When and why do handcrafted cues help self-supervised anti-spoofing? A causal and faithfulness analysis

Abstract

Most spoofing countermeasures now place a light classifier on top of a self-supervised (SSL) speech encoder. A growing line of work adds handcrafted acoustic features and fuses them by cross-attention, partly because the attention weights appear to explain which cues the model relies on. Two things about such fusion remain untested: whether the handcrafted features contribute anything once a strong SSL encoder is already in place, and whether the attention map faithfully reflects what the classifier actually uses. We study both questions with MOSAIC, a single model that handles logical access (LA) and physical access (PA) attacks by projecting a 152-dimensional biophonetic vector into six query tokens attending over thirteen intermediate layers of WavLM-Large. Rather than pursuing state-of-the-art accuracy, we treat the model itself as the object of analysis and apply inference-time interventions that zero out selected components. Removing the handcrafted branch lowers the EER by 0.67 percentage points under LA, so WavLM alone is sufficient there, but raises it by 0.76 points under PA, where the branch supplies replay channel evidence the encoder does not carry. The 6x13 attention map is highly stable under resampling (bootstrap rank correlation 0.99), yet its faithfulness varies by domain: layer attention weights predict the causal importance of each layer under PA (rho = +0.62) but not under LA (rho = -0.28). The handcrafted branch and its attention-based explanation are therefore trustworthy for replay attacks and not for synthetic ones. On standard benchmarks the model is mid-range on LA and ahead of the official baselines on cross-source deepfakes (6.21% EER on ASVspoof 2021 DF). The contribution is not a new architecture but a checking procedure: verify handcrafted cues and attention maps by intervention before trusting either.