AI Detection for Narrowband (8 kHz μ-law) Telephony Spam and Spoof-Call Blocking

No surveyed AI method is, on its own, a compliant narrowband spam/spoof blocker — and the methods with the best published numbers (self-supervised anti-spoofing at sub-1% equal-error-rate) are precisely the ones whose evidence does not transfer to 8 kHz μ-law and whose threat model (fully-synthetic TTS/voice-conversion) excludes the dominant real-world attacker tool: PSOLA and real-time voice changers operating on genuine human voice. The single most important empirical fact is that there is no published anti-spoofing equal-error-rate (EER) measured on native 8 kHz μ-law audio. The field distributes even its "telephony" data upsampled to 16 kHz, so all acoustic numbers are off-condition.

Every method below is judged on 8 kHz μ-law / G.711 PCMU input (300–3400 Hz passband, 8000 Hz sampling, 64 kbit/s — per ITU-T G.711 via RFC 5391 and practitioner references). Where the only evidence is at ≥16 kHz, that is flagged as an extrapolation and its confidence is reduced.

The defensible architecture is emergent from layer composition, not from any single detector. The load-bearing layers are the ones whose discriminative signal is sample-rate-independent — call-graph/behavioral metadata and STIR/SHAKEN attestation — hardened by bonafide-only anomaly detection and an asynchronous transcript-intent classifier, fused with deterministic AND/OR Boolean logic (never weighted-sum).

Recommended architecture in one line: a synchronous Boolean core of (behavioral-metadata anomaly) OR (STIR/SHAKEN-mismatch AND reputation) that gates the call within budget, with an asynchronous transcript-intent and acoustic-anomaly tier feeding a bounded active-learning queue (≤50 cases/week). Acoustic spoof-detection is demoted to a cascaded, post-call signal until a native-8 kHz corpus exists.

The strongest "AI anti-spoofing" results in the literature are a distraction for this problem: they are 16 kHz, TTS/VC-shaped, and collapse roughly 48% in AUC on in-the-wild 2024 audio. Spend the engineering budget on metadata and behavioral fusion first.

Method Survey

Methods are ordered by deployment tier (deployment priority). "Cascaded-tertiary" denotes a last-stage position in cascading inference, distinct from tier.

Tier 1: Defense-in-depth — independent Boolean detector layers

Principle. Multiple detectors over different feature spaces vote by deterministic Boolean composition. AND-fusion is intersection (all must flag); OR-fusion is union (any flags). This is the k-of-N decision-fusion family (AND ⇒ k=N, OR ⇒ k=1, majority ⇒ k>N/2) — a designer trades detection rate against false-alarm rate by choosing k and which detectors enter which clause.

Narrowband power. Not a detector itself but a composition rule; its power is the union/intersection of its members. Because it can route an 8 kHz-incompatible acoustic detector into an asynchronous clause, it is the mechanism that makes the system narrowband-compliant. The system-level false-positive rate is computable once member FPRs are fixed: OR-fusion FPR ≤ Σ member FPRs; AND-fusion DR ≤ min member DR.

Integration. Low-to-moderate: a rules engine evaluating Boolean predicates over per-detector verdicts. No model training. The main effort is wiring mixed-latency members (synchronous block vs. asynchronous tertiary) and enforcing the independence audit.

Latency. Negligible (0.98 with recall as low as 0.72 on real scam transcripts (arXiv:2409.11643), operating post-ASR, so 8 kHz enters only through ASR quality. Confidence is high for (a) being narrowband-safe, medium for (c) (sample rate enters upstream of the transcript).

Integration. (a) Moderate — needs CDR/call-graph access and streaming feature computation. (c) Moderate-to-high — needs streaming ASR (degraded at 8 kHz) plus an LLM; a fine-tuned audio-LLM on the TeleAntiFraud-28k task set reaches average F1 ~83% on telecom-fraud tasks (arXiv:2503.24115; sample rate not stated in the source).

