The objective of this paper is to extract robust features for detecting replay spoof attacks on text-independent speaker verification systems. In the case of replay attacks, prerecorded utterance of the target speaker is played to automatic speaker verification (ASV) system to gain unauthorized access. In such a scenario, the speech signal carries the characteristics of the intermediate recording device as well. In the proposed approach, the characteristics of the intermediate device are highlighted by subtracting the contribution of the live speech in the cepstral domain. An overcomplete dictionary learned on cepstral features, extracted from live speech data, is used to subtract the contribution of live speech. The residual captures the characteristics of recording device, and can be used to distinguish spoof speech signal from live speech signal. The distribution of the residuals from live and spoof speech signals are captured using Gaussian mixture models (GMMs). The likelihood ratio computed from the GMMs built on spoof and live signals, respectively, is used to detect the spoof attack. The performance of the proposed approach is evaluated on ASVspoof 2017 evaluation challenge database. The proposed feature extraction method achieved 20.18% relative improvement over the base line system built on the constant-Q cepstral coefficients. © 2017 IEEE.