# Adversarial Speaker Distillation for Countermeasure Model on
Automatic Speaker Verification

###### Abstract

The countermeasure (CM) model is developed to protect ASV systems from spoof
attacks and prevent resulting personal information leakage in Automatic
Speaker Verification (ASV) system. Based on practicality and security
considerations, the CM model is usually deployed on edge devices, which have
more limited computing resources and storage space than cloud-based systems,
confining the model size under a limitation. To better trade off the CM model
sizes and performance, we proposed an adversarial speaker distillation method,
which is an improved version of knowledge distillation method combined with
generalized end-to-end (GE2E) pre-training and adversarial fine-tuning. In the
evaluation phase of the ASVspoof 2021 Logical Access task, our proposed
adversarial speaker distillation ResNetSE (ASD-ResNetSE) model reaches 0.2695
min t-DCF and 3.54% EER. ASD-ResNetSE only used 22.5% of parameters and 19.4%
of multiply and accumulate operands of ResNetSE model.

Index Terms: Automatic Speaker Verification, Anti-spoofing, GE2E Pre-training,
Adversarial Fine-tuning, Knowledge Distillation

##  1 Introduction

Automatic speaker verification (ASV) is a method for determining if a certain
utterance is spoken by an individual. It is one of the essential biometric
identification technologies widely used in real-world applications, including
smartphones, smart speakers, digital wallets, etc. Through active research on
various methods [1, 2, 3, 4], significant performance improvements have been
created in accuracy and efficiency of ASV systems. The earliest proposed
method [1] used the Gaussian mixture model to extract acoustic features and
then compute a score based on the likelihood ratio. End-to-end ASV models such
as [4, 5] have been proposed to map utterances to verification scores
directly. End-to-end models improve verification accuracy, making the ASV
model compact and efficient.

The ASVspoof challenge series [6, 7, 8, 9] were held to encourage researchers
developing strong countermeasure (CM) models against spoofing audio signals
such as synthetic, converted, and replayed. ASVspoof 2021 consists of three
subtasks: logical access (LA), deepfake (DF), and physical access (PA). This
paper focuses on the LA subtask, where the spoofing audio signals are
generated from either text-to-speech (TTS) or voice conversion (VC) systems.
Despite the power of today’s TTS and VC technology, subtle differences still
exist between spoofs and raw audio streams. A variety of CM models for LA [10,
11, 12, 13, 14, 15, 16, 17, 18, 19, 20] using GRCNNs, VGG, SE-Net, or LCNN
have been proposed to detect spoofing audio signals. ASV and anti-spoofing
models have also been proven vulnerable to adversarial attack [21, 22]. A
variety of defense methods have been proposed to improve the robustness of ASV
and anti-spoofing model against adversarial attacks [23, 24, 25, 26, 27, 28].
The biggest commonality between the generated spoofing audio and the
adversarial attack audio is that they influence the decisions of the
countermeasure model in imperceptible ways.

Some ASV systems [29, 30] are running on edge devices, in order to avoid
network transmission failure. The CM model is often used in conjunction with
the ASV model. In edge devices, the models need to be lighter to account for
limited computing power and storage space. Knowledge distillation (KD) [31] is
one classical method used to reduce the model size, where the knowledge is
transferred from a larger teacher model to a more lightweight student model.
However, KD often degrades the performance while reducing the model size of
the model. To maintain or prevent the model performance degradation after
distillation, one straightforward motivation is to train a powerful teacher
model firstly.

To enable the CM system to sense the gap between the audio produced by TTS and
VC technology and the real audio, we separate the embeddings of different
spoofing conditions and narrow those of the same spoofing condition. We also
utilize the adversarial example to improve the ability of CM model to perceive
the subtle difference between modified and bona fide audio, which inspired by
training by adversarial example can easier perceive the subtle perturbation in
ASV task [27]. In this paper, we mainly have the following contributions:

  * 1)

To our best knowledge, this is the first to explore the lightweight ASV
spoofing CM model.

  * 2)

We proposed an adversarial speaker distillation method, which combined with
generalized end-to-end (GE2E) [32] pre-training and adversarial fine-tuning
for the teacher model, and used KD to obtain the student model.

  * 3)

Experiments showed that our proposed training strategies effectively improved
student model performance, while maintaining a balance between performance and
resource consumption.

