A team building an audio deepfake detector faces a data decision before a modeling one: which public corpora to train and benchmark on, and whether they cover the languages, channels, and attack types the deployed system will actually meet. The public benchmarks, above all the ASVspoof challenge series, are well documented and mostly openly licensed, and they are the reason detection research moved as fast as it did. They are also English-heavy, largely derived from studio-grade source corpora, and frozen at the spoofing systems that existed when each was built, which is exactly the material a detector should not be limited to.
This guide maps the public audio deepfake detection datasets, what each one covers, where the gaps sit, and what to specify when commissioning genuine and spoofed collection of your own.
What an audio deepfake detection dataset contains
An audio deepfake detection dataset, an anti-spoofing corpus in the speaker verification literature, pairs bona fide recordings with spoofed ones: the same kind of speech, once produced by a person and once by a text-to-speech system, a voice conversion model, or a replay through a loudspeaker. Each utterance carries a label, bona fide or spoof, and ideally the attack family that produced it, so performance can be read per attack rather than as one blended number.
Pairing is the property that separates a usable corpus from a folder of fakes. If every genuine clip comes from one corpus and every spoof from another, the two sides differ in microphone, room, loudness, and codec as well as in authenticity, and a classifier will learn the cheap difference. The detector looks accurate and has learned nothing about synthesis. The same logic applies to channels: a detector for contact-center fraud meets 8 kHz telephone audio, and narrowband codecs remove some of the artifacts detection models rely on, which is why ASVspoof 2021 routed its logical access data through telephony and VoIP networks before scoring.
The public benchmark landscape
The ASVspoof challenge series, run since 2015, is the backbone of the field: most published detectors are trained and reported on its databases. Around it sit vocoder collections such as WaveFake and evaluation material gathered from real deepfakes in circulation.
| Dataset | Size | Spoof types covered | License or access |
|---|---|---|---|
| ASVspoof 2019 (LA, PA) | Built from 107 VCTK source speakers, with disjoint train, dev, and eval speaker groups | TTS and voice conversion (LA), simulated replay (PA); evaluation includes attacks unseen in training | ODC-By 1.0, attribution |
| ASVspoof 2021 (LA, PA, DF) | DF evaluation set alone: around 600,000 utterances | TTS and VC over telephony and VoIP (LA), replay in physical spaces (PA), codec-compressed deepfakes from over 100 systems (DF) | Open Data Commons licenses via Zenodo; DF set under ODbL 1.0 |
| ASVspoof 5 (2024) | Around 2,000 crowdsourced speakers in varied acoustic conditions; 32 attack algorithms | TTS, voice conversion, and, new to the series, adversarial attacks on the detectors themselves | ODC-By 1.0, attribution |
| WaveFake | 104,885 generated clips | Neural vocoder resynthesis of LJSpeech (English) and JSUT (Japanese); fake side only | CC BY-SA 4.0 |
| In-the-Wild | 37.9 hours: 20.7 genuine, 17.2 deepfake, 58 public figures | Real deepfakes gathered from public online sources | Free download; the speakers never consented, so treat as evaluation material |
Two footnotes. WaveFake ships only the generated side; the matching genuine audio comes from the LJSpeech and JSUT source corpora, so the pairing is between corpora rather than within one collection. And In-the-Wild is best treated as an evaluation set: its recordings come from online sources, and the public figures in them never agreed to appear in anyone's pipeline. For Mandarin, the ADD challenge series builds detection tracks on the AISHELL-3 corpus, with data available for non-commercial use on request from the organizers.
Where the public sets fall short
Language first. The ASVspoof databases are built on English source speech, WaveFake adds Japanese through JSUT, and beyond ADD's Mandarin tracks, coverage of other languages is thin. A bank deploying detection across European markets inherits almost nothing.
Channel second. Bona fide audio in the benchmarks descends mostly from read, clean corpora. ASVspoof 2021 narrowed the gap by passing data through codecs and media compression, and ASVspoof 5 moved to crowdsourced speech in varied acoustic conditions, but a simulated codec pass is still not live network traffic, with its transcoding chains and handset variety.
Known-attack bias is the deepest problem. A detector learns the fingerprints of the specific generation systems in its training data, and the attack list of any published corpus is frozen while new TTS and VC systems ship continuously. The In-the-Wild study measured exactly this: models with strong ASVspoof scores saw error rates rise by up to roughly a thousand percent on real-world deepfakes. ASVspoof mitigates within its own walls by holding some attacks out of training, and ASVspoof 5 added adversarial attacks aimed at the detectors themselves, but no static corpus tracks a moving generator population.
Consent is the constraint scraping cannot fix. A spoofed utterance is a clone of someone's voice, and in the in-the-wild material that someone is a politician or celebrity who never agreed. Research licenses absorb this awkwardly; a commercial pipeline should not. The speech data licensing guide covers how to read the terms, but the structural answer is a spoofed side generated only from speakers who signed up for exactly that.
What to specify when commissioning genuine and spoofed pairs
Where the gap is language, channel, attack coverage, or rights, the alternative is collection scoped for the detector. The specification carries most of the value:
- Languages and speakers. Speaker counts, accents, and demographic spread per language, with enough speakers that a held-out set is possible.
- Channels. The deployment channel captured live, not only simulated: telephony codecs, VoIP paths, and the handsets or IVR stack the detector sits behind, with the same chain applied to genuine and spoofed sides alike.
- Spoof families. Which TTS and voice conversion families to generate with, replay through named loudspeakers and rooms if physical presentation is in the threat model, and partial splices if partially fake audio is.
- Consent on the spoofed side. Every speaker whose voice is cloned signs explicit, use-specific cloning and biometric consent naming spoof generation for detection research and evaluation as the purpose. A voice whose owner has not signed that consent is not cloned, for any customer or reason.
- Evaluation protocol. Held-out speakers and at least one held-out generation system, so the reported number measures generalization rather than recall.
- Metadata. Per-utterance attack family, generation system and version, channel chain, and speaker identifier, in a schema agreed before the first batch.
This is the model behind Spirelight's voice anti-spoofing data collection: the spoofed side exists so a detector can learn to catch it, that purpose is written into every consent form, and requests to synthesize a voice whose owner has not signed are declined. Benchmark on ASVspoof, stress-test on In-the-Wild, and train what you ship on pairs recorded and generated for your channel.