Source-linked AI summary
End-to-end anti-spoofing with RawNet2
Hemlata Tak, Jose Patino, Massimiliano Todisco, Andreas Nautsch, Nicholas Evans, Anthony Larcher
TL;DR
Some spoofing attacks still evade automatic speaker-verification countermeasures, especially A17, motivating detection without representative attack data. This paper applies and modifies RawNet2 to learn cues directly from raw speech. RawNet2 performs especially well on A17, while fusion with the baseline achieves second-best reported results for the full logical-access condition.
Problem
A17 attacks can evade existing countermeasures, and the paper asks whether they can be detected without representative training data.
Method
The paper applies modified RawNet2 classifiers that operate directly on raw speech and produce bona-fide-or-spoof predictions.
Results
The RawNet2 system achieves the second-best reported results for A17, while fusion with baseline scores gives second-best reported results for the full ASVspoof 2019 logical-access condition.
Takeaways & Limitations
RawNet2 learns cues complementary to the baseline countermeasure, supporting end-to-end anti-spoofing for difficult A17 attacks.
Abstract
from arXiv · showhide
Spoofing countermeasures aim to protect automatic speaker verification systems from attempts to manipulate their reliability with the use of spoofed speech signals. While results from the most recent ASVspoof 2019 evaluation show great potential to detect most forms of attack, some continue to evade detection. This paper reports the first application of RawNet2 to anti-spoofing. RawNet2 ingests raw audio and has potential to learn cues that are not detectable using more traditional countermeasure solutions. We describe modifications made to the original RawNet2 architecture so that it can be applied to anti-spoofing. For A17 attacks, our RawNet2 systems results are the second-best reported, while the fusion of RawNet2 and baseline countermeasures gives the second-best results reported for the full ASVspoof 2019 logical access condition. Our results are reproducible with open source software.
1. INTRODUCTION
Existing countermeasures capture some spoofing artefacts but struggle with unseen A17 attacks without representative training data. The paper investigates whether RawNet2 can learn more generalisable cues directly from raw speech.
- A17 is a neural-network voice-conversion attack that continues to evade spoofing countermeasures.
- High-spectral-resolution front-ends capture A17 artefacts, but performance is poor when classifiers use only standard training data.
- The central question is whether A17 can be detected without representative A17 training data.
- One-class classifiers are a possible solution, but anecdotal evidence reports unsuccessful application to ASVspoof 2019 data.
- The paper applies RawNet2 to anti-spoofing because hand-crafted features may over-rely on artefacts of known attacks.
2. PREVIOUS WORK
Previous work established end-to-end speaker-verification models operating directly on raw waveforms. RawNet2 combines constrained input filtering, residual processing, feature-map scaling, larger embeddings, and cosine scoring.
- End-to-end speech models jointly optimise front-end processing and back-end classification for the application.
- RawNet applies a learned first convolution directly to raw speech and uses residual blocks to extract frame-level representations.
- SincNet constrains the first raw-waveform layer to a sinc-parameterised band-pass filterbank whose cut-in and cut-off frequencies are learned.
- RawNet2 combines RawNet and SincNet, adds sigmoid filter-wise feature-map scaling, increases embeddings from 128 to 1024, and performs better with cosine similarity scoring.
- On VoxCeleb benchmarks, RawNet1 and RawNet2 report relative EER improvements over i-vector or x-vector systems.
3. APPLICATION TO ANTI-SPOOFING
The anti-spoofing system modifies RawNet2 for sparse attack data and produces bona-fide-versus-spoof predictions. Changes include fixed sinc filters, shorter filter responses, expanded residual filtering, and a classification head.
- The anti-spoofing implementation modifies the original RawNet2 architecture for successful countermeasure application.
- Layer normalization is removed, sinc-filter bandwidths and positions are fixed, and Mel, linear, and inverse-Mel filterbank initialisations are evaluated.
- All utterances are made equal length by cropping long recordings or concatenating short recordings.
- Filter responses are shortened from 251 to 129 samples, while the second residual block uses 512 kernel filters.
- A GRU with 1024 hidden nodes aggregates frame representations before a fully connected layer and two-class softmax output.
4. EXPERIMENTAL WORK
Experiments compare three RawNet2 variants with a high-spectral-resolution LFCC-GMM baseline on ASVspoof 2019 LA, then evaluate SVM-based score fusion. RawNet2 performs worse on pooled evaluation results but substantially better for A17, while fusion improves overall performance.
- Dataset and metrics: The ASVspoof 2019 LA database contains six training/development attack algorithms and thirteen evaluation attack algorithms across train, development, and evaluation partitions.The primary metric is min t-DCF, with pooled EER also reported.
- Baseline: The baseline is a high-spectral-resolution LFCC countermeasure using 70 linearly spaced filters, conventional cepstral analysis, and a GMM back-end.Despite its simplicity, it outperformed all but three ASVspoof 2019 challenge submissions.
- RawNet2 results: 0.09 pooled min t-DCF was achieved by the baseline on evaluation data, compared with 0.1175 for the best S2 RawNet2 system.All three RawNet classifiers were inferior to the baseline on pooled evaluation performance.
- RawNet2 results: 0.181 min t-DCF was achieved by S3 RawNet2 for A17, compared with 0.3524 for the baseline.A17 is the worst-case attack for the baseline and top-performing ASVspoof 2019 LA submissions, and this was among the best published A17 results.
- Fusion: SVM fusion combines the high-spectral-resolution LFCC baseline with S1, S2, and S3 RawNet2 systems and compares them with challenge and official baseline systems.The evaluation includes pooled min t-DCF, pooled EER, and an individual A17 min t-DCF column.
- Fusion: 0.0904 min t-DCF was obtained by the high-spectral-resolution baseline, while all fusions improved on it and L+S1 outperformed fusion with all three RawNet2 systems.Team T24 achieved 0.0953, providing the cited comparison for the baseline result.
- Fusion: All RawNet2 fused systems produced substantially lower A17 min t-DCF than baseline L, indicating complementary learned artefacts.The results were reported as reproducible with open source software.
5. DISCUSSION AND CONCLUSIONS
The paper presents RawNet2 as a successful end-to-end anti-spoofing application, especially for the difficult A17 attack, while fusion with the baseline achieves strong overall results. The authors discuss possible learned cues and identify validation of their hypothesis as future work.
- Contributions: RawNet2 is reported as the first successful application of the architecture to automatic speaker verification anti-spoofing.
- Results: RawNet2 pooled results are inferior to the baseline, but its A17 results are the second best reported.The authors question whether pooled or worst-case results should determine countermeasure comparisons.
- Fusion and future work: The fusion of baseline and RawNet2 classifier scores gives the second best results reported in the literature.The authors attribute the complementarity to different learned cues, while temporal attention and phase-related A17 artefacts remain hypotheses for future validation.