The DOI matches its Crossref record.
Malafide: a novel adversarial convolutive noise attack against deepfake and spoofing detection systems
Open accessAbstract
We present Malafide, a universal adversarial attack against automatic speaker verification (ASV) spoofing countermeasures (CMs). By introducing convolutional noise using an optimised linear time-invariant filter, Malafide attacks can be used to compromise CM reliability while preserving other speech attributes such as quality and the speaker's voice. In contrast to other adversarial attacks proposed recently, Malafide filters are optimised independently of the input utterance and duration, are tuned instead to the underlying spoofing attack, and require the optimisation of only a small number of filter coefficients. Even so, they degrade CM performance estimates by an order of magnitude, even in black-box settings, and can also be configured to overcome integrated CM and ASV subsystems. Integrated solutions that use self-supervised learning CMs, however, are more robust, under both black-box and white-box settings.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Malafide aims to compromise CM performance, while Malacopula escalates the threat of spoofed data to ASV.
“The former aims to compromise the performance of CMs, while the latter escalates the threat of spoofed data to ASV.”
From ASVspoof 5: crowdsourced speech data, deepfakes, and adversarial attacks at scale (2024) · cites this paper as [13]
Section 3 describes Malafide filters as designed to make spoofed utterances evade countermeasures, supporting the claim about CM performance. The paper does not mention Malacopula, so it cannot support the claim about that attack. Section 6 discusses effects on ASV, but attributes them to spoofing attacks used alongside Malafide, not to Malacopula. (LLM, conf=0.88)
Experimental — accuracy not yet measuredAdversarial attacks in ASVspoof 5 were created using Malafide and Malacopula filtering.
“Adversarial attacks, applied to augment the threat of spoofing attacks, were created using Malafide [13] and Malacopula [14] filtering.”
From ASVspoof 5: crowdsourced speech data, deepfakes, and adversarial attacks at scale (2024) · cites this paper as [13]
Less costly, more universal adversarial attacks have been reported.
“Though still designed for a specific CM/ASV system, less costly, more universal adversarial attacks, have also been reported (Panariello et al., 2023; Todisco et al., 2024).”
From ASVspoof 5: Design, collection and validation of resources for spoofing, deepfake, and adversarial attack detection using crowdsourced speech (2026) · cites this paper as Panariello et al., 2023
Adversarial modules used in ASVspoof 5 are trainable, convolutive filters that target a specific CM system or a specific ASV system.
“Adversarial modules are trainable, convolutive filters which target a specific CM system (Panariello et al., 2023) or a specific ASV system (Todisco et al., 2024).”
From ASVspoof 5: Design, collection and validation of resources for spoofing, deepfake, and adversarial attack detection using crowdsourced speech (2026) · cites this paper as Panariello et al., 2023
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Still being checked.
Research works printed but not linked: 32
- R. Tolosana, M. Gomez-Barrero, C. Busch, and J. Ortega-Garcia, "Biometric presentation attack detection: Beyond the visible spectrum," IEEE Transactions on Information Forensics and Se- curity, vol. 15, pp. 1261-1275, 2019.
- A. George, Z. Mostaani, D. Geissenbuhler, O. Nikisins, A. Anjos, and S. Marcel, "Biometric face presentation attack detection with multi-channel convolutional neural network," IEEE Transactions on Information Forensics and Security, vol. 15, pp. 42-55, 2019.
- J. Yamagishi, X. Wang, M. Todisco, M. Sahidullah, J. Patino, A. Nautsch, X. Liu, K. A. Lee, T. Kinnunen, N. Evans, and H. Del- gado, "ASVspoof 2021: Accelerating progress in spoofed and deepfake speech detection," in Proc. ASVspoof 2021 Workshop, 2021, pp. 47-54.
- J.-w. Jung, H. Tak, H.-j. Shim, H.-S. Heo, B.-J. Lee, S.-W. Chung, H.-J. Yu, N. Evans, and T. Kinnunen, "SASV 2022: The first spoofing-aware speaker verification challenge," in Proc. Inter- speech 2022, 2022, pp. 2893-2897.
