Generalized Fake Audio Detection via Deep Stable Learning

Abstract

Although current fake audio detection approaches have achieved remarkable success on specific datasets, they often fail when evaluated with datasets from different distributions. Previous studies typically address distribution shift by focusing on using extra data or applying extra loss restrictions during training. However, these methods either require a substantial amount of data or complicate the training process. In this work, we propose a stable learning-based training scheme that involves a Sample Weight Learning (SWL) module, addressing distribution shift by decorrelating all selected features via learning weights from training samples. The proposed portable plug-in-like SWL is easy to apply to multiple base models and generalizes them without using extra data during training. Experiments conducted on the ASVspoof datasets clearly demonstrate the effectiveness of SWL in generalizing different models across three evaluation datasets from different distributions.

1 Introduction

Existing synthesis techniques [1, 2] have the capability to create realistic imitations of human voices. What is even more concerning is that automatic speaker verification (ASV) systems [3] are susceptible to various types of spoofing attacks. To establish a more reliable automatic speaker verification system, Fake Audio Detection (FAD) model based on machine learning has emerged which aims to discern whether the input audio is produced by synthesis techniques (spoofed) or human (bona-fide).

While many machine learning approaches perform well under the I.I.D. (i.e., Independent and Identically Distributed) hypothesis, where the evaluation set and training set are independently sampled from the identical distribution. For FAD, there will always be new synthesis techniques and unexpected interferences not included in the training set, resulting in an unavoidable distribution shift in the test set. Therefore, researchers considered the distribution shift scenario when setting up datasets and introduced unseen conditions in the test set. For instance, ASVspoof2019 [4] and ASVspoof2021 [5] datasets exhibit significant domain shifts between the training and evaluation sets due to unseen spoofing attack methods and channel variation, making the datasets suitable for training FAD models and evaluating the generalization of FAD models.

Several studies have explored overcoming the distribution shift conducting experiments on ASVspoof datasets and related literature can be roughly divided in to two strands. One strand explores various training strategies, including multi-task learning [6, 7, 8], fusion-based methods [9, 10, 11], adversarial learning [12, 13], continual learning [14, 15], transfer learning using large pretrained models [16, 17, 18], and contrastive learning [19]. This type of method primarily enhances the training constraints by adding additional losses, implicitly supervising the model to obtain more discriminative features. While this approach can improve the generalization of the base model, it makes the training process intricate. Another strand focuses on the model’s input and can be further subdivided into data integration and data augmentation. Data integration means co-training a FAD model with multi-dataset, often combined with new training strategies, like [20] and [21] respectively introduced strategies named aggregation-separation domain generalization method and adaptive sharpness-aware minimization (ASAM). The basic idea of data integration is plain and simple, but this approach is sometimes effective and indicates no guarantee of improvements of generalization on every other dataset. Additionally, the interferences caused by the different characteristics of datasets remain unknown. Data augmentation uses technical means to modify training set data, making the distribution of the training set as close as possible to the distribution of the test set. For example, RawBoost [22] can be applied to raw audio data to simulate telephone scenarios. In [23], different vocoders are used to create various spoofing attack types of data based on the training set. Data augmentation can achieve good results under the premise of knowing the target distribution, which often cannot be satisfied in real applications.

To address the distribution shift issues and make the FAD model more applicable in more different distributions, this paper proposes a stable learning [24] based training scheme that involves a Sample Weight Learning (SWL) module. The aim of stable learning is to learn a predictive model that can achieve uniformly good performance in any possible environment, which perfectly fits the needs of FAD. The SWL module can be integrated into existing FAD models. This module takes the selected features as input and calculates sample weights to influence the final sample loss. Within the SWL module, we employ an approach based on Random Fourier Features (RFF) [25] to decorrelate all input features and utilize an iterative optimization approach [26] to gradually approximate global sample weights by iteratively optimizing local sample weights. Importantly, this module can be used as a portable plug-in during training and does not participate in the model’s inference process. Experimental results demonstrate that the SWL is applicable to multiple base FAD models and achieves consistent performance improvements when evaluated across multiple datasets from different distributions without the need for additional datasets for training or pre-training.

