AASIST: Audio Anti-Spoofing Using Integrated Spectro-Temporal Graph Attention Networks

Contributions

• Novel heterogeneous stacking graph attention layer (HS-GAL) that models spectral and temporal graphs with different node counts and dimensionalities using heterogeneity-aware attention and a stack node for accumulating cross-domain information
• Max graph operation (MGO) enabling competitive selection of artefacts across two parallel branches with element-wise maximum
• Extended readout scheme utilizing the stack node for more effective feature aggregation
• Lightweight AASIST-L variant with only 85K parameters that outperforms all prior systems except full AASIST, enabling practical deployment in speaker verification systems

Method

AASIST extends prior work (RawGAT-ST) by combining heterogeneous spectral and temporal graphs more effectively:

Graph construction: Two separate graph modules extract spectral and temporal representations from raw waveforms via a RawNet2-based encoder. Spectral graph $G_s$ is derived from $\max_t(|\mathbf{F}|)$ and temporal graph $G_t$ from $\max_s(|\mathbf{F}|)$, where $\mathbf{F} \in \mathbb{R}^{C \times S \times T}$ is the encoder output.

Heterogeneous stacking graph attention layer (HS-GAL): Projects both graphs to a common dimensionality $D_{st}$, then applies three separate projection vectors to compute attention weights for three edge types: (i) within-spectral edges, (ii) cross-domain edges (spectral-to-temporal and vice versa), and (iii) within-temporal edges. Introduces a stack node that accumulates information across both domains via uni-directional edges from all other nodes, preserving heterogeneous information without mixing signal paths.

Max graph operation (MGO): Two parallel branches, each containing two HS-GAL layers and graph pooling layers. Element-wise maximum is applied to combine outputs from both branches, allowing different branches to learn complementary artifact groups. Elements containing artifacts survive the maximum operation.

Readout: Concatenates maximum and average of all nodes with the stack node to form the final feature vector, followed by a two-node output layer for binary classification (genuine vs. spoofed).

Results

ASVspoof 2019 LA evaluation:

• AASIST achieves 0.0347 (best: 0.0275) min t-DCF and 1.13% (best: 0.83%) EER across three runs with different random seeds
• 20% relative improvement over RawGAT-ST baseline (0.0443 min t-DCF)
• Per-attack breakdown: AASIST outperforms on 9 of 13 attacks; largest improvement on A15 (0.65% vs. 1.03%, 35% relative improvement)

Lightweight variant (AASIST-L):

• 85K parameters, 332KB model size
• Min t-DCF: 0.0309 (best: 0.0289), EER: 0.99% (best: 0.78%)
• Outperforms all competing systems except full AASIST; substantially simpler than prior top systems (97K–437K parameters)

Ablation studies:

• Heterogeneous attention removed: 0.0415 min t-DCF (1.44% EER)—most impactful component
• Stack node removed: 0.0380 min t-DCF (1.21% EER)
• MGO removed: 0.0410 min t-DCF (1.35% EER)

Notes

Strengths: State-of-the-art performance with elegant heterogeneity-aware architecture; efficient lightweight variant suitable for deployment; comprehensive ablations demonstrate each component's contribution; evaluates on realistic unknown-attack evaluation set.

Limitations: Evaluated only on English ASVspoof 2019 LA dataset (VCTK corpus); cross-language generalization and applicability to other audio spoofing domains (deepfakes with music, speech-in-the-wild) not addressed. Graph pooling removes 50% and 30% of nodes respectively, which may lose subtle artifact information.

Relevance: AASIST represents state-of-the-art in speech anti-spoofing for speaker verification. The heterogeneous graph attention mechanism is applicable to multimodal detection tasks where data from different modalities have different dimensionalities and cardinalities.