adversarial-attack-on-GMM-i-vector-based-speaker-verification-systems

This repository provides the coding implementation of the paper: Adversarial Attacks on GMM i-vector based Speaker Verification Systems.

Adversarial Attack Configuration

Results

Adversarial audio samples & system responses

• Listen to audio samples at webpage: https://lixucuhk.github.io/adversarial-samples-attacking-ASV-systems

White box attacks

1. FAR (%) of the GMM i-vector systems under white box attack with different perturbation degrees (P).

2. EER (%) of the GMM i-vector systems under white box attack with different perturbation degrees (P).

Black box attacks

1. EER (%) of the target systems under black box attack with different perturbation degrees (P).

2. FAR (%) of the target systems under black box attack with different perturbation degrees (P).

Dependencies

1. Python and packages

   This code was tested on Python 3.7.1 with PyTorch 1.0.1. Other packages can be installed by:

   pip install -r requirements.txt

2. Kaldi-io-for-python

   kaldi-io-for-python is used for reading data of ark,scp format in kaldi via python codes. See README.md in kaldi-io-for-python for installation.

Prepare Dataset

1. Download Voxceleb1 dataset

   To replicate the paper's work, get Voxceleb1 dataset at http://www.robots.ox.ac.uk/~vgg/data/voxceleb/vox1.html. It consists of short clips of human speech, and there are in total 148,642 utterances for 1251 speakers. Consistent with Nagrani et al., 4874 utterances for 40 speakers are reserved for testing. The remaining utterances are used for training our SV models.

Train ASV models

• In our experiments, three ASV models are well trained: Mel-frequency cepstral coefficient (MFCC) based GMM i-vector system (MFCC-ivec), log power magnitude spectrum (LPMS) based GMM i-vector system (LPMS-ivec) and MFCC based x-vector system (MFCC-xvec).
• You can execute the run.sh script in the directory of i-vector-mfcc, i-vector-lpms and x-vector-mfcc to train MFCC-ivec, LPMS-ivec and MFCC-xvec, respectively. These codes were modified from Kaldi scripts. You need to go into the correponding directory, and run the run.sh. For e.g.,

  cd i-vector-mfcc
  ./run.sh

Perform Adversarial Attacks

• According to the attack configuration, two white box attacks are performed on MFCC-ivec and LPMS-ivec, respectively. Three black box attack settings are: LPMS-ivec attacks MFCC-ivec, MFCC-ivec attacks MFCC-xvec and LPMS-ivec attacks MFCC-xvec.

• To leverage Pytorch to automatically generate the adversarial gradients, we rebuild the forward process in ASV systems by Pytorch, using the models trained via Kaldi scripts. Before executing the codes, you need to copy i-vector-mfcc/copy-ivectorextractor.cc to /your_path/kaldi/src/ivectorbin/copy-ivectorextractor.cc and compile it. This code is used to convert i-vector extractor parameters into txt format.

• To generate adversarial samples from LPMS-ivec and perform the white box attack on it, run:

  cd i-vector-lpms
  ./perform_adv_attacks.sh

• To generate adversarial samples from MFCC-ivec, perform the white box attack on it and black box attack of LPMS-ivec attacks MFCC-ivec, run:

  cd i-vector-mfcc
  ./perform_adv_attacks.sh

• To perform black box attack of MFCC-ivec attacks MFCC-xvec and LPMS-ivec attacks MFCC-xvec, run:

  cd x-vector-mfcc
  ./spoofing_MFCC_xvec.sh

Citation

If the code is used in your research, please star our repo and cite our paper as follows:

@article{li2019adversarial,
  title={Adversarial attacks on GMM i-vector based speaker verification systems},
  author={Li, Xu and Zhong, Jinghua and Wu, Xixin and Yu, Jianwei and Liu, Xunying and Meng, Helen},
  journal={arXiv preprint arXiv:1911.03078},
  year={2019}
}

Contact

• Xu Li at the Chinese University of Hong Kong (xuli@se.cuhk.edu.hk, xuliustc1306@gmail.com)
• If you have any questions or suggestions, please feel free to contact Xu Li via xuli@se.cuhk.edu.hk or xuliustc1306@gmail.com.