Pith. sign in

REVIEW 5 major objections 6 minor 43 references

Over-the-Air Adversarial Attack Detection: from Datasets to Defenses

T0 review · 5 major / 6 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A detector trained only on genuine speech flags over-the-air voice attacks at an 11.2% equal error rate, and a neural replay simulator doubles the potency of those attacks.

desk verdict A large OTA attack dataset and a plausible attack enhancement, but the CODA-OCC defense results are likely confounded by a missing domain control. read the letter →

arxiv 2509.09296 v1 pith:A5Z2TORK submitted 2025-09-11 eess.AS

Li Wang , Xiaoyan Lei , Haorui He , Lei Wang , Jie Shi , Zhizheng Wu This is my paper
classification eess.AS
keywords adversarialattackdetectionautomaticspeakerverificationover-the-airneuralreplaysimulatorone-classclassificationcontrastivelearningdomainalignmentspeechsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that over-the-air adversarial attacks on speaker verification are a real, present threat, and that a detector trained only on genuine speech can stop them. To demonstrate the threat, the authors build a 629,735-sample dataset spanning four ASV models, three playback devices, and three recorders, and add a neural replay simulator that lets attackers optimize perturbations to survive physical playback, raising average attack success from 33.5% to 66.9%. To meet the threat, they propose CODA-OCC, which learns one hypersphere per layer of a wav2vec 2.0 feature extractor, keeps layers contrastively separated, and aligns source and target domains; it reaches 11.2% EER and 0.95 AUC on the new dataset, beating a purification baseline by 8.6% absolute EER. The point is that one-class, bona-fide-only training can generalize across domains and unseen attacks, removing the white-box assumption that limits prior defenses.

What carries the argument

The load-bearing pieces are (1) the Neural Replay Simulator, a Wave-U-Net conditioned on a replay device ID and trained with multi-scale spectral loss on VCTK clean/replay pairs, which is inserted into PGD optimization so perturbations are tested after simulated OTA distortion; and (2) CODA-OCC, which attaches a separate hypersphere to each layer of wav2vec 2.0, applies contrastive loss to keep layer features close to their own centers and distant from other layers' centers, and aligns source and target decision and feature spaces with hypersphere-center-distance and MMD losses. The first carries the attack claim; the second carries the detection claim.

What would settle it

Take NRS-generated adversarial samples from AdvSV 2.0, play them through the same three loudspeakers and record them with the same three mobile devices at 0.3 meters and 90 degrees, and measure ASV attack success; if success stays near the 33.5% no-NRS baseline rather than jumping toward 66.9%, the simulator has not captured the real channel and the attack claim collapses.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central discovery is that adversarial audio can be made to survive physical playback if the perturbation is optimized through a learned simulator of that playback, and that a one-class detector can still catch such audio using only bona fide speech for training. The detection model CODA-OCC attaches a hypersphere to every layer of a wav2vec 2.0 encoder, keeps layer-specific centers separated by a contrastive loss, and aligns source- and target-domain hyperspheres and feature distributions. On the new AdvSV 2.0 benchmark it reaches 11.2% EER and 0.95 AUC, against 19.8% EER for the previous purification-based method and 37.4% for plain one-class classification; ab

Load-bearing premise

The neural replay simulator, trained on 12.5 hours of VCTK speech replayed in one room at 0.3 meters and 90 degrees, is assumed to faithfully reproduce how all nine playback and recorder pairs distort Libri-Light audio, so that perturbations optimized through it stay potent after real playback; the paper reports no direct fidelity check.

