Scores Know Bobs Voice: Speaker Impersonation Attack

Chanwoo Hwang; Sunpill Kim; Yong Kiam Tan; Tianchi Liu; Seunghun Paik; Dongsoo Kim; Mondal Soumik; Khin Mi Mi Aung

cs.CRMar 3, 2026

Scores Know Bobs Voice: Speaker Impersonation Attack

Authors: Chanwoo Hwang, Sunpill Kim, Yong Kiam Tan, Tianchi Liu, Seunghun Paik, Dongsoo Kim, Mondal Soumik, Khin Mi Mi Aung,

Organizations: Hanyang University Seoul, Republic of Korea · I2R, A*STAR & NTU Singapore · National University of Singapore Singapore · I2R, A*STAR Singapore

Abstract

Advances in deep learning have enabled the widespread deployment of speaker recognition systems (SRSs), yet they remain vulnerable to score-based impersonation attacks. Existing attacks that operate directly on raw waveforms require a large number of queries due to the difficulty of optimizing in high-dimensional audio spaces. Latent-space optimization within generative models offers improved efficiency, but these latent spaces are shaped by data distribution matching and do not inherently capture speaker-discriminative geometry. As a result, optimization trajectories often fail to align with the adversarial direction needed to maximize victim scores. To address this limitation, we propose an inversion-based generative attack framework that explicitly aligns the latent space of the synthesis model with the discriminative feature space of SRSs. We first analyze the requirements of an inverse model for score-based attacks and introduce a feature-aligned inversion strategy that geometrically synchronizes latent representations with speaker embeddings. This alignment ensures that latent updates directly translate into score improvements. Moreover, it enables new attack paradigms, including subspace-projection-based attacks, which were previously infeasible due to the absence of a faithful feature-to-audio mapping. Experiments show that our method significantly improves query efficiency, achieving competitive attack success rates with on average 10x fewer queries than prior approaches. In particular, the enabled subspace-projection-based attack attains up to 91.65% success using only 50 queries. These findings establish feature-aligned inversion as a key tool for evaluating the robustness of modern SRSs against score-based impersonation threats.

Figures & tables

Method	Victim Voice Required	Query Output	#Queries
( Kinnunen et al., 2019 )	Yes	–	0
( Yoon et al., 2020 )		–	0
( Pani et al., 2023 )		–	0
SV2TTS ( Jia et al., 2018 )		–	0
Voxstructor ( Lu et al., 2021 )		Feature vector	$\geq 100\mathrm{K}$
AdvTTS ( Zuo et al., 2024 )		–	0

Table 1. Comparison of speaker impersonation attacks against SRSs. The reported number of queries corresponds to the cost of performing the attack task as defined in each original work. Ours-NES and Ours-SP denote two optimization strategies used in our attack: Natural Evolution Strategies (NES) and Subspace Projection (SP), respectively. Details of these optimization methods are described in Section 6.1 .

\dagger:

We consider FakeBob applied to speaker verification here.

Figure 1. Distributions of round-trip similarity scores $s_{L}(\mathfrak{v})$ (red) evaluated on the local speaker recognition model $F_{L}$ . Positive (blue) and negative (orange) reference distributions are shown for comparison. Best viewed in color.

Figure 2. Distributions of round-trip similarity scores $s_{T}(\mathfrak{v})$ (red) evaluated on the $F_{T}=T_{1}$ . Positive (blue) and negative (orange) reference distributions are shown for comparison. Best viewed in color.

Figure 3. Optimization trajectories of score-based impersonation attacks on various search spaces. Curves show the mean of the best cosine distance with 95% CI. Best viewed in color.

Figure 4. Fixed-text Strategy for Fine Tuning Inverse Model.

Figure 5. ID-Constraints Loss $L_{\mathsf{IC}}$ . Given an audio batch $\mathsf{A}_{\mathsf{batch}}$ , the cosine similarities for each sample pair are computed using the set of synthesized samples $\widetilde{\mathsf{A}}_{\mathsf{batch}}$ generated through the process illustrated in Figure 4 .

Figure 6. ID-Constraints Loss $L_{\mathsf{IC}}$ . Given an audio batch $\mathsf{A}_{\mathsf{batch}}$ , the cosine similarities for each sample pair are computed using the set of synthesized samples $\widetilde{\mathsf{A}}_{\mathsf{batch}}$ generated through the process illustrated in Figure 4 .

