Frequency domain disturbance-based black box transferable voiceprint recognition system anti-attack method and device

Abstract

The invention belongs to the technical field of nuclear power, and particularly relates to a black box transferable voiceprint recognition system attack resisting method and device based on frequency domain disturbance. According to the invention, the perception of the human ear on the voice signal is considered and simultaneously depends on the characteristics of the frequency and the loudness of the voice signal, and the adversarial disturbance is added in the frequency interval insensitive to the human ear, so that the voice adversarial sample generated by the method is hidden to the human ear, the human ear is difficult to distinguish, and the model classification is wrong; in order to solve the problems that most black-box countermeasure attack methods need to query a large amount of attack targets, the attack time is long, and practical application is difficult, the method utilizes the transferability of countermeasure samples, adopts a three-stage iteration method, and improves the concealment and generation speed of the countermeasure samples, so that a large amount of query of the attack targets is avoided, and the security of the countermeasure samples is improved. The method achieves the high-success-rate countermeasure attack for an unknown voiceprint recognition system.

Description

Technical Field

[0001] The present invention belongs to the field of nuclear power technology, and specifically relates to a method and device for counteracting attacks on a black box transferable voiceprint recognition system based on frequency domain disturbance. Background Art

[0002] Voiceprint recognition system is an automated technology that determines the speaker's identity based on the speaker's voice biometrics. In recent years, with the rapid development of deep learning technology, voiceprint recognition technology based on deep learning has been widely used in identity authentication scenarios such as mobile phone unlocking, bank transactions, and access control systems. Adversarial attack is an attack method against deep learning systems, which disturbs the input samples of deep learning systems to make the deep learning systems make incorrect outputs. The introduction of deep learning has brought new security issues to voiceprint recognition. How to protect voiceprint recognition systems from adversarial attacks is an urgent problem to be solved.

[0003] 1) Most current adversarial attack methods against voiceprint recognition systems do not take into account the characteristics of the human ear, resulting in poor concealment. The human ear's perception of speech signals depends on both the frequency and loudness of the speech signal;

[0004] 2) Most black-box adversarial attack methods require a large number of queries on the attack target, which is time-consuming and difficult to apply in practice. Summary of the invention

[0005] In order to overcome the problems existing in the related art, a method and device for countering attacks on a black-box transferable voiceprint recognition system based on frequency domain perturbation is provided.

[0006] According to one aspect of an embodiment of the present disclosure, a method for countering attacks on a black-box transferable voiceprint recognition system based on frequency domain perturbation is provided, the method comprising:

[0007] Step 1: Integrate the collected voiceprint recognition models of different architectures to obtain an integrated voiceprint recognition model;

[0008] Step 2: Input the speech sample into the integrated voiceprint recognition model, obtain and save the output of the integrated voiceprint recognition model; determine the gradient information of the adversarial sample based on the output using the loss function; use the gradient information as the generated adversarial perturbation, and perform short-time Fourier transform to extract frequency domain information; eliminate the frequency range in the frequency domain information that is sensitive to the human ear to obtain the processed frequency domain information; perform inverse short-time Fourier transform on the processed frequency domain information to generate a perturbed speech sample;

[0009] Step 3, adding the disturbed speech sample to the speech sample according to a preset coefficient to obtain a final disturbed speech sample;

[0010] Step 4: Input the final perturbed speech sample into the integrated voiceprint recognition model, repeat steps 2 and 3 until the input perturbed speech sample successfully attacks the integrated voiceprint recognition model, and use the perturbed speech sample that has been successfully attacked as the adversarial sample.

[0011] In a possible implementation, the method further includes:

[0012] Step 5: Input the obtained adversarial sample into the target voiceprint recognition system to complete the attack.

[0013] In a possible implementation, step 2 further includes:

[0014] Step 21, in the first stage, the cross entropy loss is calculated according to the output of the integrated voiceprint recognition model to obtain the sum of the integrated model gradients, the sum of the gradients is multiplied by the weight coefficient δ and then Fourier transformed to extract the frequency domain information of the first stage;

[0015] Step 22, remove the disturbance in the undisturbed frequency interval [win1, win2] in the frequency domain information of the first stage, and then perform inverse Fourier transform to obtain the intermediate adversarial sample of the first stage;

[0016] Step 23, iteratively repeating steps 21 to 22 to form an intermediate speech sample;

[0017] Step 24, inputting the intermediate speech sample into the integrated voiceprint recognition system, and saving the output of the integrated voiceprint recognition system;

[0018] Step 25, calculate the cross entropy loss according to the output of step 24 to obtain the sum of the integrated model gradient and the gradient of the mean square loss of the adversarial sample perturbation, add the two gradients according to the weight constant λ, multiply them by δ, and perform Fourier transform to extract the frequency domain information of the second stage.

