each other than to samples from different speakers—the speaker clustering structure has been effectively destroyed. The slight negative value suggests a mild anti-clustering effect where samples are, on average, marginally closer to other speakers' samples than to their own, which could indicate over-projection (removing some dimensions that carry both speaker and non-speaker information, causing residual structure to push same-speaker samples apart).

Figure 2(b) shows the silhouette scores clustered by real versus synthetic class. The mean silhouette coefficient increases from 0.118 (baseline) to 0.181 (SNAP)—a ~53% relative improvement. This is the paper's key quantitative evidence that speaker nulling does not just remove a confounder but actively improves the representation's ability to discriminate real from synthetic speech. The baseline value of 0.118 indicates that, before projection, the real and synthetic clusters overlap substantially (consistent with the t-SNE visualization in Figure 1, where real/synthetic separation appears fragmented within speaker clusters). The post-projection value of 0.181 indicates improved class separation, though it is still far from perfect clustering (which would approach 1.0 for well-separated, compact clusters).

Interpretation. This dual measurement—speaker clustering destroyed, class clustering improved—is the paper's strongest single piece of evidence for the subspace decomposition hypothesis (Equation 1: $\mathcal{H} = \mathcal{S} + \mathcal{A} + \mathcal{C}$ ). If the speaker subspace $\mathcal{S}$ and artifact subspace $\mathcal{A}$ were truly orthogonal, nulling $\mathcal{S}$ would leave class clustering unchanged (the artifact signal would be preserved but not enhanced). The observed increase in class clustering suggests that $\mathcal{A}$ and $\mathcal{S}$ are not entirely orthogonal, and that removing $\mathcal{S}$ removes interference that was masking the artifact signal—in other words, speaker variance was acting as structured noise that degraded class discriminability. This supports the paper's "signal denoising" interpretation: the projection increases the effective signal-to-noise ratio of artifact information.

Unseen TTS Generalization (Table 2, Custom LibriSpeech Experiments)

Section 4.4 presents what is arguably the paper's most practically important result: evaluation of SNAP's ability to generalize to TTS architectures that were entirely unseen during training. This experiment addresses the critical deployment scenario where a detector trained on known TTS models encounters audio from a new generative system.

Experimental design. The paper constructs a custom dataset from LibriSpeech test-clean. Sixteen distinct speakers are allocated to training (800 samples) and 16 non-overlapping speakers to testing (200 samples), with exact label balance maintained throughout. Synthetic data is generated using two modern TTS systems with fundamentally different vocoder architectures: CosyVoice2 (Du et al., 2024), which uses a HiFi-GAN vocoder that predicts 1D waveforms from mel-spectrograms, and F5-TTS (Chen et al., 2024), which uses a Vocos vocoder that predicts complex spectrograms (real and imaginary components). Both systems are provided with the original LibriSpeech audio as voice prompts and the identical transcripts, ensuring that the synthetic utterances match the real ones in speaker characteristics and linguistic content—only the synthesis process differs. This strictly controlled setup enables rigorous evaluation of speaker invariance and cross-architecture generalization.

Evaluation conditions. The paper evaluates six training-testing configurations: (1) CV2 → CV2: trained and tested on CosyVoice2 data (in-domain, unseen speakers); (2) CV2 → F5: trained on CosyVoice2, tested on F5-TTS (cross-domain, unseen TTS architecture); (3) F5 → F5: trained and tested on F5-TTS (in-domain); (4) F5 → CV2: trained on F5-TTS, tested on CosyVoice2 (cross-domain); (5) Mixed → CV2: trained on a mixture of both TTS systems, tested on CosyVoice2; (6) Mixed → F5: trained on a mixture, tested on F5-TTS. The "Mixed" condition represents the most realistic training scenario where diverse synthesis artifacts are available. Baselines include AASIST and WavLM-ECAPA-TDNN, evaluated under identical conditions.

In-domain results. In in-domain settings with unseen speakers (CV2 → CV2 and F5 → F5), SNAP achieves perfect detection with 0.00% EER, 1.000 accuracy, precision, recall, and F1. Both baselines degrade substantially: for CV2 → CV2, AASIST achieves 61.50% EER and WavLM-ECAPA achieves 5.50% EER; for F5 → F5, AASIST achieves 46.50% EER and WavLM-ECAPA achieves 0.50% EER. The WavLM-ECAPA result on F5 → F5 (0.50%) is competitive but represents a 10× higher error rate than SNAP's perfect score. The AASIST results (46–61% EER) indicate near-random performance, likely because AASIST was trained from scratch on ASVspoof 2019 LA and fails to transfer to these novel TTS architectures.

SNAP's perfect in-domain performance demonstrates that the projection effectively removes speaker identity while preserving the TTS-specific artifact fingerprints. The model is not confusing "speaker X in the training set was associated with real speech" with "this utterance is real"; it is genuinely detecting synthesis artifacts specific to each TTS system.

Cross-domain results. The cross-domain evaluations are the most stringent test. When trained on CosyVoice2 and tested on F5-TTS (CV2 → F5), SNAP achieves 10.50% EER (accuracy 0.905, precision 1.000, recall 0.810, F1 0.895). The perfect precision but imperfect recall indicates that SNAP on this transfer task produces no false positives (never misclassifies real speech as synthetic) but misses 19% of synthetic samples. This asymmetric error profile—conservative on real speech, missing some fakes—is arguably preferable for deployment, where false alarms (blocking legitimate audio) may be more costly than missed detections. In comparison, AASIST achieves 46.50% EER and WavLM-ECAPA achieves 23.75% EER—both substantially worse than SNAP.

When trained on F5-TTS and tested on CosyVoice2 (F5 → CV2), SNAP achieves 9.25% EER, but with a notably different error profile: accuracy 0.535, precision 1.000, recall 0.070, F1 0.131. The extremely low recall (7%) means that in this direction, SNAP correctly flags only 7% of synthetic samples as fake—the model becomes extremely conservative, classifying almost everything as real. The perfect precision is maintained (no false positives), but the detector is essentially non-functional for identifying synthetic speech. AASIST achieves 61.50% EER and WavLM-ECAPA achieves 29.75% EER, both worse in EER terms but potentially more balanced in error types.

The asymmetry in cross-domain performance (CV2 → F5: 10.50% EER; F5 → CV2: 9.25% EER, but with radically different precision-recall profiles) reveals an important property: the artifact subspace learned from one TTS architecture does not transfer equally to another. CosyVoice2 (HiFi-GAN vocoder) and F5-TTS (Vocos vocoder) leave different spectral fingerprints, and the linear classifier trained on projected features from one system does not necessarily detect the artifacts of the other—even though the projection itself is speaker-agnostic. This suggests that the projection isolates a space where artifacts can be found, but the specific artifact patterns still differ by architecture, and a linear boundary learned on one set of artifacts may not align with the artifact direction of another architecture. This is consistent with the paper's subspace decomposition framework: the artifact subspace $\mathcal{A}$ likely contains multiple sub-directions corresponding to different synthesis methods, and training on only one method learns a boundary that is aligned with that specific sub-direction.

Mixed-domain results. When trained on a mixture of both CosyVoice2 and F5-TTS data, SNAP achieves perfect detection (0.00% EER, all metrics 1.000) on both CV2 and F5 test sets. This is the most practically significant result: exposure to diverse synthesis artifacts during training allows SNAP to learn a decision boundary that generalizes across architectures. In the mixed → CV2 condition, WavLM-ECAPA achieves 7.50% EER; in mixed → F5, WavLM-ECAPA achieves 2.50% EER. SNAP's zero-error performance in both conditions demonstrates that the combination of speaker nulling (to remove the speaker confound) and diverse artifact exposure (to learn a universal artifact boundary) is sufficient for robust detection—at least on this controlled dataset.

Interpretation and practical implications. The cross-domain results collectively validate the paper's central claim that speaker nulling enables generalization, but with an important nuance: generalization to unseen speakers is near-perfect (in-domain results on new speakers), while generalization to unseen TTS architectures depends on the similarity of artifact fingerprints and improves dramatically with exposure to diverse synthesis methods. This has a clear practical prescription: train SNAP on data from as many TTS architectures as possible to maximize the coverage of the learned artifact boundary within the projected subspace.