Latency. (a) Synchronous-blocking (metadata is available pre-answer). (c) Asynchronous/cascaded-tertiary — ASR plus LLM inference exceeds the 0.6–0.8 s budget, so transcript intent is a post-call or late-arriving signal that must not gate the answer decision.

Failure modes. (a) Defeated by low-volume "snowshoe" spreading and number-rotation; (c) defeated by scripts mimicking legitimate intent or by multilingual/code-switched ASR failure. Counter-moves: distributed dialing from aged, well-reputationed numbers (defeats (a)); benign-sounding opener scripts (defeats (c)). Lead times: (a) months-to-deploy (number farms exist now); (c) roughly 6–12 months.

Deployability: 4 for (a); 3 for (c). Narrowband suitable: Yes for (a); Partial-with-caveats for (c).

Falsification test. If call-graph features on a held-out production week yield under 15 pp TPR uplift over a caller-ID-reputation baseline at fixed FPR, sub-signal (a)'s independent value is invalidated; if transcript-intent recall falls below ~0.5 on 8 kHz-ASR transcripts of confirmed scams, sub-signal (c) is invalidated as a tier member.

Dataset note. ASVspoof is irrelevant (no transcripts, no call-graph). (a) needs production CDR; (c) needs a labeled scam-transcript corpus. Custom corpus required.

Tier 1: STIR/SHAKEN integration depth

Principle. Cryptographic call-origin attestation in the SIP Identity header: A = caller authenticated and authorized to use the number; B = caller authenticated, number-authorization not verified; C = origin validated only. Carrier/attestation mismatch is a corroborating fraud signal.

Narrowband power. Signaling-layer, fully sample-rate-independent — but weak as a standalone signal. Attestation is explicitly not a spam score: labeling is a matter of analytics driven by crowd-sourced complaints and unusual calling patterns, and attestation level may only factor into those algorithms (Genesys). A-attested numbers can still be spam; C-attested can be legitimate. Confidence is high that it is narrowband-safe, medium that it carries meaningful independent discriminative power (no benchmark; vendor framing only). It should be a secondary signal, never primary.

Integration. Low: read the verstat/attestation result the carrier already passes (where passed). Caveat: cannot depend on direct-IP routing visibility; attestation must survive varied carrier destinations, and gaps exist where upstream carriers do not sign.

Latency. Synchronous-blocking — available at call setup, ~0 ms added.

Failure modes. Coverage holes (unsigned international/legacy origins), and the FCC mandate's own timeline (Eighth Report & Order rules effective Sept 18, 2025, per TransNexus reporting FCC DA-25-730). Counter-move: originate from a carrier that legitimately A-attests a number the attacker controls (e.g., a rented DID) — attestation says nothing about intent. Already commodity.

Deployability: 4 (as a secondary signal). Narrowband suitable: Yes (secondary-only).

Falsification test. If, on a production sample, attestation level is statistically independent of confirmed-spam labels (no lift in either direction), STIR/SHAKEN carries zero discriminative value for this traffic and should be dropped from the fusion plan.

Dataset note. ASVspoof irrelevant. Requires production attestation-vs-outcome telemetry to estimate lift.

Tier 2: Self-supervised speech embeddings at 8 kHz (WavLM / HuBERT / wav2vec 2.0)

Principle. A self-supervised front-end (wav2vec 2.0 / XLS-R / WavLM / HuBERT) feeds an anti-spoofing back-end (AASIST / Conformer / Mamba); the SSL representation captures synthesis artifacts.

Narrowband power. Extrapolation from 16 kHz; low confidence. State of the art at 16 kHz is excellent — XLS-R+Mamba reaches 0.93% EER on ASVspoof 2021 LA / 1.88% on DF (arXiv:2411.10027); a wav2vec 2.0 front-end reaches 0.82% LA / 2.85% DF (Odyssey 2022, arXiv:2202.12233). None of this transfers cleanly: the canonical checkpoints are 16 kHz-only (WavLM-Large's model card instructs that speech input be sampled at 16 kHz), and there is no public 8 kHz SSL checkpoint. Up-sampling 8 kHz μ-law to 16 kHz fabricates no high-band information, and the ASVspoof authors observe that narrowband conditions are harder for countermeasures (arXiv:2210.02437). No 8 kHz EER exists — not viable at 8 kHz without a validated adaptation.

