# Generalized Spoof Detection and Incremental Algorithm Recognition for Voice Spoofing
## 3 Voice Spoof Detection and Algorithm Recognition System
### Generalized Voice Spoof Detection  
#### 3.1.1 Domain Adaptation Based on Decision Boundary Maximization  
The domain-adaptive approach utilizes two types of networks: task-specific classifiers and feature mappers. To find the target samples near the decision boundary, two independent classifiers were introduced. The features were obtained from the mappers using both classifiers, and an attempt was made to classify the source samples correctly. This is shown in Figure 2a.  
The different distributions of the source and target domains lead to differences in the classification results of the two classifiers for the target samples near the decision boundary, and they cannot be correctly classified for these samples. Adversarial learning methods were introduced for the samples that could not be correctly classified near the decision boundary. First, a task-specific classifier was used to maximize the decision boundary to increase the difference in the results between the two classifiers, as shown in Figure 2b. Then, a mapper was used to produce a better mapping effect to reduce the difference, as shown in Figure 2c. Thus, by considering the relationship between the target samples and task-specific decision boundaries, it is possible to make the model learned on the training set applicable to different distributions of faked audio in the test set. The specific procedure is as follows.  
Figure 1: The framework of the system.  
Phase 1: As shown in Figure 2a, shadows are generated, allowing different feature representations to be learned by different classifiers. The goal was to maximize the shaded area.  
Phase 2: As shown in Figure 2b, the classifiers are maximized. The shading is more significant at this point. Therefore, the goal was to reduce the divergence between the two classifiers by extracting better features.  
Phase 3: The divergence is minimized, as shown in Figure 2c. At this point, the shadows are almost nonexistent, but the problem is that there is still some compactness in the decision boundary. These features might not be robust, so alternating optimization with the previous stage continued.  
Phase 4: The final goal of the alternate optimization is shown in Figure 2d. At this point, shadows do not exist, and the decision boundary is more robust.  
This study constructed two classifiers as discriminators using the dropout regularization method for the primary classifier [26]. The other represents the difference between the two classifiers based on the symmetric Kullback-Leibler (KL) scatter. The procedure is as follows: the features \(G(x_{t})\) obtained from feature mapper G are fed to classifier network C twice. A different node was removed each time to obtain two different output vectors. These are denoted as \(C_{1}(G(x_{t}))\) and \(C_{2}(G(x_{t}))\), respectively. The corresponding posterior probabilities are denoted as \(P_{1}(y|x)\) and \(p_{2}(y|x)\) and abbreviated as \(P_{1}\) and \(P_{2}\) below. The discriminator then attempts to increase the difference between the predictions of \(C_{1}\) and \(C_{2}\). This difference corresponds to the discriminator's sensitivity to noise, measured using the symmetric KL scatter between the two obtained probability outputs \(d(p_{1},P_{2})\), and the scatter is calculated as  
\[d(p_{1},p_{2})=\frac{1}{2}(D_{kl}(p_{1}|p_{2})+D_{kl}(p_{2}|p_{1})) \tag{1}\]  
where \(D_{kl}(p|q)\) denotes the KL scatter between \(p\) and \(q\).  
However, the decision boundaries obtained from such adversarial training methods were still set for the training data. Therefore, the decision boundary set for the voice spoofing samples in the embedding space might be too compact. This led to difficulties for the model in defending against unseen voice spoofing attacks. Therefore, we introduced a one-class learning method. It set decision boundaries for real data and forged data separately, which improved the model's defense against unseen voice spoofing attacks.