Adversarial Transformation of Spoofing Attacks for Voice Biometrics

Abstract

Voice biometric systems based on automatic speaker verifi- cation (ASV) are exposed to spoofing attacks which may com- promise their security. To increase the robustness against such attacks, anti-spoofing or presentation attack detection (PAD) systems have been proposed for the detection of replay, synthe- sis and voice conversion based attacks. Recently, the scientific community has shown that PAD systems are also vulnerable to adversarial attacks. However, to the best of our knowledge, no previous work have studied the robustness of full voice biomet- rics systems (ASV + PAD) to these new types of adversarial spoofing attacks. In this work, we develop a new adversarial biometrics transformation network (ABTN) which jointly pro- cesses the loss of the PAD and ASV systems in order to generate white-box and black-box adversarial spoofing attacks. The core idea of this system is to generate adversarial spoofing attacks which are able to fool the PAD system without being detected by the ASV system. The experiments were carried out on the ASVspoof 2019 corpus, including both logical access (LA) and physical access (PA) scenarios. The experimental results show that the proposed ABTN clearly outperforms some well-known adversarial techniques in both white-box and black-box attack scenarios.