Abstract:Automatic speaker verification (ASV) systems have been widely applied in voice user interfaces to conduct person identification and access control via voiceprints. A typical ASV system consists of three stages, i.e., training, enrollment, and verification. Previous work has revealed that the ASV system can be bypassed at the training stage by backdoor attacks and at the verification stage by adversarial example attacks. In this paper, we propose a new type of backdoor attack aimed at the enrollment stage via adversarial ultrasound, named UltraBD, which is highly imperceptible, synchronization-free, and content-independent. By simultaneously injecting the ultrasound backdoor examples when the legitimate user initiates the enrollment, the polluted voiceprints stored in the ASV systems grant access to both the legitimate user and the adversary with relatively high confidence. Despite the challenges, i.e., when, what, and how the legitimate user articulates at the enrollment stage can be remarkably unpredictable and various, we managed to launch UltraBD by augmenting the generation and optimization process of the ultrasound backdoor examples with the randomness of synchronous time and relative amplitude ratio. Furthermore, we optimize the modulation mechanism of adversarial ultrasound by tuning the baseband signal on limited signal frequency points to improve its robustness in the physical world setting. We validate UltraBD on two common datasets together with two open-source ASV models. Results show that UltraBD can be robust to various configurations, e.g., different speakers and utterance content. In sum, our attack calls attention to a new attack surface of ASV systems and sheds light on its fundamental mechanisms.

Canceling Inaudible Voice Commands Against Voice Control Systems

Echo: Reverberation-based Fast Black-Box Adversarial Attacks on Intelligent Audio Systems.

Remote Attacks on Speech Recognition Systems Using Sound from Power Supply

The Silent Manipulator: A Practical and Inaudible Backdoor Attack against Speech Recognition Systems

EarArray: Defending Against DolphinAttack Via Acoustic Attenuation

UltraBD: Backdoor Attack against Automatic Speaker Verification Systems via Adversarial Ultrasound

Evaluation and Defense of Light Commands Attacks Against Voice Controllable Systems in Smart Cars

DolphinAttack: Inaudible Voice Commands

CapSpeaker: Injecting Commands to Voice Assistants Via Capacitors

Anti-Replay: A Fast and Lightweight Voice Replay Attack Detection System.

Learning Normality is Enough: A Software-based Mitigation against Inaudible Voice Attacks

Protecting Voice Controlled Systems Using Sound Source Identification Based on Acoustic Cues

The Feasibility of Injecting Inaudible Voice Commands to Voice Assistants

DolphinAtack: Inaudible Voice Commands

Voiceprint Mimicry Attack Towards Speaker Verification System in Smart Home

Defending Adversarial Attacks on Cloud-aided Automatic Speech Recognition Systems.

Hidden Voice Commands: Attacks and Defenses on the VCS of Autonomous Driving Cars.

Exploiting Physical Presence Sensing to Secure Voice Assistant Systems.

Detecting Inaudible Voice Commands via Acoustic Attenuation by Multi-channel Microphones

A Practical Survey on Emerging Threats from AI-driven Voice Attacks: How Vulnerable are Commercial Voice Control Systems?

Audio Hotspot Attack: An Attack on Voice Assistance Systems Using Directional Sound Beams and its Feasibility