never validate a critical path on a single detector or on margin-less confidence.
The threat
adversarial audio calibrated against anti-spoofing (AASIST, RawNet2, WavLM) to pass synthetic or cloned content as authentic: perturbation computed on the detector gradients, confidence gradient manipulation (locating and moving the boundary between high and low confidence), transferability of perturbations across architectures (an example crafted on one model rarely defeats a heterogeneous ensemble alone, but transfers between similar models).
Blind spotWhy classic frameworks miss it
classic grids treat the detector as a reliable barrier ("we have anti-spoofing"); yet an AI control is itself an attackable function (gradients, over-confidence, manipulable output probability) and can be transferred by the attacker. No single detector, no bare confidence, guarantees detection.
MitigationProposed approach
never validate a critical path on a single detector or on bare confidence: heterogeneous ensemble of detectors (diverse architectures), confidence thresholds with margin and human escalation on both sides of the threshold, input validation/normalization (codec, resampling, filtering) to break perturbations, adversarial robustness benchmarks (transferability) re-evaluated, alerts on samples close to the threshold.
The proposed control
no critical path validated on a single detector nor on margin-less confidence.
Expected evidence
an adversarial example (including transferred) never pushes the verdict below the action threshold across the ensemble, or pushes it to human escalation.