Integration. High. Requires (a) fine-tuning an SSL front-end from a 16 kHz checkpoint onto collected 8 kHz μ-law data (no drop-in checkpoint), (b) a labeled narrowband spoof corpus, and (c) GPU training infrastructure. Up-sampling alone is not a valid adaptation.

Latency. Large SSL front-ends (300M+ parameters) are cascaded-tertiary or asynchronous; a distilled student might reach the synchronous budget but is unproven at 8 kHz.

Failure modes. Cross-distribution collapse: established detectors drop roughly 48% AUC on in-the-wild 2024 audio (arXiv:2503.02857) and reach 27–36% EER on unseen 2024–25 TTS (arXiv:2601.20510). Counter-move: any generator family outside the training set — and PSOLA/voice conversion on genuine voice, which SSL spoof-detectors are not trained to catch. Lead time under 6 months (new TTS/VC monthly).

Deployability: 2 (lab-validated at 16 kHz; not production at 8 kHz). Narrowband suitable: Partial-with-caveats (only after a validated 8 kHz adaptation).

Falsification test. A WavLM/XLS-R model fine-tuned on 8 kHz μ-law that catches PSOLA at under 15 pp detection-rate-at-1%-FPR above random on a held-out matched-bonafide PSOLA set invalidates SSL embeddings as a Tier-2 candidate for the real threat.

Dataset note. ASVspoof 2019/2021 LA is the wrong baseline. Its attack base-rate is TTS plus voice-conversion only — replay is the separate physical-access track, and PSOLA/real-time voice changers appear in no ASVspoof attack family (a structural mismatch, not a footnote). A custom narrowband-PSOLA corpus is required.

Tier 2: Adversarial training-corpus generation

Principle. Synthesize or augment training data to cover the deployment channel and attack mix: codec/channel augmentation (e.g., RawBoost), plus PSOLA-, voice-conversion-, and TTS-generated positives.

Narrowband power. Extrapolation; low-to-medium confidence (a near-band bridge). Channel augmentation works at 16 kHz: RawBoost models nuisance variability from encoding, transmission, and microphones and cuts EER 44% relative (to 5.31% on ASVspoof 2021 LA, ICASSP 2022, arXiv:2111.04433); a 2025 study shows targeted augmentation can mitigate the degradation caused by codec compression (arXiv:2504.12423). The crucial nuance: augmentation only helps when it matches the channel — telephony-tuned augmentation is not automatically robust to other channels. This is the most promising medium-term lever because it directly attacks the 8 kHz gap, but it is unproven on native μ-law, and corpus generation must include PSOLA/voice-conversion, which public corpora lack.

Integration. High — a data-pipeline and retraining program: build a μ-law channel simulator, generate PSOLA/VC/TTS positives from a bonafide seed set, and retrain detectors. Watch for an anti-reward-hack risk: a detector can overfit the generator's fingerprint rather than learn genuine spoof cues (neural-codec source-tracing reaches F1 99.99% by fingerprinting the synthesizer, arXiv:2501.06514 — which inverts under a real μ-law transmission channel that overwrites those fingerprints).

Latency. Training-time only; inference latency is that of the trained detector. Placement inherited.

Failure modes. Augmentation/channel mismatch; fingerprint overfit; the generator zoo never matching the attacker's exact tool. Counter-move: switch to a generator/voice-changer not in the augmentation set. Lead time under 6 months.

Deployability: 2. Narrowband suitable: Partial-with-caveats (the augmentation target can be 8 kHz μ-law; effectiveness unmeasured).

Falsification test. If a detector trained with full μ-law + PSOLA + voice-conversion augmentation shows no detection-rate improvement over a non-augmented baseline on a held-out real (not simulated) 8 kHz μ-law attack set, the augmentation program is invalidated.