The paper emphasizes that the two vocoder types represent fundamentally different approaches:

"CosyVoice2 utilizes a HiFi-GAN vocoder predicting 1D waveforms from mel-spectrograms, whereas F5-TTS employs a Vocos vocoder predicting complex spectrograms"

The success of mixed training suggests that SNAP's projected features capture something more abstract than vocoder-specific fingerprints—a shared "synthetic-ness" dimension that generalizes across generation paradigms—but only when the training data includes exemplars that span the relevant variation.

Impact of Training Speaker Count on Detection Performance (Figure 3)

Section 4.5 investigates how detection performance changes as the number of training speakers increases, comparing SNAP against the WavLM baseline. This experiment directly tests the paper's claim that speaker entanglement causes baseline degradation with more speakers, while speaker nulling enables monotonic improvement.

Experimental design. The number of training speakers is incrementally increased from 2 to 20 (the exact values shown on the x-axis of Figure 3 are 2, 8, 14, and 20). The WavLM baseline uses the last hidden state with logistic regression (the same baseline as in Table 1). SNAP uses the full speaker-nulling pipeline. Both are evaluated on three benchmarks: ASVspoof 2019 LA, ASVspoof 2021 LA, and ASVspoof 2021 DF. The paper notes this follows the "identical setup detailed in Section 4.3," though the connection to the silhouette analysis is conceptual rather than procedural.

Results on ASVspoof 2019 LA (Figure 3, left panel). The baseline EER increases from approximately 4% at 2 training speakers to roughly 2% at 8 speakers, then rises to approximately 3% at 14 speakers and fluctuates around 2.5–3.5% through 20 speakers. This non-monotonic pattern—performance worsening as more data is added—is the paper's key evidence for speaker entanglement: more speakers do not provide more artifact information; they provide more speaker identities that the classifier must learn to ignore, making the optimization problem harder. SNAP's EER remains consistently near 0–2% across all speaker counts, showing a stable downward trend as speakers increase. The gap between SNAP and baseline widens from roughly 2 percentage points at 2 speakers to approximately 3 percentage points at 20 speakers.

Results on ASVspoof 2021 LA (Figure 3, center panel). The baseline EER starts at approximately 22% with 2 speakers, drops to roughly 16% at 8 speakers, but then increases to approximately 18% at 14 speakers and 15–17% at 20 speakers—again showing fluctuation and even degradation with more data. SNAP's EER starts at approximately 15% with 2 speakers and decreases nearly monotonically to roughly 9% at 20 speakers, with only minor fluctuations. The SNAP curve lies below the baseline at all speaker counts, with the gap growing from roughly 7 percentage points at 2 speakers to approximately 7–8 percentage points at 20 speakers.

Results on ASVspoof 2021 DF (Figure 3, right panel). The baseline EER starts at approximately 13% with 2 speakers, rises to roughly 18% at 8 speakers (a notable degradation), then fluctuates around 14–17% through 20 speakers. This is the clearest example of the "more data makes performance worse" phenomenon that the paper attributes to entanglement. SNAP's EER starts at approximately 9% with 2 speakers and decreases to roughly 5% at 20 speakers, with a consistently downward trend. The gap between SNAP and baseline is smallest at 2 speakers (roughly 4 percentage points) and largest at 8 speakers (roughly 10–11 percentage points), where the baseline degrades and SNAP improves.

Interpretation. The paper summarizes these results as demonstrating that:

"nulling speaker information effectively promotes data generalization and is crucial for constructing a speaker-robust deepfake detection system"

The evidence strongly supports this interpretation. The baseline's non-monotonic behavior—performance improving, then degrading, then fluctuating as speaker count increases—is consistent with a model that is simultaneously trying to learn artifact discrimination and speaker discrimination, with the two objectives interfering. As more speakers are added, the speaker-discrimination problem becomes harder (more classes to separate), consuming more of the model's representational capacity and optimization effort, potentially at the expense of artifact learning. SNAP's monotonic improvement with more speakers (decreasing EER across all three benchmarks) is consistent with a model that has isolated the artifact signal: more speakers provide more diverse training examples of how artifacts manifest across different voices, enriching the learned artifact boundary without introducing interference.

A subtle but important point: the SNAP curves in Figure 3 are not perfectly monotonic—there are small fluctuations, particularly on ASV21 LA and ASV21 DF. This suggests that the projection does not perfectly remove all speaker-dependent variation, and that the speaker subspace estimate (based on the training speakers) may not fully capture speaker-discriminative directions for all speaker populations. However, the overall trend is consistently downward, which is the key contrast with the baseline.

Ablation Studies and Robustness Checks

The paper's ablation analysis is notably sparse compared to the depth of its main results. There is no formal ablation section or table; relevant ablations are distributed across the experiments and methodological descriptions. Below is a synthesis of what the paper does and does not investigate:

Subspace dimensionality (K): The paper uses $K = 5$ principal components for the speaker subspace (stated in Section 4.1). However, no sweep over $K$ values is reported. This is a significant omission because $K$ is the critical hyperparameter controlling the tradeoff between speaker removal and artifact preservation. Key questions left unanswered: What happens with $K=1$ (removing only the single most speaker-discriminative direction)? With $K=10$ , $K=20$ , $K=50$ ? Does performance plateau after some $K$ , or does it peak and then degrade as artifact-relevant dimensions are accidentally removed? The paper's central claim—that the feature space decomposes into separable subspaces—predicts a performance peak at some $K$ that captures the true speaker subspace dimensionality. Without a $K$ sweep, we cannot assess whether $K=5$ is genuinely optimal or merely a reasonable default, nor can we validate the claim that artifact and speaker subspaces are orthogonal (if they overlap, performance should degrade at higher $K$ as artifact-relevant dimensions are removed).

Layer selection (layers 8 and 22): The paper uses a specific dual-layer combination (layers 8 and 22) based on empirical validation:

"These layers were selected based on empirical validation, as this combination yielded the most discriminative representations for synthetic speech detection in our preliminary experiments."

However, no quantitative comparison of alternative layer pairs or single-layer baselines is reported in the paper. Critical ablations that are missing: (1) performance using only layer 8 (shallow acoustic features), (2) performance using only layer 22 (deep semantic features), (3) performance using only the final layer 24 (the WavLM baseline in Table 1 uses layer 24, but with logistic regression—it is unclear whether the WavLM-ECAPA baseline in the layer ablation would differ), (4) performance using other layer pairs (e.g., layers 4 and 16, layers 12 and 24). The paper's silence on these comparisons means the reader cannot assess how much of SNAP's performance comes from the projection and how much from the specific choice of layers. This is particularly important given that the paper's theoretical framing (Section 2.2, Equation 1) does not depend on layer selection—the subspace decomposition hypothesis should hold for any WavLM layer that captures both speaker and artifact information—so the ablation would test whether the projection's effectiveness is robust to feature extraction choices.

Real-only vs. all-sample centroid computation: The paper does not specify whether speaker centroids $\mu_u$ (Equation 5) are computed from real utterances only or from both real and synthetic utterances for each speaker. This matters because synthetic utterances may contain artifact-correlated distortions that bias the centroid and contaminate the estimated speaker subspace with artifact information. Computing centroids from synthetic samples would then project out some artifact signal along with speaker information, potentially degrading performance. The paper's perfect in-domain results (Table 2: 0.00% EER) suggest that centroids were likely computed from real speech only (or that the artifact contamination is negligible), but the ambiguity is a documentation gap. An ablation comparing real-only centroid estimation to all-sample centroid estimation would directly test the orthogonality assumption.