Figure 1: The overall architecture of the proposed stable learning based method. LSWD refers to Learning Sample Weighting for Decorrelation as described in Section 2.1. The number of RFF map** fuctions and hidden state feature are flexible to be adjusted. In the training stage, we only need to feed the selected hidden state feature into SWL module and multiply the computed sample weights with the Weighted Cross-Entropy (WCE) loss. In the inference phase, the model directly conduct prediction without calculation of sample weights.

The contributions of this paper are presented as follows:

• We propose a stable-learning based training scheme for FAD called SWL, which involves a SWL module based on RFF and utilizes an iterative optimization strategy. To the best of our knowledge, this is the first study to apply stable learning to improve the generalization of FAD models.

• Experiments conducted on the ASVspoof datasets show that SWL can generalize AASIST [27], RawNet2 [28], and TSSD [29] when evaluated across three different datasets.

• We further explored what combination of node features in the AASIST model might be optimal for decorrelation when applying SWL.

2 Proposed Method

Different from the method mentioned earlier that uses extra data or complicates the training process by computing additional loss, we use stable learning to addressing distribution shift by decorrelating all input features without using extra data. Figure 1 shows the overall architecture of proposed SWL.

In stable learning, a sample weighting method [30] is proven to be useful to decorrelate features and help linear models produce more stable predictions under distribution shift. When extending these ideas into FAD models to handle more complex data types like audio, we first need to consider how to quantify independence between features. Moreover, this sample weighting method requires meticulous calculations for all features, which is not suitable for training deep neural networks.

In the following subsections, we detail sample weighting with RFF and iteratively learn global sample weights, which correspond to solving the two problems mentioned above.

2.1 Sample weighting with RFF

In stead of focusing only on eliminating dependence between bona-fide and spoofed samples, we tend to eliminate dependence between all input features so that we can get more dispersed representations of all samples. To eliminate the dependence between any pair of features $Z_{:,i}$ and $Z_{:,j}$ from samples in the representation space, we first need to quantify the independence between features. In [31], Hilbert-Schmidt Independence Criterion (HSIC) is proven to be capable of applying as a criterion to supervise feature decorrelation, but HSIC computationally cost too much on large datasets. In Euclidean space, Frobenius norm corresponds to the HilbertSchmidt norm [32], in this paper, Frobenius norm is used to quantify the independence between features.

We sample $(A_{1},A_{2},\ldots,A_{n})$ and $(B_{1},B_{2},\ldots,B_{n})$ from the distribution of $A$ and $B$. Consider a measurable, positive definite kernel $k_{D}$ on the domain of random variable $D$ and we denote the corresponding Reproducing Kernel Hilbert Space as $\mathcal{H}_{D}$. If we denote cross-covariance operator from $\mathcal{H}_{B}$ to $\mathcal{H}_{A}$ by the symbol $\Sigma_{\text{AB}}$, then the partial cross-covariance matrix will be:

$$\hat{\Sigma}_{AB} =\frac{1}{n-1}\sum_{i=1}^{n}[(\textbf{u}(A_{i})-\frac{1}{n}\sum_{j=1}^{n}\textbf{u}(A_{j}))^{T}\cdot$$

$$\phantom{=AAAA==}(\textbf{v}(B_{i})-\frac{1}{n}\sum_{j=1}^{n}\textbf{v}(B_{j}))],$$ (1)

where

$$\textbf{u}(A) =(u_{1}(A),u_{2}(A),\ldots,u_{n_{A}}(A)),\quad u_{j}(A)\in\mathcal{H}_{\text{RFF}},\quad\forall j,$$

$$\textbf{v}(B) =(v_{1}(B),v_{2}(B),\ldots,v_{n_{B}}(B)),\quad v_{j}(B)\in\mathcal{H}_{\text{RFF}},\quad\forall j,$$ (2)

