SLMIA-SR: Speaker-Level Membership Inference Attacks against Speaker Recognition Systems

Abstract

Membership inference attacks allow adversaries to determine whether a particular example was contained in the model's training dataset. While previous works have confirmed the feasibility of such attacks in various applications, none has focused on speaker recognition (SR), a promising voice-based biometric recognition technique. In this work, we propose SLMIA-SR, the first membership inference attack tailored to SR. In contrast to conventional example-level attack, our attack features speaker-level membership inference, i.e., determining if any voices of a given speaker, either the same as or different from the given inference voices, have been involved in the training of a model. It is particularly useful and practical since the training and inference voices are usually distinct, and it is also meaningful considering the open-set nature of SR, namely, the recognition speakers were often not present in the training data. We utilize intra-similarity and inter-dissimilarity, two training objectives of SR, to characterize the differences between training and non-training speakers and quantify them with two groups of features driven by carefully-established feature engineering to mount the attack. To improve the generalizability of our attack, we propose a novel mixing ratio training strategy to train attack models. To enhance the attack performance, we introduce voice chunk splitting to cope with the limited number of inference voices and propose to train attack models dependent on the number of inference voices. Our attack is versatile and can work in both white-box and black-box scenarios. Additionally, we propose two novel techniques to reduce the number of black-box queries while maintaining the attack performance. Extensive experiments demonstrate the effectiveness of SLMIA-SR.

In Proceedings of the 31st Network and Distributed System Security (NDSS) Symposium, 2024

References in corpus (10)

• "Hello, It's Me": Deep Learning-based Speech Synthesis Attacks in the Real World
• Membership Inference Attacks From First Principles
• SirenAttack: Generating Adversarial Audio for End-to-End Acoustic Systems
• Adversarial Attacks on GMM i-vector based Speaker Verification Systems
• User-Level Membership Inference Attack against Metric Embedding Learning
• Introducing Model Inversion Attacks on Automatic Speaker Recognition
• Semi-Leak: Membership Inference Attacks Against Semi-supervised Learning
• Pushing the limits of raw waveform speaker recognition
• EncoderMI: Membership Inference against Pre-trained Encoders in Contrastive Learning
• FACE-AUDITOR: Data Auditing in Facial Recognition Systems