Editorial extensions

If this is right

  • Adversarial samples optimized through the NRS keep 66.9% average success after real playback, versus 33.5% without it, so over-the-air attacks on speaker verification cannot be dismissed as a lab artifact.
  • CODA-OCC detects these attacks at 11.2% EER while trained only on bona fide speech, so it does not need to know the attack algorithm or the ASV model used by the attacker.
  • The gains of domain alignment and contrastive learning are additive (23.9% plus 2.3% absolute EER reduction), suggesting both are needed for cross-domain generalization.
  • The AdvSV 2.0 dataset, with 629,735 samples across four ASV models, three playback devices, and three recorders, provides a common benchmark for future over-the-air attack and defense research.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the NRS were trained on a broader range of distances, angles, and room acoustics, its simulated channel would likely generalize to more deployment settings; the current single-configuration training is the paper's most exposed point.
  • Because CODA-OCC uses only bona fide speech, it may transfer to other audio-safety tasks such as deepfake or replay-spoof detection without retraining on attack data, though the paper does not test this.
  • The contrastive one-class structure is not specific to wav2vec 2.0; any layered pre-trained audio encoder could be substituted, and the layer-separation principle might apply to other one-class anomaly detection problems.
  • An adaptive attacker aware of the detector could try to craft perturbations that stay inside the bona fide hypersphere while still fooling the ASV; whether CODA-OCC survives such an adversary is an open question the paper leaves unresolved.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes three contributions: (i) AdvSV 2.0, a large corpus of over-the-line (OTL) and over-the-air (OTA) adversarial examples against four ASV models using PGD/ensemble-PGD attacks and multiple playback/recording configurations; (ii) an NRS-based OTA attack that optimizes perturbations through a learned replay simulator; and (iii) CODA-OCC, a one-class adversarial-sample detector combining contrastive multi-layer learning with domain alignment. The headline claims are that NRS raises the average OTA attack success rate from 33.5% to 66.9% (Table V) and that CODA-OCC achieves 11.2% EER and 0.95 AUC on AdvSV 2.0 (Table VII), outperforming a purification-based baseline and several ablations.

Significance. If the results hold, AdvSV 2.0 would be a valuable community resource, and the NRS-based attack is a genuine contribution: it is evaluated against real OTA playback rather than only against the simulator, which is a clear strength. The CODA-OCC formulation is also attractive because it avoids the white-box assumption of many prior detectors and requires only bona fide training data. The component-wise ablations (OCC, +CO, +DA, +CODA) support the internal logic of the method. However, the central detection claim is weakened by an evaluation protocol that lacks a clean control for the adversarial test domain, and the central method is not fully specified because the CO-OCC and CODA-OCC objective functions are never written down. These issues are fixable within the manuscript's scope, but they are load-bearing for the reproducibility and validity of the reported numbers.