Model	Architecture	Trainset	$\tau_{\mathsf{E}}$	$\tau_{\mathsf{M}}$
$T_{1}$	Redim-S ( Yakovlev et al., 2024 )	VoxBlink2	0.6605	0.5518
$T_{2}$	Redim-M ( Yakovlev et al., 2024 )	VoxBlink2	0.6624	0.5437
$T_{3}$	SimAMResNet34 ( Qin et al., 2022 )	VoxBlink2	0.6256	0.5060
$T_{4}$	SimAMResNet100 ( Qin et al., 2022 )	VoxBlink2	0.6135	0.4932
$T_{5}$	Titanet-L ( Koluguri et al., 2022 )	VoxCeleb1,2+ $\alpha$	0.6654	0.5215
$L$	H/ASP ( Heo et al., 2020 )	VoxCeleb1,2	0.5778	0.4667

Table 2. Specifications of target SR models (

T_{1}

–

T_{5}

) and local model (

L

), including architectures, trainsets, and thresholds defined on EER, minDCF (resp.

\tau_{\mathsf{E}}

\tau_{\mathsf{M}}

). Detailed EER and minDCF performance metrics are in Table 13 .

Figure 7. Attack success rate as a function of the number of score queries for NES-based impersonation attacks. Results are shown for two decision thresholds, $\tau_{E}$ (left) and $\tau_{M}$ (right), across five target speaker recognition models ( $T_{1}$ – $T_{5}$ ).

Method	$T_{1}$	$T_{2}$	$T_{3}$	$T_{4}$	$T_{5}$	Avg.
$\tau_{\text{target}}=\tau_{\mathsf{E}}$
Audio-NES	100.0 % (5.2k)	100.0 % (4.3k)	100.0 % (8.7k)	100.0 % (9.5k)	100.0 % (3.8k)	100.0 % (6.3k)
YourTTS-NES	100.0 % (2.5k)	100.0 % (3.4k)	96.0% (4.1k)	93.0% (4.2k)	96.0% (7.9k)	97.0% (4.4k)
Ours-NES	100.0 % (0.2k)	100.0 % (0.3k)	100.0 % (0.4k)	100.0 % (0.5k)	100.0 % (0.3k)	100.0 % (0.3k)
$\tau_{\text{target}}=\tau_{\mathsf{M}}$
Audio-NES	100.0 % (8.5k)	100.0 % (7.6k)	100.0 % (16.3k)	100.0 % (16.1k)	100.0 % (19.3k)	100.0 % (13.6k)

Table 3. Comparison of ASR and query efficiency under

\tau_{\text{target}}=\tau_{\mathsf{E}}

and

\tau_{\mathsf{M}}

. The query budget is 50k. Each cell reports the ASR (top) and the average number of queries calculated over successful attacks (bottom).

Method	$T_{1}$		$T_{2}$		$T_{3}$		$T_{4}$		$T_{5}$
Method	$\tau_{\mathsf{E}}$	$\tau_{\mathsf{M}}$	$\tau_{\mathsf{E}}$	$\tau_{\mathsf{M}}$	$\tau_{\mathsf{E}}$	$\tau_{\mathsf{M}}$	$\tau_{\mathsf{E}}$	$\tau_{\mathsf{M}}$	$\tau_{\mathsf{E}}$	$\tau_{\mathsf{M}}$
SV2TTS	1.57%	0.04%	0.87%	0.02%	0.59%	0.00%	0.42%	0.00%	0.02%	0.00%
Voxstructor	0.11%	0.00%	0.02%	0.00%	0.02%	0.00%	0.01%	0.00%	0.00%	0.00%
Audio-GD	4.65%	0.15%	6.37%	0.19%	1.38%	0.02%	0.30%	0.00%	34.36%	4.89%
YourTTS	15.99%	2.70%	11.62%	1.57%	10.58%	1.72%	7.99%	1.57%	0.28%	0.00%
Ours-SP	91.65%	59.83%	85.47%	44.33%	76.23%	34.54%	62.23%	19.86%	68.46%	17.03%

Table 4. ASRs comparing the proposed method against alternative baseline approaches attacking

T_{1}

–

T_{5}

. Target thresholds (

\tau_{\text{target}}

) are derived from EER (

\tau_{\mathsf{E}}

) and minDCF (

\tau_{\mathsf{M}}

) for each target model.

