Spoof detection using time-delay shallow neural network and feature switching

TL;DR

This paper introduces a time-delay shallow neural network (TD-SNN) for detecting spoofed speech in voice biometrics, effectively handling variable-length utterances and improving detection performance over traditional GMM methods.

Contribution

The paper proposes a novel TD-SNN approach that manages variable-length inputs and combines feature switching to enhance spoof detection accuracy in voice biometrics.

Findings

TD-SNN outperforms GMM in physical access spoof detection.

Feature switching significantly improves overall detection performance.

Best system achieves nearly 50% relative improvement over baseline GMMs.

Abstract

Detecting spoofed utterances is a fundamental problem in voice-based biometrics. Spoofing can be performed either by logical accesses like speech synthesis, voice conversion or by physical accesses such as replaying the pre-recorded utterance. Inspired by the state-of-the-art \emph{x}-vector based speaker verification approach, this paper proposes a time-delay shallow neural network (TD-SNN) for spoof detection for both logical and physical access. The novelty of the proposed TD-SNN system vis-a-vis conventional DNN systems is that it can handle variable length utterances during testing. Performance of the proposed TD-SNN systems and the baseline Gaussian mixture models (GMMs) is analyzed on the ASV-spoof-2019 dataset. The performance of the systems is measured in terms of the minimum normalized tandem detection cost function (min-t-DCF). When studied with individual features, the TD-SNN system consistently outperforms the GMM system for physical access. For logical access, GMM surpasses TD-SNN systems for certain individual features. When combined with the decision-level feature switching (DLFS) paradigm, the best TD-SNN system outperforms the best baseline GMM system on evaluation data with a relative improvement of 48.03\% and 49.47\% for both logical and physical access, respectively.

Tables

Table 1. Table 1 : Number of trials in development and training subsets

Attack	Subsets	No. of speakers		No. of trials
		Male	Female	Bonafide	Spoofed
LA	train	8	12	2580	22800
	dev	8	12	2548	22296
	eval	-	-	7355	63822
PA	train	8	12	5400	48600
	dev	8	12	5400	24300
	eval	-	-	18090	116640

Table 2. Fig. 2 : Comparison of proposed network embeddings trained using cross-entropy loss and focal loss. The LA development subset of ASV-spoof-2019 dataset is used to generate this plot.

Fig. 2: Comparison of proposed network embeddings trained using cross-entropy loss and focal loss. The LA development subset of ASV-spoof-2019 dataset is used to generate this plot.

Table 2: List of developed systems. Type System System Name GMM TD-SNN Single Baseline G-CQCC x-CQCC G-LFCC x-LFCC G-IMFCC x-IMFCC G-LFBE x-LFBE DLFS Primary G-Prim x-Prim Contrastive-1 G-C1 x-C1 Contrastive-2 G-C2 x-C2 DLFS1 G-DLFS1 x-DLFS1 DLFS2 G-DLFS2 x-DLFS2 The systems submitted to ASV-spoof-2019 challenge are highlighted in grey color.

Table 3. Table 3 : Performance (in min-t-DCF) of various GMM-based SDS submitted to ASV-spoof-2019 challenge

System Type	Attack Type	System Name	Feature	Dev Data	Eval Data
Single	LA	G-LFBE	LFBE	0.0077	0.2059
	PA	G-IMFCC	IMFCC	0.1396	0.1518
Primary	LA	G-Prim	CQCC$\mid$LFBE	0.0002	0.1333
	PA	G-Prim	CQCC$\mid$IMFCC $\mid$LFBE	0.1236	0.1330
Contrastive-1	LA	G-C1	IMFCC$\mid$LFBE	0.0003	0.1565
	PA	G-C1	CQCC$\mid$LFCC	0.1226	0.1401
Contrastive-2	LA	G-C2	CQCC$\mid$LFCC	0.0013	0.2139
	PA	G-C2	CQCC$\mid$LFBE	0.1821	0.1672
The symbol ‘$\mid$‘ represents exclusive-OR. A$\mid$B implies that either feature A (OR) B will be chosen for each trial.

