[论文解读] Adversarial Defense for Automatic Speaker Verification by Self-Supervised Learning

Haibin Wu, Xu Li+4 more|arXiv (Cornell University)|Jun 1, 2021

Adversarial Robustness in Machine Learning参考文献 58被引用 4

一句话总结

本文提出了一种基于自监督学习（SSL）的自动说话人验证（ASV）防御方法，可在不事先了解对抗性攻击方法的情况下运行。通过将对抗性扰动视为噪声，该方法利用SSL模型实现对抗性扰动的净化与检测，实现了约80%的对抗性样本检测准确率，并提出了一套正式的ASV对抗防御评估框架。

ABSTRACT

Previous works have shown that automatic speaker verification (ASV) is seriously vulnerable to malicious spoofing attacks, such as replay, synthetic speech, and recently emerged adversarial attacks. Great efforts have been dedicated to defending ASV against replay and synthetic speech; however, only a few approaches have been explored to deal with adversarial attacks. All the existing approaches to tackle adversarial attacks for ASV require the knowledge for adversarial samples generation, but it is impractical for defenders to know the exact attack algorithms that are applied by the in-the-wild attackers. This work is among the first to perform adversarial defense for ASV without knowing the specific attack algorithms. Inspired by self-supervised learning models (SSLMs) that possess the merits of alleviating the superficial noise in the inputs and reconstructing clean samples from the interrupted ones, this work regards adversarial perturbations as one kind of noise and conducts adversarial defense for ASV by SSLMs. Specifically, we propose to perform adversarial defense from two perspectives: 1) adversarial perturbation purification and 2) adversarial perturbation detection. Experimental results show that our detection module effectively shields the ASV by detecting adversarial samples with an accuracy of around 80%. Moreover, since there is no common metric for evaluating the adversarial defense performance for ASV, this work also formalizes evaluation metrics for adversarial defense considering both purification and detection based approaches into account. We sincerely encourage future works to benchmark their approaches based on the proposed evaluation framework.

研究动机与目标

• 解决自动说话人验证（ASV）对对抗性攻击的严重脆弱性问题，该问题相较于重放和合成语音攻击仍缺乏充分研究。
• 克服现有防御方法依赖攻击算法先验知识的局限性，该局限在实际场景中不切实际。
• 通过利用自监督学习模型（SSLMs）的抗噪特性，开发一种对未知或实际环境中出现的对抗性攻击具有鲁棒性的ASV防御机制。
• 为ASV中的对抗性防御形式化定义评估指标，涵盖基于净化和基于检测的两种方法，以实现标准化基准测试。

提出的方法

• 将对抗性扰动视为一种输入噪声形式，利用自监督学习模型（SSLMs）固有的降噪能力，实现对抗性扰动的净化。
• 设计一个检测模块，通过分析原始特征与SSL模型重建特征之间的差异，识别对抗性样本。
• 利用预训练的SSLMs（如Wav2Vec 2.0或类似模型）提取对对抗性扰动不敏感的鲁棒表征。
• 在SSLM特征上训练分类器，以区分干净输入与对抗性输入，实现对恶意样本的实时检测。
• 将净化与检测模块整合到统一的防御流水线中，以增强ASV的鲁棒性。
• 提出一个正式的评估框架，综合考虑净化与检测性能，包含检测准确率和攻击下验证准确率等指标。

实验结果

研究问题

• RQ1 在不事先了解攻击方法的情况下，自监督学习模型能否有效净化ASV输入中的对抗性扰动？
• RQ2 基于SSLM的检测防御在识别ASV系统中的对抗性样本方面效果如何？
• RQ3 在同时考虑净化与检测组件的前提下，哪些评估指标最适合用于ASV对抗性防御的基准测试？
• RQ4 一种不依赖特定攻击知识的防御机制，是否仍能对多种对抗性攻击保持高度鲁棒性？

主要发现

• 所提出的检测模块在识别对抗性样本方面实现了约80%的准确率，表现出色，且无需了解攻击算法细节。
• 基于SSL的净化方法通过利用自监督表征的抗噪特性，有效降低了对抗性扰动的影响。
• 净化与检测组件的集成显著提升了ASV系统在对抗性条件下的整体鲁棒性。
• 本文形式化了一套全面的ASV对抗性防御评估框架，弥补了以往工作中缺乏标准化指标的不足。
• 实验结果证实，即使在攻击方法未知的情况下，该防御机制依然有效，凸显其实际应用潜力。
• 所提出的评估框架有望实现未来ASV对抗性防御方法的公平且一致的基准测试。