Pooling strategy: The paper uses mean pooling along the temporal axis (Equation 3) to produce utterance-level embeddings. Alternative pooling strategies—max pooling (which might be more sensitive to transient artifacts), attentive pooling (which could learn to weight artifact-relevant time frames), or concatenation of mean and standard deviation (which preserves distribution information)—are not compared. Given that mean pooling acts as a low-pass temporal filter that smooths transient artifacts, max pooling or attentive pooling might capture different aspects of the synthesis fingerprint. The paper's choice of mean pooling is reasonable as the simplest option, but the ablation would establish whether SNAP's performance is robust to this choice or depends on mean pooling's smoothing properties.

Normalization ablation: The paper applies L2 normalization before projection (Equation 4) but does not test whether performance degrades without it. L2 normalization is important for PCA because it ensures that speaker centroids reflect directional consistency rather than magnitude differences, but it also discards information about embedding magnitude, which could carry artifact-relevant signal (e.g., synthesis artifacts might systematically reduce embedding norms if the synthetic speech is less "confident" in WavLM's representation space). An ablation comparing normalized vs. unnormalized embeddings would quantify the tradeoff.

Orthogonal projection vs. soft suppression: The paper chooses hard nulling (projection matrix $P^\perp$ , Equation 8) but does not compare against soft suppression variants (e.g., multiplying the speaker-subspace component by an attenuation factor $\alpha$ rather than setting it to zero). A sweep over $\alpha \in [0, 1]$ would characterize how aggressively speaker information must be removed to achieve the observed gains, and whether partial suppression (which might preserve some artifact information correlated with speaker directions) outperforms complete nulling.

Classifier complexity: The paper uses logistic regression (2,049 parameters) but does not compare against more expressive classifiers on the same projected features. Key ablations would be: (1) a multi-layer perceptron with 1–2 hidden layers to test whether the features benefit from nonlinear decision boundaries, (2) ECAPA-TDNN on projected features to test whether the sophisticated architecture adds value beyond what the projection provides, (3) logistic regression on raw (unprojected) WavLM features with the same dual-layer extraction to isolate the projection's contribution. The WavLM baseline in Table 1 uses layer 24 with logistic regression, which confounds layer selection and projection—a logistic regression on dual-layer (8+22) raw features would be the cleanest ablation.

Speaker subspace estimation method: The paper uses PCA on per-speaker centroids. Alternatives include: (1) Linear Discriminant Analysis (LDA), which maximizes between-speaker separation while minimizing within-speaker variation and might produce a more discriminative speaker subspace, (2) training a linear speaker classifier and using its weight vectors as the speaker subspace basis, (3) using the speaker embedding from WavLM's pre-trained speaker verification pipeline if available. None of these are compared.

PRM aggregation strategy / alternative: Not applicable to this paper (this was an LLM-search concept from the reference example).

Oracle vs. predicted difficulty bins: Not applicable to this paper (this was a difficulty-estimation concept from the reference example).

Revision model verifier choice / history in context: Not applicable to this paper (this was an LLM-revision concept from the reference example).

Negative result—ASVspoof 2021 LA: SNAP achieves 9.46% EER on ASVspoof 2021 LA, trailing WavLM-ECAPA at 6.67% by 2.79 percentage points (Table 1). The paper does not discuss or ablate this result. Plausible explanations (which the paper leaves unexplored) include: (1) telephone codec compression shifts artifact information into dimensions that overlap with the speaker subspace, so nulling removes artifact-relevant signal; (2) the channel variability in ASV21 LA introduces a new confound (transmission channel) that is not removed by speaker nulling and that the ECAPA-TDNN architecture handles better through its channel attention mechanisms; (3) the logistic regression classifier on projected features is underpowered for the additional variability introduced by codec compression, and a slightly more expressive classifier would recover the gap.

Negative result—Cross-domain recall collapse: In the F5 → CV2 cross-domain condition (Table 2), SNAP achieves 0.00% EER but with recall of only 0.070 (7% of synthetic samples detected). The paper reports this result but does not analyze why the error profile is so asymmetric, why precision remains perfect while recall collapses, or whether adjusting the decision threshold (which would change EER but could improve practical utility) would help. This is a significant practical limitation—a detector that flags only 7% of unseen-architecture fakes is not operationally useful—and the paper's silence on the mechanism behind this failure mode is a gap.

Critical Assessment

How well do the experiments support the paper's central claims?

Claim: Speaker entanglement is the dominant failure mode in SSL-based deepfake detection, causing models to exploit speaker-specific correlations rather than artifact-related cues.

The evidence for this claim is strong but not airtight. Figure 1 (t-SNE visualizations) provides qualitative evidence that WavLM embeddings cluster by speaker identity. Figure 2 provides quantitative evidence: the silhouette coefficient for speaker clustering (0.026 baseline) drops to chance level (−0.002) after projection, while class clustering improves (0.118 → 0.181). Figure 3 shows that the baseline detector's performance degrades or fluctuates as training speakers increase, consistent with a model that is increasingly burdened by the speaker-discrimination problem.

However, the paper does not directly demonstrate that the baseline's errors are caused by speaker identity exploitation. An experiment that would strengthen this claim: analyze the baseline detector's errors on the evaluation set and determine whether misclassifications are correlated with speaker identity (e.g., does the baseline systematically misclassify utterances from speakers that were predominantly associated with one class in training?). Without this error analysis, the speaker entanglement claim rests on correlational evidence from the representation space (clustering by speaker) and the indirect evidence from the scaling experiment (performance degrades with more speakers), but not on direct evidence that the baseline's decision boundary is speaker-aligned.

Additionally, the paper uses only WavLM-Large as the SSL backbone. The Wav2Vec 2.0-ECAPA baseline in Table 1 shows even worse generalization (29.69% EER on ASV19 LA, 30.69% on In-the-Wild), suggesting the entanglement problem may generalize across SSL models, but the paper does not apply SNAP to Wav2Vec 2.0 features or analyze whether the same speaker-subspace structure exists in other SSL encoders. The claim that speaker entanglement is a general property of SSL representations is therefore supported only for WavLM.

Claim: The feature space can be decomposed into speaker, artifact, and context subspaces, and nulling only the speaker subspace leaves artifact-enriched residuals.

The evidence for the existence of a speaker subspace is strong: PCA on speaker centroids identifies directions that, when removed, eliminate speaker clustering (Figure 2a). The evidence that the residual features are artifact-enriched is supported by the improved class clustering (Figure 2b) and the strong detection performance with a linear classifier (Table 1).

However, the paper does not validate the full decomposition (Equation 1: $\mathcal{H} = \mathcal{S} + \mathcal{A} + \mathcal{C}$ ). The existence of $\mathcal{A}$ as an identifiable subspace (as opposed to "whatever is left after removing $\mathcal{S}$ ") is not demonstrated. The paper does not extract or characterize the artifact subspace explicitly—it only shows that the residual features after removing $\mathcal{S}$ are discriminative for the detection task. It is possible that the residual features contain a mixture of artifact information, linguistic content, channel effects, and residual speaker information that the top- $K$ PCA components missed, and that the linear classifier is picking up on a combination of these signals, not a cleanly isolated artifact subspace. An experiment that would validate the subspace decomposition: train a regressor to predict known synthesis parameters (vocoder type, specific TTS architecture) from the projected features, and show that these parameters are predictable from $\tilde{z}$ but not from features projected onto only the artifact subspace (if one could be estimated).

The paper also does not test whether the speaker subspace generalizes across datasets. The speaker subspace is estimated from ASVspoof 2019 LA training speakers. Do these principal directions capture speaker variation in In-the-Wild data, which has different speaker demographics and recording conditions? The strong In-the-Wild performance (15.39% EER) provides indirect evidence that they do, but a direct measurement (e.g., evaluating how well the ASV19-estimated speaker subspace nullifies speaker clustering in In-the-Wild data) would strengthen the claim.

Claim: SNAP achieves state-of-the-art performance using only logistic regression with 2,049 parameters.

This claim is supported for three of four benchmarks (Table 1): SNAP achieves the best EER on ASV19 LA (0.35%), ASV21 DF (5.42%), and In-the-Wild (15.39%). On ASV21 LA, SNAP (9.46%) trails WavLM-ECAPA (6.67%), so the "state-of-the-art" claim requires a footnote for this benchmark.

