Pipe Overflow: Smashing Voice Authentication for Fun and Profit

Abstract

Recent years have seen a surge of popularity of acoustics-enabled personal devices powered by machine learning. Yet, machine learning has proven to be vulnerable to adversarial examples. Large number of modern systems protect themselves against such attacks by targeting the artificiality, i.e., they deploy mechanisms to detect the lack of human involvement in generating the adversarial examples. However, these defenses implicitly assume that humans are incapable of producing meaningful and targeted adversarial examples. In this paper, we show that this base assumption is wrong. In particular, we demonstrate that for tasks like speaker identification, a human is capable of producing analog adversarial examples directly with little cost and supervision: by simply speaking through a tube, an adversary reliably impersonates other speakers in eyes of ML models for speaker identification. Our findings extend to a range of other acoustic-biometric tasks such as liveness, bringing into question their use in security-critical settings in real life, such as phone banking.

Beyond Neural-on-Neural Approaches to Speaker Gender Protection

“…It also pushes us to look beyond neural attacks to extend the threat models under investigation to include non-neural modifications and before-the-mic scenarios. Initial efforts in these directions, and the closest work to our own, is [3], who tested a simple non-neural pitch shifting gender protection approach, and [12], who investigate before-the-mic speech protection created by having speakers speak through a tube. In contrast, in our work we propose, for the first time, "vocal adversaries", speakers speaking with adaptations created using their own voices.…”