FoolHD：利用不可感知的对抗干扰欺骗说话人辨识
FoolHD: Fooling speaker identification by Highly imperceptible adversarial Disturbances
摘要：
说话人辨识模型容易受到精心设计的输入信号的对抗性扰动的影响，从而导致误分类。在这项工作中，我们提出了一个白盒隐写启发的对抗攻击，对说话人辨识模型产生不可感知的对抗性扰动。我们的方法，FoolHD，使用门控卷积自动编码器，在DCT域中操作，并使用多目标损失函数进行训练，以生成和隐藏原始音频文件中的对抗性扰动。除了阻碍说话人辨识性能之外，这种多目标损失通过从原始音频文件和对抗音频文件中提取的MFCC特征向量之间的逐帧余弦相似性来考虑人类感知。我们使用VoxCeleb训练的250-说话人辨识x向量网络验证了FoolHD在准确性、成功率和不可感知性方面的有效性。我们的研究结果表明，FoolHD生成高度不可感知的对抗性音频文件（平均PESQ分数高于4.30），同时在非目标和目标设置下分别实现了99.6%和99.2%的误导说话人辨识模型的成功率。
英文摘要：
Speaker identification models are vulnerable to carefully designed adversarial perturbations of their input signals that induce misclassification. In this work, we propose a white-box steganography-inspired adversarial attack that generates imperceptible adversarial perturbations against a speaker identification model. Our approach, FoolHD, uses a Gated Convolutional Autoencoder that operates in the DCT domain and is trained with a multi-objective loss function, in order to generate and conceal the adversarial perturbation within the original audio files. In addition to hindering speaker identification performance, this multi-objective loss accounts for human perception through a frame-wise cosine similarity between MFCC feature vectors extracted from the original and adversarial audio files. We validate the effectiveness of FoolHD with a 250-speaker identification x-vector network, trained using VoxCeleb, in terms of accuracy, success rate, and imperceptibility. Our results show that FoolHD generates highly imperceptible adversarial audio files (average PESQ scores above 4.30), while achieving a success rate of 99.6% and 99.2% in misleading the speaker identification model, for untargeted and targeted settings, respectively.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
