# Generalized Spoof Detection and Incremental Algorithm Recognition for Voice Spoofing
## 4 Experimental Methods
### Experimental Results
#### 4.3.2 Results of Spoof Algorithm Recognition  
The results of incremental learning using iCaRL and prototyping on the ASVspoof 2019 LA dataset are summarized in Table 2. Comparing the second and third rows of the table, we see that the weights can effectively mitigate the adverse effects of data imbalance and improve the model's classification performance. Both the iCaRL and prototype methods in Table 2 use the same ResNet-44 for feature extraction of the LFCC of the voices, which is later fed into the classifier for classification. Comparing the first and third rows in Table 2, we see that the prototype method performed better in the incremental experiments.  
We observed high-dimensional features of the prototypically trained model using \(t\)-distribution Stochastic Neighborhood Embedding (t-SNE) plots, as shown in Figure 7. Figure 7a shows that the various types of voice spoofing sample features are in high-dimensional spaces with compact intra-classes and large class spacing. This makes the  
\begin{table}
\begin{tabular}{l c c c c c} \hline \hline \multirow{2}{*}{**Method**} & **0 Iters** & **1 Iters** & **2 Iters** & **3 Iters** & **4 Iters** \\ \cline{2-6}  & **Avg (\%)** & **Avg (\%)** & **Avg (\%)** & **Avg (\%)** & **Avg (\%)** \\ \hline iCaRL & 99.03 & 87.97 & 84.86 & 83.20 & 76.58 \\ prototype & 98.78 & 85.38 & 84.51 & 82.02 & 68.77 \\ prototype + weight & 98.78 & 87.17 & 85.31 & 88.35 & 79.89 \\ \hline \hline \end{tabular}
\end{table}
Table 2: The accuracy during the incremental learning iterations.  
Figure 6: CM score histogram: (**a**) AM-Softmax. (**b**) Sigmoid. (**c**) Domain adaptation. (**d**) OC-Softmax.  
model highly generalizable for forgery algorithm recognition. From Figure 7b, we can see that the features of the untrained voice spoofing samples are primarily distributed in low-density regions and are separated from the trained class sample features. This indicates that, after the new classes are added, we can still classify the old classes using the prototypes, and the appearance of the new classes will not have an excessive impact on the old classes. Therefore, the prototype is suitable for incremental voice spoof detection.  
After the last training iteration, the accuracy of the model in identifying various spoof algorithms in the test set is presented in Table 3. It can be seen that the model has a high recognition ability for most forgery algorithms (accuracy higher than 80%), whereas the classification performance for forgery attacks A4, A7, and A10 is relatively poor. From the confusion matrix shown in Figure 8, we can see that the three attacks A4, A7, and A10 will misclassify each other, which we believe is because of the voice spoofing generated by these three spoof algorithms having very similar characteristics. Incremental learning is a deep learning method in scenarios where there is a lack of data, which leads to the model's poor classification performance for these three attack methods.  
Figure 8: Classification confusion matrix after the last iteration of training.  
Figure 7: (**a**) Visualization of the t-SNE of the learned A1–A9 category features distribution. (**b**) The t-SNE visualization of the learned category A1–A9 and for the learned category A10–A17 features distribution t-SNE visualization. The numbers in the figure indicate the category numbers of the forgery methods.