major comments (5)
  1. [IV-C and IV-E] The central method is not fully specified. CO-OCC and CODA-OCC are described only verbally and pictorially; no objective function is given for either. Eq. (9) defines OCC and Eq. (11) defines DA-OCC, but the contrastive terms (per-layer hyperspheres, the 'bona fide center,' center-separation penalties) and how they are combined with Eq. (11) — including loss weights and which wav2vec layers are used — are absent. Without these equations the method cannot be implemented or compared.
  2. [VI-A2, Table VI, Table VII, Fig. 7c] The detection evaluation is confounded by domain shift. Bona fide training uses Libri-Light Medium and VoxCeleb2 (Section VI-A2), while the adversarial test set AdvSV 2.0 is generated from Libri-Light Large (Section V-A2). No clean Libri-Light Large samples appear in the test set (Table VI), so the one-class model may reject Libri-Light Large utterances because of channel/recording mismatch rather than because of adversarial perturbation. The t-SNE in Fig. 7c shows AdvSV 2.0 separated from training clusters, but this cannot distinguish perturbation-induced from domain-induced separation. Please add clean Libri-Light Large bona fide samples to the test set and report per-domain FAR/FRR, or otherwise control for the domain shift.
  3. [V-B2 and Table V] The NRS is trained on about 12.5 hours of VCTK data in a single acoustic geometry (0.3 m, 90 degrees), yet it is used to craft attacks for Libri-Light utterances replayed through nine device combinations. The paper claims the NRS 'accurately predicts' OTA transmission, but no direct fidelity metric is reported (e.g., spectrogram distance, ASV score agreement, or per-device error on held-out parallel recordings). The attack benefit is only measured end-to-end, so it is possible that the NRS functions as a differentiable augmentation rather than an accurate simulator. Please report a direct fidelity evaluation or an ablation that isolates the NRS's predictive accuracy.
  4. [VI-A3 and Table VII] All detection results are point estimates from a single training run selected by validation EER. The headline difference between DA-OCC (13.5%) and CODA-OCC (11.2%) is only 2.3% absolute, and the reported 8.6% improvement over the baseline could be within run-to-run variation. Report multiple seeds with standard deviations or a significance test, at least for the main comparison in Table VII.
  5. [VII and Table VII] The abstract and introduction claim CODA-OCC 'outperforms several state-of-the-art detection methods,' but the only external baseline evaluated is the purification-based method of [11]. Other published detectors (e.g., [12], [13], [25]) are not compared. Please evaluate these competitive detectors on the same protocol, or temper the claim to the methods actually compared.
minor comments (6)
  1. [III-A1, Eq. (6)] The clipping formula in Eq. (6) is malformed: min(1, max(-1, x+ε, max(x-ε, x'))) does not define a projection to the intersection of the L∞ ball and [-1,1]. Please rewrite as a standard two-stage projection.
  2. [Abstract and Table II] The abstract says 628k samples and 800 hours, while Table II reports 629,735 samples and 799.5 hours. Reconcile these numbers.
  3. [Table VII] The column layout is difficult to parse: the relationship between 'EER(%)', 'FAR(%)', 'FRR(%)', 'AUC', and the subcolumns 'ALL', 'Libri-Light', 'VoxCeleb2' should be clarified (e.g., which FAR is global and which are per-domain).
  4. [V-B2, Algorithm 3] Algorithm 3 initializes the adversarial sample at x_replay_v but takes PGD steps clipped around the original x_v. The first iteration will project x_replay_v into the ε-ball around x_v; please state this explicitly so readers do not interpret the initialization as violating the perturbation bound.
  5. [III and IV] The paper says AdvSV 2.0 is open-source and that the NRS uses a public MSSL implementation, but no dataset/download or code links are provided in the manuscript. Please add these, as they are essential for the dataset and defense contributions.
  6. [V-B2] NRS training hyperparameters (number of epochs, optimizer, learning rate, device-embedding dimension) are not specified. Please add them.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: NRS attacks are tested over the real air; CODA-OCC is trained on bona fide and tested on held-out samples; remaining domain-shift concern is a validity issue, not a circular reduction.

full rationale

The paper's principal claims are not circular. The NRS-based attack (Algorithm 3) optimizes adversarial perturbations against a learned simulator, but the reported attack success rates (Table V) are measured after actual physical over-the-air playback through the specified loudspeaker/microphone combinations; the simulator is not used as the evaluation oracle. The CODA-OCC detector (Section IV) is trained exclusively on bona fide samples from Libri-Light Medium and VoxCeleb2 and evaluated on held-out adversarial samples from AdvSV 2.0; no adversarial labels or attack configurations are used to fit the detector, so the reported EER/AUC are not forced by construction. The self-citations [5], [6] motivate the OTA threat and the NRS concept, but the current paper provides independent experimental evidence (new real-OTA measurements, new dataset, ablation study) that does not reduce to those citations. The one legitimate concern is a domain-shift confound in the detection evaluation: adversarial test samples come from Libri-Light Large while clean test samples come from Libri-Light Medium and VoxCeleb2, with no clean Libri-Light Large control; this could inflate apparent detection accuracy, but it is a correctness/validity risk rather than a circular derivation. No specific equation or construction makes the claimed predictions equivalent to the inputs.

