Adversarial Sample Detection for Speaker Verification by Neural Vocoders

Abstract

Automatic speaker verification (ASV), one of the most important technology for biometric identification, has been widely adopted in security-critical applications, including transaction authentication and access control. However, previous work has shown that ASV is seriously vulnerable to recently emerged adversarial attacks, yet effective countermeasures against them are limited. In this paper, we adopt neural vocoders to spot adversarial samples for ASV. We use the neural vocoder to re-synthesize audio and find that the difference between the ASV scores for the original and re-synthesized audio is a good indicator for discrimination between genuine and adversarial samples. This effort is, to the best of our knowledge, among the first to pursue such a technical direction for detecting adversarial samples for ASV, and hence there is a lack of established baselines for comparison. Consequently, we implement the Griffin-Lim algorithm as the detection baseline. The proposed approach achieves effective detection performance that outperforms all the baselines in all the settings. We also show that the neural vocoder adopted in the detection framework is dataset-independent. Our codes will be made open-source for future works to do fair comparison 1 .

Adversarial attacks and defenses in Speaker Recognition Systems: A survey

“…In Section 5, we comprehensively review the existing works about defense methods [35,36,39,40,41,43,44] for adversarial attacks in SRSs. Meanwhile, we compare all the defense methods reviewed in this section in Table 2.…”

“…Among all the studies reviewed in this section, passive defense methods [36,39,40,41,43,44] are distinctly overwhelming with three-quarters of all reviewed papers. Passive defense methods are so popular since they can be deployed in any SRSs to defend against adversarial attacks.…”

“…Half of reviewed defense methods [36,40,41,44] are highly general. Highly general defense methods are favored by researchers since they can defend against any attack methods theoretically.…”

“…This is caused by the differences in experimental settings and evaluation metrics applied in different works. For example, the defense methods proposed in [40] and [41] were used to defend against adversarial examples generated by BIM. However, we cannot directly compare the performance of them since [40] and [41] used different evaluation metrics, i.e., [40] used FPR and FAR, and [41] used EER and DA.…”

“…Wu et al [41] also proposed a highly general defense method. They leveraged Parallel WaveGan, a neural vocoder, to re-synthesize the input utterance, and then used the difference between the SVS scores, i.e., the similarity with the enrollment utterance, for the input and re-synthesized utterance to determine whether the input utterance is an adversarial example.…”