Anti-Spoofing Countermeasures in ASV

• Anti-Spoofing Countermeasures are systems that classify speech as bona fide or spoofed by detecting synthetic, replayed, or manipulated signals.
• Recent advances integrate deep spectro-temporal architectures, self-supervised front ends, and component-level labeling to tackle complex spoofing scenarios.
• Evaluation now combines metrics like EER and t-DCF with robustness measures against noise, channel effects, and adaptive adversarial attacks.

Anti-spoofing countermeasures (CMs) are classifiers placed before or inside automatic speaker verification (ASV) pipelines to decide whether an input is bona fide (human speech) or spoofed (synthetic or manipulated speech). In the speech domain they are also described as presentation attack detection modules, and they are central to both ASV security and speech deepfake detection. The field has evolved from handcrafted acoustic front ends and stand-alone binary detection toward deep spectro-temporal architectures, self-supervised front ends, tandem ASV+CM evaluation, and finer-grained threat models such as partial spoofing and component-level spoofing. At the same time, the literature shows that apparently strong CMs can remain vulnerable to shortcut learning, silence artifacts, channel mismatch, noise and reverberation, watermark-induced domain shift, and adaptive adversarial attacks (Kamel et al., 22 Aug 2025, Kinnunen et al., 2018, Zhang et al., 19 Sep 2025).

1. Scope, operating role, and threat models

In the conventional formulation, a CM discriminates bona fide speech from spoofed speech produced by text-to-speech, voice conversion, replay, or related manipulations. The standard deployment pattern is tandem use with ASV: a CM screens the signal and the ASV system then verifies the claimed identity. This tandem view is essential because CMs are rarely deployed in isolation, and the interaction between CM and ASV errors determines end-to-end security and usability (Kinnunen et al., 2020, Kinnunen et al., 2018).

The threat taxonomy distinguishes zero-effort impostors from spoofing adversaries; logical access from physical access; targeted from untargeted objectives; and white-box, gray-box, and black-box attack knowledge. Logical access centers on injected or transmitted synthetic or converted speech, whereas physical access includes replay and channel-mediated attacks. Modern survey treatments also place adversarial perturbations, poisoning, backdoors, and adversarial spoofing—where synthetic speech is additionally optimized to evade the CM and satisfy the verifier—within the CM threat surface (Kamel et al., 22 Aug 2025, Kassis et al., 2021).

Recent work broadens the threat model beyond utterance-level binary labels. Partial spoofing embeds short fake speech segments into an otherwise bona fide utterance, making spoofness a localized temporal property rather than a global utterance attribute (Zhang et al., 2022). Component-level spoofing further departs from the usual assumption by treating an audio scene as a mixture of speech and environmental sound in which only one component may be forged. In this setting, spoofed speech with genuine environmental sound, or genuine speech over spoofed environmental sound, becomes a first-class attack condition rather than a corner case (Zhang et al., 19 Sep 2025).

These extensions change the semantics of the CM task. A single utterance-level label cannot identify which part of a signal is compromised, and genuine content in one region or component can mask spoof artifacts in another. This motivates segment-level localization, component-wise detection, and more interpretable outputs for downstream remediation (Zhang et al., 2022, Zhang et al., 19 Sep 2025).

2. Signal evidence and model families

The evidence exploited by CMs spans handcrafted spectral and phase representations, learned spectro-temporal patterns, raw-waveform cues, and self-supervised speech representations. Widely used handcrafted front ends include MFCC, LFCC, and CQCC, alongside phase and group-delay cues and spectral subband statistics. These representations were historically paired with GMMs or shallow discriminative back ends, and they remain common baselines in ASVspoof-style protocols (Kamel et al., 22 Aug 2025, Kassis et al., 2021).

Deep CM architectures include spectrogram-based CNNs such as LCNN and ResNet variants, raw-waveform systems such as RawNet-style models, and graph-attention architectures such as AASIST and RawGAT-ST. These models are designed to capture spoof artifacts in local spectral structure, temporal consistency, excitation patterns, and cross-band relations. End-to-end raw-audio systems avoid fixed front-end assumptions, while graph-attentional models explicitly integrate spectral and temporal relations (Kamel et al., 22 Aug 2025, Wu et al., 2022, Kassis et al., 2021).

