Fooling End-to-end Speaker Verification by Adversarial Examples
This highlights a security flaw in speaker verification systems used for authentication, which is incremental as it applies known adversarial attack methods to a new domain.
The paper demonstrates that end-to-end deep neural speaker verification systems are vulnerable to adversarial attacks, where adding imperceptible noise to audio waveforms can fool the system into misidentifying speakers, reducing accuracy and increasing false-positive rates.
Automatic speaker verification systems are increasingly used as the primary means to authenticate costumers. Recently, it has been proposed to train speaker verification systems using end-to-end deep neural models. In this paper, we show that such systems are vulnerable to adversarial example attack. Adversarial examples are generated by adding a peculiar noise to original speaker examples, in such a way that they are almost indistinguishable from the original examples by a human listener. Yet, the generated waveforms, which sound as speaker A can be used to fool such a system by claiming as if the waveforms were uttered by speaker B. We present white-box attacks on an end-to-end deep network that was either trained on YOHO or NTIMIT. We also present two black-box attacks: where the adversarial examples were generated with a system that was trained on YOHO, but the attack is on a system that was trained on NTIMIT; and when the adversarial examples were generated with a system that was trained on Mel-spectrum feature set, but the attack is on a system that was trained on MFCC. Results suggest that the accuracy of the attacked system was decreased and the false-positive rate was dramatically increased.