##  2 Methods

In this paper, we designed an adversarial speaker distillation training
strategy and used ResNetSE [33] as the backbone model. The establishment of
the teacher model involved two steps: pre-training and fine-tuning. The
teacher model, GE2E-ResNetSE, is pre-trained by GE2E loss and adversarial
fine-tuned by negative log-likelihood (NLL) loss. Note that adversarial fine-
tuning means injecting an adversarial speaker class into the original dataset.
The student ResNetSE (ASD-ResNetSE) distilled adversarial speaker knowledge
from GE2E-ResNetSE. Each utterance has two labels, namely the speaker and the
spoofing condition. We will use them in different steps respectively. The
overall process is shown in Figure 1, and the details will be described in the
following subsections.

Figure 1: The proposed the training strategies for lightweight CM model for
ASV. “Adv Dataset” represents the adversarial dataset generated by the AEG
process.

###  2.1 Model structure

Excellent results have been achieved by ResNet and its improved version
ResNetSE on image processing and ASV [32, 34, 33]. Figure 2 shows the
structure of ResNetSE, where self-attentive pooling was used as the pooling
layer to enhance model flexibility for accepting audio streams of various
lengths. It can reduce the input signals of any length to the same dimension
by using pooling in our system. The output target of ResNetSE is an 8-element
vector, indicating the input audio is bona fide, TTS spoofing methods, VC
spoofing methods, and an adversarial speaker. Note that only the adversarial
fine-tuning step has an adversarial speaker class. The difference between
GE2E-ResNetSE and ASD-ResNetSE is the number of channels: (32, 64, 128, 256)
for the former and (16, 32, 64, 128) for the latter.

Figure 2: Model structure of ResNetSE. (a) Sketch of ResNetSE model. (b)
Details of Res-Block. (c) Details of squeeze-excitation layer.

###  2.2 Teacher training

The process of training the teacher model was composed of two main steps. The
first step of using GE2E pre-training with spoofing condition classes is to
ensure the model has sufficient discriminating power between different
spoofing conditions. In this step, the GE2E loss was computed using the
pooling layer of ResNetSE (Figure 2 (a)). In the second step, we fine-tuned
the whole model with the ASVspoof2021-provided data and the injected
adversarial data generated by AEG. This process makes the model focus on
distinguishing fake audio streams from bona fide ones.

####  2.2.1 Generalized End-to-End Pre-training

GE2E loss [32] was proposed for speaker verification, and a variant of this
approach has been used to detect replayed spoofing attacks (PA subtask of
ASVspoof 2021) [35]. This paper uses GE2E loss calculated according to
spoofing condition classes in LA subset to obtain the initial model. Firstly,
each batch included $M$ utterances from one of the $N$ different conditions.
The utterances $\mathbf{x}_{nm}$ in the batch (except the query itself) formed
the centroids $c_{n}$ of each condition, where $1\leq n\leq N$, $1\leq m\leq
M$. The formula of $c_{n}$ is defined as:

$c_{n}=\frac{1}{M}\sum^{M}_{m=1}\mathbf{x}_{nm}$ (1)

Each utterance embedding was expected to be close to its corresponding
spoofing condition centroid but far from the centroids of other spoofing
conditions. Thus, a similarity matrix $\mathbf{S}_{nm,k}$ was defined to
describe the scaled cosine similarity of utterances with centroids $k$, where
$w,b$ are learnable parameters in the expression:

$\mathbf{S}_{nm,k}=w\cdot\mathrm{cos}(\mathbf{x}_{nm},c_{k})+b$ (2)

Softmax was applied to the similarity matrix for every category (from 1 to
$N$) when calculating GE2E loss. The overall loss function was defined in
equation 3, which means that utterance embeddings of the same spoofing
condition should be close to each other, and far from those of other spoofing
conditions.

$\mathcal{L}_{GE2E}=-\mathbf{S}_{nm,n}+\mathbf{log}\sum^{N}_{k=1}exp(\mathbf{S}_{nm,k})$
(3)

####  2.2.2 Adversarial fine-tuning

After the teacher model was initialed by GE2E pre-training, it will be fine-
tuned using NLL loss with spoofing condition label. The spoofing condition
label is composed of 8 classes: 1 bona fide, 6 spoof methods, and 1
adversarial speaker. The additional adversarial speaker class is generated by
the Adversarial Example Generation (AEG) algorithm described below.

