Source-linked AI summary
Source-Directed Trajectory Perturbation at First-Order Cost for Domain Generalization in Speech Deepfake Detection
Siqing Qin, Kong Aik Lee, Youzhi Tu
TL;DR
Speech deepfake detection faces train–test domain shift as new generators and recording conditions emerge, while standard MLDG considers only a clean adaptation trajectory. The paper introduces explicit and source-directed worst-case MLDG variants; the two-pass method improves mean EER over MLDG on all four evaluation sets.
Problem
Standard MLDG considers a single clean adaptation trajectory and does not account for local loss landscapes around its endpoints, despite domain shifts from unseen generators, codecs, and recording conditions.
Source: §1 · p. 1, §2.1 · p. 2Method
The paper proposes four-pass worst-case MLDG at both trajectory endpoints and a two-pass variant that evaluates the meta-test gradient at a source-directed shift of the clean endpoint.
Source: §1 · p. 1Results
Relative to MLDG, WC-MLDG-2P improves all four evaluation sets and reduces relative mean EER by 23.4% with XLSR-AASIST and 7.6% with XLSR-Conformer-TCM.
Source: §5 · p. 4Takeaways & Limitations
Abstract
from arXiv · showhide
Speech deepfake detectors often lose accuracy when the distribution of the test data differs from that of the training data. Meta-learning for domain generalization (MLDG) shows promise by simulating domain shifts with episodic meta-train and meta-test splits. However, the MLDG meta-objective considers only a single clean adaptation trajectory and does not account for the local loss landscape around its endpoints. To address this limitation, we first propose an explicit worst-case MLDG variant, dubbed WC-MLDG-4P, which perturbs both the meta-train and meta-test states but requires four gradient evaluations per episode. We then introduce WC-MLDG-2P, a source-directed alternative to the explicit robust objective. It shifts the clean MLDG endpoint toward a locally higher source-loss state and evaluates the meta-test gradient there, retaining the two-evaluation cost of the first-order MLDG. A first-order expansion relates the resulting gradient change to meta-test directional curvature along the source gradient without explicitly computing a Hessian. Relative to MLDG, WC-MLDG-2P achieves relative mean-EER reductions of 23.4% with XLSR-AASIST and 7.6% with XLSR-Conformer-TCM, respectively.
1. INTRODUCTION
Speech deepfake detectors face domain shift as new generators and recording conditions outpace retraining. The paper extends episodic MLDG with worst-case trajectory evaluation, including a source-directed two-pass variant.
1. INTRODUCTION
- Domain generalization addresses train–test mismatch using source-domain data without assuming target-domain access during training.New speech-generation methods appear faster than detectors can be retrained.Source: §1 · p. 1
- MLDG simulates domain shift by adapting on meta-train source domains and evaluating on held-out meta-test source domains.Prior extensions combine episodic transfer with multi-task learning, gradient surgery, and parameter-efficient adaptation.Source: §1 · p. 1
- Standard MLDG follows one clean adaptation path without controlling the local loss landscape around its starting and adapted states.Small parameter or update-direction changes can raise loss sharply, while unseen generators, codecs, and recording conditions may have different loss geometry.Source: §1 · p. 1
- WC-MLDG-4P evaluates worst-case sensitivity at both meta-train and meta-test states, requiring four gradient evaluations per episode.The method applies local worst-case evaluation to both ends of the MLDG trajectory.Source: §1 · p. 1
- WC-MLDG-2P shifts the clean MLDG endpoint along the normalized meta-train gradient and evaluates the meta-test gradient there using two evaluations.A first-order expansion relates the resulting gradient change to meta-test directional curvature along the meta-train gradient, without explicitly computing a Hessian.Source: §1 · p. 1
2. PRELIMINARIES
The preliminaries describe MLDG as episodic transfer across source-domain splits and explain how sharpness-aware minimization evaluates loss at locally higher-loss parameter states.
2.1. Meta-Learning for Domain Generalization (MLDG)
- MLDG randomly splits source domains into meta-train and meta-test sets, then evaluates target loss after a virtual source-domain adaptation.Its objective combines source loss with meta-test loss after that adaptation; differentiating through the inner update requires a Hessian–vector product.Source: §2.1 · p. 2
- First-order MLDG stops gradients through the inner-update direction, preserving a clean transfer trajectory while leaving endpoint loss landscapes outside the objective.The stop-gradient operation preserves the forward value but treats it as constant in the backward pass.Source: §2.1 · p. 2
2.2. Sharpness-Aware Minimization (SAM)
- Sharpness-aware minimization seeks parameters whose loss changes little within a neighborhood and evaluates the training gradient at a locally higher-loss perturbation.The first-order loss increase is greatest along the current gradient direction.Source: §2.2 · p. 2
- The paper applies local worst-case evaluation to both MLDG update endpoints, then introduces a lower-cost source-directed alternative.The two-pass alternative evaluates meta-test loss at a source-ascent-shifted MLDG endpoint rather than separately solving both local maximizations.Source: §2.2 · p. 2
3. PROPOSED METHOD
WC-MLDG applies local worst-case evaluation to the MLDG adaptation cycle through an explicit four-pass method and a source-directed two-pass alternative. The efficient variant shifts the clean MLDG endpoint toward higher source loss before evaluating the meta-test loss.