Assumptions & free parameters 4 free parameters · 6 assumptions · 0 invented entities

The central claims rest on typical ML domain assumptions: imperceptibility of bounded perturbations, NRS fidelity to the OTA channel, the informativeness of wav2vec features, and the transferability of domain alignment. The NRS itself is a trained model, not a postulated physical entity. The free parameters are experimental choices (attack bounds, acoustic geometry, NRS data split) that condition but do not by themselves calibrate the detection results.

free parameters (4)
  • PGD perturbation bound epsilon = 0.01
    Chosen in Section V-A3 to keep perturbations imperceptible; attack success rates and dataset difficulty depend on this value.
  • PGD step size alpha = 0.0005
    Set in Section V-A3; together with epsilon it controls attack strength and convergence.
  • OTA geometry = 0.3 m distance, 90 degree angle
    Fixed in Section V-B1. The paper says 'we simplified this factor'; the general OTA claims rest on this single acoustic geometry in a soundproof studio.
  • NRS training data split = 9000/1300 utterances from VCTK, 103 speakers
    Section V-B2. The NRS is trained on a relatively small corpus and its fidelity to the Libri-Light OTA domain is assumed, not measured.
assumptions (6)
  • domain assumption L-infinity-bounded perturbations with epsilon=0.01 are imperceptible and representative of real attacks on ASV
    Used throughout attack generation (Eq. 3, Section V-A3); no perceptual evaluation is reported.
  • domain assumption The NRS trained on VCTK accurately simulates the OTA channel for Libri-Light and all nine device combinations
    Algorithm 3 optimizes and early-stops on NRS output, so the attack's transfer to real OTA depends on NRS fidelity; no direct fidelity measure is given.
  • domain assumption wav2vec 2.0 layer features carry multi-level acoustic/linguistic information useful for one-class attack detection
    CO-OCC relies on per-layer hyperspheres (Section IV-C) citing [31],[32]; no analysis is provided that these features separate adversarial from bona fide audio.
  • domain assumption Deep one-class hypersphere (Deep SVDD) generalizes to unseen attacks when trained only on bona fide samples
    Equation 9, Section IV-B, based on [30]; the paper's own results show strong domain dependence, so the assumption is not automatically satisfied.
  • domain assumption MMD and center alignment on bona fide samples from Libri-Light and VoxCeleb2 transfer to the AdvSV 2.0 / OTA domain
    DA-OCC uses this in Eq. 11, but there is no held-out third-domain evaluation to confirm the alignment transfers.
  • domain assumption The soundproof studio with fixed 0.3 m / 90 degree geometry is representative of over-the-air attacks
    Section V-B1 intentionally removes environmental noise and varies only devices; real-world OTA conditions with reverberation and noise are not tested.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Over-the-Air Adversarial Attack Detection: from Datasets to Defenses." pith.science (2026). https://pith.science/paper/A5Z2TORK

@misc{pith2026250909296,
  author       = {Pith},
  title        = {Pith review of: Over-the-Air Adversarial Attack Detection: from Datasets to Defenses},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/A5Z2TORK}},
  note         = {Machine review of arXiv:2509.09296}
}
read the original abstract

Automatic Speaker Verification (ASV) systems can be used for voice-enabled applications for identity verification. However, recent studies have exposed these systems' vulnerabilities to both over-the-line (OTL) and over-the-air (OTA) adversarial attacks. Although various detection methods have been proposed to counter these threats, they have not been thoroughly tested due to the lack of a comprehensive data set. To address this gap, we developed the AdvSV 2.0 dataset, which contains 628k samples with a total duration of 800 hours. This dataset incorporates classical adversarial attack algorithms, ASV systems, and encompasses both OTL and OTA scenarios. Furthermore, we introduce a novel adversarial attack method based on a Neural Replay Simulator (NRS), which enhances the potency of adversarial OTA attacks, thereby presenting a greater threat to ASV systems. To defend against these attacks, we propose CODA-OCC, a contrastive learning approach within the one-class classification framework. Experimental results show that CODA-OCC achieves an EER of 11.2% and an AUC of 0.95 on the AdvSV 2.0 dataset, outperforming several state-of-the-art detection methods.

Figures

Figures reproduced from arXiv: 2509.09296 by the authors.

