Spoofing attack augmentation: can differently-trained attack models improve generalisation?