RawBoost: Waveform Augmentation for Anti-Spoofing

• RawBoost is a raw waveform augmentation method that simulates channel, codec, and recording variability to enhance anti-spoofing performance.
• It combines linear/non-linear convolutive noise, impulsive signal-dependent noise, and stationary additive noise to mimic telephony distortions without extra data.
• Empirical results show significant error rate reductions, demonstrating its practical impact when integrated with robust anti-spoofing pipelines.

RawBoost is a raw-waveform data boosting and augmentation method for anti-spoofing and speech deepfake detection. It was introduced for automatic speaker verification anti-spoofing systems that operate directly upon raw waveform inputs, especially in logical access settings affected by unknown telephony transmission, encoding, and channel conditions. RawBoost requires no additional data sources such as noise recordings or impulse responses, is data, application and model agnostic, and is designed to model nuisance variability through waveform-level distortions rather than model-level intervention (Tak et al., 2021). Subsequent work has used RawBoost as a training-time augmentation layer in robust speech deepfake detection, Transformer-based anti-spoofing for ASVspoof 5, and multilingual SSL-based detection systems, while also showing that the augmentation can introduce nontrivial optimization side effects if its gradients are not managed explicitly (Truong et al., 25 Sep 2025, Yin et al., 2 Jun 2026, Ali et al., 28 Aug 2025).

1. Origin, motivation, and problem setting

RawBoost emerged from a specific mismatch in ASVspoof logical access evaluation. The training and development data available from ASVspoof 2019 LA are relatively clean and do not contain the channel and codec distortions seen at evaluation time in ASVspoof 2021 LA, where speech may be transmitted through PSTN or VoIP networks, processed by various codecs, or affected by unknown or unannounced codecs. RawBoost was introduced to inject telephony-like variability during training, to work directly on raw waveform inputs, to avoid dependence on external augmentation resources, and to avoid model-level architectural changes (Tak et al., 2021).

The method is therefore best understood as a signal-processing augmentation framework for raw-audio anti-spoofing pipelines. Its design target is nuisance variability stemming from encoding, transmission, microphones, amplifiers, and both linear and non-linear distortion. Because these factors can obscure or alter spoofing artifacts, RawBoost aims to broaden the training distribution so that anti-spoofing models learn cues that persist under channel mismatch rather than cues tied to pristine recording conditions (Tak et al., 2021).

Later studies reused RawBoost in broader settings. In robust speech deepfake detection, it was adopted as the key input-level waveform augmentation for studying whether augmentation genuinely helps robust speech deepfake detection or also introduces optimization problems during training (Truong et al., 25 Sep 2025). In ASVspoof 5, it was used as a waveform-level augmentation method to improve robustness against varying spoofing conditions and channel mismatch within a Transformer-based system (Yin et al., 2 Jun 2026). In the SAFE Challenge, it served as a fixed training-time augmentation layer in a multilingual SSL + AASIST pipeline intended to generalize across unmodified, processed, and laundered audio (Ali et al., 28 Aug 2025).

2. Augmentation processes and signal model

RawBoost consists of three independent augmentation processes: linear and non-linear convolutive noise, impulsive signal-dependent additive noise, and stationary signal-independent additive noise. These processes can be used alone or in combination, and the original formulation explores both series and parallel compositions. In series, the output of one transform is fed to the next; in parallel, the original utterance is processed independently by each transform and the distortions are then combined. The augmented output waveforms are normalized to avoid overflow (Tak et al., 2021).

