# Voting for the right answer: Adversarial defense for speaker verification

arXiv: https://arxiv.org/abs/2106.07868 · HTML: https://mlsanity.com/paper/2106.07868/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- Builds on 29 of its 42 references that are in the map.
- First posted on arXiv 15 Jun 2021.

## Builds on (most cited first, 29 of 29)

- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Adversarial Machine Learning at Scale](https://mlsanity.com/paper/1611.01236/) (2016)
- [VoxCeleb2: Deep Speaker Recognition](https://mlsanity.com/paper/1806.05622/) (2018)
- [VoxCeleb: a large-scale speaker identification dataset](https://mlsanity.com/paper/1706.08612/) (2017)
- [On Adaptive Attacks to Adversarial Example Defenses](https://mlsanity.com/paper/2002.08347/) (2020)
- [Audio Adversarial Examples: Targeted Attacks on Speech-to-Text](https://mlsanity.com/paper/1801.01944/) (2018)
- [ASVspoof 2019: Future Horizons in Spoofed and Fake Audio Detection](https://mlsanity.com/paper/1904.05441/) (2019)
- [In defence of metric learning for speaker recognition](https://mlsanity.com/paper/2003.11982/) (2020)
- [Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition](https://mlsanity.com/paper/1903.10346/) (2019)
- [Attentive Statistics Pooling for Deep Speaker Embedding](https://mlsanity.com/paper/1803.10963/) (2018)
- [Adversarial Attacks Against Automatic Speech Recognition Systems via Psychoacoustic Hiding](https://mlsanity.com/paper/1808.05665/) (2018)
- [Who is Real Bob? Adversarial Attacks on Speaker Recognition Systems](https://mlsanity.com/paper/1911.01840/) (2019)
- [CommanderSong: A Systematic Approach for Practical Adversarial Voice Recognition](https://mlsanity.com/paper/1801.08535/) (2018)
- [Backdoor Attack against Speaker Verification](https://mlsanity.com/paper/2010.11607/) (2020)
- [Robust Audio Adversarial Example for a Physical Attack](https://mlsanity.com/paper/1810.11793/) (2018)
- [Fooling End-to-end Speaker Verification by Adversarial Examples](https://mlsanity.com/paper/1801.03339/) (2018)
- [Real-time, Universal, and Robust Adversarial Attacks Against Speaker Recognition Systems](https://mlsanity.com/paper/2003.02301/) (2020)
- [Adversarial Attacks on Spoofing Countermeasures of automatic speaker verification](https://mlsanity.com/paper/1910.08716/) (2019)
- [Adversarial Attacks on GMM i-vector based Speaker Verification Systems](https://mlsanity.com/paper/1911.03078/) (2019)
- [Defending Your Voice: Adversarial Attack on Voice Conversion](https://mlsanity.com/paper/2005.08781/) (2020)
- [Defense against adversarial attacks on spoofing countermeasures of ASV](https://mlsanity.com/paper/2003.03065/) (2020)
- [The Attacker's Perspective on Automatic Speaker Verification: An Overview](https://mlsanity.com/paper/2004.08849/) (2020)
- [Characterizing Speech Adversarial Examples Using Self-Attention U-Net Enhancement](https://mlsanity.com/paper/2003.13917/) (2020)
- [Adversarial defense for automatic speaker verification by cascaded self-supervised learning models](https://mlsanity.com/paper/2102.07047/) (2021)
- [Improving the Adversarial Robustness for Speaker Verification by Self-Supervised Learning](https://mlsanity.com/paper/2106.00273/) (2021)
- [Investigating Robustness of Adversarial Samples Detection for Automatic Speaker Verification](https://mlsanity.com/paper/2006.06186/) (2020)
- [Inaudible Adversarial Perturbations for Targeted Attack in Speaker Recognition](https://mlsanity.com/paper/2005.10637/) (2020)
- [Defense for Black-box Attacks on Anti-spoofing Models by Self-Supervised Learning](https://mlsanity.com/paper/2006.03214/) (2020)
- [Deep Speaker Feature Learning for Text-independent Speaker Verification](https://mlsanity.com/paper/1705.03670/) (2017)

## Built on by (most cited first, 12 of 12)

- [Towards Understanding and Mitigating Audio Adversarial Examples for Speaker Recognition](https://mlsanity.com/paper/2206.03393/) (2022)
- [Partially Fake Audio Detection by Self-attention-based Fake Span Discovery](https://mlsanity.com/paper/2202.06684/) (2022)
- [The defender's perspective on automatic speaker verification: An overview](https://mlsanity.com/paper/2305.12804/) (2023)
- [Adversarial Sample Detection for Speaker Verification by Neural Vocoders](https://mlsanity.com/paper/2107.00309/) (2021)
- [Characterizing the adversarial vulnerability of speech self-supervised learning](https://mlsanity.com/paper/2111.04330/) (2021)
- [On the Detection of Adaptive Adversarial Attacks in Speaker Verification Systems](https://mlsanity.com/paper/2202.05725/) (2022)
- [Push-Pull: Characterizing the Adversarial Robustness for Audio-Visual Active Speaker Detection](https://mlsanity.com/paper/2210.00753/) (2022)
- [Spoofing-Aware Speaker Verification by Multi-Level Fusion](https://mlsanity.com/paper/2203.15377/) (2022)
- [Adversarial Speaker Distillation for Countermeasure Model on Automatic Speaker Verification](https://mlsanity.com/paper/2203.17031/) (2022)
- [LMD: A Learnable Mask Network to Detect Adversarial Examples for Speaker Verification](https://mlsanity.com/paper/2211.00825/) (2022)
- [Tackling Spoofing-Aware Speaker Verification with Multi-Model Fusion](https://mlsanity.com/paper/2206.09131/) (2022)
- [Scalable Ensemble-based Detection Method against Adversarial Attacks for speaker verification](https://mlsanity.com/paper/2312.08622/) (2023)

## Abstract (arXiv)

Automatic speaker verification (ASV) is a well developed technology for biometric identification, and has been ubiquitous implemented in security-critic applications, such as banking and access control. However, previous works have shown that ASV is under the radar of adversarial attacks, which are very similar to their original counterparts from human's perception, yet will manipulate the ASV render wrong prediction. Due to the very late emergence of adversarial attacks for ASV, effective countermeasures against them are limited. Given that the security of ASV is of high priority, in this work, we propose the idea of "voting for the right answer" to prevent risky decisions of ASV in blind spot areas, by employing random sampling and voting. Experimental results show that our proposed method improves the robustness against both the limited-knowledge attackers by pulling the adversarial samples out of the blind spots, and the perfect-knowledge attackers by introducing randomness and increasing the attackers' budgets.