- X. Wang and J. Yamagishi, "Investigating self-supervised front ends for speech spoofing countermeasures," in Proc. Speaker Odyssey Workshop, 2022, pp. 100-106.
- H. Tak, M. Todisco, X. Wang, J.-w. Jung, J. Yamagishi, and N. Evans, "Automatic speaker verification spoofing and deepfake detection using wav2vec 2.0 and data augmentation," in Proc. Speaker Odyssey Workshop, 2022, pp. 112-119.
- J.-w. Jung, H.-S. Heo, H. Tak, H.-j. Shim, J. S. Chung, B.-J. Lee, H.-J. Yu, and N. Evans, "AASIST: Audio anti-spoofing using integrated spectro-temporal graph attention networks," in Proc. ICASSP 2022, 2022, pp. 6367-6371.
- S. Liu, H. Wu, H.-y. Lee, and H. Meng, "Adversarial attacks on spoofing countermeasures of automatic speaker verification," in 2019 IEEE Automatic Speech Recognition and Understanding Workshop (ASRU), 2019, pp. 312-319.
- Y. Zhang, Z. Jiang, J. Villalba, and N. Dehak, "Black-box attacks on spoofing countermeasures using transferability of adversarial examples," in Proc. Interspeech 2020, 2020, pp. 4238-4242.
- A. Gomez-Alanis, J. A. Gonzalez, and A. M. Peinado, "Adver- sarial transformation of spoofing attacks for voice biometrics," in Proc. IberSPEECH 2021, 2021, pp. 255-259.
- X. Zhang, X. Zhang, W. Liu, X. Zou, M. Sun, and J. Zhao, "Waveform level adversarial example generation for joint attacks against both automatic speaker verification and spoofing coun- termeasures," Engineering Applications of Artificial Intelligence, vol. 116, p. 105469, 2022.
- A. Kassis and U. Hengartner, "Practical attacks on voice spoofing countermeasures," arXiv preprint arXiv:2107.14642, 2021. · arXiv
- H. Wu, S. Liu, H. Meng, and H.-y. Lee, "Defense against ad- versarial attacks on spoofing countermeasures of ASV," in Proc. ICASSP 2020, 2020, pp. 6564-6568.
- P. Neekhara, S. Hussain, P. Pandey, S. Dubnov, J. McAuley, and F. Koushanfar, "Universal adversarial perturbations for speech recognition systems," in Proc. Interspeech 2019, 2019, pp. 481- 485.
- Y. Xie, C. Shi, Z. Li, J. Liu, Y. Chen, and B. Yuan, "Real-time, universal, and robust adversarial attacks against speaker recogni- tion systems," in Proc. ICASSP 2020, 2020, pp. 1738-1742.
- I. J. Goodfellow, J. Shlens, and C. Szegedy, "Explaining and har- nessing adversarial examples," in 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, Y. Bengio and Y. Le- Cun, Eds., 2015.
- N. Carlini and D. Wagner, "Audio adversarial examples: Targeted attacks on speech-to-text," in 2018 IEEE Security and Privacy Workshops (SPW), 2018, pp. 1-7.
- S.-M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard, "Universal adversarial perturbations," in Proc. of the IEEE Con- ference on Computer Vision and Pattern Recognition (CVPR), July 2017.
- P. Neekhara, S. Hussain, P. Pandey, S. Dubnov, J. McAuley, and F. Koushanfar, "Universal adversarial perturbations for speech recognition systems," in Proc. Interspeech 2019, 2019, pp. 481- 485.
- W. Zhang, S. Zhao, L. Liu, J. Li, X. Cheng, T. F. Zheng, and X. Hu, "Attack on practical speaker verification system using uni- versal adversarial perturbations," in Proc. ICASSP 2021, 2021, pp. 2575-2579.
- S. Abdoli, L. G. Hafemann, J. Rony, I. B. Ayed, P. Cardinal, and A. L. Koerich, "Universal adversarial audio perturbations," arXiv preprint arXiv:1908.03173, 2019. · arXiv
- K. He, X. Zhang, S. Ren, and J. Sun, "Delving deep into rec- tifiers: Surpassing human-level performance on imagenet classi- fication," in 2015 IEEE International Conference on Computer Vision (ICCV), 2015, pp. 1026-1034.