Here u and v are the RFF map** functions, $n_{A}$ and $n_{B}$ represent the numbers of functions from $\mathcal{H}_{\text{RFF}}$ and $\mathcal{H}_{\text{RFF}}$ denotes the function space of RFF with the following form:

$$\mathcal{H}_{\text{RFF}} =\{h:x\rightarrow\sqrt{2}\cos(\omega x+\phi)\mid$$

$$\phantom{==}\omega\sim{N}(0,1),\phi\sim\text{Uniform}(0,2\pi)\},$$ (3)

where $\omega$ and $\phi$ are sampled from the standard Normal distribution and the Uniform distribution respectively. Then, the independence quantification metric $I_{AB}$ is defined as the Frobenius norm of the partial cross-covariance matrix ($I_{AB}=\|\hat{\Sigma}_{{AB}}\|_{F}^{2}$). Note that $I_{AB}$ is always non-negative. So the lower the $I_{AB}$, the more independent the two variables $A$ and $B$.

After establishing the quantification criteria, we can then measure general independence via RFF and eliminate the dependence between hidden state features through sample weighting. We denote the sample weights as $w\in\mathbb{R}_{+}^{n}$ and $\Sigma_{\text{i=1}}^{n}\omega_{i}=n$. After weighting, the $\hat{\Sigma}_{\text{AB}}$ changes into $\hat{\Sigma}_{\text{AB;w}}$ which can be calculated using Equation (2.1) as follows:

$$\hat{\Sigma}_{AB;\text{w}} =\frac{1}{n-1}\sum_{i=1}^{n}[(\omega_{i}\textbf{u}(A_{i})-\frac{1}{n}\sum_{j=1}^{n}\omega_{j}\textbf{u}(A_{j}))^{T}\cdot$$

$$\phantom{=AAAA==}(\omega_{i}\textbf{v}(B_{i})-\frac{1}{n}\sum_{j=1}^{n}\omega_{j}\textbf{v}(B_{j}))],$$ (4)

Specifically, for selected features $Z_{\text{:,i}}$ and $Z_{\text{:,j}}$ mentioned above, we need to optimize w by

$$\textbf{w}^{*} =\underset{\textbf{w}\in\Delta_{n}}{argmin}\underset{1\leq i<j\leq m_{z}}{\sum}\|\hat{\Sigma}_{{Z_{:,i},Z_{:,j};\textbf{w}}}\|_{F}^{2},$$ (5)

where $\Delta_{n}=\{\textbf{w}\in\mathbb{R}_{+}^{n}\mid\sum_{i=1}^{n}w_{i}=n\}$. Hence, weighting training samples with the optimal $\textbf{w}^{*}$ can mitigate the dependence between all selected hidden state features.

Generally, this algorithm iteratively optimize sample weights w, feature extractor function $f$ , and classifier function $g$ as follows:

$$f^{(t+1)},g^{(t+1)} =\underset{f,g}{argmin}\sum_{i=1}^{n}w_{i}^{(t)}L(g(f(X_{i})),y_{i}),$$

$$\textbf{w}^{(t+1)} =\underset{\textbf{w}\in\Delta_{n}}{argmin}\underset{1\leq i<j\leq m_{z}}{\sum}\|\hat{\Sigma}_{{Z^{(t+1)}_{:,i},Z^{(t+1)}_{:,j};\textbf{w}}}\|_{F}^{2},$$ (6)

where $Z^{(t+1)}=f^{(t+1)}(X)$, $X_{i}$ and $y_{i}$ means an input audio and prediction of the classifier, $L(\textperiodcentered,\textperiodcentered)$ represents the weighted cross entropy loss function and $t$ represents the time stamp. Initially, $\textbf{w}^{(0)}=(1,1,...,1)^{T}$ .