The emphasis on parameter count (2,049) as evidence of efficiency is valid but incomplete. The logistic regression is small, but it operates on features extracted by WavLM-Large (316M parameters). The total system complexity is dominated by the WavLM forward pass. The fair comparison is not between 2,049 parameters and AASIST's millions of parameters, but between the total computational cost of SNAP (frozen WavLM + projection + logistic regression) and the baselines (which also use WavLM or are end-to-end systems). The paper provides no latency measurements, FLOP counts, or throughput comparisons, so the efficiency claim is qualitative rather than quantitative. Additionally, the paper does not report whether the logistic regression was trained to convergence with standard optimization (which is trivial) or whether hyperparameter tuning (regularization strength, solver) was required to achieve the reported performance.

Claim: SNAP generalizes robustly to unseen speakers and unseen TTS architectures.

The unseen-speaker generalization is strongly supported. By the design of the ASVspoof protocol, there is no speaker overlap between training and evaluation. SNAP's strong performance across all ASVspoof benchmarks (Table 1) and perfect in-domain performance on the LibriSpeech experiments (Table 2: 0.00% EER for CV2 → CV2 and F5 → F5) demonstrate robust speaker invariance.

The unseen-TTS generalization is conditionally supported. In cross-domain evaluation (Table 2), SNAP substantially outperforms baselines (e.g., CV2 → F5: SNAP 10.50% vs. WavLM-ECAPA 23.75%), but the absolute performance is far from perfect—10.50% EER means roughly 1 in 10 utterances is misclassified. More importantly, the F5 → CV2 direction shows a recall collapse (0.070) that makes the detector practically non-functional for identifying synthetic speech, even though the EER is technically 9.25% (which can be achieved by setting the threshold such that almost everything is classified as real, minimizing false alarms at the cost of missing nearly all fakes). The mixed-domain results (0.00% EER) demonstrate that the problem is solvable with diverse training data, but the cross-domain results indicate that SNAP does not magically generalize to arbitrary unseen architectures—it generalizes better than baselines, but still requires exposure to the target architecture's artifact family to achieve robust detection.

Claim: Nulling speaker information actively improves artifact discriminability (not just removes a confounder).

This claim is supported by Figure 2(b): the silhouette coefficient for real vs. synthetic improves from 0.118 to 0.181, a ~53% relative increase. This is the paper's primary evidence that speaker nulling amplifies the artifact signal rather than merely preserving it. However, the silhouette coefficient is a measure of cluster quality in the representation space, not detection performance. The claim would be strengthened by an ablation showing that detection EER on projected features is lower than on raw features with the same classifier—but this ablation is only partially available. The WavLM baseline in Table 1 uses layer 24 with logistic regression, while SNAP uses layers 8+22 with logistic regression, confounding layer selection and projection. A clean comparison of logistic regression on dual-layer raw features vs. logistic regression on dual-layer projected features would isolate the projection's contribution and quantify the "amplification" effect in terms of EER reduction.

Genuine weaknesses in the experimental design

1. Single SSL backbone limits generality of findings. All experiments use WavLM-Large as the feature extractor. The paper's theoretical framing—that the feature space decomposes into speaker, artifact, and context subspaces—is not tested on other SSL models (Wav2Vec 2.0, HuBERT, XLS-R, Whisper). The Wav2Vec 2.0-ECAPA baseline in Table 1 shows poor performance (29.69% EER on ASV19 LA), but this could be due to Wav2Vec 2.0's weaker pre-training rather than speaker entanglement specifically. The paper cannot claim that speaker entanglement is a universal property of SSL representations based on evidence from a single model that was explicitly designed to preserve speaker information.

2. No ablation of the critical hyperparameter $K$ (speaker subspace dimensionality). The choice of $K=5$ is stated without justification. This is the most important hyperparameter in the framework—it controls how much of the representational variance is attributed to speaker identity and removed. Without a sweep over $K$ , the reader cannot assess whether $K=5$ is optimal, whether performance is sensitive to this choice, or whether the artifact and speaker subspaces are truly orthogonal (if they overlap, increasing $K$ would initially improve performance by removing more speaker interference, then degrade as artifact-relevant dimensions are removed). This omission is the single most significant gap in the experimental analysis.

3. Confounded comparison between SNAP and the WavLM baseline. SNAP uses dual-layer features (layers 8 and 22) while the WavLM baseline uses only layer 24. The paper cannot distinguish how much of SNAP's improvement comes from the projection and how much from the choice of layers. A proper ablation chain—raw layer 24 with logistic regression, dual-layer raw features with logistic regression, dual-layer projected features with logistic regression—would decompose the contributions.

4. Missing cross-validation and statistical reporting. All main results (Table 1) are reported as single numbers with no standard deviations, confidence intervals, or multi-seed evaluation. The training uses a single 80:20 stratified split. Given the small size of some benchmarks (the ASVspoof 2019 LA evaluation set, for example), the reported EER differences may be within sampling noise, particularly for the closely clustered results (e.g., SNAP 0.35% vs. AASIST 0.82% on ASV19 LA). The paper's claim of a 56.25% relative improvement is based on a difference of 0.45 percentage points in the low-EER regime, where small absolute differences in EER correspond to very small numbers of misclassified utterances. Without statistical testing, the reader cannot assess whether this difference is reliable.

5. The ASVspoof 2021 LA result contradicts the paper's narrative and goes undiscussed. SNAP's 9.46% EER vs. WavLM-ECAPA's 6.67% on ASV21 LA is the only benchmark where SNAP is not best. The paper neither acknowledges this in the main text nor provides any analysis of why speaker nulling might underperform under telephone codec conditions. This omission undermines the paper's claim to "state-of-the-art performance" (Section 1) without qualification.

6. The custom LibriSpeech experiments use only 16 training speakers and 800 total training samples. While the controlled setup is methodologically elegant, the small scale raises questions about whether the perfect mixed-domain results (0.00% EER) would hold on larger, more diverse datasets. The ASVspoof benchmarks involve dozens to hundreds of speakers and thousands of utterances; the LibriSpeech experiment is a proof of concept rather than a large-scale validation.

7. No analysis of failure modes on In-the-Wild data. SNAP achieves 15.39% EER on In-the-Wild, which is the best result but still means ~15% of utterances are misclassified at the EER threshold. The paper does not analyze which utterances SNAP gets wrong—are they from specific TTS architectures, specific recording conditions, specific speaker demographics? Such an analysis would reveal whether the residual errors are due to incomplete speaker nulling, unseen artifact types, or other factors, and would guide future improvements.

8. No comparison to ETA-WavLM or other speaker removal methods. The paper cites Ruggiero et al. (2025), which proposes a simple linear equation for speaker identity removal from WavLM representations, but does not include it as a baseline. This is a missed opportunity to position SNAP relative to the closest prior work and to demonstrate that PCA-based nulling is superior to alternative linear removal techniques.

9. The real-only vs. all-sample centroid computation ambiguity. The paper does not specify whether speaker centroids are computed from real utterances only or from both real and synthetic utterances. This is a procedural detail with significant implications: if synthetic utterances are included, the centroids may be contaminated with artifact information, which would then be partially removed by the projection, potentially degrading artifact discriminability. The paper's silence on this point makes exact reproduction impossible and leaves open a potential confound in the results.

10. No evaluation on voice conversion attacks. The ASVspoof benchmarks include both text-to-speech (TTS) and voice conversion (VC) attacks. The paper does not break down performance by attack type, making it impossible to assess whether SNAP's artifact isolation works equally well for VC (where a real utterance is modified to sound like a different speaker) vs. TTS (where speech is generated from text). VC attacks produce different artifact fingerprints than TTS, and the speaker entanglement problem may manifest differently—since VC explicitly transfers speaker characteristics, the relationship between speaker identity and synthetic artifacts is more complex.

