LMD：一种用于说话人验证中检测对抗样本的可学习掩码网络
LMD: A Learnable Mask Network to Detect Adversarial Examples for Speaker Verification
AI总结：
本文提出可学习掩码检测器LMD，利用ASV分数变化检测对抗样本，仅需真实样本训练且具备可解释性，在12种攻击和两个ASV系统上优于五个基线方法。
摘要：
尽管自动说话人验证（ASV）的安全性受到近年来出现的对抗攻击的严重威胁，但已有一些对策来缓解这一威胁。然而，许多防御方法不仅需要攻击者的先验知识，而且可解释性较弱。为了解决这一问题，本文提出了一种与攻击者无关且可解释的方法，称为可学习掩码检测器（LMD），用于将对抗样本与真实样本区分开来。该方法利用分数变化作为检测对抗样本的指标，其中分数变化是指原始音频录音的ASV分数与其由掩码复数频谱合成的变换音频的ASV分数之间的绝对差异。分数变化检测器的核心组件是通过神经网络生成掩码频谱。该神经网络仅需真实样本进行训练，这使其成为一种与攻击者无关的方法。其可解释性在于，神经网络被训练以最小化目标ASV的分数变化，并最大化真实训练样本中被掩码的频谱单元数量。其基础基于以下观察：掩蔽掉绝大多数几乎不含说话人信息的频谱单元将不可避免地给对抗样本引入较大的分数变化，而给真实样本引入较小的分数变化。在12种攻击者和两个代表性ASV系统上的实验结果表明，我们提出的方法优于五个最先进的基线方法。广泛的实验结果也可以作为基于检测的ASV防御的基准。
英文摘要：
Although the security of automatic speaker verification (ASV) is seriously threatened by recently emerged adversarial attacks, there have been some countermeasures to alleviate the threat. However, many defense approaches not only require the prior knowledge of the attackers but also possess weak interpretability. To address this issue, in this paper, we propose an attacker-independent and interpretable method, named learnable mask detector (LMD), to separate adversarial examples from the genuine ones. It utilizes score variation as an indicator to detect adversarial examples, where the score variation is the absolute discrepancy between the ASV scores of an original audio recording and its transformed audio synthesized from its masked complex spectrogram. A core component of the score variation detector is to generate the masked spectrogram by a neural network. The neural network needs only genuine examples for training, which makes it an attacker-independent approach. Its interpretability lies that the neural network is trained to minimize the score variation of the targeted ASV, and maximize the number of the masked spectrogram bins of the genuine training examples. Its foundation is based on the observation that, masking out the vast majority of the spectrogram bins with little speaker information will inevitably introduce a large score variation to the adversarial example, and a small score variation to the genuine example. Experimental results with 12 attackers and two representative ASV systems show that our proposed method outperforms five state-of-the-art baselines. The extensive experimental results can also be a benchmark for the detection-based ASV defenses.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
