In this paper, we investigate discrete optimal transport (DOT) as a black-box attack against modern automatic speaker verification (ASV) and anti-spoofing countermeasure (CM) systems. Our attack operates as a post-processing distribution-alignment step. Frame-level WavLM embeddings of generated speech (or another person speech) are aligned to an unpaired bona fide speech pool using entropic optimal transport and a top-k barycentric projection, followed by neural vocoding. Unlike gradient-based attacks, the proposed method requires no access to model parameters, gradients, or training data. Experiments on ASVspoof2019 and ASVspoof5 demonstrate that DOT attack substantially increases CM EER and substantially degrades ASV performance across multiple spoofing attacks. The attack transfers across datasets and remains effective after CM fine-tuning. Analysis using speaker similarity, Fréchet Audio Distance, and visualization of embedding distributions suggests that DOT succeeds by shifting source speech toward bona fide regions of the representation space rather than by maximizing speaker similarity. These results indicate that optimal-transport-based distribution alignment represents a previously underexplored attack vector for contemporary ASV and anti-spoofing systems.

翻译：本文研究离散最优传输（DOT）作为一种针对现代自动说话人验证（ASV）与反欺骗对抗措施（CM）系统的黑盒攻击方法。该攻击以后处理分布对齐步骤的形式运作。通过熵正则化最优传输与top-k重心投影，将生成语音（或他人语音）的帧级WavLM嵌入与未配对的可信语音池对齐，随后执行神经声码器处理。与基于梯度的攻击不同，所提方法无需访问模型参数、梯度或训练数据。在ASVspoof2019与ASVspoof5数据集上的实验表明，DOT攻击能显著提升CM等错误率（EER），并在多种欺骗攻击场景下严重降低ASV性能。该攻击具有跨数据集迁移性，且在CM微调后仍保持有效性。基于说话人相似度、弗雷歇音频距离（Fréchet Audio Distance）及嵌入分布可视化的分析显示，DOT攻击成功的机理是将源语音向表征空间中可信区域偏移，而非最大化说话人相似度。这些结果表明，基于最优传输的分布对齐构成当前ASV与反欺骗系统中此前未被充分探索的攻击向量。