QBFF: Deep Quantum Bottleneck for Automatic Speaker Verification Anti-Spoofing

Anton Firc; Nouhaila Innan; Vojtěch Staněk; Kamil Malinka; Martin Perešini; Zbyněk Lička; Walid El Maouaki; Alberto Marchisio

quant-phOct 12, 2026

QBFF: Deep Quantum Bottleneck for Automatic Speaker Verification Anti-Spoofing

Authors: Anton Firc, Nouhaila Innan, Vojtěch Staněk, Kamil Malinka, Martin Perešini, Zbyněk Lička, Walid El Maouaki, Alberto Marchisio, +1 more

Organizations: eBRAIN Lab, Division of Engineering, New York University Abu Dhabi (NYUAD), Abu Dhabi, UAE · Center for Quantum and Topological Systems (CQTS), NYUAD Research Institute, NYUAD, Abu Dhabi, UAE · SDU Microelectronics, Institute of Mechanical and Electrical Engineering, University of Southern Denmark, Odense, Denmark

Abstract

A central goal of quantum machine learning is to identify applications in which small quantum circuits can improve task performance while remaining executable on real hardware. We investigate deepfake (synthetic) speech detection, a largely unexplored application in this area, where reliable confidence scores are as important as discrimination performance because deployment decisions are made at fixed thresholds and overconfident errors can be costly. We introduce QBFF, which routes a compressed speech representation through a small 8-qubit variational circuit (VQC) used as a drop-in bottleneck, with a matched classical bottleneck as the control. The quantum circuit yields better-calibrated confidence in most matched comparisons, including out-of-distribution evaluation, though the downstream deployment-cost benefit is model-dependent. We then run the same circuit on a real IBM quantum processor. To our knowledge, this is the first anti-spoofing pipeline to run on a QPU; hardware execution demonstrates feasibility, with lower subset EER and $C_{llr}$ but higher mean actDCF than the matched classical reference. Together, these results show that hardware-executable quantum bottlenecks can improve score reliability, with gains that vary by evaluation setting.

Figures & tables

Panel of Figure 1 — Fig. 1: QBFF and BFF use matched projection and classifier architectures, trained independently. Their mixers map $16$ bounded inputs to $8$ outputs; QBFF additionally applies a learned output scale (omitted). The comparison evaluates discrimination and score reliability, with real-QPU execution assessing feasibility.

Fig. 2: End-to-end experimental pipeline. A shared XLS-R front end and Mean , MHFA , or AASIST pooling produce a $1024$ -dimensional utterance vector. It feeds either the full feed-forward baseline ( FF ) or a $1024\rightarrow 16\rightarrow 8$ bottleneck head with a classical mixer ( BFF ) or a variational quantum circuit ( QBFF ). Systems are trained with a frozen front end or with fine-tuning and augmentation, then evaluated for discrimination, decision cost, and calibration in simulation; QBFF is also tested on IBM Heron QPUs.

System	Quantum role	Benchmark (EER %)	Real QPU	Reliab. eval
Pandey et al. [ 5 ]	Hybrid CNN–QNN	Custom set (90.0% acc.)	$\times$	$\times$
Al Amin et al. [ 6 ]	Quantum kernel	ASVspoof 5 (18.3)	$\times$	$\times$
Wang et al. [ 7 ]	VQC classifier	ASVspoof 21 DF (5.51)	$\times$	$\times$
AASIST + QBFF (ours)	Quantum bottleneck	ASVspoof 5 (5.44), ITW (3.97)	✓	✓

TABLE I: Quantum approaches to speech anti-spoofing, by capability and reported result. The highlighted columns indicate real-QPU execution and reliability evaluation. Accuracy shown where EER is not reported. ITW: In-the-Wild.

Fig. 3: Classifier heads operating on pooled XLS-R embeddings. FF uses a $1024\rightarrow 512\rightarrow 256\rightarrow 2$ MLP. BFF and QBFF project the embedding to $16$ bounded values and produce $8$ mixer outputs using a classical mixer or an $8$ -qubit VQC, respectively. Both use an $8\rightarrow 16\rightarrow 2$ classifier; QBFF additionally learns an output scale.

Training setting	Value	Augmentation	$p$
Input length	$4$ s, $16$ kHz	Silence trimming	$0.5$
Optimizer	Adam	Time masking	$0.3$
Learning rate	$1\times 10^{-4}$	Mu-law companding	$0.3$
Batch size	$96$	RawBoost	$0.3$
Frozen regime	$10$ epochs	Noise filtering	$0.3$
Finetune+aug.	$10{+}5$ epochs

