# Adversarial defense for automatic speaker verification by cascaded self-supervised learning models

arXiv: https://arxiv.org/abs/2102.07047 · HTML: https://mlsanity.com/paper/2102.07047/

## Key facts

- Cited by 16 papers in the map (data through 14 Oct 2026).
- Builds on 22 of its 32 references that are in the map.
- First posted on arXiv 14 Feb 2021.

## Builds on (most cited first, 22 of 22)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [SpecAugment: A Simple Data Augmentation Method for Automatic Speech Recognition](https://mlsanity.com/paper/1904.08779/) (2019)
- [Adversarial Machine Learning at Scale](https://mlsanity.com/paper/1611.01236/) (2016)
- [VoxCeleb2: Deep Speaker Recognition](https://mlsanity.com/paper/1806.05622/) (2018)
- [VoxCeleb: a large-scale speaker identification dataset](https://mlsanity.com/paper/1706.08612/) (2017)
- [Audio Adversarial Examples: Targeted Attacks on Speech-to-Text](https://mlsanity.com/paper/1801.01944/) (2018)
- [Mockingjay: Unsupervised Speech Representation Learning with Deep Bidirectional Transformer Encoders](https://mlsanity.com/paper/1910.12638/) (2019)
- [TERA: Self-Supervised Learning of Transformer Encoder Representation for Speech](https://mlsanity.com/paper/2007.06028/) (2020)
- [BUT System Description to VoxCeleb Speaker Recognition Challenge 2019](https://mlsanity.com/paper/1910.12592/) (2019)
- [Fooling End-to-end Speaker Verification by Adversarial Examples](https://mlsanity.com/paper/1801.03339/) (2018)
- [Margin Matters: Towards More Discriminative Deep Neural Network Embeddings for Speaker Recognition](https://mlsanity.com/paper/1906.07317/) (2019)
- [Real-time, Universal, and Robust Adversarial Attacks Against Speaker Recognition Systems](https://mlsanity.com/paper/2003.02301/) (2020)
- [Adversarial Attacks on Spoofing Countermeasures of automatic speaker verification](https://mlsanity.com/paper/1910.08716/) (2019)
- [Adversarial Attacks on GMM i-vector based Speaker Verification Systems](https://mlsanity.com/paper/1911.03078/) (2019)
- [Defense against adversarial attacks on spoofing countermeasures of ASV](https://mlsanity.com/paper/2003.03065/) (2020)
- [The Attacker's Perspective on Automatic Speaker Verification: An Overview](https://mlsanity.com/paper/2004.08849/) (2020)
- [Investigating Robustness of Adversarial Samples Detection for Automatic Speaker Verification](https://mlsanity.com/paper/2006.06186/) (2020)
- [Inaudible Adversarial Perturbations for Targeted Attack in Speaker Recognition](https://mlsanity.com/paper/2005.10637/) (2020)
- [Defense for Black-box Attacks on Anti-spoofing Models by Self-Supervised Learning](https://mlsanity.com/paper/2006.03214/) (2020)
- [Bayesian x-vector: Bayesian Neural Network based x-vector System for Speaker Verification](https://mlsanity.com/paper/2004.04014/) (2020)

## Built on by (most cited first, 16 of 16)

- [Backdoor Defense via Decoupling the Training Process](https://mlsanity.com/paper/2202.03423/) (2022)
- [Channel-wise Gated Res2Net: Towards Robust Detection of Synthetic Speech Attacks](https://mlsanity.com/paper/2107.08803/) (2021)
- [Improving the Adversarial Robustness for Speaker Verification by Self-Supervised Learning](https://mlsanity.com/paper/2106.00273/) (2021)
- [Partially Fake Audio Detection by Self-attention-based Fake Span Discovery](https://mlsanity.com/paper/2202.06684/) (2022)
- [Voting for the right answer: Adversarial defense for speaker verification](https://mlsanity.com/paper/2106.07868/) (2021)
- [Adversarial Sample Detection for Speaker Verification by Neural Vocoders](https://mlsanity.com/paper/2107.00309/) (2021)
- [Randomized Smoothing under Attack: How Good is it in Pratice?](https://mlsanity.com/paper/2204.14187/) (2022)
- [Characterizing the adversarial vulnerability of speech self-supervised learning](https://mlsanity.com/paper/2111.04330/) (2021)
- [DT-SV: A Transformer-based Time-domain Approach for Speaker Verification](https://mlsanity.com/paper/2205.13249/) (2022)
- [Push-Pull: Characterizing the Adversarial Robustness for Audio-Visual Active Speaker Detection](https://mlsanity.com/paper/2210.00753/) (2022)
- [Spoofing-Aware Speaker Verification by Multi-Level Fusion](https://mlsanity.com/paper/2203.15377/) (2022)
- [Adversarial Speaker Distillation for Countermeasure Model on Automatic Speaker Verification](https://mlsanity.com/paper/2203.17031/) (2022)
- [Tackling Spoofing-Aware Speaker Verification with Multi-Model Fusion](https://mlsanity.com/paper/2206.09131/) (2022)
- [Enhancing 3D Robotic Vision Robustness by Minimizing Adversarial Mutual Information through a Curriculum Training Approach](https://mlsanity.com/paper/2409.12379/) (2024)
- [Off-The-Shelf Image-to-Image Models Are All You Need To Defeat Image Protection Schemes](https://mlsanity.com/paper/2602.22197/) (2026)
- [Scalable Ensemble-based Detection Method against Adversarial Attacks for speaker verification](https://mlsanity.com/paper/2312.08622/) (2023)

## Abstract (arXiv)

Automatic speaker verification (ASV) is one of the core technologies in biometric identification. With the ubiquitous usage of ASV systems in safety-critical applications, more and more malicious attackers attempt to launch adversarial attacks at ASV systems. In the midst of the arms race between attack and defense in ASV, how to effectively improve the robustness of ASV against adversarial attacks remains an open question. We note that the self-supervised learning models possess the ability to mitigate superficial perturbations in the input after pretraining. Hence, with the goal of effective defense in ASV against adversarial attacks, we propose a standard and attack-agnostic method based on cascaded self-supervised learning models to purify the adversarial perturbations. Experimental results demonstrate that the proposed method achieves effective defense performance and can successfully counter adversarial attacks in scenarios where attackers may either be aware or unaware of the self-supervised learning models.