[论文解读] Adversarial Attacks and Defenses for Speaker Identification Systems.

Sonal Joshi, Jesús Villalba+3 more|arXiv (Cornell University)|Jan 22, 2021

Adversarial Robustness in Machine Learning参考文献 62被引用 8

一句话总结

本文研究了最先进的说话人识别（SID）系统在对抗性攻击下的脆弱性，特别是FGSM、BIM和CW攻击，表明其在迭代和自适应攻击下表现出极端易受攻击的特性。本文提出了一种结合随机平滑与WaveGAN声码器的混合防御方法，在黑盒条件下实现了93%的准确率，并在存在可察觉噪声（L≥0.01）的白盒攻击下仍保持鲁棒性（对不可察觉扰动的准确率为97%）。

ABSTRACT

Research in automatic speaker recognition (SR) has been undertaken for several decades, reaching great performance. However, researchers discovered potential loopholes in these technologies like spoofing attacks. Quite recently, a new genre of attack, termed adversarial attacks, has been proved to be fatal in computer vision and it is vital to study their effects on SR systems. This paper examines how state-of-the-art speaker identification (SID) systems are vulnerable to adversarial attacks and how to defend against them. We investigated adversarial attacks common in the literature like fast gradient sign method (FGSM), iterative-FGSM / basic iterative method (BIM) and Carlini-Wagner (CW). Furthermore, we propose four pre-processing defenses against these attacks - randomized smoothing, DefenseGAN, variational autoencoder (VAE) and WaveGAN vocoder. We found that SID is extremely vulnerable under Iterative FGSM and CW attacks. Randomized smoothing defense robustified the system for imperceptible BIM and CW attacks recovering classification accuracies ~97%. Defenses based on generative models (DefenseGAN, VAE and WaveGAN) project adversarial examples (outside manifold) back into the clean manifold. In the case that attacker cannot adapt the attack to the defense (black-box defense), WaveGAN performed the best, being close to clean condition (Accuracy>97%). However, if the attack is adapted to the defense - assuming the attacker has access to the defense model (white-box defense), VAE and WaveGAN protection dropped significantly-50% and 37% accuracy for CW attack. To counteract this,we combined randomized smoothing with VAE or WaveGAN. We found that smoothing followed by WaveGAN vocoder was the most effective defense overall. As a black-box defense, it provides 93% average accuracy. As white-box defense, accuracy only degraded for iterative attacks with perceptible perturbations (L>=0.01).

研究动机与目标

• 评估现代说话人识别（SID）系统对对抗性攻击（特别是FGSM、BIM和CW）的脆弱性。
• 评估预处理防御方法（随机平滑、DefenseGAN、VAE和WaveGAN）在减轻对抗性扰动方面的有效性。
• 研究在黑盒（攻击者缺乏模型访问权限）和白盒（攻击者可完全访问防御模型）攻击场景下防御方法的性能。
• 设计并评估一种结合随机平滑与生成模型的混合防御策略，以增强对自适应攻击的鲁棒性。
• 量化在不同扰动水平（L≥0.01）下鲁棒性与语音质量之间的权衡。

提出的方法

• 应用标准对抗性攻击方法：FGSM、迭代FGSM（BIM）和Carlini-Wagner（CW），生成针对SID系统的对抗性音频样本。
• 实现四种预处理防御方法：随机平滑（在输入中添加噪声）、DefenseGAN（基于生成模型的去噪）、变分自编码器（VAE）以及用于波形重建的WaveGAN声码器。
• 在黑盒条件（攻击者不了解防御机制）和白盒条件（攻击者可针对防御模型调整攻击策略）下评估防御方法。
• 采用混合防御策略：在将输入送入VAE或WaveGAN之前先应用随机平滑，以增强对自适应攻击的鲁棒性。
• 通过测量对抗性样本上的分类准确率来评估防御有效性，重点关注可察觉（L≥0.01）和不可察觉扰动。
• 利用生成模型（VAE、WaveGAN、DefenseGAN）将对抗性样本投影回原始语音流形，假设自然语音位于低维流形上。

实验结果

研究问题

• RQ1 最先进的说话人识别系统对FGSM、BIM和CW等对抗性攻击有多脆弱？
• RQ2 预处理防御方法（随机平滑、DefenseGAN、VAE和WaveGAN）在对抗性攻击下恢复分类准确率的有效性如何？
• RQ3 这些防御方法在黑盒与白盒攻击场景之间的性能差距有多大？
• RQ4 将随机平滑与生成模型（VAE或WaveGAN）结合是否能提升对自适应白盒攻击的鲁棒性？
• RQ5 扰动幅度（L≥0.01）在白盒条件下如何影响受保护系统的准确率？

主要发现

• SID系统对迭代型FGSM和CW攻击高度脆弱，在白盒条件下分类准确率显著下降。
• 随机平滑防御在不可察觉的BIM和CW攻击下将分类准确率恢复至约97%，表明其对非自适应攻击具有强大鲁棒性。
• 在黑盒设置下，基于WaveGAN的防御实现了超过97%的准确率，与干净条件下的性能非常接近。
• 在白盒攻击下，VAE和WaveGAN防御在CW攻击下的准确率分别下降至50%和37%，表明其对自适应攻击者高度敏感。
• 将随机平滑与WaveGAN声码器结合的混合防御策略在黑盒环境下实现了93%的平均准确率，并在存在可察觉扰动（L≥0.01）的白盒迭代攻击下保持了高鲁棒性（准确率下降最小）。
• 平滑与WaveGAN的结合被证明是整体上最有效的防御方法，可在两种攻击场景下均提供强大弹性，并在可见噪声下仍保持高性能。