2018

Fooling End-to-end Speaker Verification by Adversarial Examples

Kreuk, Felix, Adi, Yossi, Cisse, Moustapha et al.

Understand

Automatic speaker verification systems are increasingly used as the primary means to authenticate costumers.

Recently, it has been proposed to train speaker verification systems using end-to-end deep neural models.
In this paper, we show that such systems are vulnerable to adversarial example attack.
Adversarial examples are generated by adding a peculiar noise to original speaker examples, in such a way that they are almost indistinguishable from the original examples by a human listener.

Built on

“Signal estimation from modified short-time fourier transform,”
Daniel Griffin and Jae Lim, · 1984
Earlier work this paper cites.
“Ntimit: A phonetically balanced, continuous speech, telephone bandwidth speech database,”
Charles Jankowski, Ashok Kalyanswamy, Sara Basson, and Judith Spitz, · 1990
Earlier work this paper cites.
“Testing with the yoho cd-rom voice verification corpus,”
Joseph P Campbell, · 1995
Earlier work this paper cites.
“Speaker verification using adapted gaussian mixture models,”
Douglas A Reynolds, Thomas F Quatieri, and Robert B Dunn, · 2000
Earlier work this paper cites.
“Connectionist temporal classification: labelling unsegmented sequence data with recurrent neural networks,”
Alex Graves, Santiago Fernández, Faustino Gomez, and Jürgen Schmidhuber, · 2006
Earlier work this paper cites.
“Bayesian speaker verification with heavy-tailed priors.,”
Patrick Kenny, · 2010
Earlier work this paper cites.
“Front-end factor analysis for speaker verification,”
Najim Dehak, Patrick J Kenny, Réda Dehak, Pierre Dumouchel, and Pierre Ouellet, · 2011
Earlier work this paper cites.
“Imagenet classification with deep convolutional neural networks,”
Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton, · 2012
Earlier work this paper cites.
“Intriguing properties of neural networks,”
Christian Szegedy et al., · 2013
Earlier work this paper cites.
“Neural machine translation by jointly learning to align and translate,”
Dzmitry Bahdanau, Kyunghyun Cho, and Yoshua Bengio, · 2014
Earlier work this paper cites.

Similar

“Explaining and harnessing adversarial examples,”
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy, · 2014
Cited alongside, same era.
“Vowel duration measurement using deep neural networks,”
Yossi Adi, Joseph Keshet, and Matthew Goldrick, · 2015
Cited alongside, same era.
“Understanding adversarial training: Increasing local stability of neural nets through robust optimization,”
Uri Shaham, Yutaro Yamada, and Sahand Negahban, · 2015
Cited alongside, same era.
“Biometrics systems under spoofing attack: an evaluation methodology and lessons learned,”
Abdenour Hadid, Nicholas Evans, Sébastien Marcel, and Julian Fierrez, · 2015
Cited alongside, same era.
“End-to-end text-dependent speaker verification,”
Georg Heigold, Ignacio Moreno, Samy Bengio, and Noam Shazeer, · 2016
Cited alongside, same era.
“Deep residual learning for image recognition,”
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun, · 2016
Cited alongside, same era.
“Deep speech 2: End-to-end speech recognition in english and mandarin,”
Dario Amodei et al., · 2016
Cited alongside, same era.
“Practical black-box attacks against deep learning systems using adversarial examples,”
Nicolas Papernot et al., · 2016
Cited alongside, same era.
“Exploring the space of adversarial images,”
Pedro Tabacof and Eduardo Valle, · 2016
Cited alongside, same era.

Then

“Robustness of classifiers: from adversarial to random noise,”
Alhussein Fawzi, Seyed-Mohsen Moosavi-Dezfooli, and Pascal Frossard, · 2016
Later among the works it cites.
“Distillation as a defense to adversarial perturbations against deep neural networks,”
Nicolas Papernot et al., · 2016
Later among the works it cites.
“Deep neural network-based speaker embeddings for end-to-end speaker verification,”
David Snyder, Pegah Ghahremani, Daniel Povey, Daniel Garcia-Romero, Yishay Carmiel, and Sanjeev Khudanpur, · 2016
Later among the works it cites.
“End-to-end attention based text-dependent speaker verification,”
Shi-Xiong Zhang, Zhuo Chen, Yong Zhao, Jinyu Li, and Yifan Gong, · 2016
Later among the works it cites.
“Sequence segmentation using joint rnn and structured prediction models,”
Yossi Adi, Joseph Keshet, Emily Cibelli, and Matthew Goldrick, · 2017
Later among the works it cites.
“Parseval networks: Improving robustness to adversarial examples,”
Moustapha Cisse, Piotr Bojanowski, Edouard Grave, Yann Dauphin, and Nicolas Usunier, · 2017
Later among the works it cites.
“Houdini: Fooling deep structured visual and speech recognition models with adversarial examples,”
Moustapha M Cisse, Yossi Adi, Natalia Neverova, and Joseph Keshet, · 2017
Later among the works it cites.
“Asvspoof: the automatic speaker verification spoofing and countermeasures challenge,”
Zhizheng Wu, Junichi othersYamagishi, Tomi Kinnunen, Cemal Hanilçi, Mohammed Sahidullah, Aleksandr Sizov, Nicholas Evans, and Massimiliano Todisco, · 2017
Later among the works it cites.
“Deep neural network embeddings for text-independent speaker verification,”
David Snyder, Daniel Garcia-Romero, Daniel Povey, and Sanjeev Khudanpur, · 2017
Later among the works it cites.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…