Self-supervised learning has become a major front-end paradigm. Pre-trained wav2vec 2.0 and HuBERT models, when used as CM front ends, substantially improve cross-corpus robustness relative to classical LFCC baselines. A notable observation is architectural: with a frozen self-supervised front end, a deeper back end is needed, whereas fine-tuning a strong front end can make even a shallow global-average-pooling back end competitive (Wang et al., 2021). Conformer-based CMs similarly exploit joint local and global modeling; the MFA-Conformer aggregates multiple Conformer block outputs and can be pretrained on ASR or ASV before CM fine-tuning (Wang et al., 2023).

Specialized variants adapt the CM to deployment or conditioning constraints. Speaker-aware anti-spoofing conditions AASIST on enrollment embeddings from an ECAPA-TDNN, yielding the best results when speaker information is injected early at the frame level along the spectral axis (Liu et al., 2023). For edge deployment, adversarial speaker distillation compresses a ResNetSE-based CM into a substantially smaller student while preserving strong ASVspoof 2021 Logical Access performance (Liao et al., 2022).

3. Datasets and annotation granularity

CM research relies heavily on the ASVspoof series, which standardizes logical-access and physical-access evaluation and exposes models to seen and unseen attack families. ASVspoof 2019 LA remains a canonical training source; ASVspoof 2021 LA emphasizes channel and coding variability, and ASVspoof 2021 DF expands deepfake conditions and domain shift (Kinnunen et al., 2018, Zhang et al., 2021, Kamel et al., 22 Aug 2025).

Granularity has become a defining dataset dimension. PartialSpoof extends ASVspoof 2019 LA into a setting where spoof segments are embedded into bona fide utterances and supplies utterance-level labels together with segment-level labels at six temporal resolutions: 20, 40, 80, 160, 320, and 640 ms (Zhang et al., 2022). CompSpoof instead organizes labels by audio component. It contains 2,500 utterances, uniformly distributed across five classes of speech/environment combinations, with deterministic component labels for speech and environment and a stratified 70%/10%/20% train/dev/eval split (Zhang et al., 19 Sep 2025).

A further recent development is watermark-induced domain shift. The Watermark-Spoofing dataset applies handcrafted and neural watermarking methods to anti-spoofing corpora, creating training and evaluation conditions with 25%, 50%, and 75% watermarked samples and establishing a first benchmark for watermark-resilient CMs (Zhang et al., 25 Sep 2025).

Dataset or protocol	Granularity	Salient property
ASVspoof 2019/2021	Utterance-level bona fide vs spoof	Standard LA/PA and channel-shift evaluation
PartialSpoof	Utterance + segment labels	Fake segments embedded in bona fide utterances
CompSpoof	Utterance class + component labels	Speech/environment component combinations
Watermark-Spoofing	Utterance-level with watermark conditions	Benchmark for watermark-induced shift

This dataset progression shows a clear movement from closed-set utterance-level labeling toward structured annotation of where spoofing resides and what nuisance transformations coexist with it (Zhang et al., 2022, Zhang et al., 19 Sep 2025, Zhang et al., 25 Sep 2025).

4. Objectives, training strategies, and joint optimization

Most CMs are trained with binary cross-entropy or closely related discriminative objectives, but several strands of work alter the training target to match richer threat models or deployment goals. For partial spoofing, one approach is simultaneous utterance-level and segment-level supervision across multiple temporal resolutions, using

$$\mathcal{L} = \sum_{\mathfrak{k}=0}^{\mathfrak{K}+1} \mathcal{L}^{(\mathfrak{k})},$$

where the losses span 20–640 ms segment heads and an utterance-level head (Zhang et al., 2022).

Component-level spoofing introduces a separation-enhanced joint learning framework. A mixture detector distinguishes original audio from mixed audio, a UNet-based STFT-domain separator estimates speech and environment, and two component-specific XLSR-AASIST heads classify the separated speech and environment as bona fide or spoof. Joint learning is used because separation alone can discard manipulation artifacts relevant to detection. The overall objective is

$$L_{\text{joint}} = \kappa \cdot L_{\text{sepa}} + L_{\text{cls}}^{\text{mixed}} + L_{\text{cls}}^{\text{speech}} + L_{\text{cls}}^{\text{env}} + L_{\text{cons}},$$

with $\kappa = 10$ in the reported experiments (Zhang et al., 19 Sep 2025).