Table 4. Table 4 : Performance of various spoof detection systems. Systems with best performance in each category are highlighted in grey color.

System Type	System Name	Logical access					Physical access
		Feature	Development Data		Evaluation Data		Development Data		Evaluation Data		Feature
			min-t-DCF	EER	min-t-DCF	EER	min-t-DCF	EER	min-t-DCF	EER
Single	G-CQCC	CQCC	0.0123	0.43	0.2366	9.57	0.1953	9.87	0.2454	11.04	CQCC
	x-CQCC		0.0164	0.54	0.154	6.93	0.3039	12.98	0.3148	11.83
	G-LFCC	LFCC	0.0663	2.71	0.2116	8.09	0.2555	11.96	0.3017	13.54	LFCC
	x-LFCC		0.0062	0.28	0.164	6.29	0.1231	4.53	0.1314	4.79
	G-IMFCC†	IMFCC	0.0012	0.04	0.2401	10.62	0.2078	9.19	0.3085	12.10	IMFCC
	x-IMFCC		0.0285	1.08	0.4020	18.95	0.1396	5.28	0.1518	5.58
	G-LFBE∗	LFBE	0.0077	0.32	0.2059	10.65	0.2581	11.47	0.3708	15.79	LFBE
	x-LFBE		0.0561	1.88	0.265	11.12	0.1818	7.39	0.1766	6.99
DLFS	G-Prim∗†	CQCC $\mid$ LFBE	0.0002	0.01	0.1333	6.14	0.1888	8.17	0.2767	11.28	CQCC $\mid$ IMFCC $\mid$ LFBE
	x-Prim		0.0139	0.47	0.175	8.52	0.1236	4.85	0.133	4.91
	G-C1∗†	IMFCC $\mid$ LFBE	0.0003	0.04	0.1565	6.46	0.1972	7.53	0.2309	9.33	CQCC $\mid$ LFCC
	x-C1		0.0040	0.16	0.296	14.52	0.1226	4.56	0.140	5.05
	G-C2∗†	CQCC $\mid$ LFCC	0.0013	0.04	0.2139	9.04	0.2329	8.48	0.3058	11.34	CQCC $\mid$ LFBE
	x-C2		0.0142	0.47	0.107	5.75	0.1821	7.54	0.167	6.46
	G-DLFS1	CQCC$\mid$ IMFCC $\mid$ LFCC	0.0026	0.19	0.2070	8.92	0.1548	7.61	0.2260	9.99	CQCC $\mid$ IMFCC $\mid$ LFCC
	x-DLFS1		0.0033	0.14	0.142	7.50	0.1171	4.13	0.130	5.61
	G-DLFS2	LFCC$\mid$ IMFCC $\mid$ LFBE	0.0035	0.15	0.1780	7.92	0.3209	10.61	0.2838	13.23	LFCC $\mid$ IMFCC $\mid$ LFBE
	x-DLFS2		0.0166	0.31	0.208	11.21	0.1230	4.43	0.124	4.42
Systems marked with ∗ and † were submitted to ASV-spoof-2019 challenge under LA and PA conditions respectively. The symbol ‘$\mid$‘ represents exclusive-OR. A$\mid$B implies that either feature A (OR) B will be chosen for each trial.

Table 5. Table 5 : Relative improvement of t-DCF: Logical Access and Physical Access (evaluation data)

System Type	Attack Type	System Name	t-DCF	R.I (in %)
DLFS Systems	LA	G-C2 vs x-C2	0.2139 vs 0.1070	49.97
	PA	G-DLFS2 vs x-DLFS2	0.2383 vs 0.1240	47.96
Best Baseline System vs Best Proposed System	LA	G-LFBE vs x-C2	0.2059 vs 0.1070	48.03
	PA	G-CQCC vs x-DLFS2	0.2454 vs 0.1240	49.47

