Banana Navy
Catalog FR
Lab · AI threat modeling · Detailed card

Evade AI model

fooling the AI detector meant to catch synthetic or cloned voice, instead of making the voice.

SheetF24
CategoryT-TB7-01 (signal tampering)
Layers6 · Deepfake Detection, 8 · Speaker Verification
SystemAI voicebot

never validate a critical path on a single detector or on margin-less confidence.

The threat

adversarial audio calibrated against anti-spoofing (AASIST, RawNet2, WavLM) to pass synthetic or cloned content as authentic: perturbation computed on the detector gradients, confidence gradient manipulation (locating and moving the boundary between high and low confidence), transferability of perturbations across architectures (an example crafted on one model rarely defeats a heterogeneous ensemble alone, but transfers between similar models).

Blind spotWhy classic frameworks miss it

classic grids treat the detector as a reliable barrier ("we have anti-spoofing"); yet an AI control is itself an attackable function (gradients, over-confidence, manipulable output probability) and can be transferred by the attacker. No single detector, no bare confidence, guarantees detection.

MitigationProposed approach

never validate a critical path on a single detector or on bare confidence: heterogeneous ensemble of detectors (diverse architectures), confidence thresholds with margin and human escalation on both sides of the threshold, input validation/normalization (codec, resampling, filtering) to break perturbations, adversarial robustness benchmarks (transferability) re-evaluated, alerts on samples close to the threshold.

The proposed control
no critical path validated on a single detector nor on margin-less confidence.

Expected evidence
an adversarial example (including transferred) never pushes the verdict below the action threshold across the ensemble, or pushes it to human escalation.

SourcesReferences and public research

MITRE ATLAS 2026.07AML.T0015 Evade AI Model · AML.T0043.000 White-Box Optimization (confidence gradient) · AML.T0043.002 Black-Box Transfer (transferability)
OWASP GenAIno direct OWASP label: the threat is covered by the ATLAS mapping above.
Public researchTargeted architectures: AASIST (arXiv 2110.01200), RawNet2 (arXiv 2011.01108), WavLM back-ends (arXiv 2409.05032). Adversarial attacks on ASV countermeasures: arXiv 1910.08716, arXiv 2501.11902, arXiv 2509.07132. Defense: arXiv 2003.03065.
layer 6 · Deepfake Detectionlayer 8 · Speaker Verification

Explore the 20 security layers

MITRE ATLAS 2026.07 · OWASP GenAI · risk-voicebot