AI Security
Researchers discover optimal transport method as effective audio spoofing attack on voice verification systems
A black-box technique using discrete optimal transport can fool automatic speaker verification and anti-spoofing systems without requiring access to model parameters or training data.
Security researchers have identified a novel vulnerability in speaker verification and anti-spoofing systems: discrete optimal transport (DOT) can be weaponized as a powerful black-box attack that requires no direct access to model internals.
How the Attack Works#
The method operates through post-processing of audio rather than direct model manipulation. Generated or foreign speech is converted into frame-level embeddings using WavLM, a pre-trained speech model. These embeddings are then realigned toward patterns found in legitimate speaker samples using entropic optimal transport and barycentric projection, before being reconstructed into audio via a neural vocoder. Because the approach doesn't depend on gradient-based manipulation, it bypasses a major security assumption: that attackers need visibility into model weights or training procedures.
Performance Against Real Systems#
Testing on ASVspoof2019 and ASVspoof5 benchmark datasets revealed significant impact. The DOT attack substantially raised equal error rates (a key metric for spoofing resistance) in anti-spoofing countermeasures and degraded automatic speaker verification performance across multiple spoofing scenarios. Notably, the attack transfers effectively across different datasets and maintains potency even after anti-spoofing systems undergo fine-tuning defenses.
Why It Succeeds#
The mechanism differs from intuitive assumptions about speaker attacks. Rather than maximizing acoustic similarity to a target speaker, the method succeeds by repositioning source speech within the representation space toward regions occupied by legitimate bona fide samples. This finding emerged from analysis using speaker similarity metrics, Fréchet Audio Distance measures, and visualizations of embedding distributions, suggesting a more subtle vulnerability rooted in decision boundary geometry rather than speaker imitation.
These results highlight optimal transport-based alignment as a previously overlooked attack vector against contemporary voice authentication infrastructure.
