Methods and devices for countering attacks on black-box transferable voiceprint recognition systems based on frequency domain perturbation

Abstract

This disclosure belongs to the field of nuclear power technology, specifically relating to a method and apparatus for adversarial attacks on a black-box transferable voiceprint recognition system based on frequency domain perturbation. This disclosure considers the characteristic that human hearing's perception of speech signals depends on both the frequency and loudness of the speech signal. By adding adversarial perturbations to frequency ranges insensitive to the human ear, the adversarial samples generated by this method are concealed from the human ear, making them difficult for the human ear to distinguish and causing the model to misclassify. Addressing the problem that most black-box adversarial attack methods require extensive querying of the attack target, resulting in long attack times and impracticality, this disclosure utilizes the transferability of adversarial samples and employs a three-stage iterative method. This method increases the concealment and generation speed of adversarial samples, thereby eliminating the need for extensive querying of the attack target and achieving a high success rate of adversarial attacks against unknown voiceprint recognition systems.

Description

Technical Field

[0001] This disclosure belongs to the field of nuclear power technology, specifically relating to a method and apparatus for countering attacks on a black-box transferable voiceprint recognition system based on frequency domain perturbation. Background Technology

[0002] Voiceprint recognition systems are automated technologies that determine a speaker's identity based on their voice biometric features. In recent years, with the rapid development of deep learning technology, deep learning-based voiceprint recognition technology has been widely applied in identity verification scenarios such as mobile phone unlocking, banking transactions, and access control systems. Adversarial attacks are attack methods targeting deep learning systems, perturbing the input samples to cause the deep learning system to produce incorrect outputs. The introduction of deep learning has brought new security challenges to voiceprint recognition; how to protect voiceprint recognition systems from adversarial attacks is a problem that urgently needs to be solved.

[0003] 1) Most current adversarial attack methods targeting voiceprint recognition systems do not consider the characteristics of the human ear, resulting in poor concealment. The human ear's perception of speech signals depends on both the frequency and loudness of the speech signal;

[0004] 2) Most black-box adversarial attack methods require extensive querying of the target, which is time-consuming and difficult to apply in practice. Summary of the Invention

[0005] To overcome the problems existing in related technologies, a method and device for countering attacks on a black-box transferable voiceprint recognition system based on frequency domain perturbation are provided.

[0006] According to one aspect of the embodiments of this disclosure, a method for countering attacks on a black-box transferable voiceprint recognition system based on frequency domain perturbation is provided, the method comprising:

[0007] Step 1: Integrate the collected voiceprint recognition models with different architectures to obtain an integrated voiceprint recognition model;

[0008] Step 2: Input the speech sample into the integrated speaker recognition model, obtain and save the output of the integrated speaker recognition model; determine the gradient information of the adversarial sample based on the output using a loss function; use the gradient information as the generated adversarial perturbation and perform short-time Fourier transform to extract frequency domain information; eliminate the frequency range that is sensitive to the human ear in the frequency domain information to obtain the processed frequency domain information; perform inverse short-time Fourier transform on the processed frequency domain information to generate perturbed speech samples;

[0009] Step 3: Add the disturbed speech sample to the speech sample according to the preset coefficient to obtain the final disturbed speech sample;

[0010] Step 4: Input the final perturbation speech sample into the integrated speaker recognition model, and repeat steps 2 and 3 until the input perturbation speech sample successfully attacks the integrated speaker recognition model. The perturbation speech sample that successfully attacks the model is used as an adversarial sample.

[0011] In one possible implementation, the method further includes:

[0012] Step 5: Input the obtained adversarial sample into the target voiceprint recognition system to complete the attack.

[0013] In one possible implementation, step 2 further includes:

[0014] Step 21: In the first stage, the cross-entropy loss is calculated based on the output of the integrated voiceprint recognition model to obtain the sum of the gradients of the integrated model. The sum of the gradients is multiplied by the weight coefficient δ and then Fourier transform is performed to extract the frequency domain information of the first stage.

[0015] Step 22: After removing the perturbations in the unperturbed frequency range [win1,win2] in the first stage frequency domain information, perform an inverse Fourier transform to obtain the intermediate adversarial samples of the first stage.

[0016] Step 23: Iterate and repeat steps 21 to 22 to form intermediate speech samples;

[0017] Step 24: Input the intermediate speech sample into the integrated voiceprint recognition system and save the output of the integrated voiceprint recognition system;

[0018] Step 25: Calculate the cross-entropy loss based on the output of Step 24 to obtain the sum of the gradients of the ensemble model and the gradient of the average squared loss due to adversarial sample perturbation. Add the two gradients together with the weight constant λ, multiply them by δ, and then perform a Fourier transform to extract the frequency domain information of the second stage.