AEG was a process that deliberately generated a tiny perturbation to the
original sample to generate adversarial audio. This work adopted the basic
iterative method (BIM) [36] for AEG. The audio input of the AEG algorithm was
a same-speaker randomly-selected bona fide audio signals $\mathsf{W_{1}}$ and
$\mathsf{W_{2}}$, and the output was the newly generated sample.
Extract_Feature($\mathbf{M}$, $\mathsf{W}$) meant using model $\mathbf{M}$ to
extract features for $\mathsf{W}$. The score $s$ indicates the similarity
between the forged and the original audio. Only the new sample with $s$
smaller than $threshold$ will be used as an adversarial sample. The algorithm
is detailed in Algorithm 1. Based on this, we implemented two AEG methods,
static AEG and active AEG.

Static AEG. Static AEG used the GE2E pre-trained model as the input for
Algorithm 1 to generate attack data. All the generated attack data will be
relabeled as an adversarial example and injected into the original data set.
Since static AEG created all adversarial samples before fine-tuning, it did
not increase the overhead of fine-tuning.

Active AEG. The difference between static AEG and active AEG was that active
AEG executed BIM before each epoch, which means that the same input audios
will produce different adversarial samples in different epochs. Although this
additional work may increase training time, active AEG is expected to generate
more architecture-specific data.

Algorithm 1 Basic Iterative Method (BIM)

1:Two audios, $\mathsf{W_{1}}$ and $\mathsf{W_{2}}$ belonging to the same
speaker. Model $\mathbf{M}$. $\alpha$, $iter$, and $threshold$ are
controllable variables.

2:Feature of the forged audio.

3:

4:$\mathbf{X_{1}}\leftarrow$ Extract_feature($\mathbf{M},\mathsf{W_{1}}$)

5:$\mathbf{D}\leftarrow$ Zero_array(len($\mathsf{W_{1}}$))

6:for $t\leftarrow 1$ to $iter$ do

7: $\mathbf{X_{2}}\leftarrow$
Extract_feature($\mathbf{M},\mathsf{W_{2}}+\mathbf{D}$)

8: s $\leftarrow$ Cos-similarity($\mathbf{X_{1}},\mathbf{X_{2}}$)

9: $\mathbf{D}\leftarrow$ clip $(\mathbf{D}$ \+ $\alpha$ *
sign($\nabla_{\mathbf{D}}(s)))$

10:end for

11:$\mathbf{X_{2}}\leftarrow$
Extract_feature($\mathbf{M},\mathsf{W_{2}}+\mathbf{D}$)

12:s $\leftarrow$ Cos-similarity($\mathbf{X_{1}},\mathbf{X_{2}}$)

13:if s $\leq threshold$ then

14: return NULL

15:end if

16:return $\mathbf{X_{2}}$

###  2.3 Student training

This stage used KD loss [31] to transform the capabilities of GE2E-ResNetSE
into ASD-ResNetSE. KD loss mainly consists of Kullback–Leibler divergence (KL)
and NLL loss. KL loss is to lets the student learn soft targets from the
teacher’s output. NLL loss enables the student to learn the hard spoof
condition label. The overall loss function is:

$\mathcal{L}_{KD}=\gamma T^{2}\times
KL(\frac{O_{s}}{T},\frac{O_{t}}{T})+(1-\gamma)\mathcal{L}_{NLL}$ (4)

where $O_{s}$ means the output of the student model, $O_{t}$ means the output
of the teacher model, $\mathcal{L}_{NLL}$ is the NLL loss between the
prediction of students and ground truth classes, and $T$ is the parameter
controlling the distillation temperature, and $\gamma$ is the weight for
balancing the contribution from the teacher and the ground truth class. After
completing this stage, the ASD-ResNetSE will be used to measure the final
model performance.

##  3 Experiment Setup

Dataset and evaluation metrics. All experiments follow the ASVspoof 2021 [6]
settings, and were performed on the ASVspoof 2019 [7] (for validation) and
ASVspoof 2021 (for evaluation) LA dataset. We only reported the 2021 results
here. Training and development partitions of ASVspoof 2019 were used to
construct the countermeasures’ system. The system was evaluated on the
ASVspoof 2019 and ASVspoof 2021 evaluation sets. There were 7 spoofing
categories, including bona fide, A01-04 spoofed by TTS, and A05-06 spoofed by
VC. Meanwhile, all the audio files were labeled with speakers. The training
set includes 20 speakers, while the development set includes 10 speakers. The
dataset includes a training set of 25,380 utterances, a development set of
24,856 utterances, and an evaluation set of 181,566 utterances. Minimum tandem
decision cost function (min t-DCF) [37] and equal error rate (EER) were used
to evaluate the effectiveness of the countermeasure (CM) models.

