{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,9]],"date-time":"2026-07-09T16:14:43Z","timestamp":1783613683496,"version":"3.55.0"},"reference-count":91,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"name":"Institute of Information and Communications Technology Planning and Evaluation (IITP) grant funded by Korean Government [Ministry of Science and Information and Communication Technology (MSIT)]","award":["RS-2023-00230337"],"award-info":[{"award-number":["RS-2023-00230337"]}]},{"DOI":"10.13039\/501100010418","name":"Institute of Information and Communications Technology Planning and Evaluation (IITP) grant funded by Korean Government (MSIT)","doi-asserted-by":"publisher","award":["RS-2023-00263037"],"award-info":[{"award-number":["RS-2023-00263037"]}],"id":[{"id":"10.13039\/501100010418","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/access.2025.3635633","type":"journal-article","created":{"date-parts":[[2025,11,21]],"date-time":"2025-11-21T18:44:20Z","timestamp":1763750660000},"page":"200669-200682","source":"Crossref","is-referenced-by-count":3,"title":["Inference-Time Noise Addition for Improving Adversarial Robustness of Audio Deepfake Detection System"],"prefix":"10.1109","volume":"13","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-0876-1803","authenticated-orcid":false,"given":"Inho","family":"Kim","sequence":"first","affiliation":[{"name":"Soongsil University, Seoul, South Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7988-5953","authenticated-orcid":false,"given":"Thien-Phuc","family":"Doan","sequence":"additional","affiliation":[{"name":"Soongsil University, Seoul, South Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4154-7611","authenticated-orcid":false,"given":"Sanghyun","family":"Hong","sequence":"additional","affiliation":[{"name":"Oregon State University, Corvallis, OR, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2676-3412","authenticated-orcid":false,"given":"Souhwan","family":"Jung","sequence":"additional","affiliation":[{"name":"Soongsil University, Seoul, South Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1016\/j.specom.2014.10.005"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/3422622"},{"key":"ref3","first-page":"2256","article-title":"Deep unsupervised learning using nonequilibrium thermodynamics","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Sohl-Dickstein"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.3389\/fdata.2022.1001063"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/3537674.3554742"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2019-2668"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/TAFFC.2017.2763134"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/1639642.1639704"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/APCIT62007.2024.10673451"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3664647.3681044"},{"key":"ref11","article-title":"VALL-E R: Robust and efficient zero-shot text-to-speech synthesis via monotonic alignment","author":"Han","year":"2024","journal-title":"arXiv:2406.07855"},{"key":"ref12","article-title":"Better speech synthesis through scaling","author":"Betker","year":"2023","journal-title":"arXiv:2305.07243"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2023-817"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.21437\/Odyssey.2020-19"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3394171.3413716"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2020-1810"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.21437\/ASVSPOOF.2021-1"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/WACVW65960.2025.00178"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.21437\/interspeech.2023-409"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1201\/9781351251389-8"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40994-3_25"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref23","first-page":"2137","article-title":"Black-box adversarial attacks with limited queries and information","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Ilyas"},{"key":"ref24","article-title":"Delving into transferable adversarial examples and black-box attacks","author":"Liu","year":"2016","journal-title":"arXiv:1611.02770"},{"key":"ref25","first-page":"1310","article-title":"Certified adversarial robustness via randomized smoothing","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Cohen"},{"key":"ref26","article-title":"Towards deep learning models resistant to adversarial attacks","author":"Madry","year":"2017","journal-title":"arXiv:1706.06083"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2020-2441"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/TASLP.2023.3285283"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2022-108"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690311"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.21437\/Odyssey.2022-16"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2023-1820"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP43922.2022.9747766"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2020-3015"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/ISCSLP.2010.5684887"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.21437\/odyssey.2016-41"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1006\/dspr.1999.0361"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/5254.708428"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.21437\/ASVSPOOF.2021-10"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP39728.2021.9413828"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2021-993"},{"key":"ref42","article-title":"LEAF: A learnable frontend for audio classification","author":"Zeghidour","year":"2021","journal-title":"arXiv:2101.08596"},{"key":"ref43","first-page":"12449","article-title":"Wav2vec 2.0: A framework for self-supervised