TABLE II: Experimental setup. Augmentations (right) apply only in the fine-tuned+augmentation regime, at the listed per-utterance probability

p

					ASVspoof 5 Eval (In-Domain)				In-the-Wild (Out-of-Domain)
					Discrimination		Reliability		Discrimination		Reliability
Pooling	Model	Emb. size	Depth	Params	EER (%) $\downarrow$	minDCF $\downarrow$	actDCF $\downarrow$	$C_{llr}$ $\downarrow$	EER (%) $\downarrow$	minDCF $\downarrow$	actDCF $\downarrow$	$C_{llr}$ $\downarrow$
AASIST	FF (Baseline)	1024	3	$\sim$ 658k	10.08 $\pm$ 0.64	0.285 $\pm$ 0.019	0.424 $\pm$ 0.110	1.249 $\pm$ 0.769	14.71 $\pm$ 3.86	0.370 $\pm$ 0.097	0.768 $\pm$ 0.165	3.076 $\pm$ 1.819
	BFF (Classical)	8	2	$\sim$ 19k	9.46 $\pm$ 0.80	0.269 $\pm$ 0.019	0.385 $\pm$ 0.087	0.736 $\pm$ 0.293	10.96 $\pm$ 1.09	0.267 $\pm$ 0.038	0.371 $\pm$ 0.184	1.076 $\pm$ 0.620
	QBFF (Quantum)	8	2	$\sim$ 19k	10.13 $\pm$ 0.48	0.287 $\pm$ 0.011	0.377 $\pm$ 0.136	0.474 $\pm$ 0.111	12.02 $\pm$ 3.08	0.290 $\pm$ 0.055	0.363 $\pm$ 0.068	1.129 $\pm$ 0.395
MHFA	FF (Baseline)	1024	3	$\sim$ 658k	8.05 $\pm$ 0.37	0.233 $\pm$ 0.011	0.278 $\pm$ 0.022	0.559 $\pm$ 0.108	8.26 $\pm$ 1.06	0.229 $\pm$ 0.031	0.659 $\pm$ 0.154	2.099 $\pm$ 0.795

TABLE III: Detection performance with a frozen encoder and no augmentation (mean

\pm

std over three seeds; lower is better). Embedding size denotes the pooled dimension for FF and the mixer output dimension for BFF/QBFF. Parameter counts cover the complete classifier head, excluding pooling and the encoder. Colors compare each row with the preceding head within its pooling block: better or worse . Bold marks the best value within each block. Fine-tuned results appear in Table IV .

		Reliability
System	EER (%) $\downarrow$	actDCF $\downarrow$	$C_{llr}$ $\downarrow$
AASIST + FF	4.74 $\pm$ 0.76	0.286 $\pm$ 0.017	1.495 $\pm$ 0.064
AASIST + BFF	5.49 $\pm$ 0.23	0.205 $\pm$ 0.046	1.010 $\pm$ 0.283
AASIST + QBFF	3.97 $\pm$ 0.10	0.181 $\pm$ 0.078	0.934 $\pm$ 0.503
MHFA + FF	4.98 $\pm$ 0.07	0.350 $\pm$ 0.119	1.631 $\pm$ 0.834
MHFA + BFF	6.25 $\pm$ 0.50	0.305 $\pm$ 0.048	1.465 $\pm$ 0.178

TABLE IV: In-the-Wild performance under the strong fine-tuned+augmentation recipe (mean

\pm

std over 3 seeds). Color tint, bold , and the capped Reliability columns follow Table III .

Published systems
System	ASVspoof 5 EER (%) $\downarrow$	In-the-Wild EER (%) $\downarrow$
AASIST [ 8 ]	4.71	4.74
ResNet-101 ${}_{\text{SV}}$ [ 29 ] $\dagger$	n/a	2.16
SLIM [ 30 ]	5.5	10.80
P-V AASIST [ 31 ]	5.99	6.05
This work

TABLE V: Comparison with published anti-spoofing systems. The capped In-the-Wild column carries the comparison; ASVspoof 5 Eval is indicative only (see text). AASIST [ 8 ] is the same architecture as our AASIST+FF , to confirm our reproduction.

System	Raw ECE $\downarrow$	Best ECE $\downarrow$	$actDCF_{\mathrm{dev}}$ (Raw) $\downarrow$	Best $actDCF_{\mathrm{dev}}$ $\downarrow$
MHFA + FF	0.198	0.025	0.256	0.251
MHFA + BFF	0.169	0.023	0.234	0.230
MHFA + QBFF	0.078	0.028	0.223	0.221
AASIST + FF	0.348	0.054	0.291	0.287
AASIST + BFF	0.190	0.039	0.279	0.278
AASIST + QBFF	0.095	0.051	0.306	0.306

TABLE VI: In-domain calibration and deployment risk on ASVspoof 5 Eval (mean over three seeds; out-of-domain reliability in Figure 4 ). Raw = network posteriors as

P(\mathrm{spoof}\mid x)

; Best = the post-hoc calibrator minimizing that metric;

actDCF_{\mathrm{dev}}

uses a Dev-tuned threshold. Color tint as in Table III .

