ADVERSARIAL ATTACKS ON GMM i-vector BASED SPEAKER VERIFICATION SYSTEMS
Table 1: EER (%) of the target systems under black box attack with different perturbation degrees (ϵ).
['[EMPTY]', '[ITALIC] ϵ=0', '[ITALIC] ϵ=0.3', '[ITALIC] ϵ=1', '[ITALIC] ϵ=5', '[ITALIC] ϵ=10', '[ITALIC] ϵ=20', '[ITALIC] ϵ=30', '[ITALIC] ϵ=50']
The FAR fluctuations under these attack settings are illustrated in Fig. It is observed that the FAR is dramatically increased in all three attack settings. Specifically, FAR increases the most by around 60%, 50% and 30% in cross-feature, cross-model architecture and cross-feature-model settings, respectively. The most effective attack appears in the cross-feature setting, while the least effective attack appears in the cross-feature-model setting. This suggests that black box attack effectiveness can be affected by the gap between source and target system settings. The FAR degradation confirms that both GMM i-vector and x-vector systems are vulnerable to black box attacks. Specifically, the adversarial samples crafted from i-vector systems are transferable to x-vector systems. The phenomenon that x-vector systems are vulnerable to black box attacks also indicates their vulnerability to a more severe attack, i.e. white box attacks.