[0019] Step 26: Remove the perturbations in the unperturbed frequency range [win1,win2] from the second-stage frequency domain information to obtain the intermediate adversarial samples for the second stage.

[0020] Step 27: Iterate and repeat steps 24 to 26 to obtain perturbed speech samples.

[0021] According to another aspect of the embodiments of this disclosure, a device for countering attacks on a black-box transferable voiceprint recognition system based on frequency domain perturbation is provided, the device comprising:

[0022] The integration module is used to integrate the collected voiceprint recognition models with different architectures to obtain an integrated voiceprint recognition model;

[0023] The processing module is used to input speech samples into the integrated speaker recognition model, acquire and save the output of the integrated speaker recognition model; determine the gradient information of the adversarial sample based on the output using a loss function; use the gradient information as the generated adversarial perturbation and perform short-time Fourier transform to extract frequency domain information; eliminate the frequency range that is sensitive to the human ear in the frequency domain information to obtain the processed frequency domain information; and perform inverse short-time Fourier transform on the processed frequency domain information to generate perturbed speech samples.

[0024] The overlay module is used to add the perturbed speech sample to the speech sample according to a preset coefficient to obtain the final perturbed speech sample;

[0025] The training module is used to input the final perturbation speech sample into the integrated speaker recognition model. The repetition processing module and the overlay module continue until the input perturbation speech sample successfully attacks the integrated speaker recognition model. The perturbation speech sample that successfully attacks the model is used as an adversarial sample.

[0026] In one possible implementation, the device further includes:

[0027] The attack module is used to input the obtained adversarial sample into the target voiceprint recognition system to complete the attack.

[0028] In one possible implementation, the processing module also includes:

[0029] The first extraction submodule is used in the first stage to calculate the cross-entropy loss based on the output of the integrated voiceprint recognition model to obtain the sum of the gradients of the integrated model, multiply the sum of the gradients by the weight coefficient δ and then perform a Fourier transform to extract the frequency domain information of the first stage.

[0030] The first elimination submodule is used to eliminate the perturbations in the unperturbed frequency range [win1,win2] in the first stage frequency domain information and then perform an inverse Fourier transform to obtain the intermediate adversarial samples of the first stage.

[0031] The first iteration submodule is used to iteratively repeat the first extraction submodule and the first elimination submodule to form intermediate speech samples;

[0032] The processing submodule is used to input intermediate speech samples into the integrated voiceprint recognition system and save the output of the integrated voiceprint recognition system.

[0033] The second extraction submodule is used to calculate the cross-entropy loss based on the output of the processing submodule, obtain the sum of the gradients of the ensemble model and the gradient of the average squared loss of the adversarial sample perturbation, add the two gradients by the weight constant λ, multiply them by δ, and then perform a Fourier transform to extract the frequency domain information of the second stage.

[0034] The second elimination submodule is used to eliminate the perturbations in the unperturbed frequency range [win1,win2] in the second stage frequency domain information to obtain the intermediate adversarial samples of the second stage.

[0035] The second iteration submodule is used to iteratively repeat the processing submodule, the second extraction submodule, and the second elimination submodule to obtain perturbed speech samples.

[0036] According to another aspect of the embodiments of this disclosure, a device for countering attacks on a black-box transferable voiceprint recognition system based on frequency domain perturbation is provided, the device comprising:

[0037] processor;

[0038] Memory used to store processor-executable instructions;

[0039] The processor is configured to execute the above-described method.

[0040] According to another aspect of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, which, when executed by a processor, implement the above-described method.

[0041] The beneficial effects of this disclosure are as follows: The adversarial attack method for black-box transferable voiceprint recognition systems based on frequency domain perturbation provided by this disclosure considers the characteristic that human ear perception of speech signals depends on both the frequency and loudness of the speech signal. By adding adversarial perturbations to frequency ranges insensitive to the human ear, the adversarial samples generated by this method are concealed from the human ear, making them difficult for the human ear to distinguish and causing the model to misclassify. Addressing the problem that most black-box adversarial attack methods require extensive querying of the attack target, resulting in long attack times and difficulty in practical application, this disclosure utilizes the transferability of adversarial samples and adopts a three-stage iterative method. This method increases the concealment and generation speed of adversarial samples, thereby eliminating the need for extensive querying of the attack target and achieving a high success rate of adversarial attacks against unknown voiceprint recognition systems. Attached Figure Description

[0042] Figure 1 This is a flowchart illustrating an anti-attack method for a black-box transferable voiceprint recognition system based on frequency domain perturbation, as shown in an embodiment of this disclosure.