- X. Wang, J. Yamagishi, M. Todisco, H. Delgado, A. Nautsch, N. Evans, M. Sahidullah, V. Vestman, T. Kinnunen, K. A. Lee et al., "ASVspoof 2019: A large-scale public database of syn- thetized, converted and replayed speech," Computer Speech & Language, vol. 64, 2020, 101114.
- D. P. Kingma and J. L. Ba, "Adam: A method for stochastic opti- mization," in Proc. of the 3rd International Conference on Learn- ing Representations (ICLR), 2015.
- J.-w. Jung, S.-b. Kim, H.-j. Shim, J.-h. Kim, and H.-J. Yu, "Im- proved RawNet with filter-wise rescaling for text-independent speaker verification using raw waveforms," in Proc. Interspeech 2020, 2020, pp. 1496-1500.
- H. Tak, J. Patino, M. Todisco, A. Nautsch, N. Evans, and A. Larcher, "End-to-end anti-spoofing with RawNet2," in Proc. ICASSP 2021. IEEE, 2021, pp. 6369-6373.
- H. Tak, J. Jung, and J. Patino, "End-to-end spectro-temporal graph attention networks for speaker verification anti-spoofing and speech deepfake detection," in Proc. ASVspoof 2021 work- shop, 2021, pp. 1-8.
- X. Wang and J. Yamagishi, "Investigating self-supervised front ends for speech spoofing countermeasures," in Proc. Speaker Odyssey Workshop, 2022, pp. 100-106.
- Y. Eom, Y. Lee, J. S. Um, and H. Kim, "Anti-spoofing using trans- fer learning with variational information bottleneck," in Proc. In- terspeech 2022, 2022, pp. 3568-3572.
- X. Wang and J. Yamagishi, "Investigating active-learning-based training data selection for speech spoofing countermeasure," in the 2022 IEEE Spoken Language Technology Workshop, 2022, pp. 585-592.
- J. M. Martín-Doñas and A. Álvarez, "The vicomtech audio deep- fake detection system based on wav2vec2 for the 2022 add chal- lenge," in Proc. ICASSP 2022, 2022, pp. 9241-9245.
- A. Babu, C. Wang, A. Tjandra, K. Lakhotia, Q. Xu, N. Goya, K. Singh, P. von Platen, Y. Saraf, J. Pino et al., "XLS-R: Self- supervised cross-lingual speech representation learning at scale," in Proc. Interspeech 2022, 2022, pp. 2278-2282.
Cited by
Sorted by citations
ASVspoof 5: crowdsourced speech data, deepfakes, and adversarial attacks at scale
Wang, X., Delgado, H., Tak, H., Jung, J.-W., Shim, H.-J., Todisco, M., Kukanov, I., Liu, X., Sahidullah, M., Kinnunen, T. H., et al. (2024) · The Automatic Speaker Verification Spoofing Countermeasures Workshop (ASVspoof 2024) · doi:10.21437/asvspoof.2024-1 · Cited by 101
Self-citationBabaei, R., Cheng, S. S. M., Duan, R., & Zhao, S. (2025) · Journal of Sensor and Actuator Networks · doi:10.3390/jsan14010017 · Cited by 89
Wang, X., Delgado, H., Tak, H., Jung, J.-W., Shim, H.-J., Todisco, M., Kukanov, I., Liu, X., Sahidullah, M., Kinnunen, T., et al. (2026) · Computer Speech & Language · doi:10.1016/j.csl.2025.101825 · Cited by 30
Self-citationA comprehensive survey with critical analysis for deepfake speech detection
Pham, L. D., Lam, P., Tran, D., Tang, H., Nguyen, T., Schindler, A., Skopik, F., Polonsky, A., & Vu, H. C. (2025) · Computer Science Review · doi:10.1016/j.cosrev.2025.100757 · Cited by 28
FD-GAN: Generalizable and Robust Forgery Detection via Generative Adversarial Networks
Xu, N., Feng, W., Zhang, T., & Zhang, Y. (2024) · International Journal of Computer Vision · doi:10.1007/s11263-024-02136-1 · Cited by 15
2D-Malafide: Adversarial Attacks Against Face Deepfake Detection Systems
Galdi, C., Panariello, M., Todisco, M., & Evans, N. (2024) · International Conference of the Biometrics Special Interest Group (BIOSIG) · doi:10.1109/biosig61931.2024.10786754 · Cited by 6
Self-citationSpoofing Attack Augmentation: Can Differently-Trained Attack Models Improve Generalisation?
