A method for generating adversarial examples for voiceprint recognition

Abstract

This invention relates to the field of artificial intelligence security and discloses a method for generating adversarial examples for voiceprint recognition. It integrates multiple existing voiceprint recognition models to generate a substitute model to replace the target black-box voiceprint recognition model. Adversarial examples are generated by attacking the substitute model, thereby attacking the target black-box model. This overcomes the difficulty of obtaining model information from a black-box model and improves the low success rate of attacks. In generating adversarial examples, a Nesterov-based accelerated gradient method is used, which can find adversarial examples with better attack effects more quickly. During the generation of adversarial examples, the target black-box model is queried a small number of times to correct the direction of adversarial example generation, thus improving the success rate of the attack.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security, specifically to a method for generating adversarial examples for voiceprint recognition. Background Technology

[0002] Voiceprint recognition, also known as speaker identification, is an important branch of identity verification. The task of voiceprint recognition is to identify the speaker's identity through audio recordings of their speech. In recent years, artificial intelligence technologies, led by Deep Neural Networks (DNNs), have matured significantly, encompassing identity verification methods such as facial recognition, fingerprint recognition, iris recognition, and voiceprint recognition, which can be effectively and conveniently commercialized. Furthermore, because audio is easier to acquire and transmit than facial, fingerprint, or iris recognition, voiceprint recognition systems are increasingly widely used in remote authentication, voice-controlled locks, and suspect identification. Therefore, the security of voiceprint recognition systems is of paramount importance.

[0003] Attacks against deep neural network-based voiceprint recognition systems typically include the following: 1. Model theft: Hackers use various advanced methods to steal model files deployed on servers. 2. Data poisoning: Data poisoning in deep learning primarily involves adding anomalous data to the training samples, causing the model to misclassify under certain conditions. For example, backdoor attack algorithms add a backdoor marker to the poisoned data, thus poisoning the model. 3. Adversarial examples: Adversarial examples are input samples created by intentionally adding subtle perturbations to the dataset. These samples cause the model to give an incorrect output with high confidence. Simply put, adversarial examples cause deep learning models to misclassify by superimposing carefully constructed, imperceptible perturbations on elemental data. Among these, adversarial examples are the least costly attack method.

[0004] Adversarial attack scenarios can be categorized into three types: white-box attacks with detailed model information, gray-box attacks with limited model information (such as confidence scores for each category in the output), and black-box attacks without any model information. White-box and gray-box attacks are limited by the target model's information and are unusable in most real-world scenarios. While black-box adversarial attack techniques are more practical, they are currently immature, have low success rates, and the generated adversarial examples are easily detectable as having added perturbations. Therefore, improving the attack efficiency and stealth of black-box adversarial examples and reducing the cost of generating them is both important and challenging.

[0005] Current solutions, such as the method proposed in the patent application "A Method for Generating Adversarial Examples for Voiceprint Recognition Based on Boundary Attacks," do not require information about the target model. Instead, they select an initial sample point and iteratively apply the following steps: adding a random perturbation from a standard Gaussian distribution; then adding another perturbation that makes the adversarial example approximate the original sample. During the iteration, the hyperparameters of the added perturbation are adjusted, ultimately yielding an adversarial example. The advantage of this method is that it involves adversarial attacks under completely black-box conditions.

[0006] The paper "Black-box Attacks on Spoofing Countermeasures Using Transferability of Adversarial Examples" proposes a method to generate adversarial examples by sequentially attacking multiple voiceprint recognition models. By attacking multiple models under white-box conditions, a method that can attack the target black-box model is generated. This method does not require any interaction with the target model.

[0007] Patent application CN113571067A proposes a rule-based text generation method. This method does not utilize the internal structure of the model; it only searches within a space where adversarial examples may exist. This results in relatively large perturbations in the generated adversarial examples. Most importantly, this method requires continuous access to the target model, making it easily defended against by the target model's multiple-access detection mechanism. This method is not easily applied to the real world. The paper "Black-box Attacks on Spoofing Countermeasures Using Transferability of Adversarial Examples" proposes a method to generate adversarial examples by sequentially attacking multiple voiceprint recognition models. This method of sequentially attacking collected white-box models and then transferring the attack to the target model is feasible, but it completely abandons the role of the target model. Furthermore, its method of attacking white-box models (MI-FGSM) is relatively old and its attack efficiency is not very high, ultimately resulting in a relatively low attack success rate.