Robustness-oriented training adds front-end adaptation or domain-invariance objectives. Channel-robust CM training has been studied with data augmentation by device impulse responses, multi-task learning with a channel classifier, and adversarial learning with a gradient reversal layer, all applied to ResNet-OC under cross-dataset channel mismatch (Zhang et al., 2021). Noise- and reverberation-robust CM training has been addressed by transfer learning-based speech enhancement front-end joint optimization, where a mask-based DUMENet front end and a pretrained Conformer back end are optimized together using

$L_{\text{total}} = L_{CM} + L_{SE}$

under the reported setting $\alpha=1$, $\beta=0$ (Wang et al., 2024).

Training can also be conditioned on speaker identity or resource constraints. Speaker-aware anti-spoofing uses target-speaker enrollment embeddings as architectural conditioning rather than an auxiliary loss (Liu et al., 2023). Adversarial speaker distillation combines GE2E pre-training, adversarial fine-tuning, and knowledge distillation to compress a CM for edge devices (Liao et al., 2022). At the ASV+CM level, differentiable and reinforcement-learning-based optimizations of t-DCF directly target tandem cost rather than separate ASV and CM criteria (Kanervisto et al., 2022).

5. Evaluation criteria and tandem assessment

The dominant standalone CM metric is equal error rate. In the notation used across the literature, EER is obtained at a threshold where miss and false-alarm rates are equal:

$P_{\text{miss}}(\tau) = P_{\text{fa}}(\tau).$

This definition is standard for both ASV and CM evaluation, and many CM studies report EER as the primary score (Kinnunen et al., 2018, Wang et al., 2023).

A central critique is that EER is detector-centric and application-agnostic. It ignores the operating prior of spoof attacks, the asymmetry between user inconvenience and security loss, and the interaction between ASV and CM decisions. The tandem detection cost function therefore extends DCF to the ASV+CM cascade. In the CM→ASV case, the t-DCF is

$$\begin{aligned} \text{t-DCF}(s,t) & = C_\text{miss}^\text{asv} \cdot \pi_\text{tar} \cdot P_\text{a}(s,t) \ & \quad + C_\text{fa}^\text{asv} \cdot \pi_\text{non}\cdot P_\text{b}(s,t) \ & \quad + C_\text{fa}^\text{cm} \cdot \pi_\text{spoof} \cdot P_\text{c}(s,t) \ & \quad + C_\text{miss}^\text{cm}\cdot \pi_\text{tar}\cdot P_\text{d}(s), \end{aligned}$$

where the four terms correspond to ASV misses after CM pass, ASV false accepts after CM pass, spoof acceptance by both CM and ASV, and bona fide rejection by the CM (Kinnunen et al., 2018). Later work also presents an ASV-constrained simplified form,

$$\text{t-DCF}(\tau_{\text{cm}})=C_0+C_1\,P_{\text{miss}}^{\text{CM}}(\tau_{\text{cm}})+C_2\,P_{\text{fa}}^{\text{CM}}(\tau_{\text{cm}}),$$

which makes explicit how a fixed ASV operating point weights CM misses and CM spoof false alarms (Kinnunen et al., 2020).

This distinction between EER and t-DCF is not merely formal. Challenge rankings can change when moving from EER to t-DCF, especially as spoof priors increase (Kinnunen et al., 2018). That is why tandem optimization, speaker-aware conditioning measured with min t-DCF, and spoofing-aware speaker verification fusion are all treated as distinct system-design problems rather than simple post hoc thresholding (Liu et al., 2023, Liao et al., 2022, Wu et al., 2022).

6. Failure modes, robustness, and interpretability

A recurring result is that CMs can learn shortcuts unrelated to spoofness. Controlled interventions with MP3 compression, additive white noise, loudness normalization, non-speech zeroing, and $\mu$-law quantization show that aligned train/test artifacts can produce near-perfect performance, while flipping the artifact between classes at test can drive performance to worse than coin flip. With MP3 or additive white noise, several systems reach EERs near $$L_{\text{joint}} = \kappa \cdot L_{\text{sepa}} + L_{\text{cls}}^{\text{mixed}} + L_{\text{cls}}^{\text{speech}} + L_{\text{cls}}^{\text{env}} + L_{\text{cons}},$$0 under aligned conditions and near $$L_{\text{joint}} = \kappa \cdot L_{\text{sepa}} + L_{\text{cls}}^{\text{mixed}} + L_{\text{cls}}^{\text{speech}} + L_{\text{cls}}^{\text{env}} + L_{\text{cons}},$$1 under inverted conditions (Shim et al., 2023). This establishes shortcut learning as a general CM pathology rather than a dataset-specific anecdote.