[0043] Figure 2 This is a block diagram of a black-box transferable voiceprint recognition system based on frequency domain perturbation, illustrating an embodiment of the present disclosure, to counterattack devices. Detailed Implementation

[0044] The present disclosure will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0045] Unless otherwise defined, the technical and scientific terms used in this disclosure have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains; the terminology used in this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of this disclosure; the term "comprising" and any variations thereof in this disclosure are intended to cover non-exclusive inclusion. Clearly, the embodiments described in this disclosure are only a part of the embodiments of this disclosure, and not all of them. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of this disclosure without inventive effort are within the scope of protection of this disclosure.

[0046] In this disclosure, the reference to "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this disclosure. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0047] Figure 1 This is a flowchart illustrating a black-box transferable voiceprint recognition system's counter-attack method based on frequency domain perturbation, as shown in an embodiment of this disclosure. The method can be executed by a terminal device, which can be a server, desktop computer, laptop computer, etc. This disclosure does not limit the type of terminal device.

[0048] like Figure 1 As shown, the method includes:

[0049] Step 1: Integrate the collected voiceprint recognition models with different architectures to obtain an integrated voiceprint recognition model.

[0050] Step 2: Input the speech sample into the integrated speaker recognition model, obtain and save the output of the integrated speaker recognition model; determine the gradient information of the adversarial sample using a loss function based on the output; use the gradient information as the generated adversarial perturbation and perform short-time Fourier transform to extract frequency domain information; eliminate the frequency range that is sensitive to the human ear in the frequency domain information to obtain the processed frequency domain information; perform inverse short-time Fourier transform on the processed frequency domain information to generate perturbed speech samples.

[0051] In one possible implementation, step 2 further includes:

[0052] Step 21: In the first stage, the cross-entropy loss is calculated based on the output of the integrated voiceprint recognition model to obtain the sum of the gradients of the integrated model. The sum of the gradients is multiplied by the weight coefficient δ and then Fourier transform is performed to extract the frequency domain information of the first stage.

[0053] Step 22: After removing the perturbations in the unperturbed frequency range [win1,win2] of the first-stage frequency domain information, perform an inverse Fourier transform to obtain the intermediate adversarial samples of the first stage.

[0054] Step 23: Iterate and repeat steps 21 to 22 to form intermediate speech samples.

[0055] Step 24: Input the intermediate speech sample into the integrated voiceprint recognition system and save the output of the integrated voiceprint recognition system.

[0056] Step 25: Calculate the cross-entropy loss based on the output of Step 24 to obtain the sum of the gradients of the ensemble model and the gradient of the average squared loss due to adversarial sample perturbation. Add the two gradients together with the weight constant λ, multiply them by δ, and then perform a Fourier transform to extract the frequency domain information of the second stage.

[0057] Step 26: Remove the perturbations in the unperturbed frequency range [win1,win2] from the second-stage frequency domain information to obtain the intermediate adversarial samples for the second stage.

[0058] Step 27: Iterate and repeat steps 24 to 26 to obtain perturbed speech samples.

[0059] Step 3: Add the disturbed speech sample to the speech sample according to the preset coefficient to obtain the final disturbed speech sample.

[0060] Step 4: Input the final perturbation speech sample into the integrated speaker recognition model, and repeat steps 2 and 3 until the input perturbation speech sample successfully attacks the integrated speaker recognition model. The perturbation speech sample that successfully attacks the model is used as an adversarial sample.

[0061] Step 5: Input the obtained adversarial sample into the target voiceprint recognition system to complete the attack.

[0062] This disclosure presents a black-box transferable adversarial attack method for voiceprint recognition systems based on frequency domain perturbation. It generates transferable, highly covert adversarial examples by perturbing specified frequencies and using model ensemble techniques. A three-stage iterative method is employed during example generation, which increases the covertness and generation speed of the adversarial examples. The adversarial examples generated through this process do not require querying a specific target voiceprint recognition model; instead, they leverage the transferability of the adversarial examples to achieve more practical, query-free results. This disclosure can be used to test the security of voiceprint recognition systems and serves as a basis for research on the security of voiceprint recognition systems.

