[Paper Review] Towards Understanding and Mitigating Audio Adversarial Examples for Speaker Recognition

Guangke Chen, Zhe Zhao+5 more|arXiv (Cornell University)|Jun 7, 2022

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes a comprehensive defense framework for speaker recognition systems against adversarial audio attacks by evaluating 22 diverse input transformations and combining them with adversarial training. It introduces a novel feature-level transformation (FeCo) that, when paired with adversarial training, boosts accuracy by 13.62% and increases attack cost by two orders of magnitude under complete white-box attacks, outperforming standalone defenses.

ABSTRACT

Speaker recognition systems (SRSs) have recently been shown to be vulnerable to adversarial attacks, raising significant security concerns. In this work, we systematically investigate transformation and adversarial training based defenses for securing SRSs. According to the characteristic of SRSs, we present 22 diverse transformations and thoroughly evaluate them using 7 recent promising adversarial attacks (4 white-box and 3 black-box) on speaker recognition. With careful regard for best practices in defense evaluations, we analyze the strength of transformations to withstand adaptive attacks. We also evaluate and understand their effectiveness against adaptive attacks when combined with adversarial training. Our study provides lots of useful insights and findings, many of them are new or inconsistent with the conclusions in the image and speech recognition domains, e.g., variable and constant bit rate speech compressions have different performance, and some non-differentiable transformations remain effective against current promising evasion techniques which often work well in the image domain. We demonstrate that the proposed novel feature-level transformation combined with adversarial training is rather effective compared to the sole adversarial training in a complete white-box setting, e.g., increasing the accuracy by 13.62% and attack cost by two orders of magnitude, while other transformations do not necessarily improve the overall defense capability. This work sheds further light on the research directions in this field. We also release our evaluation platform SPEAKERGUARD to foster further research.

Motivation & Objective

• To systematically evaluate the effectiveness of diverse input transformations and adversarial training against both non-adaptive and adaptive adversarial attacks in speaker recognition.
• To identify which transformations remain effective under adaptive attacks that use evasion techniques like BPDA, EOT, and NES.
• To investigate whether combining input transformations with adversarial training improves robustness beyond either method alone.
• To release SPEAKERGUARD, an open evaluation platform to support reproducible and fair benchmarking of defenses in speaker recognition.

Proposed method

• The authors design and implement 22 diverse audio transformations, including time- and frequency-domain operations, speech compressions (e.g., MP3, AAC), and novel feature-level compressions.
• They evaluate these defenses against 7 recent adversarial attacks—4 white-box (e.g., PGD-based) and 3 black-box (e.g., FAKEBOB, SirenAttack)—under consistent experimental settings.
• Adaptive attacks are constructed using evasion techniques such as Backward Pass Differentiable Approximation (BPDA), Expectation over Transformation (EOT), and Natural Evolution Strategy (NES) to bypass non-differentiable or randomized defenses.
• A novel feature-level transformation, FeCo, is proposed and combined with PGD-based adversarial training to enhance robustness.
• The evaluation framework, SPEAKERGUARD, is released to enable reproducible benchmarking of defenses across diverse attack and defense configurations.
• Robustness is measured via accuracy on benign and adversarial examples, attack cost (perturbation magnitude), and distortion levels.

Experimental results

Research questions

• RQ1 Which input transformations are most effective at mitigating adversarial attacks in speaker recognition, especially under adaptive attack scenarios?
• RQ2 How does combining input transformations with adversarial training affect robustness compared to using either defense in isolation?
• RQ3 Do non-differentiable or randomized transformations remain effective against adaptive attacks that use gradient estimation techniques like BPDA and EOT?
• RQ4 How do variable-bit-rate and constant-bit-rate audio compressions compare in terms of defense effectiveness under white-box and black-box settings?
• RQ5 Can a novel feature-level transformation significantly improve the robustness of adversarially trained speaker recognition models?

Key findings

• The proposed feature-level transformation FeCo, when combined with adversarial training, improves clean accuracy by 13.62% and increases attack cost by two orders of magnitude under complete white-box attacks.
• Variable-bit-rate MP3 and AAC are more resilient to black-box attacks than their constant-bit-rate counterparts, while the reverse holds in white-box settings.
• Non-differentiable audio compressions like MP3 and AAC remain effective against BPDA-based adaptive attacks, contrary to findings in image recognition where such defenses typically fail.
• Most standard transformations (e.g., time/frequency-domain shifts, basic compressions) become ineffective when attacked with adaptive techniques like EOT and NES.
• Randomized transformations show strong resistance to black-box adaptive attacks, suggesting their utility in practical defense settings.
• Combining transformations with adversarial training does not universally improve robustness—only specific combinations, such as FeCo with adversarial training, yield significant gains.