RawBoost process	Representative operation	Modeled variability
Linear and non-linear convolutive noise	Multi-band notch filtering and Hammerstein-system-inspired nonlinearity	Channel filtering, encoding or compression-decompression artifacts, transmission effects, microphone or amplifier distortions, harmonic distortion
Impulsive signal-dependent additive noise	Sparse burst-like perturbations scaled by the local signal	Clipping, overflow, synchronization or acquisition glitches, transient device malfunction
Stationary signal-independent additive noise	White noise colored by an FIR filter and scaled by SNR	Thermal noise, electromagnetic interference, loose connections, stationary transmission noise

The linear and non-linear convolutive component is intended to simulate both channel distortion and harmonic distortion. The paper defines a convolutive-noise output using FIR filtering applied to powers of the waveform, with higher-order terms creating harmonics. It uses a set of notch filters with random center frequencies and bandwidths, and the parameter ranges reported for this technique are $N_{\text{notch}} = 5$, $N_{\text{fir}} \in [10,100]$, $N_f = 5$, $f_c \in [20, 8000]$ Hz, $\Delta f \in [100, 1000]$ Hz, $g^{\text{cn}}_1 \in [0,0]$ dB, and $g^{\text{cn}}_{2-N_f} \in [-5,-20]$ dB (Tak et al., 2021).

The impulsive signal-dependent additive component adds a small number of impulse-like perturbations whose magnitude depends on the local signal amplitude. The paper defines $P_{\text{rel}} = P/l$, so the maximum number of corrupted samples is selected relative to utterance length, with $P_{\text{rel}} \in [0,10]\%$ and $g^{\text{sd}} = 2$. The stationary signal-independent additive component begins with white noise, colors it using an FIR filter designed similarly to the convolutive-noise filter, scales it according to a randomly chosen SNR, and adds it to the full utterance. For this technique the paper reports $N_{\text{fir}} \in [10,100]$0, $N_{\text{fir}} \in [10,100]$1, $N_{\text{fir}} \in [10,100]$2, $N_{\text{fir}} \in [10,100]$3 Hz, $N_{\text{fir}} \in [10,100]$4 Hz, and $N_{\text{fir}} \in [10,100]$5 dB (Tak et al., 2021).

Later work reused subsets or variants of these processes. The SAFE Challenge system explicitly states that it used RawBoost with linear convolutive noise, non-linear convolutive noise, and impulsive signal-dependent additive noise, chosen as being optimal for logical access scenarios (Ali et al., 28 Aug 2025). The ASVspoof 5 TFPARN system describes a training-time RawBoost setup in which one of three algorithms is randomly selected: a short random FIR filter with optional $N_{\text{fir}} \in [10,100]$6 nonlinearity, a random Butterworth low-pass, high-pass, or band-pass IIR filter, or stationary additive Gaussian noise with SNR in the range 10 to 40 dB (Yin et al., 2 Jun 2026).

3. Integration into anti-spoofing and deepfake-detection pipelines

In the original ASVspoof 2021 LA work, RawBoost was evaluated with RawNet2, an end-to-end raw waveform spoofing detector. The training data were ASVspoof 2019 LA train and development only, and evaluation considered conditions denoted C1 through C7, including A-law VoIP, PSTN, G.722 VoIP, and unknown codecs or unknown conditions. Because ASVspoof 2019 development data lacked encoding and transmission effects, RawBoost was also applied to the development set so that augmentation tuning remained aligned with the 2021 logical access setting (Tak et al., 2021).

Later pipelines inserted RawBoost at different places but always before the main feature extractor or classifier. In the dual-path data-augmented framework for speech deepfake detection, each utterance is presented twice: once as the original input $N_{\text{fir}} \in [10,100]$7, and once as an augmented version $N_{\text{fir}} \in [10,100]$8 produced by RawBoost. Both are fed through the same shared model $N_{\text{fir}} \in [10,100]$9, so the method learns jointly from clean and distorted views of the same utterance. That study specifies RawBoost configuration 4 and states that it covers the noise types included in prior configurations 3 and 5 (Truong et al., 25 Sep 2025).