Experiments that would have strengthened the paper

A sweep over $K \in \{1, 3, 5, 10, 20, 50, 100\}$ on the ASVspoof 2019 LA benchmark to characterize the tradeoff between speaker removal and artifact preservation, and to validate that a stable optimal $K$ exists.
Clean ablation of layer selection and projection: report EER for (a) layer 24 raw + logistic regression, (b) layers 8+22 raw + logistic regression, (c) layers 8+22 projected + logistic regression, (d) layer 24 projected + logistic regression. This four-condition matrix would isolate the contributions of layer selection and projection.
Application of SNAP to Wav2Vec 2.0 features: estimate a speaker subspace from Wav2Vec 2.0 embeddings, apply the same projection pipeline, and evaluate on ASVspoof benchmarks. This would test whether the speaker entanglement phenomenon and the effectiveness of subspace nulling generalize across SSL models.
Error analysis on In-the-Wild: characterize the 15.39% of utterances that SNAP misclassifies by attack type, recording condition, and speaker characteristics to identify the residual failure modes.
Statistical validation: report mean and standard deviation of EER across 5 random train/validation splits for the ASVspoof 2019 LA benchmark to establish the reliability of the 0.35% result.
Comparison to ETA-WavLM (Ruggiero et al., 2025) as a baseline on at least ASV19 LA to situate SNAP relative to the most directly comparable prior work.
Sensitivity analysis for the training speaker population: how does SNAP's performance change if the speaker subspace is estimated from fewer speakers (e.g., 10, 20, 50) vs. all available training speakers? This would characterize how many speakers are needed to estimate a sufficiently representative speaker subspace.
Latency and throughput benchmarking: report wall-clock inference time for SNAP vs. baselines to substantiate the efficiency claim with quantitative evidence beyond parameter counting.

6. Limitations and Trade-offs

The Speaker Subspace Dimensionality ( $K$ ) Is Chosen Without Justification and Its Sensitivity Is Unmeasured

The paper sets the speaker subspace dimensionality to $K = 5$ (Section 4.1: "project them onto a speaker-nullified subspace (P⊥ with $k = 5$ )") but provides no sweep, ablation, or principled criterion for this choice. $K$ is the critical hyperparameter in the SNAP framework—it determines how many principal directions of inter-speaker variation are nullified, and therefore controls the fundamental tradeoff between removing speaker information (larger $K$ ) and preserving artifact information (smaller $K$ ). If $K$ is too small, residual speaker information remains in the projected features, and the classifier may still exploit speaker-specific correlations, undermining the paper's central claim of speaker-agnostic detection. If $K$ is too large, dimensions that carry both speaker and artifact information are removed, degrading discriminability.

The consequence is that a practitioner cannot determine whether $K = 5$ is a robust default that will transfer to a new dataset, a new SSL backbone, or a new speaker population, or whether it was cherry-picked for the ASVspoof 2019 LA training speakers. The paper's theoretical framework—that the feature space decomposes into separable speaker ( $\mathcal{S}$ ), artifact ( $\mathcal{A}$ ), and context ( $\mathcal{C}$ ) subspaces (Equation 1)—implies that there should be a natural dimensionality for $\mathcal{S}$ corresponding to the number of meaningful speaker-discriminative directions. Without a $K$ sweep, the paper provides no evidence that such a natural dimensionality exists, that $K=5$ corresponds to it, or that performance is stable in a neighborhood around $K=5$ . A method that collapses when $K$ is changed by ±2 is less practically useful than one with a broad plateau.

The paper provides no evidence whatsoever on this point—no $K$ sweep, no eigenvalue spectrum of the speaker centroid covariance matrix (which would show how many principal components are needed to capture, say, 95% of speaker variance), and no analysis of whether the selected $K$ corresponds to an "elbow" in the eigenvalue decay. The omission is complete: $K=5$ appears as a stated constant with no supporting justification.

The paper does not attempt to mitigate this limitation or even acknowledge it as a limitation. Section 5 briefly mentions that future work will explore applying the framework to other paralinguistic tasks, but does not address the sensitivity of the current method to $K$ . A reader seeking to deploy SNAP on a new dataset must either trust that $K=5$ generalizes (with no evidence) or perform their own $K$ sweep, which the paper provides no guidance for.

Difficulty Estimation Cost Is Entirely Unaccounted For, Making the Headline Efficiency Gains Upper Bounds

The speaker subspace estimation procedure requires computing per-speaker centroids (Equation 5) from labeled utterances for all training speakers. The paper performs this estimation once on the training set and treats the resulting projection matrix $P^\perp$ as a fixed pre-processing step. However, in any deployment where the training speaker population changes—a new dataset, a new domain, or a continuously updated system—the entire PCA must be re-run on the new speaker centroids. The paper does not account for this cost in any efficiency metric, focusing instead on the parameter count of the logistic regression classifier (2,049 parameters) and the simplicity of inference (a matrix multiplication).

The consequence is that the paper's efficiency narrative—"a simple logistic regression with only 2,049 parameters" achieves state-of-the-art performance—is accurate for the per-utterance inference cost but incomplete for the total system cost. Estimating the speaker subspace requires: (1) running frozen WavLM inference on all training utterances to extract embeddings, (2) computing per-speaker centroids, (3) performing PCA (eigendecomposition of a $|S| \times |S|$ or $2D \times 2D$ covariance matrix, where $|S|$ is the number of training speakers and $2D = 2{,}048$ ). For the ASVspoof 2019 LA training set, this is a one-time offline cost that is amortized over all subsequent inferences. But for a practitioner deploying SNAP in a new environment, this cost must be paid upfront and may be substantial if the training speaker population is large.

More subtly, the speaker subspace is estimated from the training speakers only. The paper assumes (implicitly) that the principal directions of inter-speaker variation learned from the training speaker population generalize to new speakers encountered at test time. This is plausible—speaker variation along dimensions like fundamental frequency and vocal tract length is universal—but the paper provides no direct validation. The strong cross-speaker generalization results (ASVspoof benchmarks have no speaker overlap between train and test by design; Table 2 shows perfect in-domain performance on unseen LibriSpeech speakers) provide indirect validation, but do not quantify how much speaker information leaks through for speakers whose vocal characteristics lie far from the training distribution. A speaker with an unusually high-pitched voice, an atypical accent, or pathological speech characteristics may have a significant component along speaker directions not captured by the training PCA, causing the projection to incompletely nullify their speaker identity.

The paper does not measure this cost or its scaling behavior with the number of training speakers. Section 3.2 describes the procedure but provides no computational complexity analysis. The paper also does not discuss whether the speaker subspace can be updated incrementally as new speakers are added (without re-running full PCA), which would be relevant for a continuously deployed system.

The paper does not address this as a limitation. Section 5 gestures toward future work on other paralinguistic tasks but does not discuss the practical overhead of speaker subspace estimation.

The Method Is Validated on a Single SSL Backbone (WavLM), Leaving Generality Unproven

All experiments in the paper use WavLM-Large as the frozen feature extractor. The paper's central claim—that SSL speech representations exhibit speaker entanglement and that explicit subspace nulling resolves it—is established only for this specific model. WavLM is not a generic SSL speech encoder; it was explicitly designed with an utterance-mixing pre-training objective that "actively remove[s] both background noise and overlapping voices from the target speech" while preserving speaker characteristics (Chen et al., 2021, as cited in the paper's Section 1). The paper itself acknowledges this design choice:

"WavLM is well-known for its exceptional speaker identification capabilities, which stem from a pre-training objective that employs a denoising strategy"

This means WavLM is, by design, the worst-case scenario for speaker entanglement—the model was optimized to make speaker identity a dominant feature. The paper's diagnosis may therefore apply primarily or exclusively to WavLM and similarly speaker-optimized encoders, rather than to SSL speech representations generally.

The consequence is that a practitioner using a different SSL backbone—Wav2Vec 2.0, HuBERT, XLS-R, Whisper, or a domain-specific pre-trained model—cannot assume that SNAP will provide equivalent benefits. The Wav2Vec 2.0-ECAPA baseline in Table 1 shows poor performance on ASVspoof 2019 LA (29.69% EER), but this could be due to Wav2Vec 2.0's weaker pre-training overall rather than specifically to speaker entanglement. The paper does not apply the SNAP pipeline to Wav2Vec 2.0 features, so it is unknown whether: (a) Wav2Vec 2.0 representations exhibit speaker entanglement to a similar degree, (b) a speaker subspace can be estimated from Wav2Vec 2.0 embeddings via the same PCA-on-centroids procedure, and (c) nulling this subspace improves artifact discriminability for Wav2Vec 2.0 as it does for WavLM.