Attack Method	$\boldsymbol{F^{-1}}$	Target SR models
Attack Method	$\boldsymbol{F^{-1}}$	$T_{1}$	$T_{2}$	$T_{3}$	$T_{4}$	$T_{5}$
NES	YourTTS	93.0% (8.9k)	82.0% (11.5k)	72.0% (8.9k)	79.0% (11.3k)	37.0% (18.8k)
	$+L_{\mathsf{IC}}$	100% (1.7k)	100% (1.9k)	100% (2.5k)	99.0% (2.8k)	6.0% (1.3k)
	$+L_{\mathsf{IC}}+L_{\mathsf{SC}}$	100% (0.5k)	100% (0.6k)	100% (0.9k)	100% (1.0k)	100% (0.8k)
SP	YourTTS	15.99%	11.62%	10.58%	7.99%	0.34%
	$+L_{\mathsf{IC}}$	71.37%	56.29%	45.58%	29.21%	64.80%

Table 5. Ablation study on inverse-model training objectives. For NES-based, we report ASR (%) at

\tau_{\mathsf{M}}

together with the average number of score queries over successful attacks (in parentheses). For SP-based, we report ASR (%) at

\tau_{\mathsf{E}}

L_{\mathsf{IC}}

: Identity-Constraint loss,

L_{\mathsf{SC}}

: Structure-Constraint loss.

Model	Architecture	Trainset	$\tau_{\mathsf{E}}$	$\tau_{\mathsf{M}}$
$C_{1}$	CAM++ ( Wang et al., 2023b )	N/A	0.7064	0.4817
$C_{2}$	ERes2Net ( Chen et al., 2023b )	N/A	0.6350	0.4617
$L_{\mathsf{CN}}$	ResNet34 ( Chung et al., 2020 )	CN-Celeb 1,2	0.7349	0.5043

Table 6. Specifications of CN target SR models (

C_{1}

C_{2}

) and local model (

L_{\mathsf{CN}}

), including architectures, trainsets, and thresholds defined on EER, minDCF (resp.

\tau_{\mathsf{E}}

\tau_{\mathsf{M}}

Method	$C_{1}$		$C_{2}$
Method	$\tau_{\mathsf{E}}$	$\tau_{\mathsf{M}}$	$\tau_{\mathsf{E}}$	$\tau_{\mathsf{M}}$
Ours-NES	100% (0.2k)	100% (1.4k)	100% (0.2k)	100% (0.6k)
Ours-SP	71.43%	4.08%	87.76%	16.84%

Table 7. Attack success rates (ASR, %) on Chinese speaker recognition systems. For Ours-NES, the average number of score queries computed over successful attacks is reported in parentheses. Target thresholds are derived from EER (

\tau_{\mathsf{E}}

) and minDCF (

\tau_{\mathsf{M}}

Appendix figures & tables15 assets

Supplementary material from the paper’s appendix.

Appendix

Method	Impersonation Type	Target Model	Victim’s Voice Requirement	Strategy	Query to Target Model
Method	Impersonation Type	Target Model	Victim’s Voice Requirement	Strategy	Output Format	Number
( Kinnunen et al., 2019 )	Voice Mimicry	Black-box	$\bigcirc$	Human Mimicry	-	0
( Yoon et al., 2020 )	Replay Attack	Black-box	$\bigcirc$	Playback	-	0
( Pani et al., 2023 )	Voice Morphing	Black-box	$\bigcirc$	Identity Morphing	-	0
SV2TTS ( Jia et al., 2018 )	Speech Synthesis	White-box	$\bigcirc$	Training-based	-	0
Voxstructor ( Lu et al., 2021 )	Speech Synthesis	Black-box	$\bigcirc$	Training-based	Feature vector	$\geq 100K$

Appendix

Table 8. Comparison of prior attack methods enabling speaker impersonation against SRSs, summarizing their methodologies, requirements (victim voice, target model access), and query strategies. The details of FakeBob are given for its speaker verification setting, which we denote as FakeBob † in this table.

