Abstract:Automatic Speaker Recognition Systems (SRSs) have been widely used in voice applications for personal identification and access control. A typical SRS consists of three stages, i.e., training, enrollment, and recognition. Previous work has revealed that SRSs can be bypassed by backdoor attacks at the training stage or by adversarial example attacks at the recognition stage. In this paper, we propose Tuner, a new type of backdoor attack against the enrollment stage of SRS via adversarial ultrasound modulation, which is inaudible, synchronization-free, content-independent, and black-box. Our key idea is to first inject the backdoor into the SRS with modulated ultrasound when a legitimate user initiates the enrollment, and afterward, the polluted SRS will grant access to both the legitimate user and the adversary with high confidence. Our attack faces a major challenge of unpredictable user articulation at the enrollment stage. To overcome this challenge, we generate the ultrasonic backdoor by augmenting the optimization process with random speech content, vocalizing time, and volume of the user. Furthermore, to achieve real-world robustness, we improve the ultrasonic signal over traditional methods using sparse frequency points, pre-compensation, and single-sideband (SSB) modulation. We extensively evaluate Tuner on two common datasets and seven representative SRS models, as well as its robustness against seven kinds of defenses. Results show that our attack can successfully bypass speaker recognition systems while remaining effective to various speakers, speech content, etc. To mitigate this newly discovered threat, we also provide discussions on potential countermeasures, limitations, and future works of this new threat.

Remote Attacks on Speech Recognition Systems Using Sound from Power Supply

Echo: Reverberation-based Fast Black-Box Adversarial Attacks on Intelligent Audio Systems.

The Silent Manipulator: A Practical and Inaudible Backdoor Attack against Speech Recognition Systems

CapSpeaker: Injecting Voices to Microphones Via Capacitors

CapSpeaker: Injecting Commands to Voice Assistants Via Capacitors

FenceSitter: Black-box, Content-Agnostic, and Synchronization-Free Enrollment-Phase Attacks on Speaker Recognition Systems

UltraBD: Backdoor Attack against Automatic Speaker Verification Systems via Adversarial Ultrasound

Query-Efficient Adversarial Attack with Low Perturbation Against End-to-End Speech Recognition Systems

Inaudible Adversarial Perturbation: Manipulating the Recognition of User Speech in Real Time

Audio Hotspot Attack: An Attack on Voice Assistance Systems Using Directional Sound Beams and its Feasibility

Enrollment-stage Backdoor Attacks on Speaker Recognition Systems via Adversarial Ultrasound

Defending Adversarial Attacks on Cloud-aided Automatic Speech Recognition Systems.

CommanderSong: A Systematic Approach for Practical Adversarial Voice Recognition

Adversarial Examples for Automatic Speech Recognition: Attacks and Countermeasures

Push the Limit of Adversarial Example Attack on Speaker Recognition in Physical Domain

Adversarial Examples Attack and Countermeasure for Speech Recognition System: A Survey.

DolphinAttack: Inaudible Voice Commands

Adversarial Attack and Defense Strategies of Speaker Recognition Systems: A Survey

Motion Sensor-based Privacy Attack on Smartphones

DolphinAtack: Inaudible Voice Commands

Towards Query-Efficient Adversarial Attacks Against Automatic Speech Recognition Systems