arXiv 2302.106862023-02-21cs.SDcs.AIeess.AS

说话人识别中的可解释谱变换攻击

Interpretable Spectrum Transformation Attacks to Speaker Recognition

Northwestern Polytechnical University（西北工业大学）；China Mobile (Hangzhou) Information Technology CO LTD（中国移动（杭州）信息技术有限公司）

Jiadi Yao, Hong Luo, Xiao-Lei Zhang

摘要：

对抗攻击对说话人识别的成功主要是在白盒场景中。将攻击白盒代理模型生成的对抗语音应用于黑盒受害模型，即\textit{transfer-based}黑盒攻击时，对抗语音的可传递性不仅远不能令人满意，而且缺乏可解释的基础。为了解决这些问题，在本文中，我们提出了一个通用的框架，命名为频谱变换攻击的基础上改进的离散余弦变换（STA-MDCT），以提高转移的敌对声音的黑箱受害者模型。具体来说，我们首先将MDCT应用于输入语音。然后，我们稍微修改了不同频带的能量，以捕获对抗性噪声在时频域中的显著区域，这对成功攻击至关重要。与在时域中操作语音的现有方法不同，所提出的框架在时频域中操作语音，这提高了攻击的可解释性、可转移性和不可感知性。此外，它可以与任何基于梯度的攻击者一起实现。为了利用模型集成的优点，我们不仅实现了STA-MDCT与一个单一的白盒代理模型，但也与集成的代理模型。最后，我们通过类激活图（CAM）可视化对抗语音的显着性图，这首次为说话人识别中基于转移的攻击提供了可解释的基础。与五个有代表性的攻击者的广泛的比较结果表明，CAM可视化清楚地解释了STA-MDCT的有效性，以及比较方法的弱点，所提出的方法优于比较方法的大幅度。

英文摘要：

The success of adversarial attacks to speaker recognition is mainly in white-box scenarios. When applying the adversarial voices that are generated by attacking white-box surrogate models to black-box victim models, i.e. \textit{transfer-based} black-box attacks, the transferability of the adversarial voices is not only far from satisfactory, but also lacks interpretable basis. To address these issues, in this paper, we propose a general framework, named spectral transformation attack based on modified discrete cosine transform (STA-MDCT), to improve the transferability of the adversarial voices to a black-box victim model. Specifically, we first apply MDCT to the input voice. Then, we slightly modify the energy of different frequency bands for capturing the salient regions of the adversarial noise in the time-frequency domain that are critical to a successful attack. Unlike existing approaches that operate voices in the time domain, the proposed framework operates voices in the time-frequency domain, which improves the interpretability, transferability, and imperceptibility of the attack. Moreover, it can be implemented with any gradient-based attackers. To utilize the advantage of model ensembling, we not only implement STA-MDCT with a single white-box surrogate model, but also with an ensemble of surrogate models. Finally, we visualize the saliency maps of adversarial voices by the class activation maps (CAM), which offers an interpretable basis to transfer-based attacks in speaker recognition for the first time. Extensive comparison results with five representative attackers show that the CAM visualization clearly explains the effectiveness of STA-MDCT, and the weaknesses of the comparison methods; the proposed method outperforms the comparison methods by a large margin.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

摘要：

英文摘要：

相关论文