[0019] Step 26, remove the disturbance in the non-disturbance frequency interval [win1, win2] in the second-stage frequency domain information to obtain the intermediate adversarial sample of the second stage;

[0020] Step 27, iteratively repeat steps 24 to 26 to obtain a disturbed speech sample.

[0021] According to another aspect of the embodiment of the present disclosure, a device for countering attacks on a black box transferable voiceprint recognition system based on frequency domain perturbation is provided, the device comprising:

[0022] An integration module, used to integrate the collected voiceprint recognition models of different architectures to obtain an integrated voiceprint recognition model;

[0023] A processing module is used to input a speech sample into an integrated voiceprint recognition model, obtain and save the output of the integrated voiceprint recognition model; determine the gradient information of the adversarial sample using a loss function according to the output; use the gradient information as the generated adversarial disturbance, and perform short-time Fourier transform to extract frequency domain information; eliminate the frequency range that is sensitive to the human ear in the frequency domain information to obtain processed frequency domain information; perform inverse short-time Fourier transform on the processed frequency domain information to generate a perturbed speech sample;

[0024] A superposition module, used for adding the disturbed speech sample to the speech sample according to a preset coefficient to obtain a final disturbed speech sample;

[0025] The training module is used to input the final perturbed speech sample into the integrated voiceprint recognition model, repeat the processing module and the superposition module until the input perturbed speech sample successfully attacks the integrated voiceprint recognition model, and use the perturbed speech sample that successfully attacks as an adversarial sample.

[0026] In a possible implementation manner, the device further includes:

[0027] The attack module is used to input the obtained adversarial samples into the target voiceprint recognition system to complete the attack.

[0028] In a possible implementation, the processing module further includes:

[0029] The first extraction submodule is used to calculate the cross entropy loss according to the output of the integrated voiceprint recognition model in the first stage to obtain the sum of the integrated model gradients, multiply the sum of the gradients by the weight coefficient δ, and then perform Fourier transform to extract the frequency domain information of the first stage;

[0030] The first elimination submodule is used to eliminate the disturbance in the undisturbed frequency interval [win1, win2] in the frequency domain information of the first stage and then perform inverse Fourier transform to obtain the intermediate adversarial sample of the first stage;

[0031] A first iterative submodule, used for iteratively repeating the first extraction submodule and the first elimination submodule to form an intermediate speech sample;

[0032] A processing submodule, for inputting the intermediate speech sample into the integrated voiceprint recognition system and saving the output of the integrated voiceprint recognition system;

[0033] The second extraction submodule is used to calculate the cross entropy loss according to the output of the processing submodule to obtain the sum of the integrated model gradients and the gradient of the mean square loss of the adversarial sample perturbation, add the two gradients according to the weight constant λ, multiply them by δ, and then perform Fourier transform to extract the frequency domain information of the second stage;

[0034] The second elimination submodule is used to eliminate the disturbance in the non-disturbance frequency interval [win1, win2] in the second-stage frequency domain information to obtain the intermediate adversarial sample of the second stage;

[0035] The second iterative submodule is used to iteratively repeat the processing submodule, the second extraction submodule and the second elimination submodule to obtain a disturbed speech sample.

[0036] According to another aspect of the embodiment of the present disclosure, a device for countering attacks on a black box transferable voiceprint recognition system based on frequency domain perturbation is provided, the device comprising:

[0037] processor;

[0038] a memory for storing processor-executable instructions;

[0039] Wherein, the processor is configured to execute the above method.

[0040] According to another aspect of an embodiment of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor.

[0041] The beneficial effects of the present disclosure are as follows: the black-box transferable voiceprint recognition system anti-attack method based on frequency domain perturbation provided by the present disclosure takes into account the characteristics that the human ear's perception of speech signals depends on both the frequency and loudness of the speech signals, and adds adversarial perturbations in frequency intervals that are insensitive to the human ear, so that the speech adversarial samples generated by this method are hidden from the human ear, which is not only difficult to distinguish for the human ear, but also can cause model classification errors; in view of the problem that most black-box adversarial attack methods require a large number of queries on the attack targets, the attack is time-consuming, and difficult to apply in practice, the present disclosure utilizes the transferability of adversarial samples and adopts a three-stage iterative method. This method increases the concealment and generation speed of adversarial samples, thereby eliminating a large number of queries on the attack targets and achieving a high success rate of adversarial attacks against unknown voiceprint recognition systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a flowchart of a method for countering attacks on a black-box transferable voiceprint recognition system based on frequency domain perturbation shown in an embodiment of the present disclosure.

