Time-Domain Voice Identity Morphing (TD-VIM): A Signal-Level Approach to Morphing Attacks on Speaker Verification Systems

Aravinda Reddy PN; Raghavendra Ramachandra; K. Sreenivasa Rao; Pabitra Mitra; Kunal Singh

cs.SDApr 7, 2026

Time-Domain Voice Identity Morphing (TD-VIM): A Signal-Level Approach to Morphing Attacks on Speaker Verification Systems

Authors: Aravinda Reddy PN, Raghavendra Ramachandra, K. Sreenivasa Rao, Pabitra Mitra, Kunal Singh

Organizations: Indian Institute of Technology Kharagpur, India · Norwegian University of Science and Technology (NTNU), Norway

Abstract

In biometric systems, it is a common practice to associate each sample or template with a specific individual. Nevertheless, recent studies have demonstrated the feasibility of generating "morphed" biometric samples capable of matching multiple identities. These morph attacks have been recognized as potential security risks for biometric systems. However, most research on morph attacks has focused on biometric modalities that operate within the image domain, such as the face, fingerprints, and iris. In this work, we introduce Time-domain Voice Identity Morphing (TD-VIM), a novel approach for voice-based biometric morphing. This method enables the blending of voice characteristics from two distinct identities at the signal level, creating morphed samples that present a high vulnerability for speaker verification systems. Leveraging the Multilingual Audio-Visual Smartphone database, our study created four distinct morphed signals based on morphing factors and evaluated their effectiveness using a comprehensive vulnerability analysis. To assess the security impact of TD-VIM, we benchmarked our approach using the Generalized Morphing Attack Potential (G-MAP) metric, measuring attack success across two deep-learning-based Speaker Verification Systems (SVS) and one commercial system, Verispeak. Our findings indicate that the morphed voice samples achieved a high attack success rate, with G-MAP values reaching 99.40% on iPhone-11 and 99.74% on Samsung S8 in text-dependent scenarios, at a false match rate of 0.1%.

Figures & tables

Figure 1: Illustration of TD-VIM morphing: Initially we apply pre-processing to make both signal of equal length. Subsequently we select four different portions of second signal in the signal selection block and average only the selected portion with the first speaker’s signal. This averaged signal is final morphed signal which is used to verify both the subjects

Figure 2: Illustration of signal selection of second speaker, based on the time samples we have selected 25%, 50%, 75% and 100% of the second speaker

Devices	No of speakers	No of sessions	No of morphed files
iPhone 11	103	1	$103$ $\times$ $102$ $\times$ $3$ $\times$ $4$ $\times$ $3$ $=$ $378,216$
Samsung S8	103	1	$103$ $\times$ $102$ $\times$ $3$ $\times$ $4$ $\times$ $3$ $=$ $378,216$
			Total=2,269,296

Table 1: Table showing exhaustive list of number of morphed files generated for 2 devices for 3 sentences for 1 sessions using 4 different types of morphing technique for 3 different languages

MAVS Database
SVS	Languages
SVS	English	Hindi	Bengali
x-vector [ 18 ]	0.56	1.43	1.60
RawNet3 [ 5 ]	0.57	1.44	1.75
Verispeak [ 21 ]	0.35	1.75	1.83

Table 2: Performance of the speaker verification systems in terms of EER (%) for MAVS database

Figure 3: The diagram showing $M_{25}$ , $M_{50}$ , $M_{75}$ and $M_{100}$ signal passed onto the x-vector and RawNet3 to get 512-dimensional and 256-dimensional embeddings respectively

Morphing Factor	Language	G-MAP with Multiple probe attempts
		iPhone11			Samsung S8
		Gender Pair			Gender Pair
		FF	MM	Combined	FF	MM	Combined
$M_{25}$	English	23.76	24.74	48.54	67.36	68.16	67.76
	Hindi	23.78	24.80	48.58	69.73	69.36	69.54
	Bengali	22.2	23.69	45.89	67.37	68.26	67.81

Table 3: Vulnerability analysis for MAVS database using G-MAP with multiple probe attempts on x-vector

Morphing Factor	Language	G-MAP with Multiple probe attempts
		iPhone11			Samsung S8
		Gender Pair			Gender Pair
		FF	MM	Combined	FF	MM	Combined
$M_{25}$	English	97.21	91.09	94.15	97.52	96.30	96.91
	Hindi	98.11	90.68	94.39	98.78	97.65	98.21
	Bengali	99.12	91.58	95.35	99.68	98.87	99.27

Table 4: Vulnerability analysis for MAVS database using G-MAP with multiple probe attempts on RawNet3