[0008] To address this, we propose a method for generating adversarial examples for voiceprint recognition. Summary of the Invention

[0009] (a) Technical problems to be solved

[0010] To address the shortcomings of existing technologies, this invention provides a method for generating adversarial examples for voiceprint recognition. The method aims to generate a substitute model by integrating multiple existing voiceprint recognition models to replace the target black-box voiceprint recognition model. Adversarial examples are generated by attacking the substitute model, thereby attacking the target black-box model. This overcomes the difficulty of obtaining model information from a black-box model and improves the low success rate of attacks. In generating adversarial examples, a Nesterov-based accelerated gradient method is used, which can find adversarial examples with better attack effects more quickly. During the generation process, the target black-box model is queried a small number of times to correct the direction of adversarial example generation, thus improving the success rate of the attack.

[0011] (II) Technical Solution

[0012] To achieve the above-mentioned objectives, the present invention provides the following technical solution: a method for generating adversarial examples for voiceprint recognition, comprising the following steps:

[0013] Step 1: The target speaker generator generates a set of target speakers and calculates the speaker features of the original attack sample and the audio samples of all registered users based on the existing voiceprint recognition model.

[0014] Step 2: Calculate and select the registrant with the smallest Euclidean distance to the original attack sample under each model, and use them as the optimal target;

[0015] Step 3: Whenever the same optimal target appears in each model, the priority of that target is increased by one level, and finally a list of target speakers sorted from high to low priority is obtained as the target speakers for the next attack.

[0016] Step 4: The adversarial example generator generates adversarial examples, selects the target speaker with the highest priority, establishes and calculates the loss function of the original attack sample relative to the target speaker on each voiceprint recognition model, and calculates the gradient of each loss function;

[0017] Step 5: Calculate the perturbation applied to the sample based on the gradient;

[0018] Step 6: Repeat steps 4 and 5, with the number of iterations being a hyperparameter that can be manually set.

[0019] Step 7: Obtain an adversarial sample, input the adversarial sample into the target black-box model, and make a judgment. If the attack is successful, stop the attack. If the attack fails, change the target speaker to a lower priority target speaker and continue to steps 4 to 6 until the attack is successful or the entire list of target speakers has been attacked and then the attack ends.

[0020] Preferably, the attack is considered successful if the speaker is identified as a member of the registration set in the seventh step.

[0021] Preferably, the existing voiceprint recognition models in the first step include, but are not limited to, i-vector, d-vector, x-vector, and r-vector models.

[0022] Preferably, the target speaker generator in the first step includes the following:

[0023] Step 1: Input the original attack sample and load the various voiceprint recognition models;

[0024] Step 2: Calculate the speaker features of the original attack sample and the registrant's audio sample in each model M1, M2, M3...Mn:

[0025] , ...

[0026] Step 3: Calculate the Euclidean distance from the speaker features of the original attack sample to the speaker features of each registrant under different models, such as in model M1:

[0027] ,in

[0028] Step 4: Extract the data from each model. minimum distance Record the speaker's ID t and the number of times the speaker's ID appears.

[0029] Step 5: Sort the speakers by frequency of occurrence from highest to lowest, and generate the target speaker set:

[0030] .

[0031] Preferably, the anti-sample generator in the fourth step includes the following:

[0032] Step 1: Input the original attack sample x and the target speaker Load the various voiceprint recognition models;

[0033] Step 2: Establish the original attack sample x relative to the target speaker on each voiceprint recognition model. Loss function:

[0034] ;

[0035] in Let M1 be the scoring function for the voiceprint recognition model. The threshold for voiceprint recognition model M1 is used. The gradient on each model is obtained based on the loss function.

