Abstract:Adversarial attacks have become a major threat for machine learning applications. There is a growing interest in studying these attacks in the audio domain, e.g, speech and speaker recognition; and find defenses against them. In this work, we focus on using representation learning to classify/detect attacks w.r.t. the attack algorithm, threat model or signal-to-adversarial-noise ratio. We found that common attacks in the literature can be classified with accuracies as high as 90%. Also, representations trained to classify attacks against speaker identification can be used also to classify attacks against speaker verification and speech recognition. We also tested an attack verification task, where we need to decide whether two speech utterances contain the same attack. We observed that our models did not generalize well to attack algorithms not included in the attack representation model training. Motivated by this, we evaluated an unknown attack detection task. We were able to detect unknown attacks with equal error rates of about 19%, which is promising.

What problem does this paper attempt to address?

The main problem that this paper attempts to solve is to detect and classify adversarial attacks in audio systems (such as speaker recognition and speech recognition systems). Specifically, the research focuses on the following aspects: 1. **Detection and Classification of Adversarial Attacks**: The authors use representation learning methods to distinguish and identify different types of adversarial attacks, which may be based on different attack algorithms, threat models, or Signal - to - Adversarial - Noise Ratio (SNR). Research shows that common adversarial attacks can be classified with an accuracy rate of up to 90%. 2. **Extraction and Application of Attack Signatures**: By training neural networks (especially the x - vector architecture) to generate attack signatures, these signatures can be used to determine whether a test recording has been attacked and to extract information about the attack. The application scenarios of attack signatures include: - **Attack Classification**: Determine whether a test speech sample belongs to one of the known attack types. - **Attack Verification**: Judge whether two speech samples are attacked in the same way, which is very useful for detecting new attacks from the same attacker. - **Unknown Attack Detection**: Identify whether the test sample contains a new attack that does not appear in the training set. 3. **Generalization Ability of the Model**: The research finds that the model has poor generalization ability when facing attack algorithms that do not appear in the training set. For this reason, the authors evaluated the unknown attack detection task and were able to detect unknown attacks with an equal error rate of about 19%, and this result has certain prospects. In general, the paper aims to improve the detection and defense capabilities against adversarial attacks in audio systems through deep - learning techniques, thereby enhancing the security of these systems.

Representation Learning to Classify and Detect Adversarial Attacks against Speaker and Speech Recognition Systems

Echo: Reverberation-based Fast Black-Box Adversarial Attacks on Intelligent Audio Systems.

AdvEst: Adversarial Perturbation Estimation to Classify and Detect Adversarial Attacks against Speaker Identification

Understanding and Benchmarking the Commonality of Adversarial Examples

Unraveling Adversarial Examples against Speaker Identification -- Techniques for Attack Detection and Victim Model Classification

Adversarial Representation Learning for Robust Privacy Preservation in Audio

Adversarial Attack and Defense Strategies of Speaker Recognition Systems: A Survey

Defending Adversarial Attacks on Cloud-aided Automatic Speech Recognition Systems.

Adversarial attacks and defenses in Speaker Recognition Systems: A survey

Adversarial defense for deep speaker recognition using hybrid adversarial training

Detecting Adversarial Attacks on Audiovisual Speech Recognition

Defending Against Adversarial Attacks in Speaker Verification Systems

Towards Understanding and Mitigating Audio Adversarial Examples for Speaker Recognition

Study of Pre-processing Defenses against Adversarial Attacks on State-of-the-art Speaker Recognition Systems

Spoofing Speaker Verification System by Adversarial Examples Leveraging the Generalized Speaker Difference.

Imperceptible Black-Box Waveform-Level Adversarial Attack Towards Automatic Speaker Recognition

Towards Resistant Audio Adversarial Examples

Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition

Adversarial Example Detection by Classification for Deep Speech Recognition

Inaudible Adversarial Perturbations for Targeted Attack in Speaker Recognition.

Enrollment-stage Backdoor Attacks on Speaker Recognition Systems via Adversarial Ultrasound