Abstract:Automatic Speaker Recognition Systems (SRSs) have been widely used in voice applications for personal identification and access control. A typical SRS consists of three stages, i.e., training, enrollment, and recognition. Previous work has revealed that SRSs can be bypassed by backdoor attacks at the training stage or by adversarial example attacks at the recognition stage. In this paper, we propose Tuner, a new type of backdoor attack against the enrollment stage of SRS via adversarial ultrasound modulation, which is inaudible, synchronization-free, content-independent, and black-box. Our key idea is to first inject the backdoor into the SRS with modulated ultrasound when a legitimate user initiates the enrollment, and afterward, the polluted SRS will grant access to both the legitimate user and the adversary with high confidence. Our attack faces a major challenge of unpredictable user articulation at the enrollment stage. To overcome this challenge, we generate the ultrasonic backdoor by augmenting the optimization process with random speech content, vocalizing time, and volume of the user. Furthermore, to achieve real-world robustness, we improve the ultrasonic signal over traditional methods using sparse frequency points, pre-compensation, and single-sideband (SSB) modulation. We extensively evaluate Tuner on two common datasets and seven representative SRS models, as well as its robustness against seven kinds of defenses. Results show that our attack can successfully bypass speaker recognition systems while remaining effective to various speakers, speech content, etc. To mitigate this newly discovered threat, we also provide discussions on potential countermeasures, limitations, and future works of this new threat.

IUAC: Inaudible Universal Adversarial Attacks Against Smart Speakers

Echo: Reverberation-based Fast Black-Box Adversarial Attacks on Intelligent Audio Systems.

UltraBD: Backdoor Attack against Automatic Speaker Verification Systems via Adversarial Ultrasound

The Silent Manipulator: A Practical and Inaudible Backdoor Attack against Speech Recognition Systems

Remote Attacks on Speech Recognition Systems Using Sound from Power Supply

EarArray: Defending Against DolphinAttack Via Acoustic Attenuation

FenceSitter: Black-box, Content-Agnostic, and Synchronization-Free Enrollment-Phase Attacks on Speaker Recognition Systems

Defending Adversarial Attacks on Cloud-aided Automatic Speech Recognition Systems.

Inaudible Adversarial Perturbation: Manipulating the Recognition of User Speech in Real Time

Audio Hotspot Attack: An Attack on Voice Assistance Systems Using Directional Sound Beams and its Feasibility

DolphinAttack: Inaudible Voice Commands

Enrollment-stage Backdoor Attacks on Speaker Recognition Systems via Adversarial Ultrasound

Using AI to Hack IA: A New Stealthy Spyware Against Voice Assistance Functions in Smart Phones

Defending Against Adversarial Attacks in Speaker Verification Systems

DolphinAtack: Inaudible Voice Commands

Adversarial Agents For Attacking Inaudible Voice Activated Devices

The Feasibility of Injecting Inaudible Voice Commands to Voice Assistants

CommanderSong: A Systematic Approach for Practical Adversarial Voice Recognition

UniAP: Protecting Speech Privacy with Non-Targeted Universal Adversarial Perturbations

AdvTTS: Adversarial Text-to-Speech Synthesis Attack on Speaker Identification Systems.

Attack on Practical Speaker Verification System Using Universal Adversarial Perturbations