[0043] Figure 2 It is a block diagram of a black-box transferable voiceprint recognition system anti-attack device based on frequency domain perturbation shown in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0044] The present disclosure is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0045] Unless otherwise defined, the technical and scientific terms used in the present disclosure have the same meanings as those generally understood by those skilled in the art to which the present disclosure belongs; the terms used in the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure; the term "including" and any variations thereof in the present disclosure are intended to cover non-exclusive inclusions. Obviously, the embodiments described in the present disclosure are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative efforts are within the scope of protection of the present disclosure.

[0046] Reference to "embodiments" in this disclosure means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the disclosure. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0047] Figure 1 This is a flowchart of a method for countering attacks on a black box transferable voiceprint recognition system based on frequency domain perturbation shown in an embodiment of the present disclosure. The method can be executed by a terminal device, wherein the terminal device can be a server, a desktop computer, a laptop computer, etc. The embodiment of the present disclosure does not limit the type of the terminal device.

[0048] like Figure 1 As shown, the method includes:

[0049] Step 1: Integrate the collected voiceprint recognition models of different architectures to obtain an integrated voiceprint recognition model.

[0050] Step 2: Input the speech sample into the integrated voiceprint recognition model, obtain and save the output of the integrated voiceprint recognition model; determine the gradient information of the adversarial sample based on the output using the loss function; use the gradient information as the generated adversarial perturbation, and perform short-time Fourier transform to extract frequency domain information; eliminate the frequency range in the frequency domain information that is sensitive to the human ear to obtain the processed frequency domain information; perform inverse short-time Fourier transform on the processed frequency domain information to generate a perturbed speech sample.

[0051] In a possible implementation, step 2 further includes:

[0052] Step 21, in the first stage, the cross entropy loss is calculated according to the output of the integrated voiceprint recognition model to obtain the sum of the integrated model gradients, the sum of the gradients is multiplied by the weight coefficient δ and then Fourier transformed to extract the frequency domain information of the first stage.

[0053] Step 22, remove the disturbance in the undisturbed frequency interval [win1, win2] in the frequency domain information of the first stage, and then perform inverse Fourier transform to obtain the intermediate adversarial sample of the first stage.

[0054] Step 23, iteratively repeating steps 21 to 22 to form an intermediate speech sample.

[0055] Step 24, input the intermediate speech sample into the integrated voiceprint recognition system, and save the output of the integrated voiceprint recognition system.

[0056] Step 25, calculate the cross entropy loss according to the output of step 24 to obtain the sum of the integrated model gradient and the gradient of the mean square loss of the adversarial sample perturbation, add the two gradients according to the weight constant λ, multiply them by δ, and perform Fourier transform to extract the frequency domain information of the second stage.

[0057] Step 26, remove the disturbance in the undisturbed frequency interval [win1, win2] in the second stage frequency domain information to obtain the intermediate adversarial sample of the second stage.

[0058] Step 27, iteratively repeat steps 24 to 26 to obtain a disturbed speech sample.

[0059] Step 3: Add the disturbed speech sample to the speech sample according to a preset coefficient to obtain a final disturbed speech sample.

[0060] Step 4: Input the final perturbed speech sample into the integrated voiceprint recognition model, repeat steps 2 and 3 until the input perturbed speech sample successfully attacks the integrated voiceprint recognition model, and use the perturbed speech sample that has been successfully attacked as the adversarial sample.

[0061] Step 5: Input the obtained adversarial sample into the target voiceprint recognition system to complete the attack.

[0062] The black-box transferable voiceprint recognition system anti-attack method based on frequency domain perturbation provided by the present disclosure generates transferable high-concealment adversarial samples by perturbing the specified frequency and integrating the model; in the sample generation process, a three-stage iteration method is adopted, which increases the concealment and generation speed of the adversarial samples. The adversarial samples generated by the above processing do not need to query a certain target voiceprint recognition model, but use the transferability of the adversarial samples to achieve more practical adversarial samples without query. The present disclosure can detect the security of the voiceprint recognition system and serve as a research on the security of the voiceprint recognition system.