The paper also does not test whether the speaker subspace estimated from WavLM transfers to other SSL backbones (i.e., do the same principal directions capture speaker variation across different encoders?), which would be relevant for a multi-encoder ensemble system.

The paper provides no evidence on this limitation. The evaluation is exclusively on WavLM-Large features. The Wav2Vec 2.0-ECAPA baseline serves only as a detection performance comparison, not as a test of the speaker entanglement hypothesis on other backbones.

The paper does not claim generality beyond WavLM. Section 3.1 states WavLM-Large is used as the backbone; Section 4.1 repeats this. The limitation is one of scope, not of false advertising, but it is consequential: the paper's framing as a contribution to "SSL-based deepfake detection" (Section 1) implies broader applicability than the evidence supports.

The Linear Subspace Assumption May Fail for Nonlinear Speaker Manifolds, and Residual Speaker Leakage Is Unmeasured

SNAP models speaker variation as a linear subspace—the span of the top $K$ PCA eigenvectors of the speaker centroid covariance matrix. This is a strong geometric assumption: it asserts that speaker identity manifests as directions in the embedding space along which different speakers' representations vary linearly. If the true speaker manifold is nonlinear—for instance, if speaker identity is encoded in the covariance structure of features, in higher-order interactions between dimensions, or in a curved manifold that is not well-approximated by a $K$ -dimensional linear subspace—then orthogonal projection will incompletely remove speaker information, and residual speaker cues will remain in the projected features $\tilde{z}$ .

The paper provides some evidence that linear nulling is effective: the silhouette coefficient for speaker clustering drops from 0.026 to −0.002 after projection (Figure 2a), suggesting that speaker clustering is reduced to chance level along the measured dimensions. However, the silhouette coefficient is a global measure of cluster quality based on pairwise cosine distances. It does not rule out the possibility that a nonlinear speaker classifier (e.g., a shallow MLP) could still recover speaker identity from $\tilde{z}$ better than chance, which would indicate residual nonlinear speaker structure. The paper does not train a speaker classifier on $\tilde{z}$ to probe for residual speaker information—the claimed invariance is based on cluster structure, not on adversarial probing.

The consequence for deployment is uncertainty about the completeness of speaker nulling. If a sufficiently motivated adversary (or an unintended deployment scenario) attempts to recover speaker identity from SNAP-processed features, the paper provides no guarantee that this is impossible or even difficult. For privacy-sensitive applications where speaker identity must be provably removed (e.g., processing sensitive voice data before sharing with third parties), the lack of a formal privacy guarantee or adversarial evaluation is a significant gap.

The evidence in the paper is limited to Figure 2(a), which shows mean speaker silhouette at chance level. The paper does not report: (a) a speaker classification accuracy on $\tilde{z}$ using a nonlinear classifier, (b) mutual information between speaker identity and $\tilde{z}$ , (c) visualization of $\tilde{z}$ colored by speaker identity (analogous to Figure 1a but after projection) to visually inspect for residual clustering, or (d) an ablation where $K$ is increased to see whether performance degrades (which would indicate that artifact information overlaps with speaker directions beyond the top 5).

The paper does not address this limitation. It does not discuss the linearity assumption, its potential violations, or methods for validating the completeness of speaker removal beyond the silhouette analysis.

The Method Underperforms on Channel-Degraded Speech (ASVspoof 2021 LA) Without Explanation

The only benchmark where SNAP does not achieve the best result is ASVspoof 2021 LA, where it records 9.46% EER compared to WavLM-ECAPA-TDNN's 6.67% (Table 1)—a gap of 2.79 percentage points, or a ~42% relative disadvantage. ASVspoof 2021 LA introduces telephone channel codec compression, which degrades audio quality and introduces transmission artifacts not present in the clean ASVspoof 2019 LA condition. The paper does not discuss this result in the main text; it appears silently in Table 1 alongside the other benchmarks where SNAP is best.

This matters because many real-world deployment scenarios for deepfake detection involve channel-degraded audio: phone calls, video conferencing with lossy compression, social media audio with platform-specific codecs, and forensic audio recovered from low-quality recordings. If SNAP's advantage over baselines disappears or reverses under codec compression, its practical utility is limited to clean-audio scenarios—which are uncommon outside of controlled benchmark evaluations.

The paper provides no analysis of why SNAP underperforms on ASVspoof 2021 LA. Plausible hypotheses (none tested in the paper) include: (a) codec compression introduces new variance that is not cleanly separable into speaker and artifact subspaces, potentially shifting artifact information into dimensions that overlap with the estimated speaker subspace, so that nulling removes useful signal; (b) telephone channel effects introduce a new confound (transmission channel) that is not removed by speaker nulling and that the ECAPA-TDNN architecture handles better through its channel attention mechanisms; (c) the logistic regression classifier on projected features is underpowered for the additional variability introduced by codec compression, and a slightly more expressive classifier would close the gap; (d) the speaker subspace estimated from clean ASVspoof 2019 LA training data does not transfer well to telephone-channel speech, where codec compression may alter the embedding geometry.

The evidence is limited to the single EER number in Table 1. There is no breakdown by codec type, no analysis of which utterances SNAP misclassifies on ASV21 LA, and no ablation testing whether increasing $K$ , using a different classifier, or normalizing for channel effects recovers performance.

The paper does not mitigate or even acknowledge this limitation. The claim of "state-of-the-art performance" in the abstract and Section 1 is stated without qualification, implying best results across all benchmarks, when in fact SNAP is second-best on one of the four.

Hardest Problems: Cross-Domain TTS Generalization Suffers Catastrophic Recall Collapse in One Direction

Section 4.4 presents cross-domain generalization experiments between CosyVoice2 and F5-TTS architectures. While SNAP substantially outperforms baselines in all cross-domain conditions, the F5 → CV2 direction reveals a critical vulnerability: SNAP achieves 9.25% EER but with recall of only 0.070 (Table 2). This means the model correctly identifies only 7% of synthetic utterances as fake—it is essentially non-functional as a synthetic speech detector in this direction, classifying nearly everything as real. The perfect precision (1.000) indicates that when it does flag something as fake, it is always correct, but this is cold comfort when it misses 93% of synthetic samples.

This is not a minor threshold-tuning issue. EER is computed at the threshold where false acceptance rate equals false rejection rate—a standard operating point. The extremely low recall at the EER threshold means the true positive rate (recall) and false positive rate are both ~7%, implying the model's score distributions for real and synthetic speech are almost entirely overlapping, with a tiny separation at one extreme. The model has essentially failed to learn a discriminative representation for F5-TTS artifacts that transfers to CosyVoice2.

The paper acknowledges this result implicitly by reporting the full metrics (accuracy 0.535, precision 1.000, recall 0.070, F1 0.131) in Table 2, but does not comment on the recall collapse in the text. The asymmetry between the two cross-domain directions—CV2 → F5 achieves 10.50% EER with recall 0.810, while F5 → CV2 achieves 9.25% EER with recall 0.070—suggests that CosyVoice2 and F5-TTS leave fundamentally different artifact signatures, and that the linear classifier trained on one does not align with the artifact direction of the other. The paper notes the architectural difference (HiFi-GAN vs. Vocos vocoders) but does not analyze why one direction transfers better.

The consequence for deployment is significant: a SNAP detector trained on available TTS architectures may completely fail to detect novel architectures whose artifact fingerprints lie in a different region of the projected subspace. The paper's mixed-domain result (0.00% EER when training on both architectures) shows that the problem is solvable with diverse training data, but the cross-domain results demonstrate that SNAP does not automatically learn a universal "synthetic-ness" dimension—it learns architecture-specific boundaries, and generalization across architectures is fragile and asymmetric.

