Source-linked AI summary
One-class Learning Towards Synthetic Voice Spoofing Detection
You Zhang, Fei Jiang, Zhiyao Duan
TL;DR
Existing anti-spoofing methods struggle to generalize to unknown synthetic attacks because spoofing distributions expand beyond the training data. The paper formulates detection as one-class learning with OC-Softmax, compacting bona fide speech and separating spoofing attacks by angular margins; it outperforms existing single systems without data augmentation on ASVspoof 2019 LA.
Problem
Existing methods struggle to generalize to unseen spoofing attacks because training and test distributions differ for the synthetic-spoofing class.
Method
The proposed OC-Softmax learns a compact bona fide speech embedding distribution while keeping spoofing attacks outside it using angular margins.
Results
The system outperforms the original Softmax, AM-Softmax, and all existing single systems without data augmentation on ASVspoof 2019 LA, ranking between second and third among all participating systems.
Takeaways & Limitations
One-class learning provides good performance across unknown attacks and improves robustness against spoofing attacks outside the training distribution.
Abstract
from arXiv · showhide
Human voices can be used to authenticate the identity of the speaker, but the automatic speaker verification (ASV) systems are vulnerable to voice spoofing attacks, such as impersonation, replay, text-to-speech, and voice conversion. Recently, researchers developed anti-spoofing techniques to improve the reliability of ASV systems against spoofing attacks. However, most methods encounter difficulties in detecting unknown attacks in practical use, which often have different statistical distributions from known attacks. Especially, the fast development of synthetic voice spoofing algorithms is generating increasingly powerful attacks, putting the ASV systems at risk of unseen attacks. In this work, we propose an anti-spoofing system to detect unknown synthetic voice spoofing attacks (i.e., text-to-speech or voice conversion) using one-class learning. The key idea is to compact the bona fide speech representation and inject an angular margin to separate the spoofing attacks in the embedding space. Without resorting to any data augmentation methods, our proposed system achieves an equal error rate (EER) of 2.19% on the evaluation set of ASVspoof 2019 Challenge logical access scenario, outperforming all existing single systems (i.e., those without model ensemble).
I. INTRODUCTION
Synthetic voice spoofing threatens speaker verification because unknown attacks can differ statistically from known training attacks. The paper addresses this mismatch with one-class feature learning that compacts bona fide speech and separates spoofing attacks by a margin.
- Synthetic attacks include text-to-speech and voice conversion, whose rapid development increasingly threatens speaker verification systems.
- Existing methods often generalize poorly to unseen attacks because binary classification assumes similar training and test distributions for bona fide and spoofing classes.That assumption is less plausible for spoofing attacks because practical attack distributions expand faster than the training set.
- One-class classification instead models the target class distribution with a tight boundary, while non-target samples may be absent or unrepresentative during training.
- The paper formulates antispoofing as one-class feature learning, using OC-Softmax to compact bona fide embeddings and keep spoofing data away by a margin.The target class is bona fide speech, and spoofing attacks are the non-target class.
- The proposed system uses no data augmentation, outperforms existing single systems on ASVspoof 2019 LA, and ranks between second and third among all participating systems.
II. METHOD
Deep-learning voice spoofing detectors learn utterance embeddings that are scored to determine whether speech is bona fide. Previous systems generally train these embeddings with binary classification losses.
- A neural network converts speech features into an embedding vector for each input utterance.
- Training aims to learn an embedding space that discriminates bona fide voices from spoofing voices.
- The learned embedding is used to score whether an utterance belongs to bona fide speech.
- Previous voice spoofing detection systems generally learn speech embeddings with a binary classification loss function.
A. Preliminary: binary classification loss functions
The preliminary losses treat spoofing detection as binary classification. Softmax uses two class directions, while AM-Softmax adds an angular margin to compact both class distributions.
- Softmax formulates spoofing detection as binary classification using embedding vectors and binary labels.The two class weight vectors represent the bona fide and non-target classes.
- For each sample, xi is its embedding vector, yi is its binary label, w0 and w1 are class weight vectors, and N is the mini-batch size.
- AM-Softmax introduces an angular margin to make both class embedding distributions more compact around their respective directions.
- AM-Softmax uses α as a scale factor, m as the cosine-similarity margin, and normalized weight and embedding vectors.
