Spoofing-robust automatic speaker verification (SASV) aims to integrate automatic speaker verification (ASV) and countermeasure (CM). A popular solution is fusion of independent ASV and CM scores. To better modeling SASV, some frameworks integrate ASV and CM within a single network. However, these solutions are typically bi-encoder based, offer limited interpretability, and cannot be readily adapted to new evaluation parameters without retraining. Based on this, we propose a unified end-to-end framework via a three-class formulation that enables log-likelihood ratio (LLR) inference from class logits for a more interpretable decision pipeline. Experiments show comparable performance to existing methods on ASVSpoof5 and better results on SpoofCeleb. The visualization and analysis also prove that the three-class reformulation provides more interpretability.
Figures & tables
Fig. 1 : Comparison of SASV paradigms. (a) Fusion-based SASV typically trains separate ASV and CM using Lspk and Lcm , and may include a fusion loss Lfusion in either score level (shown here) or embedding level. (b) Existing bi-encoder-based integrated SASV systems use a unified SASV objective Lsasv , often together with ASV-related or contrastive objectives, and independently encode enrollment and test utterances before scoring. (c) The proposed 3T2-SASV adopts a cross-encoder architecture with a three-class formulation and converts the class logits into an SASV LLR for inference. Unlike the double- or single-score formulations in (a) and (b), the proposed method preserves explicit class-level evidence for the three SASV hypotheses. Gray boxes denote non-trainable modules.
Fig. 2 : Overview of the proposed 3T2-SASV framework. Given enrollment and test utterances, the embedding extractor first produces utterance-level representations, which are then aggregated to obtain a fused representation Ft . The three-class classifier predicts target, nontarget, and spoof logits, which are converted into an SASV log-likelihood ratio llrSASV for the final accept/reject decision.
Emb. Extractor
Method
min a-DCF
ASVspoof 5
MFA-Conformer
ASV5-B04 [ 6 ]
0.5882
MFA-Conformer
SA-SASV [ 17 ]
0.6025
MFA-Conformer
Proposed 3T2-SASV
0.6029
SKA-TDNN
ASV5-B04
0.5788
SKA-TDNN
SA-SASV
0.5830
SKA-TDNN
Proposed 3T2-SASV
0.5961
TABLE I : Comparison with existing methods (min a-DCF on evaluation sets).
Fig. 3 : Comparison of score distributions between the ASV5-B04 baseline and the proposed 3T2-SASV on SpoofCeleb.
Fig. 4 : Min a-DCF across different operating spoof priors for the fixed-prior and prior-adjusted LLRs.
Emb. Extractor
Dev.
Eval.
wav2vec 2.0 Base
0.2545
0.4821
Wav2vec 2.0 Large
0.2293
0.4510
MFA-Conformer
0.2126
0.5973
TABLE II : min a-DCF of wav2vec 2.0 and MFA-Conformer as embedding extractors for the proposed 3T2-SASV.
Num of Ref Utt
min a-DCF
1
0.2126
2
0.2337
3
0.2586
4
0.2366
TABLE III : The Effect of Different Number of Ref Utterances
Utt Length
min a-DCF
2.0
0.2126
3.0
0.2589
5.0
0.2624
TABLE IV : The Effect of Different Utterance Length
Number of Attention Heads
min a-DCF
1
0.2906
2
0.2984
4
0.2126
8
0.2787
TABLE V : The effect of different number of attention heads on the ASVspoof5 development set.
Strategy
min a-DCF
Random sampling
0.2481
Hard-pair
0.2126
TABLE VI : Comparison of sampling strategies on the development set of ASVspoof 5.
Fig. 5 : Comparison of three enrollment-test aggregation strategies in the proposed 3T2-SASV framework.
Aggregation Strategy
min a-DCF
Embedding Concatenation
0.4071
Waveform Concatenation
0.3297
Cross-attention
0.2126
TABLE VII : Effect of different enrollment-test aggregation strategies on the ASVspoof5 development set.
Scoring strategy
min a-DCF
Prior-adjusted LLR
0.5741
Calibrated LLR
0.5861
TABLE VIII : Effect of LLR calibration on the ASVspoof 5 evaluation set.
Fig. 6 : Class-conditional score distribution of the Integrated B04 method and the proposed method on ASVspoof 5.
Fig. 7 : Attack-wise score distribution of the spoof class in the proposed method on ASVspoof 5.
Recent advances in text-to-speech and voice cloning make high-quality spoofing inexpensive and scalable, threatening voice authentication systems, especially automatic speaker verification (ASV). Existing defenses mainly address this threat through binary countermeasures (CMs) for deepfake detection or spoofing-aware speaker verification (SASV), where current systems are dominated by modular ASV-CM fusion and cascaded pipelines. Although large audio language models (LALMs) have shown promise on related audio tasks, including CM and ASV, their use for SASV remains unexplored, despite their capacity to produce natural-language rationales for auditing and robustness beyond discriminative predictions. This work systematically evaluates LALMs for SASV against conventional pipelines under zero-shot prompting, supervised adaptation, reasoning-oriented training, and reinforcement-learning-based optimization. Our results show that pretrained LALMs are near chance in the zero-shot setting, confirming that they are not natively suited to SASV, but that task-specific adaptation closes this gap. We further find that competitive SASV performance can be achieved through several distinct routes. These findings position LALMs as a promising and auditable foundation for unified SASV, while clarifying where conventional cascade systems still lead.
Deep neural network-based automatic speaker verification (ASV) systems achieve impressive performance but their embedding representations remain opaque, lacking a structured and perceptually verifiable explanation of the vocal characteristics they encode. Existing approaches either require annotation of speaker attributes or introduce alternative representations whose interpretability is unvalidated with listeners. We propose Listenable Interpretable Speaker Embeddings (LISE), a label-free framework that decomposes pretrained speaker embeddings into a small set of components. This decomposition yields a structured representation that supports the analysis of what information has been encoded by speaker embeddings. LISE preserves ASV performance with negligible EER degradation on x-vector and ECAPA-TDNN. Crucially, the interpretability of these components for human listeners is demonstrated through listening experiments, where participants distinguished speakers with 83.9% accuracy.
Xiaoliang Wu, Chongxin Gan, Ke Liu +2
University of Southampton, United Kingdom · The Hong Kong Polytechnic University, Hong Kong SAR, China · University of Edinburgh, United Kingdom
Spoofing-aware speaker verification (SASV) must confirm who is speaking and that the speech is genuine, but current systems gain one at the expense of the other. Modular cascades are accurate yet run two large self-supervised encoders, whereas end-to-end models are efficient but lose accuracy when a single embedding has to serve two conflicting objectives. We show that this trade-off between efficiency and specialization is avoidable. A single frozen W2V-BERT~2.0 backbone is adapted per task by deep hybrid Wavelet Prompt Tuning (WPT), so each branch obtains its own view of the shared encoder through dedicated prompts and a task head, and the scores are combined only at inference. Training only about 7M parameters, a small fraction of those a strong two-encoder cascade requires, the system surpasses it on SpoofCeleb evaluation with 0.03% CM-EER and 0.038 min a-DCF against 0.16% and 0.047. Because the backbone is shared and frozen, new branches attach without retraining the heads and prompts already in place. On ASVspoof5, with adversarial attacks and codec distortions, it reaches 0.092 min a-DCF and 3.60% CM-EER using only the provided data, indicating that the design holds under realistic in-the-wild threats.
Department of Computational Linguistics, University of Zurich, Switzerland · Idiap Research Institute, Switzerland · Brno University of Technology, Czech Republic