Figure 1
Figure 1. Current mainstream adversarial detection framework. The adversarial [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Architecture of the Neural Replay Simulator (NRS). [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Pipeline of the NRS-based PGD Attack. The process begins with the Neural Replay Simulator (NRS) generating simulated audio from bona fide [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Architecture of the One-Class Classification-Based Adversarial [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Architecture of the proposed Contrastive One-Class Classification (CO-OCC) method. The wav2vec 2.0 model extracts features from multiple layers, [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: The primary goal of DA-OCC is to achieve high [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 6
Figure 6. Figure 6: Illustrations of (a) one-class domain alignment and (b) the architecture of the proposed Domain-Aligned One-Class Classification (DA-OCC) model. [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Clustering visualization results for different methods. In all plots, green represents Libri-Light Medium (Train), orange represents Libri-Light Medium [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

43 extracted references · 4 linked inside Pith

  1. [11]

    Adversarial Sample Detection for Speaker Verification By Neural V ocoders,

    H. Wu, P.-C. Hsu, J. Gao, S. Zhang, S. Huang, J. Kang, Z. Wu, H. Meng, and H.-y. Lee, “Adversarial Sample Detection for Speaker Verification By Neural V ocoders,” inICASSP, 2022, pp. 236–240

    2022

  2. [12]

    Improving the Adversarial Robustness for Speaker Verification by Self-supervised Learning,

    H. Wu, X. Li, A. T. Liu, Z. Wu, H. Meng, and H.-Y . Lee, “Improving the Adversarial Robustness for Speaker Verification by Self-supervised Learning,”IEEE/ACM Transactions on Audio, Speech, and Language Processing, vol. 30, pp. 202–217, 2021

    2021

  3. [13]

    LMD: A Learnable Mask Network to Detect Adversarial Examples for Speaker Verification,

    X. Chen, J. Wang, X.-L. Zhang, W.-Q. Zhang, and K. Yang, “LMD: A Learnable Mask Network to Detect Adversarial Examples for Speaker Verification,”IEEE/ACM Transactions on Audio, Speech, and Language Processing, vol. 31, pp. 2476–2490, 2023

    2023

  4. [25]

    Neural Codec- based Adversarial Sample Detection for Speaker Verification,

    X. Chen, J. Du, H. Wu, J.-S. R. Jang, and H.-y. Lee, “Neural Codec- based Adversarial Sample Detection for Speaker Verification,”arXiv preprint arXiv:2406.04582, 2024

    arXiv 2024

  5. [1]

    Speaker Recognition Based on Deep Learning: An Overview,

    Z. Bai and X.-L. Zhang, “Speaker Recognition Based on Deep Learning: An Overview,”Neural Networks, vol. 140, pp. 65–99, 2021

    2021

  6. [2]

    Adversarial Attack and Defense Strategies of Speaker Recognition Systems: A Survey,

    H. Tan, L. Wang, H. Zhang, J. Zhang, M. Shafiq, and Z. Gu, “Adversarial Attack and Defense Strategies of Speaker Recognition Systems: A Survey,”Electronics, vol. 11, no. 14, p. 2183, 2022

    2022

  7. [3]

    Audio Deepfake Detection: A Survey,

    J. Yi, C. Wang, J. Tao, X. Zhang, C. Y . Zhang, and Y . Zhao, “Audio Deepfake Detection: A Survey,”Arxiv Preprint Arxiv:2308.14970, 2023

    arXiv 2023

  8. [4]

    Black-box Attacks on Spoofing Countermeasures Using Transferability of Adversarial Exam- ples

    Y . Zhang, Z. Jiang, J. Villalba, and N. Dehak, “Black-box Attacks on Spoofing Countermeasures Using Transferability of Adversarial Exam- ples.” inINTERSPEECH, 2020, pp. 4238–4242

    2020

Show all 43 references
  1. [5]

    AdvSV: An Over-the-air Adversarial Attack Dataset for Speaker Verification,

    L. Wang, J. Li, Y . Luo, J. Zheng, L. Wang, H. Li, K. Xu, C. Fang, J. Shi, and Z. Wu, “AdvSV: An Over-the-air Adversarial Attack Dataset for Speaker Verification,” inICASSP, 2024, pp. 4555–4559

    2024

  2. [6]

    An Initial Investigation of Neural Replay Simulator for Over-the-air Adversarial Perturbations to Automatic Speaker Verification,

