Abstract:Speaker recognition technology is applied in various tasks ranging from personal virtual assistants to secure access systems. However, the robustness of these systems against adversarial attacks, particularly to additive perturbations, remains a significant challenge. In this paper, we pioneer applying robustness certification techniques to speaker recognition, originally developed for the image domain. In our work, we cover this gap by transferring and improving randomized smoothing certification techniques against norm-bounded additive perturbations for classification and few-shot learning tasks to speaker recognition. We demonstrate the effectiveness of these methods on VoxCeleb 1 and 2 datasets for several models. We expect this work to improve voice-biometry robustness, establish a new certification benchmark, and accelerate research of certification methods in the audio domain.

What problem does this paper attempt to address?

The main focus of this paper is the security of speech recognition systems, particularly the robustness against adversarial attacks. Although current deep learning speech biometric models perform well in various applications, they are susceptible to specific perturbations that may be imperceptible to humans but significantly degrade the model's performance. The paper proposes a novel random smoothing method for certifying the robustness of speech recognition models against adversarial additive perturbations, initially developed for the image domain. In the methodology section, the paper transforms the speech recognition problem into a few-shot problem, where the model needs to identify the speaker from a given audio. Through the random smoothing technique, the paper provides robustness guarantees against adversarial attacks, even when the attacker has knowledge of the model's architecture, parameters, and gradients. The authors propose a smoothing framework based on Gaussian noise to compute the certification radius of the model under an l2 norm constraint and demonstrate the theoretical advantages of this method. In the experimental section, the paper evaluates the certification accuracy of different models using the VoxCeleb1 and VoxCeleb2 datasets and compares them with existing methods. The results show that the proposed method outperforms other methods in terms of certification accuracy, especially in the case of few-shot settings. However, the certification results are currently lenient, with a gap between practical accuracy and certification accuracy, and are limited to additive perturbations only. Further research is needed for more complex attack forms, such as deepfakes. Overall, the paper fills the gap in adversarial attack certification for speech recognition and contributes to improving the security of speech biometrics and establishing new certification benchmarks.

Certification of Speaker Recognition Models to Additive Perturbations

Attack on Practical Speaker Verification System Using Universal Adversarial Perturbations

Defending Against Adversarial Attacks in Speaker Verification Systems

Certified Adversarial Robustness Within Multiple Perturbation Bounds

Improving the Adversarial Robustness for Speaker Verification by Self-Supervised Learning

Transferable universal adversarial perturbations against speaker recognition systems

Learning to Fool the Speaker Recognition

Adversarial Data Augmentation for Robust Speaker Verification

Universal Adversarial Perturbations for Speech Recognition Systems

Sequential Randomized Smoothing for Adversarially Robust Speech Recognition

Imperceptible Black-Box Waveform-Level Adversarial Attack Towards Automatic Speaker Recognition

A Comprehensive Investigation on Speaker Augmentation for Speaker Recognition

CC-CERT: A Probabilistic Approach to Certify General Robustness of Neural Networks

Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition

Towards Understanding and Mitigating Audio Adversarial Examples for Speaker Recognition

Adversarial defense for deep speaker recognition using hybrid adversarial training

HiddenSpeaker: Generate Imperceptible Unlearnable Audios for Speaker Verification System

AdvEst: Adversarial Perturbation Estimation to Classify and Detect Adversarial Attacks against Speaker Identification

Towards Bridging the gap between Empirical and Certified Robustness against Adversarial Examples

Adversarial Attack and Defense Strategies of Speaker Recognition Systems: A Survey

Diffusion-Based Adversarial Purification for Speaker Verification