Dataset note. ASVspoof is a seed, not a baseline: usable for bonafide/TTS/VC positives but must be supplemented with PSOLA/VC positives and a μ-law channel model. Custom corpus required.

Tier 2: Device/endpoint fingerprinting

Principle. Exploit microphone-channel signatures, DC offset, narrowband noise floor, and codec idiosyncrasies to attribute or anomaly-flag an endpoint.

Narrowband power. Extrapolation; low confidence. Forensic similarity determines whether two segments share source/channel characteristics (IH&MMSec 2026, arXiv:2510.02864; EER ~10.4%, 16 kHz, in-domain); neural-codec source-tracing fingerprints the synthesis codec (F1 99.99% closed-set, arXiv:2501.06514). The narrowband problem inverts both: G.711 μ-law is a lossy, low-bandwidth, 8-bit companded channel that destroys exactly the fine spectral/phase traces device-fingerprinting relies on, and homogenizes endpoints toward the codec's signature. No 8 kHz device-fingerprinting result was found.

Integration. High; bespoke feature engineering plus per-endpoint enrollment; brittle under codec re-encoding.

Latency. Feature extraction is cheap and synchronous-capable in principle, but the signal it needs is largely absent at 8 kHz.

Failure modes. μ-law quantization noise floor swamps device noise floor; transcoding along the carrier path overwrites endpoint traces. Counter-move: inject through any standard softphone — the codec normalizes the fingerprint. Already neutralized by the channel.

Deployability: 1 (research-only at 8 kHz). Narrowband suitable: No (the channel destroys the signal; up-sampling cannot recover destroyed traces).

Falsification test. If endpoint-fingerprint features extracted from 8 kHz μ-law audio cluster by codec rather than by device on a labeled multi-device set, the method is invalidated for narrowband.

Dataset note. ASVspoof is the wrong baseline (16 kHz, no per-device labels). Requires a custom multi-device 8 kHz μ-law corpus that will almost certainly confirm the negative.

Tier 3: Audio-language models as cascaded-tertiary classifiers

Principle. Prompt an audio LLM (Qwen2.5-Omni, GPT-4o-audio, Gemini 2.x) — "is this audio fake or real?" — as a cascaded-tertiary (last-stage, lowest-confidence) classifier.

Narrowband power. Low confidence. Zero-shot audio LLMs are near-useless here: a Qwen-audio base model scores 11.34% accuracy / 4.60% macro-F1 on ASVspoof 2019, "primarily due to the mismatch between their pretraining objectives and the fake audio detection requirements" (arXiv:2505.11079). Fine-tuned (ALLM4ADD) reaches 0.41% EER — but that is a trained classifier head on clean 16 kHz, not a drop-in ALM capability, and a sibling RL-tuned ALM shows a roughly 10-point in-to-cross-set accuracy drop (99.75%→90.10%, arXiv:2601.02983). No 8 kHz ALM anti-spoof result exists.

Integration. High (API/infrastructure, prompt plus supervised fine-tuning, cost); vendor model-deprecation risk.

Latency. Cascaded-tertiary/asynchronous only. ALM inference is in the sub-second-to-second class, exceeding the 0.6–0.8 s synchronous budget and structurally unfit to gate the call decision.

Failure modes. Hallucinated verdicts, prompt-injection via spoken content, generator-distribution shift, vendor deprecation. Counter-move: spoken adversarial content; any unseen generator. Lead time under 6 months.

Deployability: 1–2 (research-stage; useful only post-call, fine-tuned). Narrowband suitable: Partial-with-caveats (only fine-tuned, asynchronous).

Falsification test. A zero-shot ALM whose accuracy on held-out 8 kHz μ-law spoof/bonafide does not exceed chance (~50%) — already essentially observed at 16 kHz (11.34%) — confirms it is invalid as anything but a fine-tuned tertiary signal.