    J. Li, L. Wang, L. Xue, L. Wang, and Z. Wu, “An Initial Investigation of Neural Replay Simulator for Over-the-air Adversarial Perturbations to Automatic Speaker Verification,” inICASSP, 2024, pp. 4635–4639

    2024

  3. [7]

    The Defender’s Perspective on Automatic Speaker Verification: An Overview,

    H. Wu, J. Kang, L. Meng, H. Meng, and H. Lee, “The Defender’s Perspective on Automatic Speaker Verification: An Overview,” inDADA Workshop, vol. 3597, 2023, pp. 6–11

    2023

  4. [8]

    Study of Pre-processing Defenses against Adversarial Attacks on State-of-the-art Speaker Recognition Systems,

    S. Joshi, J. Villalba, P. ˙Zelasko, L. Moro-Vel ´azquez, and N. Dehak, “Study of Pre-processing Defenses against Adversarial Attacks on State-of-the-art Speaker Recognition Systems,”IEEE Transactions on Information Forensics and Security, vol. 16, pp. 4811–4826, 2021

    2021

  5. [9]

    Representation Learning to Classify and Detect Adversarial Attacks against Speaker and Speech Recognition Systems,

    J. Villalba, S. Joshi, P. ˙Zelasko, and N. Dehak, “Representation Learning to Classify and Detect Adversarial Attacks against Speaker and Speech Recognition Systems,” inINTERSPEECH, 2021, pp. 4304–4308

    2021

  6. [10]

    In- vestigating Robustness of Adversarial Samples Detection for Automatic Speaker Verification,

    X. Li, N. Li, J. Zhong, X. Wu, X. Liu, D. Su, D. Yu, and H. Meng, “In- vestigating Robustness of Adversarial Samples Detection for Automatic Speaker Verification,” inINTERSPEECH, 2020, pp. 1540–1544

    2020

  7. [14]

    Defending against Adver- sarial Audio via Diffusion Model,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Defending against Adver- sarial Audio via Diffusion Model,” inICLR, 2015

    2015

  8. [15]

    FoolHD: Fooling Speaker Identification By Highly Imperceptible Adversarial Disturbances,

    A. S. Shamsabadi, F. S. Teixeira, A. Abad, B. Raj, A. Cavallaro, and I. Trancoso, “FoolHD: Fooling Speaker Identification By Highly Imperceptible Adversarial Disturbances,” inICASSP, 2021, pp. 6159– 6163

    2021

  9. [16]

    Who is Real Bob? Adversarial Attacks on Speaker Recognition Systems,

    G. Chen, S. Chenb, L. Fan, X. Du, Z. Zhao, F. Song, and Y . Liu, “Who is Real Bob? Adversarial Attacks on Speaker Recognition Systems,” in S&P, 2021, pp. 55–72

    2021

  10. [17]

    Speaker-specific Utterance En- semble Based Transfer Attack on Speaker Identification,

    C.-X. Zuo, J.-Y . Leng, and W.-J. Li, “Speaker-specific Utterance En- semble Based Transfer Attack on Speaker Identification,” inINTER- SPEECH, 2022, pp. 3203–3207

    2022

  11. [18]

    Interpretable Spectrum Transformation Attacks to Speaker Recognition Systems,

    J. Yao, H. Luo, J. Qi, and X.-L. Zhang, “Interpretable Spectrum Transformation Attacks to Speaker Recognition Systems,”IEEE/ACM Transactions on Audio, Speech, and Language Processing, vol. 32, pp. 1531–1545, 2024

    2024

  12. [19]

    Real-time, Universal, and Robust Adversarial Attacks against Speaker Recognition Systems,

    Y . Xie, C. Shi, Z. Li, J. Liu, Y . Chen, and B. Yuan, “Real-time, Universal, and Robust Adversarial Attacks against Speaker Recognition Systems,” inICASSP, 2020, pp. 1738–1742

    2020

  13. [20]

    CommanderSong: A Systematic Approach for Practical Adversarial V oice Recognition,

    X. Yuan, Y . Chen, Y . Zhao, Y . Long, X. Liu, K. Chen, S. Zhang, H. Huang, X. Wang, and C. A. Gunter, “CommanderSong: A Systematic Approach for Practical Adversarial V oice Recognition,” inUSENIX Security, 2018, pp. 49–64

