# Real-time, Universal, and Robust Adversarial Attacks Against Speaker Recognition Systems

arXiv: https://arxiv.org/abs/2003.02301 · HTML: https://mlsanity.com/paper/2003.02301/

## Key facts

- Cited by 26 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 4 Mar 2020.

## Built on by (most cited first, 26 of 26)

- [A Survey On Universal Adversarial Attack](https://mlsanity.com/paper/2103.01498/) (2021)
- [Attack on practical speaker verification system using universal adversarial perturbations](https://mlsanity.com/paper/2105.09022/) (2021)
- [Adversarial defense for automatic speaker verification by cascaded self-supervised learning models](https://mlsanity.com/paper/2102.07047/) (2021)
- [Improving the Adversarial Robustness for Speaker Verification by Self-Supervised Learning](https://mlsanity.com/paper/2106.00273/) (2021)
- [Voting for the right answer: Adversarial defense for speaker verification](https://mlsanity.com/paper/2106.07868/) (2021)
- [Exploring Targeted Universal Adversarial Perturbations to End-to-end ASR Models](https://mlsanity.com/paper/2104.02757/) (2021)
- [AS2T: Arbitrary Source-To-Target Adversarial Attack on Speaker Recognition Systems](https://mlsanity.com/paper/2206.03351/) (2022)
- [Malafide: a novel adversarial convolutive noise attack against deepfake and spoofing detection systems](https://mlsanity.com/paper/2306.07655/) (2023)
- [Adversarial Examples in the Physical World: A Survey](https://mlsanity.com/paper/2311.01473/) (2023)
- [Practical Attacks on Voice Spoofing Countermeasures](https://mlsanity.com/paper/2107.14642/) (2021)
- [Who Can Withstand Chat-Audio Attacks? An Evaluation Benchmark for Large Audio-Language Models](https://mlsanity.com/paper/2411.14842/) (2024)
- [Beyond Boundaries: A Comprehensive Survey of Transferable Attacks on AI Systems](https://mlsanity.com/paper/2311.11796/) (2023)
- [Malacopula: adversarial automatic speaker verification attacks using a neural-based generalised Hammerstein model](https://mlsanity.com/paper/2408.09300/) (2024)
- [SoK: A Modularized Approach to Study the Security of Automatic Speech Recognition Systems](https://mlsanity.com/paper/2103.10651/) (2021)
- [RIBAC: Towards Robust and Imperceptible Backdoor Attack against Compact DNN](https://mlsanity.com/paper/2208.10608/) (2022)
- [CSTAR: Towards Compact and STructured Deep Neural Networks with Adversarial Robustness](https://mlsanity.com/paper/2212.01957/) (2022)
- [Interpretation of Neural Networks is Susceptible to Universal Adversarial Perturbations](https://mlsanity.com/paper/2212.03095/) (2022)
- [Push-Pull: Characterizing the Adversarial Robustness for Audio-Visual Active Speaker Detection](https://mlsanity.com/paper/2210.00753/) (2022)
- [Secure and Trustworthy Artificial Intelligence-Extended Reality (AI-XR) for Metaverses](https://mlsanity.com/paper/2210.13289/) (2022)
- [A Novel Noise Injection-based Training Scheme for Better Model Robustness](https://mlsanity.com/paper/2302.10802/) (2023)
- [Online Evasion Attacks on Recurrent Models:The Power of Hallucinating the Future](https://mlsanity.com/paper/2207.09912/) (2022)
- [Exploiting Vulnerabilities in Speech Translation Systems through Targeted Adversarial Attacks](https://mlsanity.com/paper/2503.00957/) (2025)
- [Multi-Target Backdoor Attacks Against Speaker Recognition](https://mlsanity.com/paper/2508.08559/) (2025)
- [Impact of Phonetics on Speaker Identity in Adversarial Voice Attack](https://mlsanity.com/paper/2509.15437/) (2025)
- [AudioFool: Fast, Universal and synchronization-free Cross-Domain Attack on Speech Recognition](https://mlsanity.com/paper/2309.11462/) (2023)
- [RRISE: Robust Radius Inference via a Surrogate Estimator](https://mlsanity.com/paper/2606.02876/) (2026)

## Abstract (arXiv)

As the popularity of voice user interface (VUI) exploded in recent years, speaker recognition system has emerged as an important medium of identifying a speaker in many security-required applications and services. In this paper, we propose the first real-time, universal, and robust adversarial attack against the state-of-the-art deep neural network (DNN) based speaker recognition system. Through adding an audio-agnostic universal perturbation on arbitrary enrolled speaker's voice input, the DNN-based speaker recognition system would identify the speaker as any target (i.e., adversary-desired) speaker label. In addition, we improve the robustness of our attack by modeling the sound distortions caused by the physical over-the-air propagation through estimating room impulse response (RIR). Experiment using a public dataset of 109 English speakers demonstrates the effectiveness and robustness of our proposed attack with a high attack success rate of over 90%. The attack launching time also achieves a 100X speedup over contemporary non-universal attacks.