Over-the-Air Adversarial Attacks and Detection for Automatic Speaker Verification

Automatic Speaker Verification (ASV) systems are widely used for voice-based identity verification, but recent studies have shown that they are vulnerable to both over-the-line (OTL) and over-the-air (OTA) adversarial attacks. Although various detection methods have been proposed, their robustness against diverse OTA attack scenarios has not been systematically assessed. In this work, we present AdvSV 2.0, a large-scale, open-source dataset for adversarial attacks on ASV systems. AdvSV 2.0 contains 628k utterances (800 hours) spanning 8 ASV models, 4 attack methods, and 9 physical playback-recording device combinations, and includes both OTL and OTA adversarial examples. To better connect digital adversarial optimization with the physical OTA channel, we further propose an OTA attack generation method based on a Neural Replay Simulator (NRS), which simulates replay-channel distortions and improves OTA attack success rates by up to 33.4% after air transmission. To defend against these attacks, we propose CODA-OCC, a COntrastive Domain-Aligned One-Class Classifier. Built on a one-class classification paradigm, CODA-OCC is trained only on bona fide speech and does not rely on any white-box assumption about the ASV backend. Experimental results on AdvSV 2.0 show that CODA-OCC achieves an EER of 11.2% and an AUC of 0.95, outperforming the purification-based baseline by 8.6% absolute EER, and providing a robust foundation for studying OTA adversarial robustness in ASV.