SA-SV: Spoofing-Aware Speaker Verification

• SA-SV is a framework that verifies speaker identity while simultaneously detecting and rejecting spoofed utterances using integrated or ensemble architectures.
• Multi-stage fusion and end-to-end models have achieved notable performance gains, reducing SASV-EER by up to 24–25% through innovative score integration.
• Advanced loss functions and adversarial training, combined with cross-corpus evaluations, enhance robustness against spoofing attacks like voice conversion, TTS, and replay.

SA-SV

Spoofing-Aware Speaker Verification (SA-SV or SASV) refers to a class of methods, tasks, and challenge protocols that aim to verify speaker identity in the presence of both zero-effort (non-target) impostors and sophisticated spoofing attacks, such as voice conversion (VC), text-to-speech (TTS), and replay. Unlike classical automatic speaker verification (ASV), which is only required to distinguish target from non-target speakers, SA-SV broadens the scope to reject highly realistic but fake input utterances generated by adversarial methods. This dual challenge has motivated integrated architectures, multi-objective optimization, and new evaluation protocols in speech security research.

1. Formal Definition and Task Objective

SA-SV systems are evaluated on their ability to solve two simultaneous problems: (1) verifying if a test utterance comes from the claimed enrolled speaker (ASV), and (2) detecting and rejecting spoofed or manipulated utterances (countermeasure, CM). The evaluation framework, as defined in the SASV 2022 Challenge (Jung et al., 2022), stratifies test trials into three categories:

• Target: utterance is bona-fide and from the claimed speaker.
• Non-target: bona-fide, but not spoken by the claimed speaker.
• Spoof: synthesized, converted, or replayed speech targeting the claimed speaker.

For each trial, the system outputs a single score $s(x)$. Performance is primarily measured via three Equal Error Rates (EERs):

• SV-EER: Equates miss rate on targets to false-acceptance rate on non-targets.
• SPF-EER: Compares targets versus spoof attacks.
• SASV-EER: Equates miss rate on targets with the combined false-acceptance rate on both non-targets and spoofs.

The most discriminative system is the one yielding the lowest SASV-EER, demonstrating robustness to both traditional impostor access and technical spoofing attacks.

2. System Architectures and Fusion Paradigms

SA-SV systems can be categorized into ensemble and integrated approaches.

Ensemble (Score/Embedding Fusion):

• Baseline approaches combine a standalone ASV subsystem (e.g., ECAPA-TDNN [Desplanques et al. 2020]) with a standalone CM subsystem (e.g., AASIST, RawGAT), either through simple sum/averaging of output scores (score-level fusion) or via a stacking back-end (e.g., MLP, SVM, logistic regression) (Jung et al., 2022, Kurnaz et al., 16 Sep 2025).
• Multi-stage fusion refines this by introducing sequential classifiers: the first fusing ASV and CM scores, the second further calibrating with meta-features such as the output of stage one, and an optional third stage integrating auxiliary CM scores (Kurnaz et al., 16 Sep 2025). Empirically, multi-stage fusion reduces SASV-EER, e.g., from 1.71% to 1.30%, a relative improvement of 24% on the SASV2022 evaluation set.

Integrated Architectures:

• End-to-end models (e.g., SA-SASV (Teng et al., 2022)) employ a shared deep encoder, performing joint ASV and CM learning with multi-task heads and adversarial objectives. The Spoof-Aggregated-SASV system utilizes an ECAPA-TDNN backbone for ASV, concatenates feature streams from raw waveform and FBank encoders, and applies multi-head classification and adversarial training to enforce spoof cluster decorrelation.
• Matrix fusion methods leverage the inherent correlation between ASV and CM tasks by propagating embeddings through shared trainable layers, as in the Total–Divide–Total (TDT) model (Zhang et al., 2022); integrated scoring modules use matrix operations to combine speaker and spoofing cues, achieving further EER gains.

Modular Optimization: More recent work proposes optimization schemes explicitly balancing detection cost (a-DCF) under challenge-specific operating points, while modeling ASV–CM embedding interactions at both embedding and score levels with non-linear fusion calibrated during training (Kurnaz et al., 2 Feb 2026).