3. PROPOSED METHOD
- WC-MLDG applies local worst-case evaluation to the MLDG adaptation cycle through explicit four-pass and efficient two-pass variants.The two-pass variant is not algebraically identical to the two-maximization objective and does not separately solve its local maximizations.Source: §3 · p. 2
3.1. Objective of WC-MLDG
- The explicit objective evaluates worst-case source and target losses at the start and end of the virtual adaptation trajectory.The clean source gradient defines the virtual update; separate maximization terms measure local sensitivity before and after it.Source: §3.1 · p. 2
3.2. Explicit Four-Pass Realization
- WC-MLDG-4P perturbs the source and target states around a clean virtual MLDG update, requiring two gradient evaluations on each split.The clean source gradient supplies the virtual update, while the perturbed source and target evaluations supply the endpoint-sensitive gradients.Source: §3.2 · p. 2
3.3. Efficient Source-Directed Trajectory Perturbation
- WC-MLDG-2P reuses the clean source gradient to shift the MLDG endpoint toward higher source loss, then evaluates the meta-test loss there.Its two passes compute the source gradient and the shifted-state meta-test gradient; both directions are detached to keep meta-test differentiation first order.Source: §3.3 · pp. 2–3
- The shifted endpoint is equivalent to an episode-dependent effective inner step, and a first-order expansion links the meta-test gradient change to cross-domain directional curvature.The shift shortens source descent when αeff > 0 and becomes source-ascent extrapolation when αeff < 0.Source: §3.3 · p. 3
4. EXPERIMENTS
Across four unseen evaluation sets, WC-MLDG-2P improves on MLDG and ERM-Aug while retaining a two-pass cost; its fixed perturbation radius is most balanced across the tested backends. Landscape visualizations show broader low-loss regions for both WC-MLDG variants than for the compared baselines.
4.1. Experimental Setup
- Training uses ASVspoof 2019 LA source data, expands six attack domains to 12 with RawBoost augmentation, and evaluates on four unseen test sets.The two XLS-R detector backends are AASIST and Conformer-TCM; comparisons include ERM, ERM-Aug, MLDG, ERM-Aug-SAM, and both WC-MLDG variants.Source: §4.1 · p. 3
4.2. Main Results
- WC-MLDG-2P improves on ERM-Aug in all eight comparisons, while preserving competitive accuracy versus WC-MLDG-4P at half the gradient-evaluation count.The gains over ERM-Aug include AASIST Codecf EER falling from 24.83% to 21.62% and Conformer-TCM ITW EER falling from 7.97% to 5.96%.Source: §4.2 · pp. 3–4
- 34.2/16.3/65.7/9.8% (AASIST) and 8.7/7.9/15.6/5.2% (Conformer-TCM) are relative EER reductions versus MLDG on 21DF, ITW, FoR, and Codecf, respectively.Table 1 reports EER (%) across four evaluation sets and gradient-evaluation passes per iteration.Source: §4.2 · p. 3, Table 1 · p. 4
4.3. Hyperparameter Sensitivity
- No tested ρ is best in every column, but ρ = 0.01 gives the most balanced fixed setting across both backends.The effect of ρ varies by backend and test set; a large value may place the trajectory endpoint outside the Taylor expansion's local region.Source: §4.3 · p. 4, Table 2 · p. 4
4.4. Loss Landscape Visualization
- Both WC-MLDG variants have broader low-loss regions and slower loss increases than MLDG, ERM-Aug-SAM, and ERM-Aug in the visualized planes.The checkpoint-defined plane connects WC-MLDG-2P, WC-MLDG-4P, and MLDG through a low-loss region, while ERM-based checkpoints project farther from it.Source: §4.4 · p. 4, Figure 1 · p. 4, Figure 2 · p. 4
5. CONCLUSION
The conclusion presents WC-MLDG-2P as a two-gradient-evaluation alternative that improves on MLDG across four evaluation sets. Its reported relative mean-EER reductions are 23.4% with XLSR-AASIST and 7.6% with XLSR-Conformer-TCM.
5. CONCLUSION
- 23.4% with XLSR-AASIST and 7.6% with XLSR-Conformer-TCM are WC-MLDG-2P's relative mean-EER reductions versus MLDG across four evaluation sets.The variant evaluates the meta-test gradient at a source-directed perturbation of the clean MLDG endpoint using two gradient evaluations per episode.Source: §5 · p. 4