The evidence is in Table 2, rows "F5 → CV2" and "CV2 → F5." The paper does not ablate this result by testing additional TTS architectures, by visualizing the projected feature space for different architectures, or by analyzing what artifact features are shared vs. architecture-specific.

The paper partially mitigates this limitation by showing that mixed-domain training solves the problem (achieving 0.00% EER in both directions when trained on data from both architectures). However, the fundamental vulnerability—unknown generalization to unseen architectures—remains. A practitioner deploying SNAP in the wild faces TTS models released after the detector was trained, and the cross-domain results suggest that performance on these novel models may range from moderate (CV2 → F5, 10.50% EER) to catastrophic (F5 → CV2, recall 0.070), with no way to predict which regime will apply.

7. Implications and Future Directions

How This Work Changes the Landscape

SNAP introduces a conceptual reframing rather than a new architecture, and this is precisely what makes its contribution potentially durable. The paper does not propose yet another deepfake detector competing on benchmark EER; it diagnoses a structural problem—speaker entanglement—and demonstrates that fixing it at the representation level, through explicit geometric operations rather than learned approximate invariance, enables even trivial classifiers to achieve state-of-the-art performance. This shifts the field's attention from classifier architecture design to representation conditioning: the question becomes not "how do we build a better detector on top of WavLM?" but "how do we transform SSL representations so that the artifact signal, not the speaker signal, dominates the variance?"

This reframing resolves a tension that has been implicit in the SSL-for-speech literature. WavLM achieved its strong speaker verification performance through a pre-training objective that explicitly preserves speaker identity. The same property that made it excellent for speaker tasks made it problematic for artifact detection—the representation space was organized around speaker clusters, and downstream classifiers inherited this organization. Prior work treated this as an acceptable cost of using powerful pre-trained features, addressing it through data diversity (train on more speakers) or architectural complexity (design classifiers that can disentangle competing signals). SNAP demonstrates that neither is necessary: the speaker structure is separable and can be removed analytically, with the removal itself amplifying the artifact signal (the ~53% relative improvement in class silhouette coefficient, Figure 2b).

The paper also changes the evidentiary standards for representation-level interventions. By using a deliberately trivial classifier (2,049-parameter logistic regression) and demonstrating that it outperforms deep architectures on raw features, SNAP makes a methodological argument: the simplicity of the downstream model is evidence for the quality of the representation. This is not a new idea—linear probes are standard in NLP interpretability—but applying it as a validation tool for a geometric decomposition hypothesis in speech processing, and then using that same probe as the production classifier, is an elegant demonstration that interpretable representations can be practically superior.

The identification of speaker identity as structured noise rather than merely a nuisance variable is another landscape-shifting contribution. The paper shows that speaker variation functions as high-energy interference with an identifiable covariance structure (the speaker centroid PCA), which makes it amenable to targeted removal via subspace filtering—a technique standard in signal processing (Harsanyi and Chang, 1994) but underutilized in deep learning for representation cleaning. This opens the door to treating other confounders similarly: recording device, background noise type, transmission channel, language, or emotion could each occupy identifiable subspaces in SSL representations that can be estimated and nullified.

The paper also provides a unifying explanation for the inconsistent generalization behavior observed across deepfake detection systems. Why does AASIST achieve 0.82% EER on ASVspoof 2019 LA but 43.52% on In-the-Wild? Why does WavLM-ECAPA degrade from 0.80% to 34.64% on the same shift? The speaker entanglement diagnosis provides a mechanistic answer: these models are not learning artifact detection; they are learning speaker-conditional artifact detection, where the decision boundary fragments along speaker clusters (Figure 1). When the evaluation speakers differ from training speakers, the speaker-conditional boundaries fail to generalize. SNAP's cross-speaker robustness—perfect in-domain detection on unseen LibriSpeech speakers (Table 2), strong ASVspoof performance under speaker-disjoint evaluation—validates this explanation by showing that removing the speaker confound resolves the generalization failure.

Finally, the paper redirects research attention from architectures to verifier robustness—though "verifier" here means the feature extraction and conditioning pipeline rather than a reward model. The finding that aggressive optimization (complex classifiers on raw features) can be counterproductive, while a simple classifier on cleaned features excels, parallels the over-optimization phenomenon documented in LLM test-time compute scaling. The bottleneck is not classifier capacity but representation quality, and future work on deepfake detection should prioritize improving the feature conditioning pipeline (better subspace estimation, nonlinear manifold removal, dynamic difficulty-adaptive projection) over designing more sophisticated detection architectures.

Follow-Up Research This Work Enables

Characterizing the optimal speaker subspace dimensionality K across datasets and backbones. The paper uses K=5 without sweep or justification. A systematic study would: (a) sweep K from 1 to, say, 100 on ASVspoof 2019 LA, ASVspoof 2021 LA, and In-the-Wild, measuring both EER and speaker classification accuracy on projected features (to quantify residual speaker leakage); (b) plot the eigenvalue spectrum of the speaker centroid covariance matrix to identify whether a natural elbow exists that corresponds to the true speaker subspace dimensionality; (c) test whether the optimal K transfers across datasets—does K=5 trained on ASV19 LA remain optimal for In-the-Wild?—and whether it transfers across SSL backbones (WavLM vs. Wav2Vec 2.0 vs. HuBERT). This study would convert SNAP from a method with an opaque hyperparameter to one with a principled selection criterion, and would directly test the paper's implicit claim that speaker variation is low-rank and separable.

Adversarial probing for residual speaker information and nonlinear speaker structure. The paper demonstrates that linear speaker clustering (measured by silhouette coefficient) drops to chance after projection (Figure 2a). But this does not rule out recoverable speaker identity through nonlinear means. A direct follow-up would: (a) train a nonlinear speaker classifier (MLP with 1–3 hidden layers, or an ECAPA-TDNN) on SNAP-projected features $\tilde{z}$ from the ASVspoof 2019 LA training set and evaluate speaker identification accuracy on held-out speakers; (b) measure mutual information between speaker identity and $\tilde{z}$ using a non-parametric estimator; (c) visualize $\tilde{z}$ via t-SNE colored by speaker identity to visually inspect for residual clustering structure. If nonlinear speaker recovery is possible, this would reveal that the linear subspace assumption is insufficient and motivate nonlinear speaker manifold removal techniques (e.g., kernel PCA, autoencoder-based disentanglement). This stress-test is critical for privacy-sensitive deployments where speaker anonymity must be guaranteed.

Combining SNAP with channel/recording-condition nulling to address the ASVspoof 2021 LA gap. SNAP's underperformance on ASVspoof 2021 LA (9.46% EER vs. WavLM-ECAPA's 6.67%, Table 1) is the paper's most significant failure mode and the most obvious target for immediate improvement. A natural extension would: (a) estimate a channel subspace from the training data, using metadata about recording conditions or codec types to compute per-condition centroids, in exact analogy to the speaker subspace estimation; (b) apply a second orthogonal projection to nullify channel-dependent components, producing features that are invariant to both speaker and transmission channel; (c) evaluate on ASVspoof 2021 LA to test whether the dual-nulling recovers the performance gap with WavLM-ECAPA. If successful, this would validate the subspace decomposition framework as composable and generalizable to confounders beyond speaker identity. If unsuccessful, it would reveal that codec compression interacts with artifact information in ways that are not cleanly separable by linear projection, which would be an important negative result bounding the method's applicability.

Testing SNAP's generality across SSL backbones (Wav2Vec 2.0, HuBERT, XLS-R, Whisper). The paper establishes speaker entanglement only for WavLM—a model explicitly optimized for speaker discrimination. A critical stress-test would replicate the full SNAP pipeline on at least two other SSL speech encoders that were not designed with speaker-preserving objectives. For each backbone: (a) extract features from layers analogous to WavLM's 8 and 22 (using layer-wise probing to identify acoustic vs. semantic layers); (b) estimate a speaker subspace via PCA on per-speaker centroids; (c) apply orthogonal projection with a swept K; (d) evaluate the projected features on ASVspoof benchmarks with logistic regression. This experiment would answer whether speaker entanglement is a universal property of high-capacity speech representations (in which case SNAP is a general-purpose tool) or a WavLM-specific pathology (in which case the paper's claims are narrower than presented). The Wav2Vec 2.0-ECAPA baseline in Table 1 (29.69% EER on ASV19 LA) suggests that Wav2Vec 2.0 performs poorly for detection, but does not reveal whether this is due to speaker entanglement or simply weaker representations overall—the SNAP replication would disambiguate.

