attack arXiv Sep 18, 2025 · Sep 2025
Anton Selitskiy, Akib Shahriyar, Jishnuraj Prakasan · University of Rochester · Rochester Institute of Technology
Attacks audio anti-spoofing ML classifiers via optimal transport distributional alignment without gradient access
Input Manipulation Attack audiogenerative
In this paper, we introduce the discrete optimal transport voice conversion ($k$DOT-VC) method. Comparison with $k$NN-VC, SinkVC, and Gaussian optimal transport (MKL) demonstrates stronger domain adaptation abilities of our method. We use the probabilistic nature of optimal transport (OT) and show that $k$DOT-VC is an effective black-box adversarial attack against modern audio anti-spoofing countermeasures (CMs). Our attack operates as a post-processing, distribution-alignment step: frame-level {WavLM} embeddings of generated speech are aligned to an unpaired bona fide pool via entropic OT and a top-$k$ barycentric projection, then decoded with a neural vocoder. Ablation analysis indicates that distribution-level alignment is a powerful and stable attack for deployed CMs.
transformer University of Rochester · Rochester Institute of Technology
ML Security Papers