Morphing Factor	Language	G-MAP with Multiple probe attempts
		iPhone11			Samsung S8
		Gender Pair			Gender Pair
		FF	MM	Combined	FF	MM	Combined
M25	English	50.21	51.09	50.65	51.52	51.30	51.41
	Hindi	53.11	53.68	53.39	52.78	52.65	52.71
	Bengali	51.12	50.58	50.84	50.68	52.87	51.77

Table 5: Vulnerability analysis for MAVS database using G-MAP with multiple probe attempts for the Verispeak commercial speaker verification system

Morphing factor	Language	G-MAP with Multiple probe attempts with multiple SVS
		iPhone11			Samsung S8
		Gender Pair			Gender Pair
		FF	MM	Combined	FF	MM	Combined
$M_{25}$	English	23.76	24.74	48.54	51.52	51.30	51.41
	Hindi	23.78	24.80	48.58	52.78	52.65	52.71
	Bengali	22.2	23.69	45.89	50.68	52.87	51.77

Table 6: Vulnerability analysis for MAVS database using G-MAP with multiple probe attempts with multiple SVS

G-MAP(%)
iPhone-11	Samsung S8
52.08	56.61

Table 7: G-MAP (with full capacity) for iPhone-11 and Samsung S8

Panel of Figure 4 — Figure 4: The speaker verification match score distribution comprises several comparisons: non-morph genuine pairs versus non-morph impostor pairs, as well as morph (across all four types) versus non-morph genuine pairs. This analysis employs Rawnet on iPhone-11 for English language and x-vector (on iPhone-11 for Hindi language).

Speaker Verification

Speaker verification determines whether two speech recordings come from the same person, enabling voice authentication and identity analysis.

See all 62 papers

Spectral Masking and Interpolation Attack (SMIA): A Black-box Adversarial Attack against Voice Authentication and Anti-Spoofing Systems
Sep 9, 2025Kamel Kamel, Hridoy Sankar Dutta, Keshav Sood +1Audio Deepfake Detection Speaker Verification
School of Information Technology, Deakin University, Australia
DCMorph: Face Morphing via Dual-Stream Cross-Attention Diffusion
Apr 23, 2026Tahar Chettaoui, Eduarda Caldeira, Guray Ozgur +3Identity-Preserving Image Generation Conditional Diffusion Models
Fraunhofer Institute for Computer Graphics Research IGD, Germany · TU Darmstadt, Germany · Norwegian University of Science and Technology (NTNU), Norway
Arc2Morph: Identity-Preserving Facial Morphing with Arc2Face
Feb 18, 2026Nicolò Di Domenico, Annalisa Franco, Matteo Ferrara +1Identity-Preserving Image Generation Face Recognition
Department of Computer Science and Engineering, University of Bologna, Italy

Sep 9, 2025J/K move · Enter open · S save

Spectral Masking and Interpolation Attack (SMIA): A Black-box Adversarial Attack against Voice Authentication and Anti-Spoofing Systems

Kamel Kamel, Hridoy Sankar Dutta, Keshav Sood, Sunil Aryal

School of Information Technology, Deakin University, Australia

Audio Deepfake Detection Speaker Verification Adversarial Attacks Black-Box Adversarial Attacks

Open paper AskPDF arXiv

Voice Authentication Systems (VAS) use unique vocal characteristics for verification. They are increasingly integrated into high-security sectors such as banking and healthcare. Despite their improvements using deep learning, they face severe vulnerabilities from sophisticated threats like deepfakes and adversarial attacks. The emergence of realistic voice cloning complicates detection, as systems struggle to distinguish authentic from synthetic audio. While anti-spoofing countermeasures (CMs) exist to mitigate these risks, many rely on static detection models that can be bypassed by novel adversarial methods, leaving a critical security gap. To demonstrate this vulnerability, we propose the Spectral Masking and Interpolation Attack (SMIA), a novel method that strategically manipulates inaudible frequency regions of AI-generated audio. By altering the voice in imperceptible zones to the human ear, SMIA creates adversarial samples that sound authentic while deceiving CMs. We conducted a comprehensive evaluation of our attack against state-of-the-art (SOTA) models across multiple tasks, under simulated real-world conditions. SMIA achieved a strong attack success rate (ASR) of at least 82% against combined VAS/CM systems, at least 97.5% against standalone speaker verification systems, and 100% against countermeasures. These findings conclusively demonstrate that current security postures are insufficient against adaptive adversarial attacks. This work highlights the urgent need for a paradigm shift toward next-generation defenses that employ dynamic, context-aware frameworks capable of evolving with the threat landscape.

Abstract

Speaker Verification

Explore similar work

Spectral Masking and Interpolation Attack (SMIA): A Black-box Adversarial Attack against Voice Authentication and Anti-Spoofing Systems

DCMorph: Face Morphing via Dual-Stream Cross-Attention Diffusion

Arc2Morph: Identity-Preserving Facial Morphing with Arc2Face