Defense for Black-box Attacks on Anti-spoofing Models
by Self-Supervised Learning

Automatic speaker verification, abbreviated as ASV, is the task to verify whether a piece of speech sample belongs to a certain speaker. Thanks to the efforts of previous researchers [1, 2, 3, 4, 5], it is now a matured technology widely applied to biometric identification. However, evidence shows that unprotected ASV models are highly vulnerable to spoofing audio deliberately generated by text-to-speech, voice conversion, and audio replay [6, 7], as some malicious attackers mimic a specific target user to deceive the ASV systems. As a result, strategies to handle the spoofing audio are in need. The ASVspoof challenge series [8, 9, 10] is a community-driven challenge to arouse attention in addressing spoofing audio attacks and their countermeasures. Spoofing countermeasure models, also known as anti-spoofing models, are shields for ASV to detect and filter spoofing audio. Recently several high performance anti-spoofing models have been proposed [11, 12, 13, 14, 15, 16, 17, 18, 19, 20].

Since Szegedy et al. [21] first proposed the concept of adversarial attacks, and illustrate how deep neural networks with impressive performance for computer vision tasks are vulnerable to adversarial attacks, a large variety of research in this domain have been done. Adversarial example, which is generated by adding imperceptible perturbation to the input sample, can result in the incorrect prediction of the models. The added perturbation is carefully crafted such that humans can not distinguish the adversarial example from the input sample visually or acoustically. Attacking the models with adversarial examples is called adversarial attack. Previous works show that deep neural networks for speech processing tasks are subject to adversarial attacks. [22] investigates the vulnerability of automatic speech recognition (ASR) models to adversarial attacks. Given any audio waveform, whether speech or music, they can generate an adversarial example, which is over 99% similar to the original audio but makes the ASR model wrongly predict any transcribes they defined before. It has also been shown that ASV systems can be fooled by adversarial examples [23, 24, 25]. Moreover, in [26, 27], the authors illustrate the anti-spoofing models for ASV systems are also vulnerable to adversarial attacks. In this paper, we focus on the defense for adversarial attacks of the anti-spoofing models.

Proactive defense and passive defense are two main categories of defense for the adversarial attacks. The former defense aims to train new models to counter the adversarial attacks. The most famous proactive defense method is adversarial training [28], which injects the adversarial examples generated by different attack algorithms into the training data. It is reasonable that the models are robust to specific attack algorithms if the models have already seen the adversarial examples during training. However, adversarial training is time-consuming and resource-consuming. What’s more, when defenders do adversarial training, they have no idea which attack algorithm the attackers will take. The mismatch between attack algorithms during training and inference will make the models susceptible to adversarial attacks they haven’t seen during training. Passive defense methods embrace the advantage of defending adversarial examples generated by all kinds of attacking methods without modifying the model. The spatial smoothing, also called as filter, is a passive defense method that counters adversarial attacks [29]. Gaussian filter, median filter and mean filter are used to defend anti-spoofing models in [26]. The above three filters are shallow filters to counter the deliberately generated adversarial perturbations.

In this paper, we propose a passive defense leveraging the power of self-supervised learning. Self-supervised learning allows the model to learn high-level and contextualized representations from a large amount of unlabeled data, without the use of any label [30]. In self-supervised learning, a pre-training task (or auxiliary task) that uses only unlabeled data is formulated, and the model is required to solve such a task. While solving the pre-training task, the model is also learning a function that maps input to high-level representations, which can potentially transfer information learned from unlabeled data to downstream tasks. Through pre-training models on speech, self-supervised learning based models are able to leverage the knowledge of unlabeled speech, then the performance of downstream speech and language processing (SLP) tasks can be improved dramatically [31, 32, 33, 34], including phone classification, speaker recognition, and speech recognition. However, the robustness of such high-level audio representations learned by self-supervised learning based models against adversarial attacks for anti-spoofing of ASV have not been studied yet.

In this work, we find that self-supervised learning models can serve as a deep filter which extracts the pivotal information from the contaminated input spectrograms to counter the adversarial attacks. To the best of our knowledge, we are among the first ones to adopt the high-level representations extracted by the self-supervised model for the defense of anti-spoofing models in the black-box scenario and the experimental results show the effectiveness of our proposed method. We also propose the layerwise noise to signal ratio (LNSR), to quantize and measure the effect of deep models in countering adversarial noise. We find that the adversarial noise is attenuated layer by layer in the self-supervised learning model.

When a tiny perturbation, which is imperceptible to humans, is deliberately crafted and added to the original example, the new example will lead to the model’s incorrect prediction. We call the new example and the tiny perturbation as adversarial example and adversarial noise respectively.

As shown in Figure 1 a), $x$ is the original example, $\delta$ is the adversarial noise and $\tilde{x}$ is the adversarial example. Given the anti-spoofing model $f(.)$, we denote the prediction of the original example and adversarial example as $f(x)$ and $f(\tilde{x})$. The adversarial example is generated as this equation:

$$\tilde{x}=x+\delta.$$

(1)

Finding an adversarial example is equivalent to crafting a suitable perturbation $\delta$ and searching for a suitable $\delta$ is an optimization problem as shown below:

$$max_{\|\delta\|_{\infty}\leq\epsilon}Diff(f(x),f(\tilde{x})),$$

(2)

where $Diff(f(x),f(\tilde{x}))$ means the difference between $f(x)$ and $f(\tilde{x})$ and it is totally differentiable, $\|\delta\|_{\infty}$ is the $L_{\infty}$ norm, $\epsilon$ is a constant we defined to constrain $\delta$. We solve the optimization problem by doing gradient descent to the input with the model parameters fixed. We want the adversarial example $x$ to be as similar as $\tilde{x}$ to make them indistinguishable by human, so the noise $\delta$ shouldn’t be too large. In this paper, $\delta$ is constrained in an $L_{\infty}$ norm ball. Different searching strategies for $\delta$ result in different attack algorithms. In this paper, we adopted the fast gradient-sign method (FGSM) [28] and the projected gradient descent method (PGD) [35].

There are two kinds of adversarial attack scenarios: black-box attack and white-box attack. In both two scenarios, there are two models: the target model and the attacking model. The target model is the model attackers aim to attack, and the attacking model is the model implemented by the attackers to generate adversarial examples. In the black-box attack scenario, the target model and the attacking model are different models, while in the white-box attack scenario, the target model is also the attacking model. In the white-box attack scenario, the attackers know everything about the target model, including model parameters, gradients, etc. Obviously it is unrealistic that the attackers have all access to the target model. In the black-box scenario, the attackers can’t obtain the inner parameters of the target model, while they can collect the inputs and the outputs of the target model by querying it. Then the attackers will train a substitute model and employ the substitute as the attacking model to generate adversarial samples with transferability. Our objective in this paper is to prevent the transferability of such adversarial examples, and improve the robustness of anti-spoofing models against black-box attacks by leveraging high-level representations extracted by self-supervised models.

In this work, we propose to use a self-supervised learning model to protect the anti-spoofing models against black-box attacks. Experimental results illustrate the representations extracted by self-supervised learning model prevent the transferability of adversarial examples and counter the black-box attacks. The proposed layerwise noise to signal ratio manifests the effectiveness of the self-supervised learning model in alleviating the adversarial noise layer by layer. For the future work, we would like to explore the capability of defense for the self-supervised model learned with different objectives and apply the proposed defense approaches on more speech processing applications.