Defense Against Adversarial Attacks on Audio DeepFake Detection

Piotr Kawa,Marcin Plata,Piotr Syga

2023-06-11

Abstract:Audio DeepFakes (DF) are artificially generated utterances created using deep learning, with the primary aim of fooling the listeners in a highly convincing manner. Their quality is sufficient to pose a severe threat in terms of security and privacy, including the reliability of news or defamation. Multiple neural network-based methods to detect generated speech have been proposed to prevent the threats. In this work, we cover the topic of adversarial attacks, which decrease the performance of detectors by adding superficial (difficult to spot by a human) changes to input data. Our contribution contains evaluating the robustness of 3 detection architectures against adversarial attacks in two scenarios (white-box and using transferability) and enhancing it later by using adversarial training performed by our novel adaptive training. Moreover, one of the investigated architectures is RawNet3, which, to the best of our knowledge, we adapted for the first time to DeepFake detection.

Sound,Cryptography and Security,Machine Learning,Audio and Speech Processing

What problem does this paper attempt to address?

The problem this paper attempts to address is the defense against adversarial attacks (AA) in audio DeepFake detection systems. Specifically, the researchers focused on the following points:

1. **Evaluating the robustness of existing detection models**: The researchers evaluated the performance of three different audio DeepFake detection models (LCNN, RawNet3, SpecRNet) when faced with adversarial attacks. These attacks include Fast Gradient Signed Method (FGSM), Projected Gradient Descent (PGD), and Fast Adaptive Boundary (FAB) attacks.

2. **Analyzing performance under different attack scenarios**: The researchers tested not only under white-box attacks (where the attacker has full knowledge of the target model) but also under black-box attacks (where the attacker has limited information about the target model) to assess the robustness and generalization ability of the models.

3. **Improving model robustness**: To enhance the resistance of detection models to adversarial attacks, the researchers proposed a new adaptive adversarial training method. Through this method, the model can dynamically select and respond to different attack methods during the training process, thereby improving its robustness in practical applications.

In summary, the main goal of this paper is to improve the security of audio DeepFake detection systems, enabling them to better withstand adversarial attacks and thus protect users from the potential threats posed by DeepFake technology.