Waveform augmentation. The number of utterances in the evaluation data set was
much larger than in training or developing sets. Therefore, we used waveform
augmentation to expand the training data to increase system robustness. First,
we randomly selected music, voice, or noise in MUSAN [38] and trimmed or
padded it to the same length as the target utterance, then added it to the
audio file to generate new audio. Next, we randomly selected audio from the
RIR noise data [39] set and convoluted it with the target audio to generate
new audio for reverberation simulation of different room sizes. The training
data of all models in the experiment were augmented using the above-mentioned
on-the-fly methods.

Training Details. We extracted 40 dimensions log-Mel spectrogram with a 25 ms
window size, a 10 ms hop size, and an FFT size set as 512 as the input, while
all audio files had a sample rate of 22,050 Hz. Following acoustic extraction,
we applied instance normalization to the feature. We set
$\alpha=3.0,iter=5,threshold=0.4$ in AEG augmentation. The $\alpha$ and $iter$
are referred from the empirical value of [27]. We applied waveform
augmentation and used the Adam optimizer during the end-to-end teacher and
student model training. In the beginning, the learning rate is 0.0003, and
every two epochs will become 0.95 times the original. In KD loss,
$\gamma=0.5,T=5$.

##  4 Results and Analysis

###  4.1 Ablation Study

GE2E. We compared the performance of ResNetSE and GE2E-ResNetSE model in Table
1. The results show that GE2E pre-training reduces min t-DCF score from 0.3143
to 0.3003 and reduces EER from 5.78 to 5.10. GE2E pre-training enables the
model to distinguish the information of the same spoofing condition from the
information of other spoofing conditions, which helps classify the spoofing
classes by providing additional spoofing condition information. Rather than
classifying all the data at once, GE2E enabled the classification of spoof and
non-spoof starting from classifying a particular spoofing condition case,
which was expected to have better results.

Model Loss min t-DCF EER ResNetSE $\mathcal{L}_{NLL}$ 0.3143 5.78
GE2E-ResNetSE $\mathcal{L}_{GE2E}$ \+ $\mathcal{L}_{NLL}$ 0.3003 5.10

Table 1: Influence of GE2E pre-training.

Teacher Model AEG min t-DCF EER (A) ResNetSE None 0.3143 5.78 (B)
GE2E-ResNetSE None 0.3003 5.10 (C) GE2E-ResNetSE Static 0.2931 5.05 (D)
GE2E-ResNetSE Active 0.2869 4.59 Student Model AEG min t-DCF EER (A′) ASD-
ResNetSE None 0.2987 (4.9%) 4.83 (16.4%) (B′) ASD-ResNetSE None 0.2826 (5.8%)
4.44 (12.9%) (C′) ASD-ResNetSE None 0.2695 (8.0%) 3.54 (29.9%) (D′) ASD-
ResNetSE None 0.2903 (-1.1%) 4.76 (-3.7%)

Table 2: Comparison of adversarial example generation methods and knowledge
distillation. (A′)-(D′) denote student model obtained by distillation of
corresponding teacher (A)-(D). ($\cdot$%) refers to the relative improvement
ratio between student and teacher.

AEG. The results (B)(C)(D) in the upper part of Table 2 show that both active
and static AEG improved the performance of GE2E-ResNetSE. In particular, the
active method effectively reduced the min t-DCF from 0.3003 to 0.2869 and the
EER from 5.10 to 4.59% through on-the-fly augmentation. It showed that adding
model-weakness data to the dataset during training can help the model perceive
the subtle differences inside the spoofing audio streams. From the perspective
of data preparation, the active method is easier to implement, whereas the
static method generates the whole dataset before training.

Knowledge Distillation. The lower half of Table 2 is the result of ASD-
ResNetSE obtained by distillation of the corresponding teacher through the KD
process. The result of (A′) is our knowledge distillation baseline. Its
teacher (A) did not use GE2E pre-training and adversarial fine-tuning. The
teacher (B) only used GE2E pre-training. The teachers (C) and (D) of (C′) and
(D′) are based on GE2E-ResNetSE and also use static AEG and active AEG to
inject adversarial speaker class during fine-tuning, respectively. Note that
we don’t use AEG during the distillation process.