B. Proposed loss function for one-class learning
OC-Softmax adapts angular-margin learning to one-class spoofing detection by compacting bona fide speech while avoiding compact modeling of spoofing attacks. It uses one target direction and separate margins for the two classes.
- Binary losses may overfit known attacks by learning a compact embedding space for spoofing as well as bona fide speech.
- OC-Softmax introduces two different margins to compact bona fide speech and isolate spoofing attacks.
- The method uses one weight vector w0 as the optimization direction for target-class embeddings.
- For bona fide samples, m0 forces θi below arccos m0; for spoofing samples, m1 forces θi above arccos m1.Here m0 and m1 satisfy m0 > m1, and θi is the angle between w0 and xi.
- A small arccos m0 concentrates bona fide embeddings around w0, while a relatively large arccos m1 pushes spoofing data away from w0.
A. Dataset
The ASVspoof 2019 LA dataset contains bona fide speech and TTS/VC spoofing attacks, with six known attacks for training/development and mostly unseen attacks for testing.
- Training and development sets share six attacks, A01–A06, comprising four TTS and two VC algorithms.
- The test set contains eleven unknown attacks, A07–A15, A17, and A18, including combinations of TTS and VC attacks.
- The test set also includes A16 and A19, which reuse algorithms from training attacks A04 and A06 with different training data.
B. Evaluation metrics
The study evaluates anti-spoofing using CM scores, EER, and t-DCF, with LFCC inputs processed by a ResNet-based architecture and attentive temporal pooling.
- EER measures anti-spoofing errors where false-alarm and miss rates are equal; lower EER indicates better spoofing detection.
- t-DCF measures how an anti-spoofing system affects ASV reliability, using a fixed ASV system for comparison; lower t-DCF is better.
- The system extracts 60-dimensional LFCCs with 20 ms frames and 10 ms hops, using 750 time frames per batch input.
- A ResNet-18 architecture with attentive temporal pooling accepts LFCC features and outputs a confidence score for classification.
- The experiments compare loss functions on ASVspoof 2019 LA development and evaluation sets, including individual unseen attacks.
- The model uses a 256-dimensional speech embedding and trains OC-Softmax with α = 20, m0 = 0.9, and m1 = 0.2.
D. Results
OC-Softmax improves robustness to unknown spoofing attacks while retaining known-attack discrimination, producing compact bona fide embeddings and angular separation from spoofing speech.
- The three losses perform similarly on development data, indicating comparable discrimination of known attacks.
- 33% relative EER improvement is achieved at most on unknown evaluation attacks versus Softmax and AM-Softmax.
- OC-Softmax performs well across all individual attacks except A17, whereas binary-loss systems overfit with uneven attack-specific results.
- The shared t-SNE and PCA projections show similar bona fide distributions but different distributions for unknown evaluation attacks.
- Unknown attacks in highlighted top and bottom clusters remain separated from the bona fide cluster, indicating generalization by the proposed system.
- PCA visualizations show compact bona fide embeddings and an angular margin that remains between bona fide and unknown spoofing embeddings.
2) Comparison with other systems:
Against existing single systems without data augmentation or model fusion, the proposed system achieves the strongest reported comparison on the ASVspoof 2019 LA evaluation set.
- The proposed system significantly outperforms other existing single systems on the ASVspoof 2019 LA evaluation set.
- The comparison excludes model fusion and data augmentation to evaluate single-system performance under a consistent setting.
- Its leaderboard-equivalent ranking would fall between second-place EER 1.86% and third-place EER 2.64%, although the top three systems used model fusion.
- The embedding visualization distinguishes bona fide speech from spoofing attacks, including highlighted unknown attacks with different distributions.
IV. CONCLUSION
The proposed one-class system improves robustness to unknown spoofing attacks by compacting bona fide speech representations and separating spoofing attacks with an angular margin. It outperforms conventional binary-classification losses and existing single systems without data augmentation in the ASVspoof 2019 LA scenario.
- The system uses one-class learning to enhance robustness against unknown spoofing attacks.Its embedding space gives bona fide speech a compact distribution while placing spoofing attacks outside it with an angular margin.
- The proposed loss outperforms original Softmax and AM-Softmax anti-spoofing formulations.These baselines formulate anti-spoofing as conventional binary classification.
- The system outperforms all existing single systems without data augmentation on the ASVspoof 2019 Challenge LA scenario.It ranks between second and third among all participating systems.
- The authors identify detecting other multimedia forgeries as future work.