In the TFPARN anti-spoofing system for ASVspoof 5, RawBoost is used only during training. Each training utterance is resampled to 16 kHz, normalized, cropped to 4.0 s, and then RawBoost is applied with probability $N_f = 5$0. The augmentation is completely disabled on Dev and Eval. It is applied before log-Mel feature extraction and is not mathematically coupled to the Transformer encoder, focal classification loss, pairwise ranking loss, or attention pooling. Test-time augmentation is separate: Dev and Eval use five fixed-length crops, and logits are averaged across crops (Yin et al., 2 Jun 2026).

In the SAFE Challenge system, RawBoost is applied during training after waveform loading, resampling to 16 kHz, and padding or cropping to a fixed duration, and before SSL feature extraction through S3PRL. The fixed duration is 4 s in Iterations 1–2 and 12 s in Iterations 3–4. The pipeline is audio waveform, RawBoost augmentation, SSL encoder such as WavLM Large or MAE-AST Frame, a 128-dimensional fully connected projection, and then an AASIST back-end for binary spoof versus bona fide prediction (Ali et al., 28 Aug 2025).

4. Empirical performance and reported gains

On ASVspoof 2021 LA, the original RawBoost paper reports substantial gains over a RawNet2 baseline. The baseline pooled min t-DCF is 0.4257 and pooled EER is 9.50%. Using only linear and non-linear convolutive noise yields min t-DCF 0.3527 and EER 7.22%; using only impulsive signal-dependent noise yields min t-DCF 0.3260 and EER 6.09%; using only stationary signal-independent noise yields min t-DCF 0.3372 and EER 7.85%. The best reported configuration is RawBoost (1)+(2) in series, with pooled min t-DCF 0.3099 and pooled EER 5.31%, reported as a 27% relative reduction in min t-DCF and a 44% relative reduction in EER over the baseline. The paper also notes that adding stationary noise on top of the other transforms did not improve performance further for this logical access task, likely because the evaluation data did not contain ambient noise (Tak et al., 2021).

In later systems, RawBoost is usually part of a full recipe rather than the sole variable. The ASVspoof 5 TFPARN paper reports that the best full system achieves minDCF $N_f = 5$1, EER $N_f = 5$2, and actDCF $N_f = 5$3, and that RawBoost is included in the training setup. However, the paper does not present a dedicated ablation isolating RawBoost alone, so there is no direct quantitative estimate of its standalone contribution within that architecture (Yin et al., 2 Jun 2026).

The SAFE Challenge system similarly treats RawBoost as a fixed component across all experiments. The paper reports second place in Task 1 and Task 3, and gives iteration-level results for the full multilingual training recipe. For the WavLM-based system, Iteration 1 reports Task 1 BA 0.531, Task 2 BA 0.589, Task 3 BA 0.492, ITW BA 0.616, and ITW EER 35.61%; Iteration 2 reports Task 1 BA 0.745, Task 2 BA 0.587, Task 3 BA 0.478, ITW BA 0.875, and ITW EER 8.46%; Iteration 3 reports Task 1 BA 0.766, Task 2 BA 0.765, Task 3 BA 0.518, ITW BA 0.856, and ITW EER 12.05%; Iteration 4 reports Task 1 BA 0.810, Task 2 BA 0.819, Task 3 BA 0.496, ITW BA 0.905, and ITW EER 8.42%. The paper explicitly states that there is no clean RawBoost-versus-no-RawBoost ablation, so these improvements belong to the combined effect of multilingual training data, SSL front-ends, audio-length choices, and augmentation (Ali et al., 28 Aug 2025).

5. Gradient misalignment under RawBoost-based joint training

A major later development is the observation that RawBoost can expose an optimization problem rather than acting as a purely benign regularizer. In the dual-path data-augmented framework for robust speech deepfake detection, the original waveform $N_f = 5$4 and the RawBoost-augmented waveform $N_f = 5$5 are processed in parallel through a shared SDD model, giving two losses and two gradients,

$N_f = 5$6

The conventional data-augmentation update aggregates these into a single gradient, but this can hide conflicts between the two paths (Truong et al., 25 Sep 2025).