In Table 2, (A′) gains 4.9% min t-DCF and 16.4% EER improvement after
distillation. (C′) obtains 8.0% min t-DCF and 29.9% EER improvement combined
with GE2E pre-training and static AEG fine-tuning, which outperforms baseline
(A′). However, (D′) degrades -1.1% min t-DCF and -3.7% EER. In most
distillation results, the performance of the student model did not decrease
but increased. Previous work [40] has found that subnetworks exist in the
original network that can reach or exceed the original model performance. Wang
[41] has tried to find such a subnetwork through KD. The above result shows
that static AEG is more helpful than active AEG in finding a super subnetwork
in the adversarial speaker distillation process.

###  4.2 Overall Performance

To further analyze overall performance, we select our best ASD-ResNetSE model
(C′) and ResNetSE (A) and the other existing countermeasure models, such as
RawNet2 [10], SE-ResNet18 [11], LFCC-LCNN [12], ECAPA-TDNN [13], ASSERT34 [14]
and W2V2-AASIST [15]. The best ASD-ResNetSE model and GE2E-ResNetSE model were
from Table 2. For a fair comparison, we only consider single models instead of
fusion models. Figure 3 visualize the relation between the model sizes and
their performance of min t-DCF, EER. Because SE-ResNet18 does not provide EER
results, so we do not make a comparison here.

We mainly compare three aspects in Figure 3. Firstly, ASD-ResNetSE not only
outperforms most countermeasure models but also has only a 22.5% model size of
ResNetSE. Secondly, ASD-ResNetSE is more than 50% min t-DCF lower than
ASSERT34, which has a similar model size to ASD-ResNetSE. Moreover, the EER of
ASD-ResNetSE is only about 20% of the EER of ASSERT34. The above results
demonstrate that ASD-ResNetSE can obtain a better trade-off between the model
size and performance. Thirdly, W2V2-AASIST achieves state-of-the-art min t-DCF
and EER, consisting of a self-supervised learning frontend wav2vec2.0 [42, 43]
and a countermeasure backend AASIST [44]. However, its parameters are over
1200 megabytes, so this is not practical for using it on edge devices.

Figure 3: Overall performance comparison.

###  4.3 Model Size and Operands

We compared the size and multiply and accumulate operands (MACs) of several
methods, shown in Table 3. ASD-ResNetSE, with only 0.90G MACs, had a
significantly smaller model size than ResNetSE. As the model size, ASD-
ResNetSE also had similar MACs with ASSERT34. Combining the results in Table 3
and Figure 3, ASD-ResNetSE stands out for its capacity, efficiency and
effectiveness.

Model Param MACs min t-DCF EER ResNetSE 6.39 M 4.62 G 0.3143 5.78 ASSERT34
[14] 1.34 M 1.01 G 0.603 16.98 ASD-ResNetSE 1.44 M 0.90 G 0.2695 3.54

Table 3:  Comparison of model size and operands. Param represents model
parameters. MACs represents multiply and accumulate operands..

##  5 Conclusion

This paper is the first to explore the lightweight CM model for ASV and
propose an adversarial speaker distillation method, an improved version of
knowledge distillation. In the evaluation phase of the ASVspoof 2021 Logical
Access task, our ASD-ResNetSE reaches 0.2695 min t-DCF and 3.54% EER with only
used 22.5% of parameters and 19.4% of MACs of the original ResNetSE model. The
experiment results demonstrate that ASD-ResNetSE stands out for its capacity,
efficiency and effectiveness.

##  6 Acknowledgements

Thanks for technical support from Chi-Han Lin, E.SUN COMMERCIAL BANK, LTD.
This work was partially supported by the Ministry of Science and Technology,
Taiwan (Grant no. MOST109-2221-E-002-163-MY3).