Ge, W., Wang, X., Yamagishi, J., Todisco, M., & Evans, N. (2024) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp48485.2024.10448016 · Cited by 6
Self-citationThe Interpretable and Transferable Adversarial Attack against Synthetic Speech Detectors
Deng, J., Ye, D., Li, J., Liu, Z., Tang, L., & Zhang, Y. (2025) · ACM Transactions on Multimedia Computing Communications and Applications · doi:10.1145/3727341 · Cited by 2
Wang, X., Delgado, H., Evans, N., Liu, X., Kinnunen, T., Tak, H., Lee, K. A., Kukanov, I., Sahidullah, M., Todisco, M., et al. (2026) · IEEE Transactions on Audio Speech and Language Processing · doi:10.1109/taslpro.2026.3682962 · Cited by 4
Self-citationFuture-Proofing Deepfake Detection by Integrating Audio, Video, and Text
Lisena, P., Lee, K. A., Wang, Y., Todisco, M., Galdi, C., Raphaël Troncy, A., Evans, N., Lin, W., Chau, L., & Mak, M. (2026) · ACM AI Letters · doi:10.1145/3797958 · Cited by 1
Self-citationSchäfer, K., & Ludwig, L. (2025) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom66490.2025.00029
Tri-View Collaborative Graph Learning for Robust Deepfake Speech Detection
Zhang, K., Zhao, Y., Hua, Z., Zhang, Y., Liao, Q., & Jiang, W. Y. (2026) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2026.3660668
End-to-End Modeling for Speech Spoofing and Deepfake Detection
Tak, H. (2023) · theses.fr (ABES) · doi:10.70675/aa9fb6cbz3f6az45bcz933fzf95d89893e59
Self-citationLee, Y., Doan, T.-P., Hong, S., & Jung, S. (2026) · PeerJ Computer Science · doi:10.7717/peerj-cs.3744
PLC-CA: Phoneme-Level Component Convolutional Adversarial Attack With High Transferability
Deng, J., Liu, Y., Ye, D., Wei, Z., lin, Y., Zhang, Y., Ye, Z., & Shang, Y. (2026) · IEEE Transactions on Audio Speech and Language Processing · doi:10.1109/taslpro.2026.3684423
Interpreting SSL Representations for Spoof Detection: A WavLM Study
Mallat, M., Panariello, M., Todisco, M., Evans, N., & Larcher, A. (2026) · International Workshop on Biometrics and Forensics (IWBF) · doi:10.1109/iwbf68042.2026.11558152
Self-citation
Metadata
- Authors
- Panariello, M., Ge, W., Tak, H., Todisco, M., & Evans, N.
- Venue
- INTERSPEECH 2023
- Publisher
- ISCA
- Published
- 2023-08-20
- Pages
- 2868-2872
- ISSN
- 2308-457X (ISSN-L)
- OpenAlex
- W4385807439
- Cited by
- 15
- References
- 0
- Citations by year
- 2026: 6 · 2025: 5 · 2024: 3 · 2023: 1
- FWCI
- 1.61
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- cc-by
- Locations
- Interspeech (USB) (publishedVersion)
- arXiv (Cornell University) (submittedVersion, cc-by)
- HAL (submittedVersion, other-oa)
- arXiv (Cornell University) (cc-by)
- Funders
- European Commission (HORIZON2020, 860813)
- Agence Nationale de la Recherche
- Japan Science and Technology Agency
- Topics
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Signal Processing › Biometric Identification and Security
- Keywords
- adversarial attacks, deepfake detection, adversarial perturbations, face anti-spoofing
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
