Voice liveness detection: replay, synthesis and injection attacks

This page belongs to the deepfake detection hub and extends the face-based view of liveness to speech. The voice deepfake benchmarks page covers the challenge series as a whole, and liveness across other biometrics compares speech with face, fingerprint and iris; here the focus is the replay and live-talker question.

01What attacks does voice liveness have to catch?

The ASVspoof 2021 paper names four principal ways to attack a speaker verification system with manipulated speech: impersonation, voice conversion, text-to-speech synthesis and replay. Impersonation "typically require[s] special expertise", whereas the other three "can all be mounted using readily available software toolkits and consumer devices". Replay is the one that needs a loudspeaker and a room, which is what makes it a liveness problem: a recording of a real voice is played to a microphone.

The 2021 challenge split the problem into three tasks. Logical access (LA) covers conversion and synthesis sent through telephony channels, physical access (PA) covers replay in real physical spaces, and the speech deepfake (DF) task covers manipulated, compressed speech posted online. The ASVspoof 2021 page lists the top systems of all three.

02How does ASVspoof 2021 test replay?

The PA task was designed so that countermeasures trained on simulated replay data would be tested on replays made in real spaces. Its bona fide data are 670 utterances from the VCTK corpus, played to the verification microphone through a high-quality loudspeaker. Recordings were made in 162 acoustic environments, from nine rooms, three microphones and six talker distances.

Replay attacks vary the room where the attacker records, the attacker's microphone, the replay device and the distance. The full product of factors is 1,458 combinations, so the organisers sampled a non-exhaustive subset. They also withheld some factors from the progress subset so that the evaluation subset tests combinations nobody could tune against.

03What scores did the best replay systems get?

Scores below are the pooled normalised minimum t-DCF on the evaluation set, with the equal error rate beside it; lower is better for both. The minimum t-DCF page explains the cost function.

The paper states that "the performance of all systems is substantially worse than the ASV floor of 0.12", and concludes that the PA task is more challenging than LA. For comparison, the best LA system, T23, had an EER of 1.32 percent on its own task, and the best DF system an EER of 15.64 percent.

04Why do real rooms differ from simulated ones?

The 2019 edition of the challenge used simulated replays. The 2021 paper reports that post-challenge analysis of the 2019 results "showed evidence of over-fitting to simulated attacks", with worse performance on attacks recorded in real spaces. The 2021 abstract summarises the PA outcome as "the potential to detect replay attacks in real, as opposed to simulated physical spaces, but a lack of robustness to variations between simulated and real acoustic environments".

A hidden track of simulated data in 2021 showed the same gap in reverse. Two systems among the top five on real recordings, T16 and T01, had a minimum t-DCF of around 1.0 on most simulated conditions. T07, the top system, trained with room simulation and speed perturbation, and the paper concludes that "with certain training strategies, the CMs can do well on both the real and simulated data".

05What about synthesis, conversion and injected audio?

For synthetic speech, the story moved on after 2021. ASVspoof 5 (2024) added a stand-alone deepfake detection track, with minimum DCF as the primary metric. In its closed condition the best system reached a minimum DCF of 0.2436 and an EER of 8.61 percent, while the baselines had "minDCF higher than 0.7 and EERs higher than 29%" (arXiv 2408.08739). The in-the-wild audio test shows what happens off the challenge data: a set of 37.9 hours of found recordings, 17.2 hours of them deepfakes, produced "performance degradation of up to one thousand percent" (arXiv 2203.16263).

None of these tasks is named or scored as an injection test. The LA task sends spoofed speech as a signal over telephony channels, with no loudspeaker and room involved, which is the nearest analogue. The face-side threat of video injected past the camera is described on the injection attacks page. A voice system that only passes replay tests has not shown it resists synthesis or injection.

06How should a voice liveness score be read?

Read three things. First, the task: a PA score concerns replay, an LA score concerns synthesis and conversion over a channel, and a DF score concerns compressed speech with no verification system. Second, the metric: min t-DCF depends on the verification system in the loop, while EER does not. Third, the data: simulated, recorded in rooms, or found online.

The face-side equivalent, with its own datasets and protocols, is on the face anti-spoofing datasets page. Those three conditions explain why one challenge can report an EER of 1.32 percent for one task and 24.25 percent for another, and why scoring metrics matter more here than in any single-number leaderboard.