## References

  * [1] D. A. Reynolds, T. F. Quatieri, and R. B. Dunn, “Speaker verification using adapted gaussian mixture models,” _Digit. signal process._ , vol. 10, no. 1-3, pp. 19–41, 2000.
  * [2] A. Senior and I. Lopez-Moreno, “Improving dnn speaker independence with i-vector inputs,” in _Proc. ICASSP_ , 2014, pp. 225–229.
  * [3] Y. Lei, N. Scheffer, L. Ferrer _et al._ , “A novel scheme for speaker recognition using a phonetically-aware deep neural network,” in _Proc. ICASSP_ , 2014, pp. 1695–1699.
  * [4] G. Heigold, I. Moreno, S. Bengio _et al._ , “End-to-end text-dependent speaker verification,” in _Proc. ICASSP_ , 2016, pp. 5115–5119.
  * [5] Y. Zhang _et al._ , “Mfa-conformer: Multi-scale feature aggregation conformer for automatic speaker verification,” _arXiv preprint arXiv:2203.15249_ , 2022.
  * [6] J. Yamagishi _et al._ , “Asvspoof 2021: accelerating progress in spoofed and deepfake speech detection,” _arXiv preprint arXiv:2109.00537_ , 2021\.
  * [7] M. Todisco _et al._ , “Asvspoof 2019: Future horizons in spoofed and fake audio detection,” _arXiv preprint arXiv:1904.05441_ , 2019.
  * [8] T. Kinnunen _et al._ , “The ASVspoof 2017 Challenge: Assessing the Limits of Replay Spoofing Attack Detection,” in _Proc. INTERSPEECH_ , 2017, pp. 2–6.
  * [9] Z. Wu _et al._ , “Asvspoof 2015: the first automatic speaker verification spoofing and countermeasures challenge,” in _Sixteenth annual conf. of the int. speech commun. association_ , 2015.
  * [10] H. Tak _et al._ , “End-to-end anti-spoofing with rawnet2,” in _Proc. ICASSP_ , 2021, pp. 6369–6373.
  * [11] W. H. Kang _et al._ , “CRIM’s System Description for the ASVSpoof2021 Challenge,” in _Proc. 2021 Ed. of the Autom. Speaker Verification and Spoofing Countermeasures Challenge_ , 2021, pp. 100–106.
  * [12] G. Lavrentyeva _et al._ , “STC Antispoofing Systems for the ASVspoof2019 Challenge,” in _Proc. INTERSPEECH_ , 2019, pp. 1033–1037.
  * [13] X. Chen, Y. Zhang, G. Zhu, and Z. Duan, “UR Channel-Robust Synthetic Speech Detection System for ASVspoof 2021,” in _Proc. 2021 Edition of the Automatic Speaker Verification and Spoofing Countermeasures Challenge_ , 2021, pp. 75–82.
  * [14] Z. Benhafid _et al._ , “LARIHS ASSERT Reassessment for Logical Access ASVspoof 2021 Challenge,” in _Proc. 2021 Edition of the Automatic Speaker Verification and Spoofing Countermeasures Challenge_ , 2021, pp. 94–99.
  * [15] H. Tak _et al._ , “Automatic speaker verification spoofing and deepfake detection using wav2vec 2.0 and data augmentation,” _arXiv preprint arXiv:2202.12233_ , 2022.
  * [16] H. Wu _et al._ , “Tackling spoofing-aware speaker verification with multi-model fusion,” _arXiv preprint arXiv:2206.09131_ , 2022.
  * [17] H. Zeinali _et al._ , “Detecting spoofing attacks using vgg and sincnet: but-omilia submission to asvspoof 2019 challenge,” _arXiv preprint arXiv:1907.12908_ , 2019.
  * [18] C. I. Lai _et al._ , “Assert: Anti-spoofing with squeeze-excitation and residual networks,” _arXiv preprint arXiv:1904.01120_ , 2019.
  * [19] J. Yamagishi _et al._ , “STC Antispoofing Systems for the ASVspoof2021 Challenge,” in _Proc. 2021 Ed. of the Autom. Speaker Verification and Spoofing Countermeasures Challenge_ , 2021, pp. 61–67.
  * [20] H. Wu _et al._ , “Partially fake audio detection by self-attention-based fake span discovery,” _arXiv preprint arXiv:2202.06684_ , 2022.
  * [21] F. Kreuk, Y. Adi, M. Cisse, and J. Keshet, “Fooling end-to-end speaker verification with adversarial examples,” in _ICASSP_. IEEE, 2018, pp. 1962–1966.
