Deceiving End-to-End Speaker Verification Systems with Adversarial Examples

Research shows that end-to-end deep neural network speaker verification systems are vulnerable to adversarial example attacks; under noise that is nearly indistinguishable to the human ear, a waveform that sounds like speaker A can be accepted by the system as speaker B. The paper carries out white-box attacks on end-to-end models trained on the YOHO and NTIMIT datasets respectively, and demonstrates two black-box attacks, namely attacking a system trained on NTIMIT with adversarial examples generated from a system trained on YOHO, and attacking an MFCC-trained system with adversarial examples generated from a Mel-spectrogram-feature system. Results show that the accuracy of the attacked systems decreases and the false acceptance rate rises substantially.