[0063] According to another aspect of the embodiment of the present disclosure, a device for countering attacks on a black box transferable voiceprint recognition system based on frequency domain perturbation is provided, the device comprising:

[0064] An integration module, used to integrate the collected voiceprint recognition models of different architectures to obtain an integrated voiceprint recognition model;

[0065] A processing module is used to input a speech sample into an integrated voiceprint recognition model, obtain and save the output of the integrated voiceprint recognition model; determine the gradient information of the adversarial sample using a loss function according to the output; use the gradient information as the generated adversarial disturbance, and perform short-time Fourier transform to extract frequency domain information; eliminate the frequency range that is sensitive to the human ear in the frequency domain information to obtain processed frequency domain information; perform inverse short-time Fourier transform on the processed frequency domain information to generate a perturbed speech sample;

[0066] A superposition module, used for adding the disturbed speech sample to the speech sample according to a preset coefficient to obtain a final disturbed speech sample;

[0067] The training module is used to input the final perturbed speech sample into the integrated voiceprint recognition model, repeat the processing module and the superposition module until the input perturbed speech sample successfully attacks the integrated voiceprint recognition model, and use the perturbed speech sample that successfully attacks as an adversarial sample.

[0068] In a possible implementation manner, the device further includes:

[0069] The attack module is used to input the obtained adversarial samples into the target voiceprint recognition system to complete the attack.

[0070] In a possible implementation, the processing module further includes:

[0071] The first extraction submodule is used to calculate the cross entropy loss according to the output of the integrated voiceprint recognition model in the first stage to obtain the sum of the integrated model gradients, multiply the sum of the gradients by the weight coefficient δ, and then perform Fourier transform to extract the frequency domain information of the first stage;

[0072] The first elimination submodule is used to eliminate the disturbance in the undisturbed frequency interval [win1, win2] in the frequency domain information of the first stage and then perform inverse Fourier transform to obtain the intermediate adversarial sample of the first stage;

[0073] A first iterative submodule, used for iteratively repeating the first extraction submodule and the first elimination submodule to form an intermediate speech sample;

[0074] A processing submodule, for inputting the intermediate speech sample into the integrated voiceprint recognition system and saving the output of the integrated voiceprint recognition system;

[0075] The second extraction submodule is used to calculate the cross entropy loss according to the output of the processing submodule to obtain the sum of the integrated model gradients and the gradient of the mean square loss of the adversarial sample perturbation, add the two gradients according to the weight constant λ, multiply them by δ, and then perform Fourier transform to extract the frequency domain information of the second stage;

[0076] The second elimination submodule is used to eliminate the disturbance in the non-disturbance frequency interval [win1, win2] in the second-stage frequency domain information to obtain the intermediate adversarial sample of the second stage;

[0077] The second iterative submodule is used to iteratively repeat the processing submodule, the second extraction submodule and the second elimination submodule to obtain a disturbed speech sample.

[0078] The description of the above-mentioned device has been explained in detail in the description of the above-mentioned method, and will not be repeated here.

[0079] Figure 2 1900 is a block diagram of a black box transferable voiceprint recognition system anti-attack device based on frequency domain perturbation according to an embodiment of the present disclosure. For example, the device 1900 may be provided as a server. Figure 2 , the apparatus 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0080] The device 1900 may also include a power supply component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output (I / O) interface 1958. The device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™, or the like.

[0081] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the device 1900 to perform the above method.

[0082] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0083] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0084] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0085] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0086] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0087] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0088] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0089] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0090] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for countering attacks on a black-box transferable voiceprint recognition system based on frequency domain perturbation, characterized in that: The method comprises: Step 1: Integrate the collected voiceprint recognition models of different architectures to obtain an integrated voiceprint recognition model; Step 2: Input the speech sample into the integrated voiceprint recognition model, obtain and save the output of the integrated voiceprint recognition model; determine the gradient information of the adversarial sample based on the output using the loss function; use the gradient information as the generated adversarial perturbation, and perform short-time Fourier transform to extract frequency domain information; eliminate the frequency range in the frequency domain information that is sensitive to the human ear to obtain the processed frequency domain information; perform inverse short-time Fourier transform on the processed frequency domain information to generate a perturbed speech sample; Step 3, adding the disturbed speech sample to the speech sample according to a preset coefficient to obtain a final disturbed speech sample; Step 4: Input the final perturbed speech sample into the integrated voiceprint recognition model, repeat steps 2 and 3 until the input perturbed speech sample successfully attacks the integrated voiceprint recognition model, and use the perturbed speech sample that has been successfully attacked as the adversarial sample.