[0036] Step 3: Calculate the perturbation applied to the sample based on the gradient;

[0037] Step 4: After iterating through the attacks T times (hyperparameter, manually set), the final adversarial examples are generated. The input is fed into the target black-box model for detection, which may yield two results: attack success or attack failure. If the attack is successful, an adversarial example is output; if the attack fails, the target speaker is replaced with a secondary target (e.g., in this case, the target is...). Then it will be changed to Then repeat step 3 until the attack is successful or the entire target speaker set has been traversed.

[0038] Preferably, step 3 includes the following:

[0039] Step 31: Directly use the original attack sample x as the input for the first iteration;

[0040] Step 32: Iterative attack, the input for the (t+1)th attack is:

[0041] ;

[0042] Where t represents the number of iterations, and n represents the voiceprint recognition model number. To observe the step size, The attenuation coefficient is denoted by t. This formula indicates that the input at the (t+1)th attack is the output of the tth attack plus the gradients of each model at the tth attack multiplied by the observation step size and the attenuation coefficient. Therefore, the input at the (t+1)th attack consists of n samples.

[0043] Step 33: For the (t+1)th input (which varies depending on the model), calculate the gradient on each model:

[0044] ;

[0045] in The gradient of the (t+1)th attack is the gradient of the tth attack multiplied by the decay coefficient and the gradient of the current iteration.

[0046] Step 34: Take the directions of the n gradients calculated in Step 33 and sum them to obtain the final gradient of the (t+1)th iteration. Then, add a perturbation in the direction of this final gradient to the output of the t-th attack:

[0047] ;

[0048] in The `Clip` function represents the step size, controlling the magnitude of the perturbation applied in the gradient direction. It limits the range of generated adversarial examples; the total perturbation applied to the adversarial examples cannot exceed [a certain value]. .

[0049] (III) Beneficial Effects

[0050] Compared with existing technologies, this invention provides a method for generating adversarial examples for voiceprint recognition, which has the following beneficial effects:

[0051] 1. This voiceprint recognition adversarial example generation method, based on NAG, incorporates ensemble and restart attacks. The forward-looking nature of NAG improves the efficiency of adversarial example generation, resulting in stronger robustness and better performance in transfer attacks. The ensemble attack strategy further enhances the robustness of the adversarial examples and improves the performance of transfer attacks. The restart attack leverages the similarity between models, estimating targets with lower attack difficulty for a restart attack, effectively increasing the success rate of black-box attacks. This invention not only overcomes the difficulty of black-box attacks requiring multiple querying of the target model but also achieves a high attack success rate. Attached Figure Description

[0052] Figure 1 This is a schematic diagram of the process of the present invention;

[0053] Figure 2 A flowchart illustrating the process of generating a target speaker;

[0054] Figure 3 A schematic diagram of the adversarial sample generator flow;

[0055] Figure 4 A schematic diagram of the process for generating adversarial examples. Detailed Implementation

[0056] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0057] Please see Figure 1-4 A method for generating adversarial examples for voiceprint recognition, comprising the following steps:

[0058] ① Target speaker generator;

[0059] ② Adversarial sample generator.

[0060] In step ①, speaker features are calculated for the original attack sample and audio samples of all registered users based on existing voiceprint recognition models. Then, the registered user with the smallest Euclidean distance to the original attack sample under each model is selected (as the optimal target). Each time the same optimal target appears under each model, its priority is increased by one level. Finally, a list of target speakers sorted from highest to lowest priority is obtained as the target speakers for the next attack. In step ②, a multi-model structure integrating existing voiceprint recognition models is first constructed. Adversarial attacks are then performed on this multi-model structure to generate adversarial samples. The adversarial attack process is as follows:

[0061] (1) Select the target speaker with the highest priority, establish and calculate the loss function of the original attack sample relative to the target speaker on each voiceprint recognition model, and calculate the gradient of each loss function;

[0062] (2) Calculate the perturbation applied to the sample based on the gradient;

[0063] (3) Repeat (1)-(2) in a loop. The number of loops is a hyperparameter that is set manually.