    2018

  14. [21]

    Black-Box Adversarial Attacks on Commercial Speech Platforms with Minimal Information,

    B. Zheng, P. Jiang, Q. Wang, Q. Li, C. Shen, C. Wang, Y . Ge, Q. Teng, and S. Zhang, “Black-Box Adversarial Attacks on Commercial Speech Platforms with Minimal Information,” inCSS, 2021, p. 86–107

    2021

  15. [22]

    QFA2SR: Query-Free Ad- versarial Transfer Attacks to Speaker Recognition Systems,

    G. Chen, Y . Zhang, Z. Zhao, and F. Song, “QFA2SR: Query-Free Ad- versarial Transfer Attacks to Speaker Recognition Systems,” inUSENIX Security, 2023, pp. 2437–2454

    2023

  16. [23]

    Effective and Inconspicuous Over-the-air Adversarial Examples with Adaptive Filtering,

    P. O’Reilly, P. Awasthi, A. Vijayaraghavan, and B. Pardo, “Effective and Inconspicuous Over-the-air Adversarial Examples with Adaptive Filtering,” inICASSP, 2022, pp. 6607–6611

    2022

  17. [24]

    UTIO: Universal, Targeted, Im- perceptible and Over-the-air Audio Adversarial Example,

    C. Zhao, Z. Li, H. Ding, and W. Xi, “UTIO: Universal, Targeted, Im- perceptible and Over-the-air Audio Adversarial Example,” inICPADS, 2023, pp. 346–353

    2023

  18. [26]

    Towards Deep Learning Models Resistant to Adversarial Attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards Deep Learning Models Resistant to Adversarial Attacks,” inICLR, 2018

    2018

  19. [27]

    Amphion: An Open-Source Audio, Music and Speech Generation Toolkit,

    X. Zhang, L. Xue, Y . Gu, Y . Wang, H. He, C. Wang, X. Chen, Z. Fang, H. Chen, J. Zhang, T. Y . Tang, L. Zou, M. Wang, J. Han, K. Chen, H. Li, and Z. Wu, “Amphion: An Open-Source Audio, Music and Speech Generation Toolkit,”arXiv preprint arXiv:2312.09911, 2024

    2024 arXiv

  20. [28]

    Emilia: An Extensive, Multilingual, and Diverse Speech Dataset for Large-Scale Speech Generation,

    H. He, Z. Shang, C. Wang, X. Li, Y . Gu, H. Hua, L. Liu, C. Yang, J. Li, P. Shi, Y . Wang, K. Chen, P. Zhang, and Z. Wu, “Emilia: An Extensive, Multilingual, and Diverse Speech Dataset for Large-Scale Speech Generation,”arXiv preprint arXiv:2407.05361, 2024

    2024 arXiv

  21. [29]

    Wave-U-Net: A Multi-scale Neural Network for End-to-end Audio Source Separation,

    D. Stoller, S. Ewert, and S. Dixon, “Wave-U-Net: A Multi-scale Neural Network for End-to-end Audio Source Separation,” inISMIR, 2018, pp. 334–340

    2018

  22. [30]

    Deep One-class Classification,

    L. Ruff, R. Vandermeulen, N. Goernitz, L. Deecke, S. A. Siddiqui, A. Binder, E. M ¨uller, and M. Kloft, “Deep One-class Classification,” inICML, 2018, pp. 4393–4402

    2018

  23. [31]

    Wav2vec 2.0: A Framework for Self-supervised Learning of Speech Representations,

    A. Baevski, Y . Zhou, A. Mohamed, and M. Auli, “Wav2vec 2.0: A Framework for Self-supervised Learning of Speech Representations,” Advances in Neural Information Processing Systems, vol. 33, pp. 12 449–12 460, 2020

    2020

  24. [32]