3. Algorithms, Loss Functions, and Training

State-of-the-art SA-SV systems typically consider the following loss designs:

• Binary Cross-Entropy (BCE) for CM (spoof/bonafide detection).
• Additive Angular Margin (AAM)-Softmax or similar for ASV speaker discrimination over bona fide data.
• Adversarial Losses: Gradient-reversal branches that oppose intra-group clustering for specific spoof types, to force hard-to-spoof features (Teng et al., 2022).
• Triplet or Center Loss: For aligning bona fide and spoofed embeddings in a way that enforces speaker-separability and spoof separation.
• Calibration Losses: Logistic regression with L2 regularization or SVM hinge loss to produce well-calibrated output scores for thresholding (Kurnaz et al., 16 Sep 2025).
• Operating-Condition-Dependent Loss: a-DCF, a weighted sum of cross-entropy and detection-cost, for explicit optimization toward challenge rankings (Kurnaz et al., 2 Feb 2026).

Systems often employ a multi-phase training strategy: unsupervised or semi-supervised pre-training of a speaker encoder (typically on large corpora such as VoxCeleb2), followed by supervised fine-tuning on joint ASVspoof development datasets, with careful cross-validation to prevent overfitting given the limited number of speakers and spoof types in some benchmarks.

4. Performance Benchmarks and Findings

Empirical results from multiple SASV challenge benchmarks attest to rapid progress in the field:

System	SASV-EER (%)	SV-EER (%)	SPF-EER (%)	a-DCF
Baseline1 (sum)	19.31	35.32	0.67	—
Baseline2 (MLP)	6.37	11.48	0.78	—
TDT (single)	4.78	—	—	—
Multi-stage	1.30	—	—	0.028
SA-SASV (E2E)	4.86	8.06	0.50	—
Modular (ReDim)	—	—	—	0.0515

Relative improvements are substantial: the transition from score-sum fusion to stacking and then to multi-stage or integrated end-to-end systems yields up to 24–25% reduction in SASV-EER (Kurnaz et al., 16 Sep 2025, Zhang et al., 2022). Adversarial training (gradient reversal, triplet loss) further reduces SPF-EER and SASV-EER compared to naïve multi-task or ensemble-only systems (Teng et al., 2022).

5. Challenges, Limitations, and Research Directions

Several open topics continue to stimulate research in SA-SV:

• Data limitations: Fine-tuning on relatively small spoof corpora (e.g., ASVspoof, WildSpoof) can result in overfitting, especially for speaker generalization. Pre-training on large-scale speaker data helps but does not fully address cross-corpus robustness (Teng et al., 2022, Kurnaz et al., 2 Feb 2026).
• Fusion complexity vs. interpretability: While multi-stage and non-linear score fusion architectures improve accuracy, they require careful hyperparameter selection and risk overfitting without sufficient development data (Kurnaz et al., 16 Sep 2025).
• Domain adaptation and uncertainty: Evaluations on unseen spoof algorithms or recording conditions reveal weak points in learned detectors, indicating a need for Bayesian or more robust calibration layers (Kurnaz et al., 16 Sep 2025, Kurnaz et al., 2 Feb 2026).
• Extension to Other Modalities: Though not the mainstream interpretation, "SA-SV" has also occurred as a typo or shorthand for tasks such as Segment Audio-Visual Segmentation, typically written as "SAVE" or "AVS", but sometimes as "SA-SV" (e.g., (Nguyen et al., 2024))—this nomenclature is not widely adopted in speaker verification contexts.

6. Historical and Community Context

SA-SV emerged as a formal research area through the SASV 2022 Challenge (Jung et al., 2022), which provided unified protocols, baseline code, and community benchmarks. The challenge structure promoted the convergence of the ASV and anti-spoofing research communities and fostered sharing of standardized resources such as ASVspoof2019 LA and VoxCeleb2. Recent work has focused on exploring:

• Modular reuse of off-the-shelf ASV and CM systems with minimal joint fine-tuning (Kurnaz et al., 2 Feb 2026).
• Embedding-level fusion and integrated trainable scoring back-ends (Zhang et al., 2022).
• Score-level stacking and multi-stage meta-classification (Kurnaz et al., 16 Sep 2025).
• Fully end-to-end pipelines with architectural ensembling and adversarial objectives (Teng et al., 2022).

The field continues to prioritize evaluation strategies that properly reflect both impostor and spoof rejection.

7. Summary and Perspectives

SA-SV research has established a landscape where addressing both classical ASV errors and state-of-the-art spoofing attacks is critical to secure deployment. The best systems increasingly combine strong single-task ASV and CM backbones with sophisticated, often multi-level, fusion strategies and explicit loss calibrations tailored to operational constraints. Advances in adversarial and uncertainty-aware training, comprehensive multi-corpus evaluation, and plug-and-play modularity are expected to further advance both accuracy and robustness of spoofing-aware speaker verification in the coming years (Jung et al., 2022, Kurnaz et al., 16 Sep 2025, Kurnaz et al., 2 Feb 2026, Teng et al., 2022, Zhang et al., 2022).