[0064] (4) Obtain an adversarial sample, input the adversarial sample into the target black box model, and make a judgment. If the attack is successful (the attack is successful if the speaker is identified as a speaker in the registration set), the attack will stop. If the attack fails, the target speaker will be replaced with a secondary target speaker and steps (1)-(3) will be performed until the attack is successful or the entire list of target speakers has been attacked once and then the attack will end.

[0065] The target speaker generator generates a set of target speakers.

[0066] The main process of the target speaker generator is as follows: Figure 2 As shown. Existing voiceprint recognition models include, but are not limited to, i-vector, d-vector, x-vector, and r-vector models. These models can obtain the speaker features of the original attack sample and the registrant's audio samples. The Euclidean distance between the speaker features of the original attack sample and each registrant sample under different models is calculated. The registrant whose speaker features are closest to the original attack sample under each model is obtained. The more times the registrant appears, the higher its priority.

[0067] Step 10: Input the original attack sample and load each voiceprint recognition model.

[0068] Step 11: Calculate the speaker features of the original attack sample and the registrant's audio sample in each model M1, M2, M3...Mn:

[0069] , ...

[0070] Step 12: Calculate the Euclidean distance from the speaker features of the original attack sample to the speaker features of each registrant under different models, such as in model M1:

[0071] ,in

[0072] Step 13: Take the following for each model minimum distance Record the speaker's ID t and the number of times the speaker's ID appears.

[0073] Step 14: Sort speakers by frequency of occurrence from highest to lowest, generating the target speaker set:

[0074] ;

[0075] Adversarial sample generator

[0076] The adversarial example generator combines multi-model ensemble and trigger-restart concepts with NAG (Newton's Gradient Descent) to build upon it. Specifically, the adversarial examples rely on the forward-looking nature of NAG to accelerate attacks and avoid poor local maxima. Simultaneously, we enhance the robustness of the adversarial examples by attacking multiple models simultaneously. Based on the similarity theory of feature distributions and using the target speaker set generated by the target speaker generator, we add a trigger-restart mechanism to further improve the effectiveness of adversarial attacks.

[0077] Step 20: Input the original attack sample x and the target speaker Load each voiceprint recognition model.

[0078] Step 21: Establish the original attack sample x relative to the target speaker on each voiceprint recognition model. Loss function:

[0079]

[0080] in Let M1 be the scoring function for the voiceprint recognition model. The threshold is set for the voiceprint recognition model M1. The gradient on each model is obtained based on the loss function.

[0081] Step 22: Calculate the perturbation applied to the sample based on the gradient;

[0082] Step 220: Directly use the original attack sample x as the input for the first iteration;

[0083] Step 221: Iterative attack, the input for the (t+1)th attack is:

[0084]

[0085] Where t represents the number of iterations, and n represents the voiceprint recognition model number. To observe the step size, The attenuation coefficient is denoted by t. This formula indicates that the input at the (t+1)th attack is the output of the tth attack plus the gradients of each model at the tth attack multiplied by the observation step size and the attenuation coefficient. Therefore, the input at the (t+1)th attack consists of n samples.

[0086] Step 222: For the (t+1)th input (which varies depending on the model), calculate the gradient on each model:

[0087]

[0088] in The attenuation coefficient is the gradient of the (t+1)th attack, which is the gradient of the tth attack multiplied by the attenuation coefficient and the gradient of the current iteration.

[0089] Step 223: Take the directions of the n gradients calculated in step 222 and sum them to obtain the final gradient of the (t+1)th iteration. Then, add a perturbation in the direction of this final gradient to the output of the t-th attack:

[0090]

[0091] in The `Clip` function represents the step size, controlling the magnitude of the perturbation applied in the gradient direction. It limits the range of generated adversarial examples; the total perturbation applied to the adversarial examples cannot exceed [a certain value]. .

[0092] Step 23: After iterating through the attacks T times (hyperparameter, manually set), the final adversarial examples are generated. The input is fed into the target black-box model for detection, which may yield two results: attack success or attack failure. If the attack is successful, an adversarial example is output; if the attack fails, the target speaker is replaced with a secondary target (e.g., in this case, the target is...). Then it will be changed to Then repeat step 22 until the attack is successful or the entire target speaker set has been traversed.

