A new audio adversarial attack based on discrete optimal transport (DOT) poses a significant threat to automatic speaker verification (ASV) and anti-spoofing countermeasure (CM) systems, according to research published on arXiv. The attack, developed by Selitskiy, Anton, Shahriyar, Akib, and Prakasan, Jishnuraj, operates as a black-box method that requires no access to model parameters, gradients, or training data, making it particularly dangerous for deployed systems.
Attack Methodology
The DOT attack functions as a post-processing distribution-alignment step. It uses frame-level WavLM embeddings of generated speech (or another person's speech) and aligns them to an unpaired bona fide speech pool using entropic optimal transport and a top-k barycentric projection, followed by neural vocoding. Unlike gradient-based attacks that need internal model knowledge, DOT only relies on output-level alignment, making it a strong black-box adversarial attack.
Experimental Findings
The researchers conducted experiments on ASVspoof2019 and ASVspoof5 datasets, both standard benchmarks for spoofing detection. Results showed that the DOT attack substantially increases CM equal error rate (EER) and substantially degrades ASV performance across multiple spoofing attack types. Importantly, the attack transfers across datasets and remains effective even after CM fine-tuning, indicating robustness against adaptive defenses.
Analysis using speaker similarity metrics, Fréchet Audio Distance, and visualization of embedding distributions revealed that the attack succeeds by shifting source speech toward bona fide regions of the representation space rather than by maximizing speaker similarity. This means the attack mimics the distribution of legitimate speech, making it harder for countermeasures to detect.
Enterprise Security Implications
The research underscores that optimal-transport-based distribution alignment represents a previously underexplored attack vector for contemporary ASV and anti-spoofing systems. Given that many enterprise applications — including financial services, call centres, and secure access control — increasingly rely on voice biometrics, the findings highlight a critical vulnerability. The attack's black-box nature means it could be deployed against commercial systems without any internal knowledge, lowering the barrier for adversaries.
These results indicate that optimal-transport-based distribution alignment represents a previously underexplored attack vector for contemporary ASV and anti-spoofing systems.
The study emphasizes the need for robust countermeasures capable of defending against distribution-based attacks, not just gradient-based ones. As voice interfaces become more prevalent in supply chain and logistics operations, ensuring the security of these systems is critical. The attack's transferability and resilience to fine-tuning suggest that current defenses may be inadequate, and new detection methods must be developed to address this emerging threat.