[0063] According to another aspect of the embodiments of this disclosure, a device for countering attacks on a black-box transferable voiceprint recognition system based on frequency domain perturbation is provided, the device comprising:

[0064] The integration module is used to integrate the collected voiceprint recognition models with different architectures to obtain an integrated voiceprint recognition model;

[0065] The processing module is used to input speech samples into the integrated speaker recognition model, acquire and save the output of the integrated speaker recognition model; determine the gradient information of the adversarial sample based on the output using a loss function; use the gradient information as the generated adversarial perturbation and perform short-time Fourier transform to extract frequency domain information; eliminate the frequency range that is sensitive to the human ear in the frequency domain information to obtain the processed frequency domain information; and perform inverse short-time Fourier transform on the processed frequency domain information to generate perturbed speech samples.

[0066] The overlay module is used to add the perturbed speech sample to the speech sample according to a preset coefficient to obtain the final perturbed speech sample;

[0067] The training module is used to input the final perturbation speech sample into the integrated speaker recognition model. The repetition processing module and the overlay module continue until the input perturbation speech sample successfully attacks the integrated speaker recognition model. The perturbation speech sample that successfully attacks the model is used as an adversarial sample.

[0068] In one possible implementation, the device further includes:

[0069] The attack module is used to input the obtained adversarial sample into the target voiceprint recognition system to complete the attack.

[0070] In one possible implementation, the processing module also includes:

[0071] The first extraction submodule is used in the first stage to calculate the cross-entropy loss based on the output of the integrated voiceprint recognition model to obtain the sum of the gradients of the integrated model, multiply the sum of the gradients by the weight coefficient δ and then perform a Fourier transform to extract the frequency domain information of the first stage.

[0072] The first elimination submodule is used to eliminate the perturbations in the unperturbed frequency range [win1,win2] in the first stage frequency domain information and then perform an inverse Fourier transform to obtain the intermediate adversarial samples of the first stage.

[0073] The first iteration submodule is used to iteratively repeat the first extraction submodule and the first elimination submodule to form intermediate speech samples;

[0074] The processing submodule is used to input intermediate speech samples into the integrated voiceprint recognition system and save the output of the integrated voiceprint recognition system.

[0075] The second extraction submodule is used to calculate the cross-entropy loss based on the output of the processing submodule, obtain the sum of the gradients of the ensemble model and the gradient of the average squared loss of the adversarial sample perturbation, add the two gradients by the weight constant λ, multiply them by δ, and then perform a Fourier transform to extract the frequency domain information of the second stage.

[0076] The second elimination submodule is used to eliminate the perturbations in the unperturbed frequency range [win1,win2] in the second stage frequency domain information to obtain the intermediate adversarial samples of the second stage.

[0077] The second iteration submodule is used to iteratively repeat the processing submodule, the second extraction submodule, and the second elimination submodule to obtain perturbed speech samples.

[0078] The description of the above-mentioned apparatus has been elaborated in detail in the description of the above-mentioned method, and will not be repeated here.

[0079] Figure 2 This is a block diagram illustrating an anti-attack device for a black-box transferable voiceprint recognition system based on frequency domain perturbation, as shown in an embodiment of this disclosure. For example, device 1900 can be provided as a server. See also... Figure 2 The apparatus 1900 includes a processing component 1922, which further includes one or more processors, and memory resources represented by memory 1932 for storing instructions, such as application programs, that can be executed by the processing component 1922. The application programs stored in memory 1932 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 1922 is configured to execute instructions to perform the methods described above.

[0080] Device 1900 may also include a power supply component 1926 configured to perform power management of device 1900, a wired or wireless network interface 1950 configured to connect device 1900 to a network, and an input / output (I / O) interface 1958. Device 1900 can operate on an operating system stored in memory 1932, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™, or similar.

[0081] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions that can be executed by a processing component 1922 of the device 1900 to perform the above-described method.

[0082] This disclosure can be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of this disclosure.

[0083] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example—but not limited to—electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0084] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0085] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0086] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0087] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0088] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0089] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0090] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for countering attacks on a black-box transferable voiceprint recognition system based on frequency domain perturbation, characterized in that, The method includes: Step 1: Integrate the collected voiceprint recognition models with different architectures to obtain an integrated voiceprint recognition model; Step 2: Input the speech sample into the integrated speaker recognition model, obtain and save the output of the integrated speaker recognition model; determine the gradient information of the adversarial sample based on the output using a loss function; use the gradient information as the generated adversarial perturbation and perform short-time Fourier transform to extract frequency domain information; eliminate the frequency range that is sensitive to the human ear in the frequency domain information to obtain the processed frequency domain information; perform inverse short-time Fourier transform on the processed frequency domain information to generate perturbed speech samples; Step 3: Add the disturbed speech sample to the speech sample according to the preset coefficient to obtain the final disturbed speech sample; Step 4: Input the final perturbation speech sample into the integrated speaker recognition model, and repeat steps 2 and 3 until the input perturbation speech sample successfully attacks the integrated speaker recognition model. The perturbation speech sample that successfully attacks the model is used as an adversarial sample.

