# Generalized Spoof Detection and Incremental Algorithm Recognition for Voice Spoofing
## 3 Voice Spoof Detection and Algorithm Recognition System
### Generalized Voice Spoof Detection
#### 3.1.2 Domain Adaptation Based on Decision Boundary Maximization  
During model inference, the voice spoof detection task may encounter many voice samples of unknown attack types. The types of voice attacks included in the training set are often limited. This leads to an extreme mismatch between the data feature distributions of the training and test sets for the spoofing samples. Suppose the voice identification spoof problem is viewed purely as a dichotomous classification problem. In that case, when the model is inferred, the model tends to have a degraded performance when faced  
Figure 2: Schematic of domain adaptation. \(C_{1}\) and \(C_{2}\) denote classification boundaries. The dashed ellipse indicates the source domain, and the solid ellipse indicates the target domain. (**a**) indicates maximizing the shaded area. (**b**) indicates that the classifier is maximized. (**c**) indicates that the divergence is minimized. (**d**) denotes the final optimization objective with more robust decision boundary. with many new samples. This one-classification task scenario is well suited to the idea of one-class classification. The traditional voice spoof detection task uses a binary classification loss function expressed as  
\[\mathrm{L}=-\frac{1}{\mathrm{M}}\sum\
olimits_{i=1}^{\mathrm{M}}\log\frac{ \mathrm{e}^{\omega_{\mathrm{label_i}}^{\mathrm{T}}\ast\mathrm{x_{i}}}}{\mathrm{e }^{\omega_{\mathrm{label_i}}^{\mathrm{T}}\ast\mathrm{x_{i}}}+\mathrm{e}^{\omega _{\mathrm{1-label_i}}^{\mathrm{T}}\ast\mathrm{x_{i}}}} \tag{2}\]  
where \(\mathrm{x_{i}}\in\mathbb{R}^{\mathrm{D}}\) is the embedding vector of the ith voice sample, and \(\mathrm{label_i}\in\{0,\,1\}\) is the corresponding label. AM-Softmax introduces an angular margin into the traditional binary loss function. The distances between the data within each class are minimized while maximizing the distance between the target and non-target classes. The decision boundary was made to be more compact. AM-Softmax is expressed as follows:  
\[\mathrm{L}=-\frac{1}{\mathrm{M}}\sum\
olimits_{i=1}^{\mathrm{M}}\log\frac{ \mathrm{e}^{\frac{\mathrm{\delta}(\omega_{\mathrm{label_i}}^{\mathrm{T}}\ast \mathrm{x_{i}}-m)}{\mathrm{e}^{\mathrm{\delta}(\omega_{\mathrm{label_i}}^{ \mathrm{T}}\ast\mathrm{x_{i}}-m)}}}}{\mathrm{e}^{\mathrm{\delta}(\omega_{ \mathrm{label_i}}^{\mathrm{T}}\ast\mathrm{x_{i}}-m)}+\mathrm{e}^{\mathrm{ \delta}(\omega_{\mathrm{label_i}}^{\mathrm{T}}\ast\mathrm{x_{i}})}-\mathrm{ label_i}^{\mathrm{T}}\ast\mathrm{x_{i}}} \tag{3}\]  
where \(\mathrm{\delta}\) denotes the scaling factor, \(\mathrm{m}\) is the cosine similarity margin, and \(\mathrm{\hat{\omega}}\) and \(\mathrm{\hat{x}}\) are the normalized \(\mathrm{\omega}\) and \(\mathrm{x}\), respectively. It can be seen from the equation that the embedding vectors of both the target and non-target classes tend to converge in two opposite directions, i.e., \(\omega_{0}-\omega_{1}\) and \(\omega_{1}-\omega_{0}\), respectively, where \(\omega_{0}\) is the target class represented by the real voice and \(\omega_{1}\) is the non-target class represented by the spoofing voice. For AM-Softmax, the embedding features of both the target and non-target classes were set to the same angular margin as \(\mathrm{m}\). In a realistic scenario, because the feature distribution of the non-target class, the spoofing voice, differs significantly from that of the target class, training the same decision boundary for both often results in overfitting the model to known attack types in the training set. Therefore, we considered introducing different angular margins \(\mathrm{m}\) for the real and spoofing samples. Different decision bounds were trained to identify real voice samples better and isolate voice spoofing samples.