2.2 Iteratively learn global sample weights

Equation 2.1 requires weight learned for every single input data. However, it cost too much for a FAD model based on deep neural networks trained on a large dataset to learn sample weights globally. For every batch during training, the features and the sample weights appear as follows:

$$\text{Z}_{O}, =\text{Concat}(\text{Z}_{G1},\text{Z}_{G2},\ldots,\text{Z}_{Gk},\text{Z}_{L})$$

$$\text{w}_{O}, =\text{Concat}(\text{w}_{G1},\text{w}_{G2},\ldots,\text{w}_{Gk},\text{w}_{L})$$ (7)

$\text{Z}_{O}$ and $\text{w}_{O}$, represent the current features and weights, are used to optimize the new sample weights in the next batch. $\text{Z}_{G1},\ldots,\text{Z}_{Gk}$ and $\text{w}_{G1},\ldots,\text{w}_{Gk}$ means features and weights represent the former global information learned from all previous batches. $\text{Z}_{L}$ and $\text{w}_{L}$ means the features and weights in the current batch, representing local information. When a FAD model is trained with a large dataset, the concatenation would incur significant space consumption and lead to an increase in computational complexity.

To address this problem, we utilize an approximation method proposed in [26] which fuses the former global information and the local information at the end of each epoch as follows:

$$\text{Z}_{G_{i}}^{{}^{\prime}}, =\alpha_{i}\text{Z}_{Gi}+(1-\alpha_{i})\text{Z}_{L}$$

$$\text{w}_{G_{i}}^{{}^{\prime}}, =\alpha_{i}\text{w}_{Gi}+(1-\alpha_{i})\text{w}_{L}$$ (8)

We substitute $(\text{Z}_{Gi},\text{w}_{Gi})$ with $(\text{Z}_{Gi}^{{}^{\prime}},\text{w}^{{}^{\prime}}_{Gi})$ for the next batch. and use the hyperparameter $\alpha$ to control the information, where a large value indicates long-term memory in the information, and a smaller value indicates short-term memory. In this paper, we set $\alpha$ to $0.9$. Detailed procedure can be found in Appendix A.1 of [26], we use Adam optimizer instead of SGD for optimization to converge faster and more stable.

3 Experiments

3.1 Datasets and Evaluation metrics

All experiments are trained on the Logical Access (LA) subset of the ASVspoof 2019 dataset. To verify the generalization of models, we utilized the ASVspoof 2021 dataset, which only contains evaluation sets and is the latest and most challenging edition of the ASVspoof challenge series. In comparison to ASVspoof 2019, the utterances in the LA scenario are transmitted across real telephone systems and the utterances in the DF scenario are processed through various audio compressors. Table 1 presents the overall statistics of the datasets used in the experiments.

Equal error rate (EER) is used to evaluate the performance of models. The lower the EER value, the better the models.

Table 1: Datasets used in the experiments. # Spks, # Utts, and # Attks indicate the number of speakers, utterances, and spoofing attacks, respectively. Training and evaluation set is divided by /. 19LA, 21LA and 21DF respectively represent ASVspoof 2019 LA, ASVspoof 2021 LA, ASVspoof 2021 DF.

Dataset	# Spks	# Utts	# Attks
19LA	20 / 48	25380 / 108978	6 / 13
21LA	- / 48	- / 181566	- / 13
21DF	- / 48	- / 611829	- / 13

3.2 Experimental setup

For experiments, we choose three FAD models as base models to apply SWL, and we will briefly explain why we choose them and how we apply SWL to each of them.

First base FAD model is AASIST model, both the original version and the light version respectively denoted as AASIST and AASIST-L. There two reasons for choosing this model. Firstly, this model is open source and has been recently utilized in multiple research studies, demonstrating state-of-the-art (SOTA) performance. Secondly, the features sent into the classifier in this model are composed of multiple node features extracted based on temporal and spectral domains. This setup allows for further exploration of feature interpretability regarding the optimal combination of node features for decorrelation.

Rawnet2 is well-known as one of the baselines of the ASVspoof challenge and a typical end to end model. As for the TSSD model, its performance is SOTA among end-to-end models. We use the input of the last fully connection layer in both models to apply SWL. We do not adjust parameters (e.g. learning rate, model architecture configuration) of all three base FAD models. The best models are chosen based on the lowest EER on the development set of 19LA.