TTS	Input	(Speaker) Encoder	Auxiliary Input	Output
Tacotron2 ( Shen et al., 2018 )	Text	None	None	Mel-spectrogram Waveform
FastSpeech2 ( Ren et al., 2020 )	Text	None	None	Mel-spectrogram Waveform
XTTS ( Casanova et al., 2024 )	Text, Voice Sample	H/ASP ( Heo et al., 2020 ) , Perceiver Conditioner	Speaker Feature Vector Identity, Style, Prosody, etc.	Waveform
EmoTTS ( Osman, 2022 )	Text, Voice Sample	SER model (based on Deep Voice3 ( Ping et al., 2017 ) )	Emotion, Speaker Embedding	Mel-spectrogram
NaturalSpeech3 ( Ju et al., 2024 )	Text, Voice Sample	Convolutional Blocks	Content, Prosody, Timbre, Acoustic Details	Waveform
StyleTTS2 ( Li et al., 2023 )	Text, Voice Sample	Acoustic and Prosodic, Style Encoders	Style Embedding	Waveform

Appendix

Table 9. Other considered TTS models for Inverse Model Candidates.

Scores	SV2TTS	Voxstructor	YourTTS
Pos.	$0.7795\pm 0.0771$	$0.6470\pm 0.1212$	$0.6549\pm 0.1007$
Neg.	$0.5766\pm 0.0707$	$0.0267\pm 0.1119$	$0.1383\pm 0.1095$
ID-const.	$0.6944\pm 0.0761$	$0.0472\pm 0.0879$	$0.4015\pm 0.0923$

Appendix

Table 10. ID-constraint test statistics for selected ZS-TTS on VoxCeleb1 test dataset.

Panel of Figure 8 — Figure 8. Distributions of round-trip similarity scores $s_{T}(\mathfrak{v})$ (red) evaluated on the each $F_{T}$ . Positive (blue) and negative (orange) reference distributions are shown for comparison.

Hyperparameter	Value
Search variable	waveform $\mathsf{aud}\in\mathbb{R}^{48000}$
Initialization	$\mathcal{N}(0,I_{48000})$
Candidate pool size $C$	100
Selected candidates $S$	1
Maximum iterations	1000
Samples per draw $B$	10, 50

Appendix

Table 11. Hyperparameters for Audio-NES

Hyperparameter	Value
Search variable	latent vector $z\in\mathbb{S}^{D}$
Initialization	$\mathcal{N}(0,I_{D})$ + $\ell_{2}$ normalization
Candidate pool size $C$	100
Selected candidates $S$	1
Maximum iterations	1000
Samples per draw $B$	10, 50

Appendix

Table 12. Hyperparameters for latent(spherical) NES. (for Ours-NES, YourTTS-NES)

Index	Architecture	Trainset	EER(%)	minDCF	$\tau_{\mathsf{E}}$	$\tau_{\mathsf{M}}$
$T_{1}$	Redim-S	VoxBlink2	1.54	0.1415	0.6605	0.5518
$T_{2}$	Redim-M	VoxBlink2	1.31	0.1003	0.6624	0.5437
$T_{3}$	SimAMResNet34	VoxBlink2	1.16	0.1039	0.6258	0.5060
$T_{4}$	SimAMResNet100	VoxBlink2	0.76	0.0767	0.6137	0.4932
$T_{5}$	Titanet-L	VoxCeleb1,2, Fisher, Switchboard, LibriSpeech	0.82	0.1353	0.6654	0.5215
$C_{1}$	CAM++	N/A	4.70	0.3120	0.7064	0.4817

Appendix

Table 13. Specifications and performance of the speaker recognition models used in this paper, including the target models (

T_{1}

–

T_{5}

) and the attacker’s local models (

L_{\mathsf{SV2TTS}}

L_{\mathsf{Vox}}

, and

L_{\mathsf{Ours}}

). Note that ‘

L_{\mathsf{Ours}}

’ is referred to as ‘

L

’ in the main paper. Performance is evaluated using EER, minDCF, and the corresponding thresholds

\tau_{\mathsf{E}}

and

\tau_{\mathsf{M}}

on the VoxCeleb1 test set. For the Chinese speaker recognition models (

C_{1}

C_{2}

) and the local model (

L_{\mathsf{CN}}

), performance is evaluated on the CN-Celeb test set.

