Automatic voiceprint recognition system-oriented black box directional attack countermeasure method and system

Abstract

The invention discloses an automatic voiceprint recognition system-oriented black box directional attack countermeasure method and system. The method comprises the following steps of determining corresponding loss functions according to different speaker recognition tasks; inputting the voice of the source speaker, the recognition model of the speaker needing to be attacked, the number of sampling points, the initial parameters of an adversarial sample generation algorithm and a corresponding loss function into the adversarial sample generation algorithm to generate voice disturbance; and adding the voice disturbance to the voice of the source speaker to generate an adversarial sample. The method has the advantages that structural information and internal gradient information of a speaker recognition system neural network do not need to be obtained, and only recognition results and scores output by a speaker recognition system need to be obtained; adversarial sample disturbance is only added to part of voice sampling points, so that the influence on imperceptibility of adversarial samples due to addition of disturbance in a mute section can be avoided; the information loss generated when the cepstrum feature is converted back to the voice waveform is avoided, so that the reduction of the voice quality is avoided.

Description

technical field [0001] The invention relates to a black-box directional confrontation attack method and system for an automatic voiceprint recognition system, belonging to the technical fields of voice signal processing and information security. Background technique [0002] Speaker recognition is a technique to identify the identity of the speaker from the characteristics of the utterance. After decades of development, speaker recognition technology has been widely used in voice interaction systems and identity authentication systems, such as: smart phones, car navigation systems, electronic bank authentication and so on. However, recent studies have shown that a trained speaker recognition system can be fooled by malicious attacks. Methods for attacking speaker recognition systems include impersonation, playback, speech synthesis, and speech conversion. As an attacker, the expectation is that these electronically disguised and fake voices sound as similar as possible to ...

AI Technical Summary

Problems solved by technology

[0005] 1. It may cause excessive disturbance to be added, which can be perceived and perceived by humans

[0006] 2. Add disturbance to all sampling points. Although it may be possible to obtain a high attack success rate, it will introduce more obvious continuous background noise.

Images