2. The method according to claim 1, characterized in that, The method further includes: Step 5: Input the obtained adversarial sample into the target voiceprint recognition system to complete the attack.

3. The method according to claim 1, characterized in that, Step 2 also includes: Step 21: In the first stage, the cross-entropy loss is calculated based on the output of the integrated voiceprint recognition model to obtain the sum of the gradients of the integrated model. The sum of the gradients is multiplied by the weight coefficient δ and then Fourier transform is performed to extract the frequency domain information of the first stage. Step 22: After removing the perturbations in the unperturbed frequency range [win1, win2] in the first stage frequency domain information, perform an inverse Fourier transform to obtain the intermediate adversarial samples of the first stage. Step 23: Iterate and repeat steps 21 to 22 to form intermediate speech samples; Step 24: Input the intermediate speech sample into the integrated voiceprint recognition system and save the output of the integrated voiceprint recognition system; Step 25: Calculate the cross-entropy loss based on the output of Step 24 to obtain the sum of the gradients of the ensemble model and the gradient of the average squared loss due to adversarial sample perturbation. Add the two gradients together with the weight constant λ, multiply them by δ, and then perform a Fourier transform to extract the frequency domain information of the second stage. Step 26: Remove the perturbations in the unperturbed frequency range [win1, win2] from the second-stage frequency domain information to obtain the intermediate adversarial samples for the second stage. Step 27: Iterate and repeat steps 24 to 26 to obtain perturbed speech samples.

4. A black-box transferable voiceprint recognition system anti-attack device based on frequency domain perturbation, characterized in that, The device includes: The integration module is used to integrate the collected voiceprint recognition models with different architectures to obtain an integrated voiceprint recognition model; The processing module is used to input speech samples into the integrated speaker recognition model, acquire and save the output of the integrated speaker recognition model; determine the gradient information of the adversarial sample based on the output using a loss function; use the gradient information as the generated adversarial perturbation and perform short-time Fourier transform to extract frequency domain information; eliminate the frequency range that is sensitive to the human ear in the frequency domain information to obtain the processed frequency domain information; and perform inverse short-time Fourier transform on the processed frequency domain information to generate perturbed speech samples. The overlay module is used to add the perturbed speech sample to the speech sample according to a preset coefficient to obtain the final perturbed speech sample; The training module is used to input the final perturbation speech sample into the integrated speaker recognition model. The repetition processing module and the overlay module continue until the input perturbation speech sample successfully attacks the integrated speaker recognition model. The perturbation speech sample that successfully attacks the model is used as an adversarial sample.

5. The apparatus according to claim 4, characterized in that, The device further includes: The attack module is used to input the obtained adversarial sample into the target voiceprint recognition system to complete the attack.

6. The apparatus according to claim 4, characterized in that, The processing module also includes: The first extraction submodule is used in the first stage to calculate the cross-entropy loss based on the output of the integrated voiceprint recognition model to obtain the sum of the gradients of the integrated model, multiply the sum of the gradients by the weight coefficient δ and then perform a Fourier transform to extract the frequency domain information of the first stage. The first elimination submodule is used to eliminate the perturbations in the unperturbed frequency range [win1, win2] in the first stage frequency domain information and then perform an inverse Fourier transform to obtain the intermediate adversarial samples of the first stage. The first iteration submodule is used to iteratively repeat the first extraction submodule and the first elimination submodule to form intermediate speech samples; The processing submodule is used to input intermediate speech samples into the integrated voiceprint recognition system and save the output of the integrated voiceprint recognition system. The second extraction submodule is used to calculate the cross-entropy loss based on the output of the processing submodule, obtain the sum of the gradients of the ensemble model and the gradient of the average squared loss of the adversarial sample perturbation, add the two gradients by the weight constant λ, multiply them by δ, and then perform a Fourier transform to extract the frequency domain information of the second stage. The second elimination submodule is used to eliminate the perturbations in the unperturbed frequency range [win1, win2] in the second stage frequency domain information to obtain the intermediate adversarial samples of the second stage. The second iteration submodule is used to iteratively repeat the processing submodule, the second extraction submodule, and the second elimination submodule to obtain perturbed speech samples.

7. A black-box transferable voiceprint recognition system anti-attack device based on frequency domain perturbation, characterized in that, The device includes: processor; Memory used to store processor-executable instructions; The processor is configured to perform the method according to any one of claims 1 to 3.

8. A non-volatile computer-readable storage medium storing computer program instructions thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 3.

Images