Fig. 4: In-the-Wild reliability diagrams for MHFA heads before and after isotonic calibration fitted on ASVspoof 5 Dev. Curves average three seeds after interpolation of ten quantile-bin estimates to a common grid; shading shows $\pm$ one standard deviation. The diagonal indicates perfect calibration. In-domain results appear in Table VI .

Shots	Mit.	QPU(s)	#Runs	EER (%) $\downarrow$	actDCF $\downarrow$	$C_{llr}$ $\downarrow$
–	–	Classical	3	7.29	0.227	0.523
256	varies	Marrakesh	12	6.4 $\pm$ 2.1	0.25 $\pm$ 0.08	0.29 $\pm$ 0.14
256	✓	Marrakesh	4	5.9 $\pm$ 1.8	0.21 $\pm$ 0.07	0.21 $\pm$ 0.04
512	–	Marrakesh+Torino	5	4.7 $\pm$ 1.6	0.62 $\pm$ 0.65	0.26 $\pm$ 0.21
512	✓	Marrakesh+Torino	3	4.69 $\pm$ 1.56	0.144 $\pm$ 0.016	0.156 $\pm$ 0.065
1024	–	Marrakesh	1	6.25	1.841	0.610

TABLE VII: Real-hardware evaluation of MHFA+QBFF on a hardness-stratified ASVspoof 5 subset. Mit. = reported mitigation grouping (DD+GM); ✓ = labeled full mitigation. Cell color compares each hardware run against the Classical reference row ( better / worse ); the capped Reliability columns and bold best follow Table III .

Explore similar work

On Evaluating Quantum Kernel Robustness for Low-Resource Cross-Corpus Audio Deepfake Detection
Sep 30, 2026Lisan Al Amin, Lei Zhang, Vandana P. JanejaAudio Deepfake Detection Domain Generalization
University of Maryland, Baltimore County, Baltimore, Maryland, USA
Quantum Vision Theory Applied to Audio Classification for Deepfake Speech Detection
Apr 9, 2026Khalid Zaman, Melike Sah, Anuwat Chaiwongyenc +1Audio Deepfake Detection Audio Classification
Graduate School of Advanced Science and Technology, Japan Advanced Institute of Science and Technology, Nomi, 923-1292, Ishikawa, Japan · Computer Engineering Department, Cyprus International University, Nicosia, 99258, North Cyprus via Mersin 10, Turkiye · Department of Management Information Systems, Thammasat University, Khlong Luang, Pathum Thani, 12121, Thailand +1
Quantum Kernels for Audio Deepfake Detection Using Spectrogram Patch Features
May 7, 2026Lisan Al Amin, Rakib Hossain, Mahbubul Islam +2Quantum Feature Maps Audio Deepfake Detection
Potomac Quantum, USA · United International University, Dhaka, Bangladesh · University of Maryland, College Park, MD, USA +2

Sep 30, 2026J/K move · Enter open · S save

On Evaluating Quantum Kernel Robustness for Low-Resource Cross-Corpus Audio Deepfake Detection

Lisan Al Amin, Lei Zhang, Vandana P. Janeja

University of Maryland, Baltimore County, Baltimore, Maryland, USA

Audio Deepfake Detection Domain Generalization Quantum Kernel Methods

Open paper AskPDF arXiv

Synthetic speech detection is critical for audio security, but performance can degrade when labeled data are scarce and evaluation conditions differ from training. This study examines quantum kernel methods and lightweight neural models for cross-corpus audio deepfake detection under limited training data. We compare a Quantum Support Vector Machine (QSVM), a classical support vector machine (SVM), and a multilayer perceptron (MLP), all trained on frozen wav2vec 2.0 embeddings using a strict budget of 200 training samples. To match the qubit budget of near-term quantum hardware, embeddings are reduced to four dimensions using principal component analysis, and all models use the same reduced features. Experiments on ASVspoof 2019, ASVspoof 5, the ADD 2023 Challenge, and the In-the-Wild dataset show that under severe domain shift from ASVspoof 2019 to ADD 2023, the MLP degrades to near-random performance, with an area under the curve of approximately 50% and an equal error rate of 50.0%. In contrast, the QSVM maintains meaningful discrimination, achieving an area under the curve of 76.0% and an equal error rate of 27.0%. This advantage is not consistent across transfer directions. When trained on ADD 2023, the QSVM falls below chance on two of three transfers, while the MLP performs better. These results suggest that quantum kernel methods can be competitive under severe cross-corpus shifts and strict low-resource constraints, but do not provide a consistent advantage under near-domain transfer. We interpret these findings as an empirical characterization of quantum kernel inductive bias under distribution shift, rather than evidence of quantum advantage, since the four-qubit kernel can be simulated exactly on classical hardware.

Abstract

Explore similar work

On Evaluating Quantum Kernel Robustness for Low-Resource Cross-Corpus Audio Deepfake Detection

Quantum Vision Theory Applied to Audio Classification for Deepfake Speech Detection

Quantum Kernels for Audio Deepfake Detection Using Spectrogram Patch Features