Can you tell? Mostly not

What detectors look for

Three broad families, and each has a specific weakness.

Artefact detectors look for traces of the generation process: characteristics of the neural codec, unnatural regularity in the noise floor, missing very-high-frequency content, absent breath and mouth noise. These work well on raw output from known systems.

Their weakness is that the artefacts live in exactly the parts of the signal that compression discards. Audio sent through a phone call, a messaging app or a social platform has been compressed heavily, and much of the evidence goes with it. Re-recording — playing the audio and capturing it with a microphone — removes nearly all of it.

Learned classifiers are trained on large sets of real and synthetic speech. They perform impressively on their test sets and drop sharply on generators they were not trained on, which is every generator released after them.

Watermark detectors look for a deliberately embedded signal. These are reliable when the signal is present and say nothing when it is absent, which covers every open model and every deliberate misuse.

The numbers to hold in your head

Published detection accuracies of 95% or more are common and are measured under favourable conditions: known generators, clean audio, no compression. Under realistic conditions — unseen generator, telephone-quality audio — reported figures fall substantially, and there is an active research literature on exactly how far.

Then apply the base rate. Suppose one call in a thousand to your organisation uses a cloned voice, and your detector is 95% accurate in both directions. Out of a thousand calls you flag the one real fake and about fifty genuine callers. Fifty false accusations for one catch is not an operational control; it is a way of insulting your customers.

This base-rate arithmetic is the same one that governs medical screening and fraud detection generally, and it is the single most important idea for anyone deploying a detector of any kind. The evaluation course in this catalogue works through it properly.

What humans can hear, and for how much longer

People perform close to chance on short clips of current systems, and better on longer ones, where prosodic monotony and the absence of breath give it away. Trained listeners do better than untrained ones. Everybody does worse over a telephone.

The tells that remain, for what they are worth: unnaturally consistent pacing, no breath before long sentences, background that is either perfectly silent or a loop, and emotional flatness under stress — a caller who claims to be in an emergency but whose voice does not have the physiological signature of one.

Do not build anything on these. They are being closed, deliberately, because naturalness is the product.

What to do instead

The whole weight should sit on verification rather than detection, because verification does not care how good the generator is.

• A shared secret with family: a word, a question with an answer only they know. Agree it now, in person.
• Call back on a known number. Not the number that called; the number in your address book.
• A second channel for anything consequential — a message, an email, a different app.
• Institutional process for money and access: no payment instruction acted on from a single voice or video contact, ever, regardless of how certain the recipient is.

These are unglamorous and they work completely, because they make the attacker's capability irrelevant rather than trying to out-run it.

There is one setting where detection does earn its place, and it is worth naming so the lesson does not read as blanket dismissal. As a triage signal inside a system that already has a verification step, a detector adds value: flag the call for a callback rather than for refusal, route the flagged case to a slower path rather than a rejection. The false positives then cost a few seconds of extra checking instead of an accusation. The rule that follows is a good one generally — a weak signal is useful when it routes and harmful when it decides.

The honest summary: treat any detector's output as a weak signal to investigate, never as a verdict and never as grounds for a public accusation. The literature on this is clear, the failure of the same approach for generated text is instructive — one widely-publicised text detector was withdrawn by its own developer for low accuracy — and the same forces apply here.