Voting for the right answer: Adversarial defense for speaker verification

Abstract

Automatic speaker verification (ASV) is a well developed technology for biometric identification, and has been ubiquitous implemented in security-critic applications, such as banking and access control. However, previous works have shown that ASV is under the radar of adversarial attacks, which are very similar to their original counterparts from human's perception, yet will manipulate the ASV render wrong prediction. Due to the very late emergence of adversarial attacks for ASV, effective countermeasures against them are limited. Given that the security of ASV is of high priority, in this work, we propose the idea of "voting for the right answer" to prevent risky decisions of ASV in blind spot areas, by employing random sampling and voting. Experimental results show that our proposed method improves the robustness against both the limited-knowledge attackers by pulling the adversarial samples out of the blind spots, and the perfect-knowledge attackers by introducing randomness and increasing the attackers' budgets.

arXiv commentAccepted by Interspeech 2021. Code is available at https://github.com/thuhcsi/adsv_voting

References in corpus (16)

• VoxCeleb2: Deep Speaker Recognition
• VoxCeleb: a large-scale speaker identification dataset
• Attentive Statistics Pooling for Deep Speaker Embedding
• In defence of metric learning for speaker recognition
• Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition
• Robust Audio Adversarial Example for a Physical Attack
• On Adaptive Attacks to Adversarial Example Defenses
• Characterizing Speech Adversarial Examples Using Self-Attention U-Net Enhancement
• The Attacker's Perspective on Automatic Speaker Verification: An Overview
• Adversarial Attacks on Spoofing Countermeasures of automatic speaker verification
• Investigating Robustness of Adversarial Samples Detection for Automatic Speaker Verification
• Inaudible Adversarial Perturbations for Targeted Attack in Speaker Recognition
• Defense for Black-box Attacks on Anti-spoofing Models by Self-Supervised Learning
• Adversarial defense for automatic speaker verification by cascaded self-supervised learning models
• Defense against adversarial attacks on spoofing countermeasures of ASV
• Deep Speaker Feature Learning for Text-independent Speaker Verification