Dataset note. ASVspoof usable for fine-tuning but inherits the TTS/VC base-rate mismatch and 16 kHz gap; custom corpus required for narrowband.

Tier 3: Carrier-level fingerprinting

Principle. Upstream signatures: long-term average spectrum (LTAS), codec/transcoding signature, jitter/packet-timing patterns, carrier mismatch.

Narrowband power. Low confidence; mostly estimate. LTAS over a μ-law band is heavily shaped by the codec itself; jitter/timing signatures are network-layer and survive narrowband (sample-rate-independent), making packet/jitter the only sub-signal plausibly viable. No telephony-spam carrier-fingerprinting benchmark was found, so any numbers would be estimates at low confidence. Network-agnosticism constraints further limit anything depending on direct-IP visibility.

Integration. High and infrastructure-coupled (needs carrier-path telemetry many deployments cannot see).

Latency. Jitter/timing is synchronous (available during setup/early media); LTAS needs a few seconds of audio, so it is cascaded-tertiary.

Failure modes. Carrier-path heterogeneity; transcoding normalizes spectra. Counter-move: route through a "clean" carrier. Lead time: months.

Deployability: 1–2. Narrowband suitable: Partial-with-caveats (jitter/timing sub-signal only; LTAS largely No at 8 kHz).

Falsification test. If LTAS features on 8 kHz μ-law cluster by codec/carrier rather than by spam/bonafide on a labeled sample, the spectral sub-signal is invalidated (the timing sub-signal must be tested separately).

Dataset note. ASVspoof irrelevant (no carrier/packet layer). Custom carrier telemetry required.

Tier 1 (operational): Active-learning loop

Principle. Automatically triage borderline scores into a bounded human-review queue; retrain weekly on the newly-labeled cases. Closes the loop without labeling at production volume.

Narrowband power. Not a detector but a label-efficiency mechanism; its power is the rate at which it improves member detectors. Medium confidence that it helps; magnitude is an estimate.

Integration. Moderate: an uncertainty sampler, a review UI, and a retraining job. The hard constraint is ≤50 borderline cases/week to human review — more is labeling at production volume and forbidden. (50/week is a representative ceiling; set it to actual ops capacity and state the number.)

Latency. Asynchronous by definition (offline triage plus weekly retrain).

Failure modes. Label-distribution drift (the queue over-represents whatever the current detector finds confusing, so blind spots persist); feedback loops that amplify sampling bias. Counter-move: flood with cases that exhaust the weekly budget on a decoy attack while the real attack passes unsampled. Lead time under 6 months.

Deployability: 4. Narrowband suitable: Yes (mechanism is content/feature-agnostic).

Falsification test. If weekly retraining on the ≤50-case queue produces no measurable detection-rate improvement over four consecutive weeks on a frozen held-out set, the loop is not learning and is invalidated.

Dataset note. Operates on production data by construction — ASVspoof is irrelevant. The custom corpus is the accumulating queue.

Comparative Matrix

#	Method	Tier	8 kHz discriminative power (anchor)	Integration	Latency / placement	Key failure mode + counter-move (lead time)	Deployability	Narrowband suitable
1	Defense-in-depth Boolean	1	System-level; OR-FPR ≤ Σ FPR; Conf-Med	Low-Mod	Sync (inherits)	Correlated members; clean-prosody attested VC call (0.98 / R≥0.72	Mod–High	(a) Sync / (c) Async

A --> L2[L2 STIR/SHAKEN attestationSYNC ~0ms, SECONDARY]
A --> L3[L3 Bonafide-only anomalySYNC 50-200ms, if compact]
L1 --> F{Synchronous Boolean gate}
L2 --> F
L3 --> F
F -->|"(L1 anomaly) OR (L2 mismatch AND reputation-bad)"| BLOCK[Block / challenge]
F -->|else| ALLOW[Allow + connect]
ALLOW --> L4[L4 Transcript-intent LLMASYNC / cascaded-tertiary]
ALLOW --> L5[L5 Acoustic spoof-detectCASCADED-TERTIARY, post-call]
L4 --> Q[Active-learning queue ≤50/wk]
L5 --> Q
Q --> RT[Weekly retrain L1/L3]