2. The method according to claim 1, characterized in that The method further comprises: Step 5: Input the obtained adversarial sample into the target voiceprint recognition system to complete the attack.

3. The method according to claim 1, characterized in that Step 2 also includes: Step 21, in the first stage, the cross entropy loss is calculated according to the output of the integrated voiceprint recognition model to obtain the sum of the integrated model gradients, the sum of the gradients is multiplied by the weight coefficient δ and then Fourier transformed to extract the frequency domain information of the first stage; Step 22, remove the disturbance in the undisturbed frequency interval [win1, win2] in the frequency domain information of the first stage, and then perform inverse Fourier transform to obtain the intermediate adversarial sample of the first stage; Step 23, iteratively repeating steps 21 to 22 to form an intermediate speech sample; Step 24, inputting the intermediate speech sample into the integrated voiceprint recognition system, and saving the output of the integrated voiceprint recognition system; Step 25, calculate the cross entropy loss according to the output of step 24 to obtain the sum of the integrated model gradient and the gradient of the mean square loss of the adversarial sample perturbation, add the two gradients according to the weight constant λ, multiply them by δ, and perform Fourier transform to extract the frequency domain information of the second stage. Step 26, remove the disturbance in the non-disturbance frequency interval [win1, win2] in the second-stage frequency domain information to obtain the intermediate adversarial sample of the second stage; Step 27, iteratively repeat steps 24 to 26 to obtain a disturbed speech sample.

4. A black box transferable voiceprint recognition system anti-attack device based on frequency domain perturbation, characterized in that: The device comprises: An integration module, used to integrate the collected voiceprint recognition models of different architectures to obtain an integrated voiceprint recognition model; A processing module is used to input a speech sample into an integrated voiceprint recognition model, obtain and save the output of the integrated voiceprint recognition model; determine the gradient information of the adversarial sample using a loss function according to the output; use the gradient information as the generated adversarial disturbance, and perform short-time Fourier transform to extract frequency domain information; eliminate the frequency interval sensitive to the human ear in the frequency domain information to obtain processed frequency domain information; perform inverse short-time Fourier transform on the processed frequency domain information to generate a perturbed speech sample; A superposition module, used for adding the disturbed speech sample to the speech sample according to a preset coefficient to obtain a final disturbed speech sample; The training module is used to input the final perturbed speech sample into the integrated voiceprint recognition model, repeat the processing module and the superposition module until the input perturbed speech sample successfully attacks the integrated voiceprint recognition model, and use the perturbed speech sample that successfully attacks as an adversarial sample.

5. The device according to claim 1, characterized in that The device also includes: The attack module is used to input the obtained adversarial samples into the target voiceprint recognition system to complete the attack.

6. The device according to claim 1, characterized in that The processing module also includes: The first extraction submodule is used to calculate the cross entropy loss according to the output of the integrated voiceprint recognition model in the first stage to obtain the sum of the integrated model gradients, multiply the sum of the gradients by the weight coefficient δ, and then perform Fourier transform to extract the frequency domain information of the first stage; The first elimination submodule is used to eliminate the disturbance in the undisturbed frequency interval [win1, win2] in the frequency domain information of the first stage and then perform inverse Fourier transform to obtain the intermediate adversarial sample of the first stage; A first iterative submodule, used for iteratively repeating the first extraction submodule and the first elimination submodule to form an intermediate speech sample; a processing submodule, for inputting the intermediate speech sample into the integrated voiceprint recognition system and saving the output of the integrated voiceprint recognition system; The second extraction submodule is used to calculate the cross entropy loss according to the output of the processing submodule to obtain the sum of the integrated model gradients and the gradient of the mean square loss of the adversarial sample perturbation, add the two gradients according to the weight constant λ, multiply them by δ, and then perform Fourier transform to extract the frequency domain information of the second stage; The second elimination submodule is used to eliminate the disturbance in the non-disturbance frequency interval [win1, win2] in the second-stage frequency domain information to obtain the intermediate adversarial sample of the second stage; The second iterative submodule is used to iteratively repeat the processing submodule, the second extraction submodule and the second elimination submodule to obtain a disturbed speech sample.

7. A black box transferable voiceprint recognition system anti-attack device based on frequency domain perturbation, characterized in that: The device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method according to any one of claims 1 to 3.

8. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 3 is implemented.

Images