Silence is another major shortcut. Removing silence through VAD can severely degrade performance even after retraining. On ASVspoof 2019 LA eval, AASIST trained on unprocessed speech rises from 1.59% EER to 23.8% when tested after silence removal, and similar collapses appear for SENet and LCNN (Zhang et al., 2023). Detailed analyses attribute this to both the proportion of silence duration and the content of silence, with TTS often exhibiting less silence than bona fide speech and different silence acoustics than bona fide or VC (Zhang et al., 2023).

Domain shift appears in multiple forms. Channel mismatch alone can collapse cross-dataset performance: a ResNet-OC CM trained on ASVspoof2019LA yields 2.29% EER on ASVspoof2019LA-eval but 26.30% on ASVspoof2015-eval and 41.66% on VCC2020 (Zhang et al., 2021). Noise and reverberation likewise degrade CM performance, motivating enhancement front ends and on-the-fly augmentation (Wang et al., 2024). Watermarking defines another overlooked shift: on ITW, a clean-trained XLSR+SLS CM rises from 7.32% EER to 9.90% under 75% WavMark watermarking, and degradation is monotonic with watermark density across models and datasets (Zhang et al., 25 Sep 2025).

Adaptive attacks show that even strong CMs remain exploitable. Practical waveform-level attacks jointly optimized against ASV and CM report black-box success rates up to 93.57% against authentication platforms (Kassis et al., 2021). The SMIA black-box attack, which manipulates low-energy STFT regions through masking and interpolation, reports 100% attack success against standalone countermeasures and at least 82% against combined VAS/CM systems (Kamel et al., 9 Sep 2025).

Interpretability studies clarify what models actually use. For partially spoofed audio, Grad-CAM and the Relative Contribution Quantification metric show that CMs trained on PartialSpoof prioritize transition-region artifacts created by concatenation, whereas models trained only on fully spoofed audio focus more on global bona fide/spoof pattern differences and non-speech regions (Liu et al., 2024). Confidence estimation provides a complementary diagnostic. Energy-based and neural-network-based confidence estimators can identify unknown attacks moderately well, and on a cross-corpus test an energy-based estimator reduces EER on the high-confidence subset from 5.55% to 2.85% (Wang et al., 2021).

7. Integrated systems, deployment considerations, and research directions

CMs increasingly appear as components of integrated verification stacks rather than isolated detectors. Multi-level fusion for spoofing-aware speaker verification first maps CM embeddings to a CM score and then combines that score with multiple ASV scores; the best single fusion system reaches 0.97% SASV-EER on evaluation, and a top-5 ensemble reaches 0.89% (Wu et al., 2022). Speaker-aware conditioning of AASIST similarly improves over a speaker-independent baseline, with a maximum relative improvement of 25.1% in EER and 11.6% in min t-DCF on a custom ASVspoof 2019 protocol (Liu et al., 2023).

Deployment constraints also shape model design. Component-level systems can operate on 4 s chunks with 2 s hops and use majority voting for file-level aggregation, making online processing feasible in streaming ASV or content-moderation pipelines (Zhang et al., 19 Sep 2025). Edge-oriented CM compression is similarly active: ASD-ResNetSE reaches 0.2695 min t-DCF and 3.54% EER on ASVspoof 2021 Logical Access while using 22.5% of the parameters and 19.4% of the multiply-and-accumulate count of the baseline ResNetSE (Liao et al., 2022).

The literature converges on several open directions. One is finer supervision: expanding from utterance labels to segment labels, boundary labels, and component labels (Zhang et al., 2022, Zhang et al., 19 Sep 2025). Another is more realistic robustness evaluation under watermarking, channels, codecs, noise, reverberation, and adversarial perturbations (Zhang et al., 25 Sep 2025, Zhang et al., 2021, Wang et al., 2024, Kamel et al., 9 Sep 2025). A third is tandem-aware optimization and calibration, so that the CM is tuned for application risk rather than only for standalone EER (Kinnunen et al., 2018, Kinnunen et al., 2020, Kanervisto et al., 2022).

A plausible implication is that the field is moving toward CMs that are less monolithic and more structured: component-aware, speaker-conditioned, confidence-aware, tandem-calibrated, and explicitly stress-tested against nuisance transformations and adaptive attacks. What the cited work already makes clear is that high headline performance on a single closed-set protocol is insufficient evidence of robust anti-spoofing capability (Shim et al., 2023, Kamel et al., 22 Aug 2025).