**Layer responsibilities and fusion rules (explicit Boolean).** The synchronous block decision is `L1_anomaly OR (L2_mismatch AND L3_reputation_bad)` — pure Boolean intersection/union, with no weighted sum, no learned threshold gate, and no post-hoc score calibration. Each member emits a hard 0/1 verdict at its own internally-calibrated operating point; the fusion never sees a continuous score. **L4/L5** are cascaded-tertiary: they emit late, feed the active-learning queue and post-hoc blocklists, and never gate the synchronous answer decision. **L3** runs synchronously only if compact enough for the 0.6–0.8 s budget; otherwise it moves to L5.

**Detector independence audit** (both feature-space and failure-mode diversity):

| Pair | Different feature space? | Different failure mode under tool-shift? | Failure correlation | Classification |
|---|---|---|---|---|
| L1 × L2 | Yes (call-graph vs SIP-crypto) | Yes (rotation vs rented-DID) | ~0.2 | Independent |
| L1 × L3 | Yes (metadata vs acoustic) | Yes (volume vs in-manifold) | ~0.2 | Independent |
| L1 × L4 | Yes (metadata vs transcript) | Mostly (rotation vs benign-script) | ~0.3 | Independent |
| L2 × L3 | Yes (crypto vs acoustic) | Yes | ~0.15 | Independent |
| L3 × L5 | No (both acoustic) | No (both die on narrowband + clean-prosody changers) | ~0.7 | Partially redundant → demote L5 to confirm-only |
| L3 × L4 | Yes (acoustic vs semantic) | Yes | ~0.25 | Independent |
| L4 × L5 | Yes (semantic vs acoustic) | Partially (both async, both generator-sensitive) | ~0.4 | Independent (monitor) |

The compliant core (L1, L2, L3, L4) spans four distinct feature spaces (call-graph metadata, SIP-crypto, acoustic manifold, transcript semantics) with four distinct failure modes, so no single attacker tool-shift collapses more than one member at a time — except the L3×L5 acoustic pair, reclassified partially redundant (correlation ~0.7 > 0.5). The fusion plan therefore treats acoustic spoof-detection as one vote, not two, and L5 is confirm-only: it can raise confidence on an already-flagged call but cannot independently clear or block.

## Existing-Stack Restructuring Recommendations

- **Remove weighted-sum fusion.** Eliminate any weighted-sum/score-blending fusion. A learned weighted sum re-introduces a continuous decision surface, lets a high-confidence acoustic score (the least trustworthy layer at 8 kHz) mask a clean metadata verdict, and makes the false-positive bound non-analytic. Replace with the explicit Boolean gate above.
- **Retain the current parallel block** if every member in the synchronous clause is independently sub-budget (≤0.6–0.8 s). Keep L1/L2 as the synchronous spine (they are ~0 ms and sample-rate-independent).
- **Restructure:**
  - **Acoustic spoof-detector → demote to cascaded-tertiary (L5), confirm-only.** It no longer gates the answer; it writes to the queue/blocklist. Rationale: no 8 kHz evidence plus L3×L5 redundancy.
  - **STIR/SHAKEN → secondary corroborator only.** Attestation may contribute to the `L2_mismatch AND reputation_bad` clause but never be a primary block reason.
  - **Any Caller-ID-primary rule → removed/demoted.** Caller ID is untrustworthy; reputation must be content/behavior-derived.
  - **Active-learning triage → hard-cap at ≤50 human cases/week** with an explicit overflow policy (auto-defer to next week, never expand the human queue).