Methods	$T_{1}$	$T_{2}$	$T_{3}$	$T_{4}$	$T_{5}$
Ours	46/50	44/50	37/50	36/50	36/50
FakeBob	43/50	43/50	32/50	29/50	34/50
# of Queries	$\approx 14233$	$\approx 14067$	$\approx 14073$	$\approx 13181$	$\approx 11552$

Appendix

Table 14. FakeBob attack performance against target models

T_{1}

–

T_{5}

, showing attack successes (out of 50 trials) and the number of queries required solely for the attack generation phase (excluding threshold estimation).

Figure 10. Flow diagram of the proposed Non-Adaptive Speaker Impersonation Attack applied to SRSs (Ours-SP). Key stages include pre-processing for $\delta$ -OVS generation, querying the target SRS, and synthesizing the impersonation audio. Note that the attacker cannot directly access the black-box target $T$ (and $F_{T}$ ). The local models ( $F_{L}$ and $F_{L}^{-1}$ ) are used as surrogate for the attack.

$T$	$L_{\mathsf{SV2TTS}}$	$L_{\mathsf{Vox}}$	$L_{\mathsf{Ours}}$
$T_{1}$	$0.3304\pm 0.2017$	$0.0617\pm 0.0479$	$0.0741\pm 0.0582$
$T_{2}$	$0.3305\pm 0.2076$	$0.0588\pm 0.0461$	$0.0757\pm 0.0594$
$T_{3}$	$0.2999\pm 0.2143$	$0.0675\pm 0.0517$	$0.0691\pm 0.0523$
$T_{4}$	$0.2935\pm 0.2248$	$0.0722\pm 0.0528$	$0.0760\pm 0.0548$
$T_{5}$	$0.3461\pm 0.2191$	$0.0484\pm 0.0387$	$0.0804\pm 0.0664$

Appendix

Table 15. Statistical summary of score discrepancies between local and target models (

T_{1}

–

T_{5}

) on the VoxCeleb1 test set. Each entry reports the mean and std. of the absolute differences in cosine similarity scores across all pairs.

Panel of Figure 11 — Figure 11. Scatter plots of the cosine similarity values output by local models for all pairs from the Voxceleb1 testset; R is the correlation coefficient between scores output by $L$ different target models ( $T_{1}$ - $T_{5}$ ).

$F$	$\langle x^{\prime},x\rangle$
$T_{1}$	0.3134
$T_{2}$	0.3112
$T_{3}$	0.3114
$T_{4}$	0.3004
$T_{5}$	0.3151

Appendix

Table 16. Cosine similarity between the recovered feature

x^{\prime}

and original feature

x

using a fixed pseudo-inversion matrix

A

constructed from

L_{\mathsf{Ours}}

. The condition number of

A

\mathrm{cond}(A)=3.8692

and remains constant across all rows.

Feat.	YourTTS	YourTTS $+L_{\mathsf{IC}}$	YourTTS $+L_{\mathsf{IC}}+L_{\mathsf{SC}}$
Org.	$0.4011\pm 0.0919$	$0.9026\pm 0.0197$	$0.8390\pm 0.0285$
$+10^{\circ}$	$0.3959\pm 0.0922$	$0.8978\pm 0.0204$	$0.8349\pm 0.0291$
$+20^{\circ}$	$0.3804\pm 0.0925$	$0.8832\pm 0.0225$	$0.8220\pm 0.0309$
$+30^{\circ}$	$0.3556\pm 0.0937$	$0.8559\pm 0.0267$	$0.7973\pm 0.0346$
$+40^{\circ}$	$0.3213\pm 0.0949$	$0.8114\pm 0.0345$	$0.7555\pm 0.0418$

Appendix

Table 17. Analysis of ID-constraint robustness under noise with random noise (

10^{\circ}

40^{\circ}

Decision	VoxCeleb1 Testset	YourTTS	Ours
Spoof	8.05%	55.90%	12.55%
Bonafide	91.95%	44.10%	87.45%

Appendix

Table 18. Results (%) of the Deepfake detection ( Tak et al., 2022 ) of audio samples classified as ‘Spoof’ or ‘Bonafide’ for genuine VoxCeleb1 audio, audio generated by YourTTS, and audio generated by our proposed method (‘Ours’).

Evaluation		Threshold	ASR(%)	FRR(%)
EER	7.73	0.4246	60.24	(= EER)
minDCF	0.6428	0.6484	0.06	60.26

Appendix

Table 19. Cross-lingual attack performance against a ResNet34 model trained on CNCeleb. Thresholds and baseline metrics were derived using the ASR was computed under these thresholds.

