Attack on practical speaker verification system using universal adversarial perturbations

Abstract

In authentication scenarios, applications of practical speaker verification systems usually require a person to read a dynamic authentication text. Previous studies played an audio adversarial example as a digital signal to perform physical attacks, which would be easily rejected by audio replay detection modules. This work shows that by playing our crafted adversarial perturbation as a separate source when the adversary is speaking, the the practical speaker verification system will misjudge the adversary as a target speaker. A two-step algorithm is proposed to optimize the universal adversarial perturbation to be text-independent and has little effect on authentication text recognition. We also estimated room impulse response (RIR) in the algorithm which allowed the perturbation to be effective after being played over the air. In the physical experiment, we achieved targeted attacks with a success rate of 100%, while the word error rate (WER) on speech recognition only increased by 3.55%. And recorded audio could pass replay detection for the live person speaking.

Shuning Zhao (赵舒宁）

Ph.D. Candidate

My research interests include the application of Artificial Intelligence and Machine Learning in Finance, Insurance, Speech, and Audio domains.

Xiaolin Hu

Associate Professor

Faculty member of Department of Computer Science and Technology, Tsinghua University, working in the TSAIL group directed by Prof. Bo Zhang and Prof. Jun Zhu. My current research interests include artificial neural networks and computational neuroscience. I’m an Associate Editor of IEEE Transactions on Pattern Analysis and Machine Intelligence, IEEE Transactions on Image Processing and Cognitive Neurodynamics. Previously I was an Associate Editor of IEEE Transactions on Neural Networks and Learning Systems. I’m a Senior Member of IEEE.