# Malafide: a novel adversarial convolutive noise attack against deepfake and spoofing detection systems

arXiv: https://arxiv.org/abs/2306.07655 · HTML: https://mlsanity.com/paper/2306.07655/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- Builds on 27 of its 30 references that are in the map.
- First posted on arXiv 13 Jun 2023.

## Builds on (most cited first, 27 of 27)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classification](https://mlsanity.com/paper/1502.01852/) (2015)
- [Universal adversarial perturbations](https://mlsanity.com/paper/1610.08401/) (2016)
- [XLS-R: Self-supervised Cross-lingual Speech Representation Learning at Scale](https://mlsanity.com/paper/2111.09296/) (2021)
- [Audio Adversarial Examples: Targeted Attacks on Speech-to-Text](https://mlsanity.com/paper/1801.01944/) (2018)
- [AASIST: Audio Anti-Spoofing using Integrated Spectro-Temporal Graph Attention Networks](https://mlsanity.com/paper/2110.01200/) (2021)
- [End-to-end anti-spoofing with RawNet2](https://mlsanity.com/paper/2011.01108/) (2020)
- [ASVspoof 2021: accelerating progress in spoofed and deepfake speech detection](https://mlsanity.com/paper/2109.00537/) (2021)
- [Automatic speaker verification spoofing and deepfake detection using wav2vec 2.0 and data augmentation](https://mlsanity.com/paper/2202.12233/) (2022)
- [Biometric Face Presentation Attack Detection with Multi-Channel Convolutional Neural Network](https://mlsanity.com/paper/1909.08848/) (2019)
- [End-to-End Spectro-Temporal Graph Attention Networks for Speaker Verification Anti-Spoofing and Speech Deepfake Detection](https://mlsanity.com/paper/2107.12710/) (2021)
- [Investigating self-supervised front ends for speech spoofing countermeasures](https://mlsanity.com/paper/2111.07725/) (2021)
- [Universal Adversarial Perturbations for Speech Recognition Systems](https://mlsanity.com/paper/1905.03828/) (2019)
- [The Vicomtech Audio Deepfake Detection System based on Wav2Vec2 for the 2022 ADD Challenge](https://mlsanity.com/paper/2203.01573/) (2022)
- [Real-time, Universal, and Robust Adversarial Attacks Against Speaker Recognition Systems](https://mlsanity.com/paper/2003.02301/) (2020)
- [Adversarial Attacks on Spoofing Countermeasures of automatic speaker verification](https://mlsanity.com/paper/1910.08716/) (2019)
- [Defense against adversarial attacks on spoofing countermeasures of ASV](https://mlsanity.com/paper/2003.03065/) (2020)
- [SASV 2022: The First Spoofing-Aware Speaker Verification Challenge](https://mlsanity.com/paper/2203.14732/) (2022)
- [Attack on practical speaker verification system using universal adversarial perturbations](https://mlsanity.com/paper/2105.09022/) (2021)
- [Biometric Presentation Attack Detection: Beyond the Visible Spectrum](https://mlsanity.com/paper/1902.11065/) (2019)
- [Improved RawNet with Feature Map Scaling for Text-independent Speaker Verification using Raw Waveforms](https://mlsanity.com/paper/2004.00526/) (2020)
- [Universal Adversarial Audio Perturbations](https://mlsanity.com/paper/1908.03173/) (2019)
- [Anti-Spoofing Using Transfer Learning with Variational Information Bottleneck](https://mlsanity.com/paper/2204.01387/) (2022)
- [Practical Attacks on Voice Spoofing Countermeasures](https://mlsanity.com/paper/2107.14642/) (2021)
- [Investigating Active-learning-based Training Data Selection for Speech Spoofing Countermeasure](https://mlsanity.com/paper/2203.14553/) (2022)
- [Adversarial Transformation of Spoofing Attacks for Voice Biometrics](https://mlsanity.com/paper/2201.01226/) (2022)

## Built on by (most cited first, 10 of 10)

- [ASVspoof 5: Crowdsourced Speech Data, Deepfakes, and Adversarial Attacks at Scale](https://mlsanity.com/paper/2408.08739/) (2024)
- [CLAD: Robust Audio Deepfake Detection Against Manipulation Attacks with Contrastive Learning](https://mlsanity.com/paper/2404.15854/) (2024)
- [Malacopula: adversarial automatic speaker verification attacks using a neural-based generalised Hammerstein model](https://mlsanity.com/paper/2408.09300/) (2024)
- [2D-Malafide: Adversarial Attacks Against Face Deepfake Detection Systems](https://mlsanity.com/paper/2408.14143/) (2024)
- [A Survey of Threats Against Voice Authentication and Anti-Spoofing Systems](https://mlsanity.com/paper/2508.16843/) (2025)
- [DeePen: Penetration Testing for Audio Deepfake Detection](https://mlsanity.com/paper/2502.20427/) (2025)
- [Augmentation through Laundering Attacks for Audio Spoof Detection](https://mlsanity.com/paper/2410.01108/) (2024)
- [Discrete optimal transport is a strong audio adversarial attack](https://mlsanity.com/paper/2509.14959/) (2025)
- [Sparse deepfake detection promotes better disentanglement](https://mlsanity.com/paper/2510.05696/) (2025)
- [RAT: Reference-Augmented Training for ASV Anti-Spoofing](https://mlsanity.com/paper/2606.10908/) (2026)

## Abstract (arXiv)

We present Malafide, a universal adversarial attack against automatic speaker verification (ASV) spoofing countermeasures (CMs). By introducing convolutional noise using an optimised linear time-invariant filter, Malafide attacks can be used to compromise CM reliability while preserving other speech attributes such as quality and the speaker's voice. In contrast to other adversarial attacks proposed recently, Malafide filters are optimised independently of the input utterance and duration, are tuned instead to the underlying spoofing attack, and require the optimisation of only a small number of filter coefficients. Even so, they degrade CM performance estimates by an order of magnitude, even in black-box settings, and can also be configured to overcome integrated CM and ASV subsystems. Integrated solutions that use self-supervised learning CMs, however, are more robust, under both black-box and white-box settings.