Black-Box Adversarial Attacks

Black-box adversarial attacks study how inputs can fool AI systems when attackers cannot inspect model parameters or gradients.

See all 174 papers

Jun 18, 2026

Exploiting Neural Audio Codec Latents for Adversarial Audio Attacks

Deep learning-based audio classification systems, including automatic speaker verification, are vulnerable to adversarial attacks. Realistic real-time threat assessment remains difficult because optimization-based methods, such as projected gradient descent (PGD) and Carlini-Wagner, require costly iterative updates in the high-dimensional waveform domain. Generative attacks allow single-shot synthesis but often introduce perceptible artifacts or depend on computationally intensive architectures, while diffusion and autoregressive approaches incur high inference latency. To address this gap, we propose a generative attack framework operating in the continuous latent space of a neural audio codec. A conditional generator synthesizes class-specific perturbations in a single forward pass and decodes them into adversarial waveforms. Our method achieves targeted attack success rates up to 99% with sub-7 ms inference, outperforming generative baselines while reducing latency by 24x.

Sameek Bhattacharya, Bharath Krishnamurthy, Ajita Rattani

Dept. of Computer Science and Engineering, University of North Texas, Denton, Texas, USA

Adversarial Attacks

Ask PDF

Jun 7, 2026

Speaker-Invariant Representation Learning for Spoofing Detection via Gradient Reversal and A Variational Information Bottleneck

Sophisticated generative speech technology can undermined the reliability of voice biometrics. While spoofing detection systems excel when assessed under in-domain conditions, generalisation to out-of-domain settings is often poor. In this paper, we show that such issues could be caused by speaker bias, where models learn individual voice traits rather than markers of manipulation or generation. We propose a teacher-student framework for speaker-invariant spoofing detection that disentangles identity without requiring speaker labels. We leverage a pre-trained speaker recognition teacher to guide a student model via a gradient reversal layer. To control the balance between suppressing cues related to voice identity with the preservation of those related to spoofing detection, we integrate a Variational Information Bottleneck. Evaluations across nine datasets show our model achieves a 25.7% relative reduction to the EER compared to the MHFA baseline.

Anh-Tuan Dao, Driss Matrouf, Mickael Rouvier +1

Laboratoire Informatique d’Avignon, Avignon Universite, France · EURECOM, Sophia Antipolis, France

Audio Deepfake Detection Invariant Representation Learning Variational Information Bottleneck

Ask PDF

May 18, 2026

Profiling the Voice: Speaker-Specific Phoneme Fingerprinting for Speech Deepfake Detection

The rapid advancement of generative AI has made audio deepfakes increasingly indistinguishable from authentic human vocals, posing significant threats to persons-of-interest (POI) such as public figures. Current detection systems primarily rely on generic, black-box models that fail to capture speaker-specific idiosyncratic traits and lack interpretability. In this paper, we propose Phoneme-based Voice Profiling (PVP), a novel personalized defense framework. By shifting the detection paradigm from macro-utterance analysis to micro-phonetic modeling, PVP captures the unique acoustic distributions underlying a POI's habitual articulatory patterns. Specifically, our framework models speaker-specific phonetic realizations using lightweight Gaussian Mixture Models (GMMs) estimated solely from bona fide reference speech. This design enables data-efficient profiling and robust generalization to previously unseen spoofing attacks without requiring heavy spoof-specific training. Furthermore, we introduce the first large-scale Chinese POI deepfake dataset to benchmark speaker-specific detection. Experimental results demonstrate that PVP significantly outperforms state-of-the-art generic detectors in POI spoofing scenarios, achieving substantial EER reductions while providing fine-grained, phoneme-level interpretability for forensic analysis. Code and data are available at: https://github.com/JunXue-tech/PVP

Jun Xue, Tong Zhang, Zhuolin Yi +4

Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education · School of Cyber Science and Engineering, Wuhan University

Biometric Identification Audio Deepfake Detection

Ask PDF

Abstract

Black-Box Adversarial Attacks

Explore similar work

Exploiting Neural Audio Codec Latents for Adversarial Audio Attacks

Speaker-Invariant Representation Learning for Spoofing Detection via Gradient Reversal and A Variational Information Bottleneck

Profiling the Voice: Speaker-Specific Phoneme Fingerprinting for Speech Deepfake Detection