    Self-supervised Speech Representation Learning: A Review,

    A. Mohamed, H.-y. Lee, L. Borgholt, J. D. Havtorn, J. Edin, C. Igel, K. Kirchhoff, S.-W. Li, K. Livescu, L. Maaløeet al., “Self-supervised Speech Representation Learning: A Review,”IEEE Journal of Selected Topics in Signal Processing, vol. 16, no. 6, pp. 1179–1210, 2022

    2022

  25. [33]

    Libri-Light: A Benchmark for Asr with Limited Or No Supervision,

    J. Kahn, M. Riviere, W. Zheng, E. Kharitonov, Q. Xu, P. Mazare, J. Karadayi, V . Liptchinsky, R. Collobert, C. Fuegen, T. Likhomanenko, G. Synnaeve, A. Joulin, A. Mohamed, and E. Dupoux, “Libri-Light: A Benchmark for Asr with Limited Or No Supervision,” inICASSP, 2020

    2020

  26. [34]

    V oxCeleb2: Deep Speaker Recognition,

    J. S. Chung, A. Nagrani, and A. Zisserman, “V oxCeleb2: Deep Speaker Recognition,” inINTERSPEECH, 2018

    2018

  27. [35]

    A Kernel Method for the Two-sample-problem,

    A. Gretton, K. Borgwardt, M. Rasch, B. Sch ¨olkopf, and A. Smola, “A Kernel Method for the Two-sample-problem,”Advances in Neural Information Processing Systems, vol. 19, 2006

    2006

  28. [36]

    ECAPA-TDNN: Emphasized Channel Attention, Propagation and Aggregation in Tdnn Based Speaker Verification,

    B. Desplanques, J. Thienpondt, and K. Demuynck, “ECAPA-TDNN: Emphasized Channel Attention, Propagation and Aggregation in Tdnn Based Speaker Verification,” inINTERSPEECH, 2020, pp. 3830–3834

    2020

  29. [37]

    X- Vectors: Robust Dnn Embeddings for Speaker Recognition,

    D. Snyder, D. Garcia-Romero, G. Sell, D. Povey, and S. Khudanpur, “X- Vectors: Robust Dnn Embeddings for Speaker Recognition,” inICASSP, 2018, pp. 5329–5333

    2018

  30. [38]

    The Ins and Outs of Speaker Recognition: Lessons From V oxsrc 2020,

    Y . Kwon, H.-S. Heo, B.-J. Lee, and J. S. Chung, “The Ins and Outs of Speaker Recognition: Lessons From V oxsrc 2020,” inICASSP, 2021, pp. 5809–5813

    2020

  31. [39]

    Pushing the Limits of Raw Waveform Speaker Recognition,

    J. weon Jung, Y . Kim, H.-S. Heo, B.-J. Lee, Y . Kwon, and J. S. Chung, “Pushing the Limits of Raw Waveform Speaker Recognition,” inINTERSPEECH, 2022, pp. 2228–2232

    2022

  32. [40]

    V oxCeleb: A Large-scale Speaker Identification Dataset,

    A. Nagrani, J. S. Chung, and A. Zisserman, “V oxCeleb: A Large-scale Speaker Identification Dataset,” inINTERSPEECH, 2017, pp. 2616– 2620

    2017

  33. [41]

    CSTR VCTK Corpus: English Multi-speaker Corpus for CSTR V oice Cloning Toolkit,

    C. Veaux, J. Yamagishi, and K. MacDonald, “CSTR VCTK Corpus: English Multi-speaker Corpus for CSTR V oice Cloning Toolkit,” 2016

    2016

  34. [42]

    Parallel Wavegan: A Fast Waveform Generation Model Based on Generative Adversarial Networks with Multi-resolution Spectrogram,

    R. Yamamoto, E. Song, and J.-M. Kim, “Parallel Wavegan: A Fast Waveform Generation Model Based on Generative Adversarial Networks with Multi-resolution Spectrogram,” inICASSP, 2020, pp. 6199–6203

    2020

  35. [43]

    Visualizing Data Using T-SNE

    L. Van der Maaten and G. Hinton, “Visualizing Data Using T-SNE.” Journal of Machine Learning Research, vol. 9, no. 11, 2008

    2008

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.