Dynamic, per-utterance subspace estimation for deployment with unknown speaker populations. The paper estimates the speaker subspace once from the training speaker population and applies it statically to all test utterances. This assumes that the principal directions of inter-speaker variation learned from training speakers generalize to test speakers—a plausible but untested assumption. A more robust approach would: (a) maintain a running estimate of the speaker subspace that updates as new speakers are encountered, using online PCA or incremental SVD; (b) for each test utterance, estimate a speaker-specific projection by identifying the test utterance's nearest training speakers and computing a local speaker subspace; (c) compare the static (global) vs. adaptive (local) projection strategies on In-the-Wild data, which has the most diverse speaker population. This would address the paper's implicit assumption that the training speakers adequately span the space of possible speaker variation, and would make SNAP truly deployment-ready for open-world speaker populations.

Extending the framework to voice conversion attacks and partial spoofing. The paper evaluates on ASVspoof benchmarks that include both text-to-speech (TTS) and voice conversion (VC) attacks but does not break down performance by attack type. Voice conversion—where a real utterance is modified to sound like a different speaker—poses a uniquely challenging case for SNAP because the artifact footprint is intertwined with speaker transfer: the synthesis process explicitly manipulates speaker characteristics. A follow-up study would: (a) evaluate SNAP separately on TTS and VC subsets of ASVspoof 2019 LA to quantify whether speaker nulling helps or hurts for VC detection (the projection might remove the very speaker-manipulation artifacts that distinguish VC from bona fide speech); (b) test on partially spoofed audio (Liu et al., 2024), where only segments of an utterance are synthetic; (c) analyze whether the artifact subspace $\mathcal{A}$ isolated by SNAP captures TTS-specific, VC-specific, or shared synthetic fingerprints. This would map the boundary conditions of the method and reveal whether different attack types require different nulling strategies.

Practical Applications and Downstream Use Cases

Voice phishing and social engineering defense for call centers and enterprise voice systems. The paper's In-the-Wild result (15.39% EER, Table 1) is the best reported but still leaves substantial room for improvement. However, SNAP's specific error profile—the detector is architecturally simple, computationally cheap at inference (one matrix multiplication after the WavLM forward pass), and explicitly prevents exploitation of speaker-specific shortcuts—makes it suitable for integration into real-time voice verification pipelines. A call center receiving a voice call can run SNAP as a pre-filter: natural speech proceeds normally; flagged speech triggers step-up authentication or human review. The cross-domain results (Table 2) provide a deployment playbook: train SNAP on audio from as many known TTS architectures as possible (the mixed-domain condition achieved 0.00% EER), with periodic retraining as new TTS models are released. The 2,049-parameter logistic regression classifier can be updated on new data with negligible compute, making continuous adaptation practical. The critical deployment consideration is the residual 15% EER on In-the-Wild—this is not yet reliable enough for fully automated blocking, but is sufficient for risk-based routing where flagged calls receive additional scrutiny.

Forensic analysis of audio evidence with speaker-anonymized artifact detection. In legal or journalistic contexts where audio authenticity must be assessed, SNAP offers a unique capability: it can detect synthesis artifacts while mathematically guaranteeing that the detection decision is not influenced by the speaker's identity along the identified K directions. This is valuable when the speaker population includes individuals not represented in the training data (e.g., a public figure whose voice was cloned, a whistleblower providing anonymous audio evidence). Traditional detectors risk learning spurious associations between speaker identity and authenticity; SNAP explicitly removes this pathway. The paper's perfect precision in cross-domain settings (Table 2: precision 1.000 for both CV2 → F5 and F5 → CV2) means that when SNAP does flag audio as synthetic, the false alarm risk is low—a desirable property for forensic applications where false accusations of fabrication carry high stakes. The main limitation is the low recall in some cross-domain conditions (0.070 for F5 → CV2), which means a negative SNAP result ("this audio appears real") should not be treated as exonerating evidence, only as absence of detected artifacts from the trained-on architecture families.

On-device deepfake detection for consumer voice assistants and messaging platforms. The inference pipeline—frozen WavLM forward pass, one matrix multiplication for projection, dot product plus sigmoid for classification—is well-suited to on-device deployment where a large model can be pre-loaded but per-utterance computation must be minimal. The projection matrix $P^\perp$ (2,048 × 2,048) and classifier weights (2,049 scalars) together require only ~17 MB of storage at float32 precision. A smartphone or smart speaker could run SNAP locally on incoming voice messages or voice commands before they are acted upon, providing privacy-preserving detection (the audio never leaves the device) and low-latency operation (the projection and classification add negligible time to the WavLM forward pass). The paper's demonstration that SNAP improves monotonically with more training speakers (Figure 3) means that a device manufacturer could pre-compute a speaker subspace from a large, diverse enrolled user base, and the model would benefit from that diversity at inference time without requiring per-user adaptation. The limitation is the current need for a separate artifact detection training phase with both real and synthetic data from the target TTS architectures—this requires the manufacturer to maintain a library of known TTS models and periodically update the classifier as new ones emerge.

When to Prefer This Method

The paper positions SNAP explicitly against end-to-end detectors (RawNet2, AASIST) and standard SSL-based classifiers (WavLM-ECAPA-TDNN), and the results provide clear guidance for practitioners choosing between these approaches:

Prefer SNAP when the evaluation speakers are unseen and the training speaker population is limited. The paper demonstrates that baseline detectors degrade or fluctuate as training speakers increase (Figure 3), while SNAP improves monotonically. For deployments where speaker diversity in training cannot match the open-world test distribution—which is essentially all real deployments—SNAP's explicit speaker removal provides robustness that learned approaches do not.
Prefer SNAP when compute or storage at inference is constrained. SNAP adds only a single matrix multiplication and a dot product to the WavLM forward pass, and the additional parameters (projection matrix + classifier) total ~17 MB. This is orders of magnitude cheaper than running an ECAPA-TDNN or AASIST classifier on top of WavLM features. The paper does not provide latency benchmarks, but the architectural simplicity makes the advantage clear.
Prefer SNAP when interpretability or auditability of the detection decision matters. The speaker nulling operation is a deterministic linear projection with an explicit geometric interpretation (removing the component of the embedding lying in the span of between-speaker variation directions). An auditor can inspect the projection matrix, verify that it removes speaker-aligned information, and confirm that the residual features used for classification do not correlate with speaker identity along the identified directions. Learned invariance methods (adversarial training, domain-adversarial networks) provide no such guarantee.
Prefer WavLM-ECAPA-TDNN or AASIST when channel conditions are degraded and the training data matches the deployment channel. On ASVspoof 2021 LA (telephone codec compression), WavLM-ECAPA achieves 6.67% EER vs. SNAP's 9.46% (Table 1). If the deployment scenario involves known codec conditions that can be included in training, an architecture with channel attention mechanisms may outperform SNAP's speaker-only nulling. Extending SNAP with channel nulling (as proposed above) would likely close this gap, but as presented, the paper provides no evidence that SNAP handles channel degradation well.
Prefer training on mixed TTS architectures over relying on cross-domain generalization. The cross-domain results (Table 2) show that SNAP generalizes better than baselines but not perfectly: CV2 → F5 achieves 10.50% EER, and F5 → CV2 shows recall collapse to 0.070. A practitioner should not assume that training on one TTS family will transfer to another. Instead, follow the mixed-domain recipe (0.00% EER) by training on synthetic data from all available TTS architectures, and plan for periodic retraining as new architectures emerge. The logistic regression classifier makes retraining cheap.