Equations

$$\mathcal{F}(p,y)=-\alpha \left[y(1-p{)}^{\gamma }log(p)+(1-y)(p{)}^{\gamma }log(p)\right]$$

$$\mathcal{S}(t)=\Lambda ({\lambda }_B(t))-\Lambda ({\lambda }_S(t))$$

Full text

Index Terms: anti-spoofing, voice-biometrics, GMM, x-vectors, time-delay neural networks

1 Introduction

Although automatic speaker verification (ASV) systems are robust to impostor threats [1] and acoustic variations, they are vulnerable when subjected to presentation attacks. Presenting a fake biometric sample to a biometric detection system is referred to as a presentation attack111https://www.iso.org/standard/53227.html. The process of this deliberate evasion is called spoofing. Spoofing at sample acquisition stage can be classified into two categories, namely, logical access (LA) and physical access (PA) [2]. Spoofing samples generated using speech synthesis (SS) or voice conversion (VC) approach are categorized as LA while replaying a pre-recorded original audio falls under the PA category. The primary objective of ASV-spoof-challenge proposed in 2015 was to detect LA. Since the implementation of PA is easier than LA, the former attack is a greater threat than later. ASV-spoof-challenge in 2017 focused on identifying physical access. Numerous spoof detection algorithms have been proposed since then for both LA [3, 4, 5] and PA [6, 7, 8].

ASV-spoof-2019 challenge focused on detecting spoofed utterances synthesized by both LA and PA. Unlike the previous anti-spoofing challenges, equal error rate (EER) was not used as the evaluation metric due to its ill-suited operating point for user applications like telephone banking [9]. Hence a new metric termed as a minimum normalized tandem detection cost function (min-t-DCF) is provided as the evaluation metric. The min-t-DCF considers the false alarms and misses for both countermeasure system as well as the automatic speaker verification (ASV) system, along with the prior probabilities of target and spoof trials. The details of min-t-DCF is discussed in  [10, 9]. Scores from a x-vector based speaker verification system [11] are used along with the statistics of the spoof detection system to estimate min-t-DCF. x-vector is a DNN based state-of-the-art speaker verification technique that embeds the speaker characteristics in low-dimensional fixed-length vectors from variable length utterances.

In this paper, inspired by the x-vector based ASV system, we propose a similar spoof detection system for identifying both logical and physical access. For detecting spoofed utterances, the following changes are made to the time-delay neural network architecture (x-vector) proposed in [11]: (i) The last layer in the ASV system’s architecture is modified to handle the two-class problem of spoof detection. (ii) Instead of the standard cross-entropy loss function, a new focal loss function [12] is used to give more focus on hard and misclassified examples (iii) The network was made shallow since this is binary classification problem with limited data. The proposed network outperforms the baseline GMM classifier for physical access almost in all the cases. On the other hand, the proposed system is not consistently outperforming the GMM classifier while detecting logical access. Instead of conventional score fusion, decision-level feature switching (DLFS) system proposed for ASV-spoof-2017 dataset [8] is used to exploit the property of different features in capturing different kinds of spoofing conditions. The focus of this paper is three-fold: Firstly, a comparison of baseline GMM system using four different features on ASV-spoof-2019 challenge is discussed. Secondly, we propose a novel neural network architecture for spoof detection system inspired by state-of-the-art ASV system (x-vector [11]). Finally, by using DLFS on individual feature system, the performance of spoof detection systems (SDS) is further improved.

The rest of the paper is organized as follows: Section 2 discusses the details of spoof detection approaches in the literature. A brief description of ASV-spoof-2019 dataset is given in Section 3. Section 4 gives a brief overview of the x-vector based ASV system. The proposed architecture for spoof detection is explained in Section 5. Section 6 discusses the details of baseline GMM systems, the proposed systems, and the DLFS systems. A comprehensive analysis on the performance of various systems is given in Section 7 followed by the conclusion in Section 8.

