# Defense against adversarial attacks on spoofing countermeasures of ASV

arXiv: https://arxiv.org/abs/2003.03065 · HTML: https://mlsanity.com/paper/2003.03065/

## Key facts

- Cited by 20 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 Mar 2020.

## Built on by (most cited first, 20 of 20)

- [Channel-wise Gated Res2Net: Towards Robust Detection of Synthetic Speech Attacks](https://mlsanity.com/paper/2107.08803/) (2021)
- [Adversarial defense for automatic speaker verification by cascaded self-supervised learning models](https://mlsanity.com/paper/2102.07047/) (2021)
- [Improving the Adversarial Robustness for Speaker Verification by Self-Supervised Learning](https://mlsanity.com/paper/2106.00273/) (2021)
- [Partially Fake Audio Detection by Self-attention-based Fake Span Discovery](https://mlsanity.com/paper/2202.06684/) (2022)
- [Voting for the right answer: Adversarial defense for speaker verification](https://mlsanity.com/paper/2106.07868/) (2021)
- [Defense Against Adversarial Attacks on Audio DeepFake Detection](https://mlsanity.com/paper/2212.14597/) (2022)
- [Malafide: a novel adversarial convolutive noise attack against deepfake and spoofing detection systems](https://mlsanity.com/paper/2306.07655/) (2023)
- [The defender's perspective on automatic speaker verification: An overview](https://mlsanity.com/paper/2305.12804/) (2023)
- [Adversarial Sample Detection for Speaker Verification by Neural Vocoders](https://mlsanity.com/paper/2107.00309/) (2021)
- [Practical Attacks on Voice Spoofing Countermeasures](https://mlsanity.com/paper/2107.14642/) (2021)
- [Adversarial Attacks on Audio Deepfake Detection: A Benchmark and Comparative Study](https://mlsanity.com/paper/2509.07132/) (2025)
- [Characterizing the adversarial vulnerability of speech self-supervised learning](https://mlsanity.com/paper/2111.04330/) (2021)
- [Push-Pull: Characterizing the Adversarial Robustness for Audio-Visual Active Speaker Detection](https://mlsanity.com/paper/2210.00753/) (2022)
- [SHIELD: A Secure and Highly Enhanced Integrated Learning for Robust Deepfake Detection against Adversarial Attacks](https://mlsanity.com/paper/2507.13170/) (2025)
- [Adversarial Speaker Distillation for Countermeasure Model on Automatic Speaker Verification](https://mlsanity.com/paper/2203.17031/) (2022)
- [LMD: A Learnable Mask Network to Detect Adversarial Examples for Speaker Verification](https://mlsanity.com/paper/2211.00825/) (2022)
- [Tackling Spoofing-Aware Speaker Verification with Multi-Model Fusion](https://mlsanity.com/paper/2206.09131/) (2022)
- [What You Read Isn't What You Hear: Linguistic Sensitivity in Deepfake Speech Detection](https://mlsanity.com/paper/2505.17513/) (2025)
- [Off-The-Shelf Image-to-Image Models Are All You Need To Defeat Image Protection Schemes](https://mlsanity.com/paper/2602.22197/) (2026)
- [Scalable Ensemble-based Detection Method against Adversarial Attacks for speaker verification](https://mlsanity.com/paper/2312.08622/) (2023)

## Abstract (arXiv)

Various forefront countermeasure methods for automatic speaker verification (ASV) with considerable performance in anti-spoofing are proposed in the ASVspoof 2019 challenge. However, previous work has shown that countermeasure models are vulnerable to adversarial examples indistinguishable from natural data. A good countermeasure model should not only be robust against spoofing audio, including synthetic, converted, and replayed audios; but counteract deliberately generated examples by malicious adversaries. In this work, we introduce a passive defense method, spatial smoothing, and a proactive defense method, adversarial training, to mitigate the vulnerability of ASV spoofing countermeasure models against adversarial examples. This paper is among the first to use defense methods to improve the robustness of ASV spoofing countermeasure models under adversarial attacks. The experimental results show that these two defense methods positively help spoofing countermeasure models counter adversarial examples.