Abstract:Deep neural networks (DNNs) are shown to be vulnerable to universal adversarial perturbations (UAP), a single quasi-imperceptible perturbation that deceives the DNNs on most input images. The current UAP methods can be divided into data-dependent and data-independent methods. The former exhibits weak transferability in black-box models due to overly relying on model-specific features. The latter shows inferior attack performance in white-box models as it fails to exploit the model's response information to benign images. To address the above issues, this paper proposes a novel universal adversarial attack to generate UAP with strong transferability by disrupting the model-agnostic features (e.g., edges or simple texture), which are invariant to the models. Specifically, we first devise an objective function to weaken the significant channel-wise features and strengthen the less significant channel-wise features, which are partitioned by the designed strategy. Furthermore, the proposed objective function eliminates the dependency on labeled samples, allowing us to utilize out-of-distribution (OOD) data to train UAP. To enhance the attack performance with limited training samples, we exploit the average gradient of the mini-batch input to update the UAP iteratively, which encourages the UAP to capture the local information inside the mini-batch input. In addition, we introduce the momentum term to accumulate the gradient information at each iterative step for the purpose of perceiving the global information over the training set. Finally, extensive experimental results demonstrate that the proposed methods outperform the existing UAP approaches. Additionally, we exhaustively investigate the transferability of the UAP across models, datasets, and tasks.

Transferable universal adversarial perturbations against speaker recognition systems

Universal Adversarial Perturbations Generative Network for Speaker Recognition

Universal Adversarial Perturbations for Speech Recognition Systems

Spoofing Speaker Verification System by Adversarial Examples Leveraging the Generalized Speaker Difference.

Inaudible Adversarial Perturbations for Targeted Attack in Speaker Recognition.

Learning to Fool the Speaker Recognition

Generating High-Quality Adversarial Examples with Universal Perturbation-Based Adaptive Network and Improved Perceptual Loss

Improving Transferability of Universal Adversarial Perturbation with Feature Disruption.

Attack on Practical Speaker Verification System Using Universal Adversarial Perturbations

UniAP: Protecting Speech Privacy with Non-Targeted Universal Adversarial Perturbations

Universal Adversarial Perturbation Generated by Attacking Layer-wise Relevance Propagation

PhoneyTalker: an Out-of-the-Box Toolkit for Adversarial Example Attack on Speaker Recognition

Multi-layer Feature Augmentation Based Transferable Adversarial Examples Generation for Speaker Recognition

Adversarial defense for deep speaker recognition using hybrid adversarial training

Transferable Adversarial Attacks against ASR

Defending Against Adversarial Attacks in Speaker Verification Systems

Adversarial Example Devastation and Detection on Speech Recognition System by Adding Random Noise

Towards cross-task universal perturbation against black-box object detectors in autonomous driving

Imperceptible Black-Box Waveform-Level Adversarial Attack Towards Automatic Speaker Recognition

Joint Universal Adversarial Perturbations with Interpretations

SUETA: Speaker-specific Utterance Ensemble Based Transfer Attack on Speaker Identification System