Most current systems work in two parts. An acoustic model converts text, or a source utterance in the case of voice conversion, into an intermediate representation such as a mel spectrogram, conditioned on an embedding that captures the target speaker's vocal characteristics. A neural vocoder then turns that representation into a waveform. Generative adversarial vocoders such as HiFi-GAN produce high-quality output much faster than real time (Kong et al., 2020). Traces of synthesis can arise at either stage: prosody and timing that are too regular or oddly placed come from the acoustic model, while fine spectral and phase irregularities, especially at high frequencies, come from the vocoder.

Spoofing countermeasures were first developed to protect automatic speaker verification, and the survey by Wu et al. (2015) describes the early field. The ASVspoof challenge series has supplied common data and metrics (Todisco et al., 2019; Yamagishi et al., 2021). Detectors range from classifiers on hand-designed features, such as constant Q cepstral coefficients (Todisco et al., 2017), to networks that learn directly from the waveform (Tak et al., 2021). On the challenge data the best systems make few errors.

The difficulty is generalisation. Müller et al. (2022) tested detectors trained on challenge data against real-world recordings and found that performance deteriorated sharply. Lossy compression, telephone transmission and re-recording through a loudspeaker all remove or mask the fine detail on which detectors rely, a problem that the 2021 challenge was designed to expose (Yamagishi et al., 2021). New synthesis methods appear faster than detectors are retrained, and data sets built from a range of vocoders show that a detector may recognise some and miss others (Frank and Schönherr, 2021). An examiner cannot therefore treat a detector's output as a finding in itself.

The examiner records the question as a pair of propositions, for example that the speech was uttered by a human speaker and captured by the stated device, or that it was generated by a synthesis system. Information needed for the technical work is requested: the claimed recording device and application, the route by which the file reached the submitter, and any intermediate platforms. Information about the wider case that has no technical bearing is kept from the examiner where the organisation allows a case manager to filter it. The examiner also notes at this point which recordings of undisputed origin are available, such as other files from the same device or account, because these will be needed as reference material at Stage 3 and again when automated tools are tested at Stage 7.

The file is acquired and handled as digital evidence under the principles of ISO/IEC 27037 (2012): a forensic copy is made, cryptographic hash values are calculated and recorded, and all work is done on the copy. Where the original device is available it should be obtained, since a recording found in place on a telephone, with its application database and system logs, carries far more provenance information than the same audio forwarded as a message attachment.

Before the audio is played, the file structure is examined. Container format, header fields, timestamps, encoder identifiers and the arrangement of data blocks are compared with what the claimed device and application are known to produce, ideally using reference recordings made on the same model and software version. Koenig and Lacey (2009) describe this kind of structural analysis for edited recordings, and it applies equally here. A file whose structure matches an editing program or a synthesis toolkit and not the claimed recorder calls for explanation. Signs of double compression indicate that the audio has been decoded and re-encoded at least once. Consistency with the claimed device does not exclude synthesis, since generated audio can be played into or imported onto a real device.

The examiner documents the properties that determine what later stages can deliver: net duration of the questioned speech, sampling rate and effective bandwidth, codec and bit rate, signal-to-noise ratio, reverberation, overlapping talkers and background sound. Narrowband telephone audio at a low bit rate retains little of the high-frequency region where vocoder traces are usually sought. If the material falls outside the conditions for which the laboratory's tools have been tested, that is recorded now, before any result is seen, and it limits the strength of conclusion available at Stage 8.

Listening is carried out on calibrated equipment against a written checklist. Points attended to include the placement and sound of breaths, hesitations and fillers, the naturalness of pitch movement across phrase boundaries, the handling of unusual names and numbers, coarticulation between words, and whether the voice sits in a plausible acoustic space that changes as a real speaker moves. Background sound and reverberation should be continuous with the speech and not laid beneath it. Observations are written down as descriptions. Listening rarely settles the matter, since well-made clones sound natural and poor recordings of real speech sound odd, but it directs the signal analysis to particular passages.

Wideband and narrowband spectrograms, long-term average spectra and phase displays are examined for features associated with synthesis: an abrupt upper band limit unrelated to the codec, periodic patterning or smeared harmonics at high frequencies, unnaturally uniform noise between words, and discontinuities where separately generated segments were joined. The acoustic environment is analysed for consistency of noise floor and reverberation time between speech and pauses. If mains hum is present, the electric network frequency criterion may show whether the recording has a continuous time base and, where reference data exist, whether it fits the claimed date (Grigoras, 2007). A cloned voice inserted into a genuine ambient recording can show a mismatch between the two layers. Each observation is recorded with the passage in which it occurs.

One or more automated detectors are then applied. The condition for using them is that the laboratory holds validation results for material resembling the questioned recording in codec, bit rate, bandwidth, duration, language and noise. Where it does not, a case-specific test is run: genuine speech and synthetic speech from several current systems are passed through the same coding and transmission chain as the questioned file, and the detector's scores for the two classes are compared. Only if the classes separate under those conditions is the score for the questioned recording given weight. Scores are reported with the validation results that give them meaning and are never converted into a bare statement that the recording is or is not synthetic.

The findings are brought together and assessed under each proposition in turn, following the logic of evaluative reporting set out by the European Network of Forensic Science Institutes (ENFSI, 2015). The examiner asks how probable the whole set of observations would be if the speech were human and directly recorded, and how probable if it were synthesised. The conclusion is expressed as a graded level of support, with the reasons stated, or as inconclusive where the material or the validation does not allow more. A second examiner reviews the work, preferably having formed a view on the listening and signal stages before seeing the first examiner's conclusion. The report states the limits of the methods in plain terms.