2 Prior works on spoof detection

The ASV-spoof-2015 challenge targeted ten different types of logical access [13]. A combination of auditory transformation based on cochlear filter cepstral coefficients (CFCC) and instantaneous frequency (IF) termed as CFCCIF is proposed as the best feature to detect these LAs in [5]. Score fusion of CFCCIF and MFCC was adjudged as the best system with an average EER of $1.2\%$ across all the ten conditions. Various LA spoof detection systems submitted to the challenge are detailed in [4].

The speech corpus used in ASV-spoof-2017 challenge has the spoofed instances generated by recording and replaying the bonafide trials of speakers in different environments (E) using various recording (R) and playback devices (P). Physical attack is harder than logical access as the spoofed utterance of a bonafide trial may come from various E-R-P combinations. The evaluation subset of the ASV-spoof-2017 dataset tried to simulate this ‘in-wild’ condition by generating the spoofed instances from different E-R-P combinations. A light convolutional neural network (LCNN) [14] system outperformed all other systems submitted to the challenge. In [7] an end-to-end neural network (NN) with attention masking was proposed to learn the difference in the spectrogram of bonafide and the replayed utterances. This end-to-end attention masking system pre-trained on ImageNet dataset [15] gives an ideal performance with zero percent EER. DLFS paradigm proposed in [8], uses information from multiple feature spaces. This technique outperforms all other replay attack detection systems in the literature except the ideal NN system with zero percent EER.

Many recent works on ASV-spoof-2019 dataset uses various end-to-end neural network (NN) structures like DNN with nine layers [16], variations of ResNet [17], namely, Squeeze-network (SENet), dilated ResNet, and light convolution neural network (LCNN) [18]. The NN architectures used in these works are deep NNs with a minimum of seven layers excluding the input, pooling, and output layers. The SENet architecture in [17] uses four blocks of NN architecture with several layers of CNN/RNN in each block.

3 Dataset Description

Similar to the ASV-spoof-2015 and ASV-spoof-2017 corpus, [19] ASV-spoof-2019 also has three subsets namely, training (train), development (dev), and evaluation (eval). Different subsets of data are used for LA and PA attacks. The duration of each utterance is approximately two seconds. Unlike the “in-wild” spoofed trials of the ASV-spoof-2017 corpus, in this dataset, the spoofed trials for physical access are generated in controlled acoustic conditions [20]. The latest best performing text-to-speech synthesis and voice conversion algorithms are used to generate the spoofed trials for logical access category. These algorithms are better than the algorithms used in ASV-spoof-2015. The number of trials in each subset is listed in the Table 1. The number of trials in evaluation subsets of LA and PA are 71,747 and 137,457, respectively.

4 x-vectors in speaker recognition

i-vectors were the state-of-the-approach for text-independent speaker recognition since 2010 [21]. An alternate approach proposed in [22] extracts DNN embeddings termed as x-vectors from a NN using a temporal pooling layer. This pooling layer facilitates the NN to discriminate the speakers from variable-length input speech segments. During testing, the fixed dimensional x-vectors are extracted and are compared with the training data embeddings using some scoring approach.

Speaker embeddings are extracted in  [22] from variable length acoustic segments using a DNN with a multi-class cross-entropy loss function. The DNN consists of few time-delay neural network (TDNN) layers to enhance frame-level representation. A pooling layer aggregates the frame-level representations, followed by few additional layers to handle segment-level representations. Finally, a softmax layer is used to get posterior probabilities of each speaker. This approach mainly aims (i) to produce the speaker embeddings at utterance level rather than frame level and (ii) to generalize well, to handle the unseen speakers. The main advantage of this x-vector architecture is to handle the short duration utterances. x-vector results in [22] are shown to outperform the i-vector systems for short utterances of duration less than 10 seconds.