learning of speech representations","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Baevski"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/TASLP.2021.3122291"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/JSTSP.2022.3188113"},{"key":"ref46","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2014","journal-title":"arXiv:1412.6572"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref48","article-title":"Maximal Jacobian-based saliency map attack","author":"Wiyatno","year":"2018","journal-title":"arXiv:1808.07945"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00764"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v32i1.11302"},{"key":"ref51","article-title":"Adversarial attacks and defences: A survey","author":"Chakraborty","year":"2018","journal-title":"arXiv:1810.00069"},{"key":"ref52","article-title":"Towards the worst-case robustness of large language models","author":"Chen","year":"2025","journal-title":"arXiv:2501.19040"},{"key":"ref53","article-title":"The space of transferable adversarial examples","author":"Tram\u00e8r","year":"2017","journal-title":"arXiv:1704.03453"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/WACV56688.2023.00141"},{"key":"ref55","article-title":"Transferability in machine learning: From phenomena to black-box attacks using adversarial samples","author":"Papernot","year":"2016","journal-title":"arXiv:1605.07277"},{"key":"ref56","first-page":"321","article-title":"Why do adversarial attacks transfer? Explaining transferability of evasion and poisoning attacks","volume-title":"Proc.28th USENIX Secur. Symp.","author":"Demontis"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP40778.2020.9191288"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref60","article-title":"Intriguing properties of neural networks","author":"Szegedy","year":"2013","journal-title":"arXiv:1312.6199"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"ref62","first-page":"1","article-title":"Decision boundary analysis of adversarial examples","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"He"},{"key":"ref63","first-page":"13887","article-title":"A theory of transfer-based black-box attacks: Explanation and implications","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"36","author":"Chen"},{"key":"ref64","article-title":"The defender\u2019s perspective on automatic speaker verification: An overview","author":"Wu","year":"2023","journal-title":"arXiv:2305.12804"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/591"},{"key":"ref66","article-title":"Stability and generalization in free adversarial training","author":"Cheng","year":"2024","journal-title":"arXiv:2404.08980"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/IPCCC51483.2021.9679446"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP39728.2021.9414525"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/TASLP.2021.3133189"},{"key":"ref70","article-title":"Diffusion models for adversarial purification","author":"Nie","year":"2022","journal-title":"arXiv:2205.07460"},{"key":"ref71","first-page":"1","article-title":"A simple unified framework for detecting out-of-distribution samples and adversarial attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Lee"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1145\/3719292"},{"key":"ref73","first-page":"12062","article-title":"Adversarial purification with score-based generative models","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Yoon"},{"key":"ref74","article-title":"On detecting adversarial perturbations","author":"Metzen","year":"2017","journal-title":"arXiv:1702.04267"},{"key":"ref75","article-title":"Ensemble adversarial training: Attacks and defenses","author":"Tram\u00e8r","year":"2017","journal-title":"arXiv:1705.07204"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v32i1.11504"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.3390\/a15080293"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2024-1191"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2024-372"},{"key":"ref80","article-title":"Defense against adversarial attacks on hybrid speech recognition using joint adversarial fine-tuning with denoiser","author":"Joshi","year":"2022","journal-title":"arXiv:2204.03851"},{"key":"ref81","article-title":"Adversarial attacks against automatic speech recognition systems via psychoacoustic hiding","author":"Sch\u00f6nherr","year":"2018","journal-title":"arXiv:1808.05665"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1016\/j.sysarc.2022.102526"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/WACV51458.2022.00387"},{"key":"ref84","first-page":"2280","article-title":"Adversarial examples are a natural consequence of test error in noise","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Ford"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1016\/j.csl.2020.101114"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP43922.2022.9746213"},{"key":"ref87","article-title":"Towards efficient data-centric robust machine learning with noise-based augmentation","author":"Liu","year":"2022","journal-title":"arXiv:2203.03810"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.21437\/SPSC.2021-8"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1145\/3560905.3568518"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/OJSP.2023.3256321"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1145\/3641519.3657435"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/6287639\/10820123\/11263781.pdf?arnumber=11263781","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,3]],"date-time":"2025-12-03T18:43:45Z","timestamp":1764787425000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11263781\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":91,"URL":"https:\/\/doi.org\/10.1109\/access.2025.3635633","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]}}}