The central empirical observation is that the augmented path often has higher loss and larger gradient norms than the original path, so the RawBoost branch can dominate the update. More importantly, the gradients from $N_f = 5$7 and $N_f = 5$8 can point in opposing directions. The paper reports that about 25% of training iterations exhibit gradient conflicts under RawBoost-based dual-path training. It also visualizes the loss surfaces of the original and RawBoost-augmented paths and shows that the augmented path has a more complex landscape, with sharper valleys and different descent directions. This suggests that RawBoost can create harder training examples that improve robustness while also distorting the optimization trajectory if the two gradient streams are combined naively (Truong et al., 25 Sep 2025).

To address this, the paper proposes a dual-path data-augmented framework with gradient alignment and evaluates PCGrad, GradVac, and CAGrad. PCGrad declares conflict when

$N_f = 5$9

and removes the conflicting component by projection. GradVac monitors cosine similarity and aligns gradients whenever that similarity falls below a learned positive target. CAGrad formulates a constrained optimization that keeps the aligned update close to the standard aggregated gradient while maximizing the worst-case improvement across the two paths (Truong et al., 25 Sep 2025).

These alignment procedures materially affect both convergence and recognition performance. On the XLSR-Conformer-TCM model, baseline dual-path training with RawBoost but without gradient alignment reaches its best validation loss at epoch 14, whereas the PCGrad-based version reaches its minimum at epoch 4; the paper reports this as a 43% faster convergence effect. Conflict frequency is also reduced, with the baseline having roughly twice as many conflict iterations as the aligned version. On the In-the-Wild dataset, the paper reports up to an 18.69% relative EER reduction compared with the baseline. One concrete example is XLSR-Conformer-TCM, where DPDA with RawBoost gives 7.97% EER on ITW and adding PCGrad lowers this to 6.48% (Truong et al., 25 Sep 2025).

6. Scope, limitations, and terminological distinctions

RawBoost is best regarded as a training-time raw waveform augmentation framework whose main purpose is to improve robustness to channel, codec, and recording variability. The original formulation is explicitly telephony-oriented, and later studies preserve the same broad role even when the backbone changes from RawNet2 to SSL-based or Transformer-based detectors. At the same time, the published evidence also qualifies a simplistic interpretation. In robust speech deepfake detection, RawBoost is useful, but only if its optimization side effects are managed; in multilingual SAFE evaluation, laundered audio remains difficult even with RawBoost; and in ASVspoof 5, RawBoost is part of the full training setup but its isolated contribution is not quantified (Truong et al., 25 Sep 2025, Ali et al., 28 Aug 2025, Yin et al., 2 Jun 2026).

A common misconception is to conflate RawBoost with similarly named boosting methods from other areas. The paper "Non-Convex Boosting Overcomes Random Label Noise" does not define a method called RawBoost explicitly; the closest related methods there are BrownBoost and RobustBoost, which are non-convex boosting algorithms for label-noise robustness rather than waveform augmentation (Cheamanunkul et al., 2014). Likewise, "Ridge Boosting is Both Robust and Efficient" studies a one-step residual correction with kernel ridge regression in an RKHS, positioned at the intersection of robust boosting, multiaccuracy, and semiparametric efficiency; it is not a raw-audio augmentation method (Bruns-Smith et al., 24 Oct 2025).

Within anti-spoofing and speech deepfake detection, the most defensible general characterization is therefore narrow and technical. RawBoost is a waveform-level augmentation family that algorithmically generates distortions from the source utterance itself, can be composed in multiple ways, and has been shown to improve robustness in logical access and related detection settings. A plausible implication is that its value is highest when the target deployment domain contains meaningful channel or recording mismatch, and when the training procedure is sufficiently optimization-aware to prevent augmented examples from dominating or conflicting with clean examples.