Adversarial Attack and Defense Strategies of Speaker Recognition Systems: A Survey

Abstract

Speaker recognition is a task that identifies the speaker from multiple audios. Recently, advances in deep learning have considerably boosted the development of speech signal processing techniques. Speaker or speech recognition has been widely adopted in such applications as smart locks, smart vehicle-mounted systems, and financial services. However, deep neural network-based speaker recognition systems (SRSs) are susceptible to adversarial attacks, which fool the system to make wrong decisions by small perturbations, and this has drawn the attention of researchers to the security of SRSs. Unfortunately, there is no systematic review work in this domain. In this work, we conduct a comprehensive survey to fill this gap, which includes the development of SRSs, adversarial attacks and defenses against SRSs. Specifically, we first introduce the mainstream frameworks of SRSs and some commonly used datasets. Then, from the perspectives of adversarial example generation and evaluation, we introduce different attack tasks, the prior knowledge of attacks, perturbation objects, perturbation constraints, and attack effect evaluation indicators. Next, we focus on some effective defense strategies, including adversarial training, attack detection, and input refactoring against existing attacks, and analyze their strengths and weaknesses in terms of fidelity and robustness. Finally, we discuss the challenges posed by audio adversarial examples in SRSs and some valuable research topics in the future.

Evaluating the Vulnerability of YOLOv5 to Adversarial Attacks for Enhanced Cybersecurity in MASS

“…The FGSM [13] algorithm is a simple and effective method for generating adversarial examples in deep learning models. By adding a minimal perturbation to the input data in the direction of the gradient of the loss function of the input data, the algorithm can cause the model to misclassify the data, even though the perturbed image may appear similar to the original one to a human observer [20]. The algorithm of the FGSM is summarized in Table 1.…”

“…The algorithm clips the perturbation at each iteration to ensure that its L∞ norm does not exceed the specified size . The I-FGSM can generate more effective adversarial examples than those generated by the FGSM, particularly when combined with other techniques such as momentum or randomization [20,21]. The algorithm of the I-FGSM is presented in Table 2.…”

Experimental & Comparative Study of Adversarial Attacks on Automatic Speech Recognition Systems

“…A thorough assessment of the development of SRSs, including the mainstream frameworks of SRSs, types of adversarial attacks, attack detection strategies, perturbation constraints and objects, defence training methods, refactoring against existing attacks and few commonly used datasets, has been provided by Hao Tan et al [20].…”

Secure Convolutional Neural Network-Based Internet-of-Healthcare Applications

“…The first type is a proactive approach aimed at increasing the resilience of the ML-based system during the training phase. A second type is a reactive approach, whose main goal is to instantly detect AEs during the inference phase [60].…”