Table 2: EER(%) results of the base FAD models and applying SWL to them. The results about ASAM are from [21] and the ^∗ represents the FAD model is trained on multi-dataset.

Model	19LA	21LA	21DF
AASIST	1.52	9.96	20.45
AASIST + SWL	1.38	9.40	19.09
AASIST-L	1.26	11.44	22.40
AASIST-L + SWL	1.14	8.02	19.67
AASIST-L + ASAM	1.48	10.18	19.58
AASIST-L + ASAM∗	1.27	12.41	19.84
RawNet2	4.72	11.04	22.13
RawNet2 + SWL	4.47	8.69	21.14
TSSD	2.12	17.75	32.10
TSSD + SWL	2.00	15.83	29.55

4 Results and Analyses

4.1 SWL generalizes base FAD models

In Table2, we validate the proposed SWL method by evaluating models on three datasets from different distributions, namely 19LA, 21LA and 21DF. From the results, it can be observed that WSL is able to simultaneously generalize the base FAD models on multiple datasets from different distributions.

Figure 2: Applying SWL to AASIST-L using different numbers of RFF map** functions. The dashed line represents the performance of AASIST-L without applying SWL.

In addition, We compare SWL with another method known as ASAM, which has shown significant advancements in enhancing the generalization of base FAD models [21]. The results demonstrate that SWL achieves competitive performance comparing ASAM in assisting the base model when trained on the same single dataset. Furthermore, upon comparing the performance of the base model using ASAM and training it with multiple datasets, it becomes evident that SWL can better generalize the base model without the need for extra training data.

4.2 More RFF map** functions, higher generalization

In Section 2.1, we demonstrate how proposed SWL method work theoretically. There is a hyperparameter that might influence the performance, which is the number of RFF map** functions. In this part, we conduct some experiments applying SWL to AASIST-L model selecting all node features to be decorrelated and using different numbers of RFF map** functions. The results are recorded in the Figure 2.

It turns out that, for AASIST-L model, generalization is better when number of RFF map** functions is higher, but at the same time, both the training duration and computational complexity will also increase. In additional, there is a decrease in performance of all models on 19LA. We attribute this to the non-optimal combination of node features selected for decorrelation, and we will discuss it in the next section.

Table 3: Different combination of node features applying SWL to AASIST-L model.

Node Features	19LA	21LA	21DF
5N	1.55	9.02	20.99
4N	1.15	11.68	20.24
2N-T	1.40	10.23	21.22
2N-S	1.14	8.02	19.67

4.3 What combination of nodes is better for decorrelation

In AASIST framework [27], the temporal and spectral domains are modeled by two graph moduls in parallel and finally turn to four node features representing temporal and spectral information. Finally, the four node features and a stack node features are sent to classifier after simple concatenation.

In this section, we explore what combination of the five node features is optimal to be selected for feature decorrelation. Four combinations were considered, namely, all five node features (5N), removing the stack node features (4N), two node features related to spectral information (2N-S), and two node features related to temporal information (2N-T). Then, we conduct experiments based on AASIST-L model setting the number of RFF map** functions to 20. The experimental results in Table 3 show that, among the four combinations, 2N-S is optimal for feature decorrelation and yields the best results, indicating that decorrelating the 2N-S is easier, and the spectral domain is more helpful for FAD.

5 Conclusions

In this paper, we propose a stable learning based training scheme named SWL for FAD, which involves a sample weight learning module based on Random Fourier Features and utilizes an iterative optimization strategy. SWL focuses more on selected feature that extracted by FAD models and decorrelates them to help model produce more stable predictions under distribution shift. Experiments conducted on the ASVspoof datasets demonstrate that our methods can generalize multiple FAD models when evaluated across three different datasets. We further find out that, for AASIST-L, generalization becomes better when the number of RFF map** functions is higher, and the node features related to spectral features are better for decorrelating when applying SWL.

6 Acknowledgements

This work is supported by the National Natural Science Foundation of China (NSFC) (No.62101553, No.62306316, No.U21B20210, No. 62201571).