Real-Time, Universal, and Robust Adversarial Attacks Against Speaker Recognition Systems

Abstract

As the popularity of voice user interface (VUI) exploded in recent years, speaker recognition system has emerged as an important medium of identifying a speaker in many security-required applications and services. In this paper, we propose the first real-time, universal, and robust adversarial attack against the state-of-the-art deep neural network (DNN) based speaker recognition system. Through adding an audio-agnostic universal perturbation on arbitrary enrolled speaker's voice input, the DNN-based speaker recognition system would identify the speaker as any target (i.e., adversary-desired) speaker label. In addition, we improve the robustness of our attack by modeling the sound distortions caused by the physical over-the-air propagation through estimating room impulse response (RIR). Experiment using a public dataset of 109 English speakers demonstrates the effectiveness and robustness of our proposed attack with a high attack success rate of over 90%. The attack launching time also achieves a 100× speedup over contemporary non-universal attacks.

FoolHD: Fooling Speaker Identification by Highly Imperceptible Adversarial Disturbances

“…The VoxCeleb dataset [22] contains speech from 7,363 speakers of multiple ethnicities, accents, occupations and age groups. Among these, for our experiments, we randomly chose 250 speakers (for consistency with the state-of-the-art [10,23,24]): 125 female speakers, and 125 male speakers. All audio files were downsampled to 8 kHz to match the sampling rate of our pre-trained speaker identification model.…”

Attack on Practical Speaker Verification System Using Universal Adversarial Perturbations

“…In the first step, we maximize the attack effect on the ASV model which is similar to the method in [13]. We make δ be effective to lead a targeted attack on the ASV model regardless of the content of input x. N audios of the adversary are collected to form a training set X = {x 1 , x 2 , ..., x N } where each x i contains different text contents.…”

“…It provides a baseline WER to measure the distortion on speech recognition caused by the adversarial perturbations. As mentioned in Section 3.1 our first step is very similar to the method used in [13]. Hence we used the adversarial perturbation δ * 1 generated in the first step as the baseline method.…”

“…But their adversarial examples will be rejected in the PSV system for audio replay or different speech content. Studies [12,13] crafted universal adversarial perturbations that were text-independent and could launch attack in real time. But it is not proved that their perturbations could not affect the speech content recognition and remained effective after being played separately over the air to pass the audio replay detection.…”

Non-Invasive Challenge Response Authentication for Voice Transactions with Smart Home Behavior

“…The feasibility of inaudible audio attacks in speech recognition systems, such as Siri and Alexa, was proven in [ 25 ]. Speaker recognition systems based on deep neural networks are also vulnerable to adversarial attacks, as shown by the high attack success rate of over 90% [ 26 ].…”