LMD: A Learnable Mask Network to Detect Adversarial Examples for Speaker Verification

TL;DR

The paper tackles adversarial threats to automatic speaker verification by introducing Learnable Mask Detector (LMD), an attacker-independent, interpretable defense that uses score variation after masking complex spectrograms to detect adversarial inputs. A neural network (LMNet) learns a masking matrix from genuine data, enabling a masking-based transformation that preserves genuine input quality while magnifying adversarial effects. Training combines a score-variation margin with regularization to yield a sparse, almost-binary mask; the approach achieves competitive to state-of-the-art detection performance, with EERs below 5.9% on ECAPA_TDNN and 10.1% on Fast-ResNet34, and a detection success rate around 90% at a 1% false-acceptance level under strong attacks. The method also demonstrates purification effects and resilience to adaptive attackers, suggesting practical impact for defender-friendly ASV deployments.

Abstract

Although the security of automatic speaker verification (ASV) is seriously threatened by recently emerged adversarial attacks, there have been some countermeasures to alleviate the threat. However, many defense approaches not only require the prior knowledge of the attackers but also possess weak interpretability. To address this issue, in this paper, we propose an attacker-independent and interpretable method, named learnable mask detector (LMD), to separate adversarial examples from the genuine ones. It utilizes score variation as an indicator to detect adversarial examples, where the score variation is the absolute discrepancy between the ASV scores of an original audio recording and its transformed audio synthesized from its masked complex spectrogram. A core component of the score variation detector is to generate the masked spectrogram by a neural network. The neural network needs only genuine examples for training, which makes it an attacker-independent approach. Its interpretability lies that the neural network is trained to minimize the score variation of the targeted ASV, and maximize the number of the masked spectrogram bins of the genuine training examples. Its foundation is based on the observation that, masking out the vast majority of the spectrogram bins with little speaker information will inevitably introduce a large score variation to the adversarial example, and a small score variation to the genuine example. Experimental results with 12 attackers and two representative ASV systems show that our proposed method outperforms five state-of-the-art baselines. The extensive experimental results can also be a benchmark for the detection-based ASV defenses.

Figures (10)

• Figure 1: Pipeline of the Masking Complex Spectrogram (MCS) detection method. The symbols $\bm{x}^t$ and $\mathbf{X}_{c}^{\left(t\right)}$ denote the original test utterance and its complex spectrogram features respectively, and $\bm{\hat{x}}^t$, $\mathbf{\widehat{X}}_{c}^{\left(t\right)}$ are the corresponding transformed ones. The ASV score variation $|s-\hat{s}|$ after the masking operation is used to identify whether the input utterance $\bm{x}^t$ is an adversarial example (AE) or a genuine example (GE).
• Figure 2: Training process of the Learnable Mask Detector (LMD). Given a genuine utterance $\bm{x}^t$, the loss function $\mathcal{L}$ in \ref{['equ:training_loss']} takes the corresponding transformed utterance $\bm{\hat{x}}^{t}$ and the mask matrix $\mathbf{M}$ to train the learnable mask network (LMNet) $L\left(\cdot\right)$. The forward (black solid lines) and the gradients backward (red dashed lines) propagation process are shown. After the transformed utterance $\bm{\hat{x}}^{t}$ is obtained by the well-trained LMNet $L\left(\cdot\right)$, we begin the detection process in Fig. \ref{['fig:mcs_detect']}.
• Figure 3: Statistical results of the number of adversarial examples in a SNR range. The ECAPA_TDNN and Fast-ResNet34 act as the victim ASV. The symbol "#$n$" means the range of "$\left[n, n+5\right)$".
• Figure 4: Attack performance of the three attackers: BIM, PGD and CW in terms of ASR, minDCF, and mean SNR, where ASR is described in solid line, the minDCF with $\bm{p=0.01}$ is described in dashed line, and the mean SNR is described in dotted line. The captions of the subfigures "(a), (b), (d), (e)" are concise. For example, "Balck-box attacks on ECAPA_TDNN" means that the victim and substitute ASV models are ECAPA_TDNN and Fast-ResNet34, respectively. The subfigures "(c)" and "(f)" depict the average SNR of the adversarial examples. Note that, the EER of the ECAPA_TDNN ASV model with the AAM-Softmax loss on the test list VoxCeleb1-test is 1.25%; the EER of the Fast-ResNet34 ASV model with the Angular Prototypical is 1.97%.
• Figure 5: Detection EER of the detectors along with the SNR budget. The performance of detectors was evaluated on ECAPA_TDNN and the three adversaril mixture sets ($\mathcal{A}_{\text{\tiny BIM}}$, $\mathcal{A}_{\text{\tiny PGD}}$ and $\mathcal{A}_{\text{\tiny CW}}$) in the white-box attack scenario.