  * [22] S. Liu, H. Wu, H.-y. Lee, and H. Meng, “Adversarial attacks on spoofing countermeasures of automatic speaker verification,” in _ASRU_. IEEE, 2019, pp. 312–319.
  * [23] H. Wu _et al._ , “Spotting adversarial samples for speaker verification by neural vocoders,” _arXiv preprint arXiv:2107.00309_ , 2021.
  * [24] H. Wu, Y. Zhang, Z. Wu, D. Wang, and H.-y. Lee, “Voting for the right answer: Adversarial defense for speaker verification,” _arXiv preprint arXiv:2106.07868_ , 2021.
  * [25] H. Wu _et al._ , “Improving the adversarial robustness for speaker verification by self-supervised learning,” _TASLP_ , vol. 30, 2022.
  * [26] H. Wu, X. Li, A. T. Liu _et al._ , “Adversarial defense for automatic speaker verification by cascaded self-supervised learning models,” in _Proc. ICASSP_ , 2021, pp. 6718–6722.
  * [27] H. Wu, S. Liu, H. Meng _et al._ , “Defense against adversarial attacks on spoofing countermeasures of asv,” in _Proc. ICASSP_ , 2020, pp. 6564–6568.
  * [28] H. Wu, A. T. Liu, and H.-y. Lee, “Defense for black-box attacks on anti-spoofing models by self-supervised learning,” _arXiv preprint arXiv:2006.03214_ , 2020.
  * [29] T. P. Duffy, “Edge device speaker verification,” _CUNY Academic Works_ , 2020\.
  * [30] F. Granqvist, M. Seigel, R. van Dalen _et al._ , “Improving on-device speaker verification using federated learning with privacy,” _arXiv preprint arXiv:2008.02651_ , 2020.
  * [31] G. Hinton _et al._ , “Distilling the knowledge in a neural network,” _arXiv preprint arXiv:1503.02531_ , 2015.
  * [32] L. Wan, Q. Wang, A. Papir _et al._ , “Generalized end-to-end loss for speaker verification,” in _Proc. ICASSP_ , 2018, pp. 4879–4883.
  * [33] J. S. Chung _et al._ , “In defence of metric learning for speaker recognition,” in _Proc. INTERSPEECH_ , 2020.
  * [34] H. S. Heo _et al._ , “Clova baseline system for the VoxCeleb speaker recognition challenge 2020,” _arXiv preprint arXiv:2009.14153_ , 2020.
  * [35] Y. Lei _et al._ , “Deep Metric Learning for Replay Attack Detection,” in _Proc. 2021 Ed. of the Autom. Speaker Verification and Spoofing Countermeasures Challenge_ , 2021, pp. 42–46.
  * [36] S. B. A. Kurakin, I. Goodfellow, “Adversarial machine learning at scale,” _arXiv preprint arXiv:1611.01236_ , 2016.
  * [37] T. Kinnunen _et al._ , “Tandem assessment of spoofing countermeasures and automatic speaker verification: Fundamentals,” _TASLP_ , vol. 28, pp. 2195–2210, 2020.
  * [38] D. Snyder, G. Chen, and D. Povey, “Musan: A music, speech, and noise corpus,” _arXiv preprint arXiv:1510.08484_ , 2015.
  * [39] B. S. Kirei _et al._ , “Novel fir implementation for acoustic signal processing,” in _2009 15th Int. Symp. for Des. and Technol. of Electronics Packages (SIITME)_ , 2009, pp. 351–354.
  * [40] J. Frankle and M. Carbin, “The lottery ticket hypothesis: Finding sparse, trainable neural networks,” _arXiv preprint arXiv:1803.03635_ , 2018.
  * [41] R. Wang _et al._ , “Lighthubert: Lightweight and configurable speech representation learning with once-for-all hidden-unit bert,” _arXiv preprint arXiv:2203.15610_ , 2022.
  * [42] A. Baevski _et al._ , “wav2vec 2.0: A framework for self-supervised learning of speech representations,” _Advances in Neural Information Processing Systems_ , vol. 33, pp. 12 449–12 460, 2020.
  * [43] Q. Xu _et al._ , “Self-training and pre-training are complementary for speech recognition,” in _ICASSP_. IEEE, 2021, pp. 3030–3034.
  * [44] J.-w. Jung _et al._ , “Aasist: Audio anti-spoofing using integrated spectro-temporal graph attention networks,” in _ICASSP_. IEEE, 2022, pp. 6367–6371.