[0093] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for generating adversarial examples for voiceprint recognition, characterized in that, Includes the following steps: Step 1: The target speaker generator generates a set of target speakers and calculates the speaker features of the original attack sample and the audio samples of all registered users based on the existing voiceprint recognition model. Step 2: Calculate and select the registrant with the smallest Euclidean distance to the original attack sample under each model, and use them as the optimal target; Step 3: Whenever the same optimal target appears in each model, the priority of that target is increased by one level, and finally a list of target speakers sorted from high to low priority is obtained as the target speakers for the next attack. Step 4: The adversarial example generator generates adversarial examples, selects the target speaker with the highest priority, establishes and calculates the loss function of the original attack sample relative to the target speaker on each voiceprint recognition model, and calculates the gradient of each loss function; Step 5: Calculate the perturbation applied to the sample based on the gradient; Step 6: Repeat steps 4 and 5, with the number of iterations being a hyperparameter that can be manually set. Step 7: Obtain an adversarial sample, input the adversarial sample into the target black box model, and make a judgment. If the attack is successful, stop the attack. If the attack fails, change the target speaker to a lower priority target speaker and continue to steps 4 to 6 until the attack is successful or the entire list of target speakers has been attacked and then the attack ends. The adversarial example generator in the fourth step includes the following: Step 1: Input the original attack sample x and the target speaker Load the various voiceprint recognition models; Step 2: Establish the original attack sample x relative to the target speaker on each voiceprint recognition model. Loss function: in Let M1 be the scoring function for the voiceprint recognition model. The threshold for voiceprint recognition model M1 is used to obtain the gradient of each model based on the loss function; Step 3: Calculate the perturbation applied to the sample based on the gradient; Step 4: Iterate through attack T to generate the final adversarial sample. The input is fed into the target black-box model for detection. If the attack is successful, an adversarial example is output. If the attack fails, the target speaker is replaced with a secondary target, and step 3 is repeated until the attack is successful or the entire set of target speakers has been traversed. Step 3 includes the following: Step 31: Directly use the original attack sample x as the input for the first iteration; Step 32: Iterative attack, the input for the (t+1)th attack is: Where t represents the number of iterations, and n represents the voiceprint recognition model number. To observe the step size, The attenuation coefficient is the input at the (t+1)th attack, which is the output of the tth attack plus the gradients of each model at the tth attack multiplied by the observation step size and the attenuation coefficient. Therefore, the input at the (t+1)th attack consists of n samples. Step 33: For the (t+1)th input, calculate the gradient on each model; Step 34: Take the directions of the n gradients calculated in step 33 and add them together to get the final gradient of the (t+1)th iteration. Then add a perturbation in the direction of the final gradient to the output of the attack at the tth iteration.

2. The method for generating adversarial examples for voiceprint recognition according to claim 1, characterized in that: The attack is considered successful if the speaker is identified as a member of the registration set in the seventh step.

3. The method for generating adversarial examples for voiceprint recognition according to claim 1, characterized in that: The existing voiceprint recognition models in the first step include, but are not limited to, i-vector, d-vector, x-vector, and r-vector models.

4. The method for generating adversarial examples for voiceprint recognition according to claim 1, characterized in that: The target speaker generator in the first step includes the following: Step 1: Input the original attack sample and load the various voiceprint recognition models; Step 2: Calculate the speaker features of the original attack sample and the registrant's audio sample in each model M1, M2, M3...Mn: , ... in, This represents the speaker features of the original attack sample in model M1. This represents the speaker feature of the audio sample of the i-th registrant in the i-th model; Step 3: Calculate the Euclidean distance from the speaker features of the original attack sample to the speaker features of each registrant under different models. In model M1: in , The Euclidean distance between the speaker features of the original attack sample and the speaker features of the i-th registrant is represented. Step 4: Extract the data from each model. minimum distance Record the speaker's ID t and the number of times the speaker's ID appears; Step 5: Sort the speakers by frequency of occurrence from highest to lowest, and generate the target speaker set: ； This represents the target speaker set, arranged in descending order of frequency of appearance.

Images