5 TD-SNN for spoof detection

Generally, speaker information is present throughout the utterance. Inspired by this concept, x-vector architecture was proposed for automatic speaker recognition in [11, 22]. The x-vector embeddings are obtained by averaging various statistics across time in a high-dimensional space. Similar to the speaker characteristics, the impact of various spoofing approaches used to generate the spoofed trials will be present throughout the utterance. X-vector proposed for ASV [11, 22], is trained using the speaker labels to extract the speaker embeddings from the data. In this work, we show that the same x-vector model can be used for spoof detection by training the NN using the class labels (bonafide and spoofed) rather than the speaker labels. The results show that the model in fact captures the characteristics of spoofing approaches embedded in the spoofed utterances.

x-vector proposed for ASV in [22] uses eight hidden layers. Unlike ASV x-vector architecture and few other neural network architectures for spoof detection [18, 17, 23, 24], we propose a time-delay shallow neural network with just four hidden layers, which includes two hidden layers at frame-level, a pooling layer to aggregate the statistics at the utterance level, and a penultimate layer to reduce the dimension. Time-delay neural network is used for the first time to detect the spoofing attacks.

The proposed architecture for spoof detection is shown in Figure 1. This architecture is referred to as time-delay shallow neural network (TD-SNN) in rest of this paper. The first two layers are frame-level layers and use time-delay neural networks. These layers convert the input feature vectors into high-dimensional vectors by preserving temporal information. The third layer averages information across time by estimating mean and standard deviation, thereby converting the inputs of variable length into a fixed length, high-dimensional vector. The fourth hidden layer reduces this high-dimensional vector to a low-dimensional representation. Since spoof detection is a binary classification problem, a soft-max layer with two outputs is used as the last layer, to get the classification posteriors of a trial. These posterior values are used to classify the trials either as bonafide or spoofed. The embeddings extracted from the penultimate layer can also be used to identify the spoofed utterances using a back-end classifier.

Instead of the standard cross-entropy error, the focal loss function is used in this work. Focal loss was first proposed for object detection task in [12]. The focal loss reshapes the cross-entropy loss such that it gives more importance for hard-to-classify and misclassified examples. The focal loss is a better loss function for the class imbalance problem (Refer to the Table 1 for imbalance in the dataset). The focal loss is estimated as shown in Equation 1.

[TABLE]

In Equation 1, $y$ is the ground truth class label, and $p$ is the posterior probability given by a neural network. $\alpha$ and $\gamma$ are hyper-parameters in this loss function. Setting $\gamma$ to zero reduces focal loss to the standard cross-entropy loss. In Figure 2, the 2D representation of DNN embeddings obtained from the proposed network trained using the cross-entropy loss and the focal loss are compared. DNN embeddings are converted to 2D space using t-Distributed Stochastic Neighbor Embedding (t-SNE) algorithm [25]. It can be observed that focal loss produces better embeddings with lesser inter-class overlap than the standard cross-entropy error.

In ASV, the x-vector architecture uses the raw filter bank energies as the input. Borrowing from the ASV approaches, the same filter bank energies were given as input to the TD-SNN framework. As the performance was poor, the focus is shifted to use different features for building a better classifier.

6 Spoof detection systems (SDS)

Several attempts have been made to train an efficient classifier for spoof detection. The most common classifiers used for the purpose are GMMs and DNNs. Although there are few works with SVMs [26] and i-vectors [27], the performance is worse than that of the GMM and DNN classifiers. Hence in this work, we use both GMM and TD-SNN classifiers to detect spoofed trials. GMM-based systems with a set of features were explored, and best performing four systems were submitted to the ASV-spoof-2019 challenge. The TD-SNN systems were developed post-challenge. The performance of the TD-SNN systems is compared with the submitted GMM-based SDS using both development and evaluation data.

