CoChat
Sign Up
Cited by 53Adversarial Robustness in Machine LearningSpeech Recognition and SynthesisSecurity and Verification in Computing

Study of Pre-Processing Defenses Against Adversarial Attacks on State-of-the-Art Speaker Recognition Systems

Open access
Joshi, Sonal, Villalba, Jesus, Zelasko, Piotr, Moro-Velazquez, Laureano, Dehak, Najim·2021·IEEE Transactions on Information Forensics and Security
DOI 10.1109/tifs.2021.3116438
Open this paper in CoChat — free accountOpen PDF

Abstract

Adversarial examples are designed to fool the speaker recognition (SR) system by adding a carefully crafted human-imperceptible noise to the speech signals. Posing a severe security threat to state-of-the-art SR systems, it becomes vital to deep-dive and study their vulnerabilities. Moreover, it is of greater importance to propose countermeasures that can protect the systems against these attacks. Addressing these concerns, we first investigated how state-of-the-art x-vector based SR systems are affected by white-box adversarial attacks, i.e., when the adversary has full knowledge of the system. x-Vector based SR systems are evaluated against white-box adversarial attacks common in the literature like fast gradient sign method (FGSM), basic iterative method (BIM)–a.k.a. iterative-FGSM–, projected gradient descent (PGD), and Carlini-Wagner (CW) attack. To mitigate against these attacks, we investigated four pre-processing defenses which do not need adversarial examples during training. The four pre-processing defenses–viz. randomized smoothing, DefenseGAN, variational autoencoder (VAE), and Parallel Wave-GAN vocoder (PWG) are compared against the baseline defense of adversarial training. Performing powerful adaptive white-box adversarial attack (i.e., when the adversary has full knowledge of the system, including the defense), our conclusions indicate that SR systems were extremely vulnerable under BIM, PGD, and CW attacks. Among the proposed pre-processing defenses, PWG combined with randomized smoothing offers the most protection against the attacks, with accuracy averaging 93% compared to 52% in the undefended system and an absolute improvement > 90% for BIM attacks with L∞ > 0.001 and CW attack.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1109/tifs.2021.3116438

Cites

71 of 71 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Adversarial attacks target the ASV system, but rarely the CM.

    “These target the ASV system, but rarely the CM.”

    From ASVspoof 2021: Towards Spoofed and Deepfake Speech Detection in the Wild (2023) · cites this paper as [57]

    The 'Adversarial attacks on speech systems' section describes several attacks on speaker-recognition and speaker-verification systems. It also notes that systems with spoofing countermeasures can be susceptible, but does not establish that attacks targeting the countermeasure itself are rare relative to attacks targeting ASV. No page number is available in our copy. (LLM, conf=0.78)

    Experimental — accuracy not yet measured

  • Many examples in the literature show the threat to reliable ASV stemming from adversarial attacks.

    “Many examples in the literature show the threat to reliable ASV stemming from adversarial attacks [56], [57].”

    From ASVspoof 2021: Towards Spoofed and Deepfake Speech Detection in the Wild (2023) · cites this paper as [57]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 15

  1. [7]7. C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. J. Goodfellow, and R. Fergus, "Intriguing properties of neural networks," in International Conference on Learning Representations (ICLR), 2014.
  2. [8]8. I. J. Goodfellow, J. Shlens, and C. Szegedy, "Explaining and Harnessing Adversarial Examples," in International Conference on Learning Rep- resentations (ICLR), 2015.
  3. [24]24. I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio, "Generative adversarial nets," Advances in Neural Information Processing Systems, vol. 27, pp. 2672- 2680, 2014.
  4. [25]25. X. Yuan, Y. Chen, Y. Zhao, Y. Long, X. Liu, K. Chen, S. Zhang, H. Huang, X. Wang, and C. A. Gunter, "Commandersong: A system- atic approach for practical adversarial voice recognition," in USENIX Security Symposium, 2018, pp. 49-64.
  5. [38]38. I. Goodfellow, J. Shlens, and C. Szegedy, "Explaining and harnessing adversarial examples," in International Conference on Learning Repre- sentations, 2015.
  6. [40]40. Y. Song, T. Kim, S. Nowozin, S. Ermon, and N. Kushman, "Pixelde- fend: Leveraging generative models to understand and defend against adversarial examples," in International Conference on Learning Repre- sentations, 2018.
  7. [41]41. P. Samangouei, M. Kabkab, and R. Chellappa, "Defense-GAN: Protect- ing Classifiers Against Adversarial Attacks Using Generative Models," International Conference on Learning Representations, 2018.
  8. [47]47. C. Laidlaw, S. Singla, and S. Feizi, "Perceptual adversarial robustness: Defense against unseen threat models," in International Conference on Learning Representations, 2021.
  9. [57]57. M. Tan and Q. Le, "Efficientnet: Rethinking model scaling for con- volutional neural networks," in International Conference on Machine Learning, 2019, pp. 6105-6114.
  10. [60]60. A. Athalye, N. Carlini, and D. Wagner, "Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples," in International Conference on Machine Learning, 2018, pp. 274-283.
  11. [61]61. S.-M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard, "Univer- sal adversarial perturbations," in Proceedings of the IEEE conference on computer vision and pattern recognition, 2017, pp. 1765-1773.
  12. [66]66. M. Arjovsky, S. Chintala, and L. Bottou, "Wasserstein generative adver- sarial networks," in Proceedings of the 34th International Conference on Machine Learning-Volume 70, 2017, pp. 214-223.
  13. [67]67. C. Donahue, J. McAuley, and M. Puckette, "Adversarial Audio Synthe- sis," International Conference on Learning Representations, 2019.
  14. [68]68. I. Gulrajani, F. Ahmed, M. Arjovsky, V. Dumoulin, and A. Courville, "Improved Training of Wasserstein GANs," in International Conference on Neural Information Processing Systems (NIPS), 2017.
  15. [70]70. A. A. Alemi, I. Fischer, J. V. Dillon, and K. Murphy, "Deep variational information bottleneck," International Conference on Learning Repre- sentations (ICLR), 2017.

Cited by

Sorted by citations

Related

Authors
Joshi, S., Villalba, J., Zelasko, P., Moro-Velazquez, L., & Dehak, N.
Affiliations
Johns Hopkins University (US)
ORCID
Venue
IEEE Transactions on Information Forensics and Security
Publisher
Institute of Electrical and Electronics Engineers (IEEE)
Published
2021
Volume
16
Pages
4811-4826
ISSN
  • 1556-6013 (ISSN-L)
  • 1556-6021
DOI
10.1109/tifs.2021.3116438
OpenAlex
W3176325251
Cited by
53
References
71
Citations by year
2026: 5 · 2025: 11 · 2024: 11 · 2023: 16 · 2022: 8 · 2021: 2
FWCI
3.27
Type
journal article
Language
en
Open access
Licence
Locations
  • IEEE Transactions on Information Forensics and Security (publishedVersion)
  • arXiv (Cornell University) (submittedVersion, public-domain)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
  • IEEE RESOURCE CENTERS
Funders
Defense Advanced Research Projects Agency (HR001119S0026-GARD-FP-052)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Artificial Intelligence › Speech Recognition and Synthesis
  • Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
Keywords
adversarial attacks, speaker recognition, x-vector, randomized smoothing, variational autoencoder, adversarial training, FGSM, projected gradient descent, Carlini-Wagner attack, adaptive attacks

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review