## Graceful-Degradation Analysis (attacker-driven co-evolution)

Modeled as a co-evolution rather than a static matrix. The four attacker categories — PSOLA → neural voice-conversion → TTS → replay — with per-method counter-moves:

| Defensive method | Named attacker counter-move | Lead time to commodity | Expected DR@1%FPR delta (confidence) |
|---|---|---|---|
| L1 behavioral metadata | Aged-number farms + distributed snowshoe dialing | 0.98 / R≥0.72) | arXiv:2409.11643 | 2024 | https://arxiv.org/html/2409.11643v1 |
| S19 | TeleAntiFraud-28k (F1 83%) | arXiv:2503.24115 | 2025 | https://arxiv.org/html/2503.24115v2 |
| S20 | Rule + reflection scam framework | Findings of EMNLP | 2025 | https://aclanthology.org/2025.findings-emnlp.270/ |
| S21 | Neural codec source tracing (F1 99.99%) | arXiv:2501.06514 | 2025 | https://arxiv.org/pdf/2501.06514 |
| S22 | Forensic similarity for speech deepfakes (~10% EER) | ACM IH&MMSec 2026 (arXiv:2510.02864, submitted 2025) | 2025 | https://arxiv.org/pdf/2510.02864 |
| S23 | WavLM-Large model card (16 kHz-only) | Microsoft / Hugging Face | 2021+ | https://huggingface.co/microsoft/wavlm-large |
| S24 | RVC (open-source, real-time speech-to-speech VC) | Wikipedia | 2026 | https://en.wikipedia.org/wiki/Retrieval-based_Voice_Conversion |
| S25 | RVC latency 90–170 ms | Apatero blog | 2025 | https://www.apatero.com/blog/rvc-retrieval-based-voice-conversion-explained-2025 |
| S26 | Low-latency real-time VC on CPU (<20 ms) | arXiv:2311.00873 | 2023 | https://arxiv.org/abs/2311.00873 |
| S27 | Voicemod — real-time voice changer | Voicemod | 2026 | https://www.voicemod.net/en/voice-changer/ |
| S28 | Clownfish — real-time voice changer | Speechify | 2025 | https://speechify.com/blog/clownfish-voice-changer/ |
| S29 | Moulines & Charpentier — PSOLA (foundational) | Speech Communication 9(5) | 1990 | https://www.sciencedirect.com/science/article/abs/pii/016763939090021Z |
| S30 | ESOLA (epoch-synchronous OLA) | arXiv:1801.06492 (IEEE) | 2018 | https://arxiv.org/abs/1801.06492 |
| S31 | Praat — jitter / shimmer / HNR formulas | Boersma & Weenink (Praat manual) | 2026 | https://www.fon.hum.uva.nl/praat/manual/Voice_2__Jitter.html |
| S32 | Snom — G.711 300–3400 Hz / 8 kHz / 64 kbit/s | Snom Service Hub | 2026 | https://service.snom.com/display/wiki/G.711 |
| S33 | RFC 5391 — G.711.1 narrowband 8 kHz core | IETF | 2008 | https://www.rfc-editor.org/rfc/rfc5391 |
| S34 | Malacopula — adversarial attack on ASV | ASVspoof 2024 Workshop (ISCA) | 2024 | https://www.isca-archive.org/asvspoof_2024/todisco24_asvspoof.html |
| S35 | Cloned-audio temporal features (balanced acc 0.81) | JMIR Biomedical Engineering | 2024 | https://biomedeng.jmir.org/2024/1/e56245 |
| S36 | Qwen2.5/3-Omni latency (≈1.34 s / TTFA 516 ms) | LearnOpenCV | 2025 | https://learnopencv.com/qwen2-5-omni/ |

**On confidence.** The narrowband acoustic problem is evidentially unmeasured: every native-8 kHz acoustic EER, all the degradation deltas, audio-LLM classification latency, device/carrier fingerprinting, and the perceptual-feature survival claim are low-confidence estimates or extrapolations from 16 kHz. The high-confidence claims are the G.711 band facts, the ASVspoof composition and 16 kHz distribution, the zero-shot ALM failure, the human-detection refutation of the 2–3-word premise, the STIR/SHAKEN definitions, and the direction of the narrowband countermeasure penalty.