6.1 Single feature systems

GMM classifier has been the baseline system for all the ASV spoof challenges conducted from 2015 to 2019. Bonafide and spoofed trials from the training subset are used to train two GMMs, one for the bonafide ($\lambda_{B}$) and other for the spoofed class ($\lambda_{S}$). During testing, a trial $t$ is given to $\lambda_{B}$ and $\lambda_{S}$, and the log-likelihood ($\Lambda$) difference is computed as

[TABLE]

The log-likelihood difference is considered as the final score for the trial $t$. This simple classifier gave an EER of $1.44\%$ and $7.82\%$ on the evaluation data of ASV-spoof-2015 [5] and ASV-spoof-2017 [8] respectively. GMM-SDS with a set of cepstral coefficients and filterbank energies were explored for the ASV-spoof-2019 challenge. The GMM systems with constant-Q cepstral coefficients (CQCC) [28, 29], inverse Mel frequency cepstral coefficients (IMFCC) [30], linear frequency cepstral coefficients (LFCC) [31], and linear filterbank energy (LFBE) gave better performance than few other features like Mel frequency cepstral coefficients (MFCC), inverse Mel filterbank energies (IMFBE), and Mel filterbank energies (MFBE). To compare the performance of TD-SNN systems with that of the baseline GMM systems, TD-SNN systems were also developed with the same set of features.

6.2 Feature switching systems

Almost every spoof detection system uses a score fusion of many single feature based system as the primary system [4, 6]. This clearly shows that different features are required to detect different spoofing conditions. Instead of the conventional score fusion approach, a decision-level feature switching (DLFS) approach proposed in [8] is used here. For a given trial, DLFS essentially chooses the decision score from a set of individual features, that has maximum discrimination between the bonafide and the spoofed model. In this work, DLFS is implemented with four best performing individual feature based system for both GMM and TD-SNN frameworks. The list of systems developed for this work is listed in Table 5. Features used in primary and contrastive DLFS systems vary for logical access and physical access. Table 3 shows the results of the GMM-based SDS systems submitted to the challenge.

7 Result Analysis

The TD-SNN for LA and PA spoof detection is trained only on the corresponding training subsets. To avoid the problem of over-fitting, twenty percentage of training data is used as the validation subset. This TD-SNN is used to test trials from development and evaluation subset. The performance of all SDS on the development and evaluation data are listed in Table 4. The best performing system is chosen based on the min-t-DCF metric [10, 9]. G-CQCC and G-LFCC are the single feature based baseline systems provided along with the challenge dataset. Results reported in Table 4 shows that the performance of the proposed system over the baseline GMM systems under LA category is not consistent across various features. On the other hand, the TD-SNN systems consistently give good performance for PA than the GMM systems. One possible reason could be that, unlike LA, the PA category have enough amount of data (refer Table 1) to train the neural network. Since TD-SNN SDS performs well for all the cases, we can conclude it as a more suitable classifier for detecting physical access spoofing. The performance of the SDS is further improved by applying DLFS as shown in the Table 4.

Apart from the systems submitted to the challenge, DLFS with new feature combinations are reported in the table as G-DLFS and x-DLFS. The comparison of best performing TD-SNN system is compared with the corresponding GMM system with same feature combination and the best performing GMM system in Table 5. From the result analysis of both LA and PA, we can conclude that TD-SNN framework can be a potential model to detect all types of spoofing attacks. It also justifies our assumption that TD-SNN better identifies the traces of spoof mechanism in the spoofed utterances than the GMM. Moreover, since x-vector is the current state-of-the-art for ASV, a spoof detection system with a similar framework, will help us to make a common NN framework for spoof detection as well as speaker recognition.

8 Conclusion

Spoofed utterances contain traces of approaches used to generate them. The ability of x-vector based NN to capture the utterance level information is established in the field of speaker verification. Hence, in this work, an attempt has been made to develop spoof detection systems using a similar TDNN framework. A time-delay shallow neural network (TD-SNN) with focal-loss function is proposed as the neural network architecture for spoof detection. On ASV-spoof-2019 dataset, the proposed TD-SNN based SDS outperforms all the GMM based SDS in case of PA, whereas GMM based SDS performs well for LA in some of the cases. Further, DLFS paradigm is used to improve the performance of single feature based SDS. The best performing TD-SNN SDS with DLFS outperforms the best performing GMM-DLFS SDS with a relative improvement of 48.03% and 49.47% for LA and PA in terms of min-t-DCF, respectively.