[论文解读] SEC4SR: A Security Analysis Platform for Speaker Recognition

Guangke Chen, Zhe Zhao+4 more|arXiv (Cornell University)|Sep 4, 2021

Adversarial Robustness in Machine Learning参考文献 95被引用 6

一句话总结

SEC4SR 是首个针对说话人识别系统（SRS）的全面安全分析平台，支持对15种攻击（包括自适应变体）和23种防御措施（如新型特征级变换）在4项识别任务和5个数据集上的系统性评估。结果表明，将特征级变换与对抗训练相结合，可对所有类型的攻击提供最强防御。

ABSTRACT

Adversarial attacks have been expanded to speaker recognition (SR). However, existing attacks are often assessed using different SR models, recognition tasks and datasets, and only few adversarial defenses borrowed from computer vision are considered. Yet,these defenses have not been thoroughly evaluated against adaptive attacks. Thus, there is still a lack of quantitative understanding about the strengths and limitations of adversarial attacks and defenses. More effective defenses are also required for securing SR systems. To bridge this gap, we present SEC4SR, the first platform enabling researchers to systematically and comprehensively evaluate adversarial attacks and defenses in SR. SEC4SR incorporates 4 white-box and 2 black-box attacks, 24 defenses including our novel feature-level transformations. It also contains techniques for mounting adaptive attacks. Using SEC4SR, we conduct thus far the largest-scale empirical study on adversarial attacks and defenses in SR, involving 23 defenses, 15 attacks and 4 attack settings. Our study provides lots of useful findings that may advance future research: such as (1) all the transformations slightly degrade accuracy on benign examples and their effectiveness vary with attacks; (2) most transformations become less effective under adaptive attacks, but some transformations become more effective; (3) few transformations combined with adversarial training yield stronger defenses over some but not all attacks, while our feature-level transformation combined with adversarial training yields the strongest defense over all the attacks. Extensive experiments demonstrate capabilities and advantages of SEC4SR which can benefit future research in SR.

研究动机与目标

• 解决说话人识别（SR）领域中对抗性攻击与防御缺乏系统性、综合性评估平台的问题。
• 提供统一框架，用于评估不同说话人识别模型、数据集和防御机制下的非自适应与自适应攻击。
• 研究输入级与特征级变换的有效性，特别是在自适应攻击场景下的表现。
• 评估对抗训练与各类防御技术之间的协同效应，以识别最鲁棒的防御配置。

提出的方法

• 集成4种白盒和2种黑盒对抗攻击，并通过BPDA、EOT和NES方法扩展为自适应版本，以规避防御机制。
• 实现24种防御机制，包括22种输入级与特征级变换（时域/频域处理、语音压缩及新型特征级操作）以及2种对抗训练方法。
• 支持3种主流说话人识别系统（SRS）和5个标准化语音数据集，覆盖4项识别任务（如CSI-E、SV、OSI、CSI-NE）。
• 引入与人类听觉感知一致的失真度量，而非仅依赖图像类度量。
• 支持非自适应与自适应攻击设置的配置，以评估在攻击者知识逐步增加情况下的防御鲁棒性。
• 提供8项攻击指标和3项防御指标，用于定量评估攻击成功率与防御有效性。

实验结果

研究问题

• RQ1 在不同攻击设置和模型下，说话人识别系统（SRS）对对抗性攻击的脆弱性如何？
• RQ2 输入级与特征级变换在防御非自适应攻击方面效果如何？
• RQ3 当攻击者完全掌握防御机制时（即自适应攻击），这些变换是否仍有效？
• RQ4 将特征级变换与对抗训练结合，能否产生更强大且更具泛化能力的防御？

主要发现

• 所有输入级与特征级变换均轻微降低原始准确率，但其在不同攻击类型下的有效性差异显著。
• 多数变换在自适应攻击下效果减弱，但部分（尤其是特征级变换）在该场景下反而更有效。
• 将对抗训练与特定变换结合可提升防御鲁棒性，但仅对特定攻击类型有效。
• 所提出的特征级变换与对抗训练结合，在全部15种攻击配置下均实现最强防御效果，优于所有其他防御组合。
• 仅靠对抗训练不足以应对自适应攻击，凸显了混合防御策略的必要性。
• 计算机视觉领域现有防御方法（如图像压缩）在说话人识别中无效，原因在于语音信号具有领域特异性。