SEC4SR: A Security Analysis Platform for Speaker Recognition

Abstract

Adversarial attacks have been expanded to speaker recognition (SR). However, existing attacks are often assessed using different SR models, recognition tasks and datasets, and only few adversarial defenses borrowed from computer vision are considered. Yet,these defenses have not been thoroughly evaluated against adaptive attacks. Thus, there is still a lack of quantitative understanding about the strengths and limitations of adversarial attacks and defenses. More effective defenses are also required for securing SR systems. To bridge this gap, we present SEC4SR, the first platform enabling researchers to systematically and comprehensively evaluate adversarial attacks and defenses in SR. SEC4SR incorporates 4 white-box and 2 black-box attacks, 24 defenses including our novel feature-level transformations. It also contains techniques for mounting adaptive attacks. Using SEC4SR, we conduct thus far the largest-scale empirical study on adversarial attacks and defenses in SR, involving 23 defenses, 15 attacks and 4 attack settings. Our study provides lots of useful findings that may advance future research: such as (1) all the transformations slightly degrade accuracy on benign examples and their effectiveness vary with attacks; (2) most transformations become less effective under adaptive attacks, but some transformations become more effective; (3) few transformations combined with adversarial training yield stronger defenses over some but not all attacks, while our feature-level transformation combined with adversarial training yields the strongest defense over all the attacks. Extensive experiments demonstrate capabilities and advantages of SEC4SR which can benefit future research in SR.

References in corpus (15)

• Deep Speech 2: End-to-End Speech Recognition in English and Mandarin
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Deep Speaker: an End-to-End Neural Speaker Embedding System
• Did you hear that? Adversarial Examples Against Automatic Speech Recognition
• Robust Audio Adversarial Example for a Physical Attack
• advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
• Techniques for Feature Extraction In Speech Recognition System : A Comparative Study
• DeepRobust: A PyTorch Library for Adversarial Attacks and Defenses
• Advbox: a toolbox to generate adversarial examples that fool neural networks
• Attack on practical speaker verification system using universal adversarial perturbations
• FenceBox: A Platform for Defeating Adversarial Examples with Data Augmentation Techniques
• Inaudible Adversarial Perturbations for Targeted Attack in Speaker Recognition
• Enabling Fast and Universal Audio Adversarial Attack Using Generative Model
• Taking Care of The Discretization Problem: A Comprehensive Study of the Discretization Problem and A Black-Box Adversarial Attack in Discrete Integer Domain