domain-adversarial training

This work addresses the limited generalization of existing voice spoofing detection models in cross-domain scenarios, which often stems from their over-reliance on speaker identity cues at the expense of genuine spoofing artifacts. To mitigate this, the authors propose a speaker-label-free teacher–student framework that leverages a pre-trained speaker recognition model as the teacher. A gradient reversal layer steers the student network to learn speaker-invariant representations, while a variational information bottleneck is introduced to balance the suppression of speaker identity information against the preservation of spoofing-related cues. This approach achieves, for the first time, unsupervised learning of speaker-invariant representations for spoofing detection, effectively disentangling speaker and spoofing characteristics. Experiments across nine datasets demonstrate a relative 25.7% reduction in equal error rate (EER) compared to the MHFA baseline.

To address the poor cross-model transferability of adversarial examples in automatic speech recognition (ASR) systems, this paper proposes an acoustic representation optimization method: for the first time, adversarial perturbations are constrained within a model-agnostic, low-level robust acoustic feature space, thereby unifying perturbation alignment and transferability. The method is plug-and-play, compatible with mainstream audio adversarial frameworks, and requires no modification to target models. Black-box attack experiments across three state-of-the-art ASR models demonstrate an average 32.7% improvement in transfer success rate, while strictly preserving perceptual fidelity of the original speech. Key contributions include: (1) establishing an acoustic-representation-driven paradigm for enhancing adversarial transferability; (2) achieving synergistic optimization of high transferability and high fidelity; and (3) providing a general, lightweight, and model-agnostic adversarial enhancement solution that requires no access to target model internals.

This study addresses the poor generalization of existing voice anti-spoofing models in cross-domain scenarios, which primarily stems from their reliance on linguistic content—referred to as language bias. The work identifies language bias for the first time as a key factor degrading cross-domain performance and proposes a language-invariant detection framework. This framework leverages a pretrained language-aware teacher model to guide a student model, integrating a gradient reversal layer with a variational information bottleneck to suppress language-related cues while preserving discriminative acoustic features. Evaluated on nine DF-Audio datasets, the proposed method significantly outperforms baseline approaches, achieving a relative reduction in equal error rate (EER) of up to 36.2%.

Robust learning under label noise remains challenging due to unreliable supervision signals. Method: This paper proposes a reconstruction loss based on information-divergence-constrained neighborhood relaxation, enabling efficient adversarial training via convex duality. Crucially, it unifies model “forgetting” with distributional robustness—without auxiliary modules—and seamlessly integrates into standard cross-entropy pipelines while preserving strong theoretical interpretability. Contribution/Results: The method defines noisy-sample neighborhoods via information divergence, adaptively down-weighting their gradient contributions; it further grounds forgetting behavior in distributionally robust optimization. Extensive experiments demonstrate consistent superiority over state-of-the-art robust losses across symmetric, asymmetric, synthetic, and real-world noisy benchmarks. Training efficiency approaches that of standard cross-entropy, while generalization performance and training stability are markedly improved.

This work addresses the limitation of existing adversarial attacks, which typically target either automatic speech recognition (ASR) or speaker recognition (SR) in isolation and fail to effectively disrupt the joint decision-making process in real-world voice-controlled systems. To overcome this, the authors propose Dual-Task Universal Adversarial Perturbations (DUAP), a method grounded in gradient analysis demonstrating no inherent conflict between ASR and SR tasks. DUAP employs a target-oriented surrogate loss function and a Dynamic Normalization Ensemble (DNE) strategy to enhance cross-model transferability, while leveraging psychoacoustic masking to ensure perceptual imperceptibility. Experiments across five ASR and six SR models show that DUAP achieves, for the first time, highly effective synchronous attacks on both ASR and SR systems, significantly outperforming single-task baselines in both attack success rate and auditory stealth.

This study addresses the critical tension between privacy preservation and diagnostic utility in voice-based dementia detection, where speaker identity is often inadvertently leaked. To reconcile this trade-off, the authors propose the first multi-level framework that jointly optimizes privacy protection at both signal and feature levels. At the signal level, cumulative signal attack (CSA) precisely perturbs keyword regions; at the feature level, a gradient reversal layer (GRL) combined with mutual information-guided noise injection enables de-identified representation learning. Evaluated on the DementiaBank Pitt Corpus, the method achieves strong privacy guarantees—evidenced by a speaker verification equal error rate (EER) of 0.59 and near-zero speaker identification F1 score—while maintaining high dementia classification performance (F1 = 0.78, AUC = 0.86).

This study systematically evaluates the adversarial robustness of modern speech enhancement systems, revealing a critical security vulnerability: state-of-the-art models are highly susceptible to semantic-level adversarial attacks under psychoacoustic masking constraints. We propose a novel adversarial example generation method that jointly incorporates psychoacoustic modeling and gradient-based optimization, targeting mainstream autoregressive/predictive models (e.g., DCCRN, SEGAN). For comparison, we analyze the intrinsic robustness of diffusion-based models (e.g., DiffWave, VoiceFixer), leveraging their stochastic sampling mechanism. Experiments demonstrate that conventional models suffer severe semantic degradation under attack—despite SNR improvement, ASR error rates increase by 47.3% on average. In contrast, diffusion models exhibit markedly higher resilience (only +6.1% ASR error), attributable to implicit regularization in denoising and multi-step stochastic reconstruction. This work provides the first empirical evidence of diffusion architectures’ inherent security advantage in speech enhancement, establishing a new paradigm for designing robust speech processing systems.

This work addresses the vulnerability of automatic speech recognition (ASR) systems to adversarial perturbations—distortions imperceptible to humans yet capable of inducing transcription errors. The authors propose a neural audio codec based on residual vector quantization (RVQ) that introduces a discrete bottleneck in the signal pathway to suppress adversarial noise while preserving linguistic content. Their analysis reveals a non-monotonic trade-off between quantization depth and robustness, demonstrating that intermediate RVQ depths optimally balance content fidelity and adversarial resilience. Notably, the study establishes, for the first time, a strong correlation between discrete codebook alterations and transcription errors. Experimental results show that the proposed method significantly reduces word error rates across multiple attack types, outperforming conventional compression-based defenses and maintaining robustness even under adaptive attacks.

This work addresses the performance degradation in multi-corpus joint training for anti-spoofing tasks, which often arises from dataset-specific biases leading to negative transfer. To mitigate this issue, the study introduces domain-invariant learning into self-supervised speech anti-spoofing models for the first time, proposing an Invariant Domain Feature Extraction (IDFE) framework. By integrating multi-task learning with gradient reversal layers, IDFE effectively disentangles corpus-specific information and enhances cross-dataset generalization. Experimental results across four mainstream anti-spoofing datasets demonstrate that the proposed method achieves a 20% relative reduction in average equal error rate compared to baseline models, substantially alleviating the instability commonly observed in multi-corpus training scenarios.

This study addresses the unclear impact of speaker identity on embedding representations in existing voice anti-spoofing systems. To this end, it presents the first systematic evaluation and effective disentanglement of speaker-related factors from anti-spoofing performance. The work proposes two contrasting speaker-invariant modeling strategies: a joint multi-task learning approach and an explicit removal of speaker information via a gradient reversal layer. Evaluated across four benchmark datasets, the proposed methods demonstrate substantial improvements, reducing the average equal error rate by 17% and achieving up to a 48% reduction for the most challenging attack types (e.g., A11). These results significantly enhance the model’s generalization capability and robustness against diverse spoofing attacks.