Defense for Black-box Attacks on Anti-spoofing Models by Self-Supervised Learning
This addresses security risks in speaker verification systems, but it is an incremental improvement as it applies an existing self-supervised method to a new defense scenario.
The paper tackles the vulnerability of anti-spoofing models for automatic speaker verification to adversarial attacks by proposing a defense using Mockingjay, a self-supervised learning model, to protect against black-box attacks. Experimental results on the ASVspoof 2019 dataset show that this approach prevents the transferability of adversarial examples and successfully counters attacks.
High-performance anti-spoofing models for automatic speaker verification (ASV), have been widely used to protect ASV by identifying and filtering spoofing audio that is deliberately generated by text-to-speech, voice conversion, audio replay, etc. However, it has been shown that high-performance anti-spoofing models are vulnerable to adversarial attacks. Adversarial attacks, that are indistinguishable from original data but result in the incorrect predictions, are dangerous for anti-spoofing models and not in dispute we should detect them at any cost. To explore this issue, we proposed to employ Mockingjay, a self-supervised learning based model, to protect anti-spoofing models against adversarial attacks in the black-box scenario. Self-supervised learning models are effective in improving downstream task performance like phone classification or ASR. However, their effect in defense for adversarial attacks has not been explored yet. In this work, we explore the robustness of self-supervised learned high-level representations by using them in the defense against adversarial attacks. A layerwise noise to signal ratio (LNSR) is proposed to quantize and measure the effectiveness of deep models in countering adversarial noise. Experimental results on the ASVspoof 2019 dataset demonstrate that high-level representations extracted by Mockingjay can prevent the transferability of adversarial examples, and successfully counter black-box attacks.