# AdvEst: Adversarial Perturbation Estimation to Classify and Detect Adversarial Attacks against Speaker Identification

arXiv: https://arxiv.org/abs/2204.03848 · HTML: https://mlsanity.com/paper/2204.03848/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 Apr 2022.

## Built on by (most cited first, 4 of 4)

- [The defender's perspective on automatic speaker verification: An overview](https://mlsanity.com/paper/2305.12804/) (2023)
- [LMD: A Learnable Mask Network to Detect Adversarial Examples for Speaker Verification](https://mlsanity.com/paper/2211.00825/) (2022)
- [Scores Know Bobs Voice: Speaker Impersonation Attack](https://mlsanity.com/paper/2603.02781/) (2026)
- [Unraveling Adversarial Examples against Speaker Identification -- Techniques for Attack Detection and Victim Model Classification](https://mlsanity.com/paper/2402.19355/) (2024)

## Abstract (arXiv)

Adversarial attacks pose a severe security threat to the state-of-the-art speaker identification systems, thereby making it vital to propose countermeasures against them. Building on our previous work that used representation learning to classify and detect adversarial attacks, we propose an improvement to it using AdvEst, a method to estimate adversarial perturbation. First, we prove our claim that training the representation learning network using adversarial perturbations as opposed to adversarial examples (consisting of the combination of clean signal and adversarial perturbation) is beneficial because it eliminates nuisance information. At inference time, we use a time-domain denoiser to estimate the adversarial perturbations from adversarial examples. Using our improved representation learning approach to obtain attack embeddings (signatures), we evaluate their performance for three applications: known attack classification, attack verification, and unknown attack detection. We show that common attacks in the literature (Fast Gradient Sign Method (FGSM), Projected Gradient Descent (PGD), Carlini-Wagner (CW) with different Lp threat models) can be classified with an accuracy of ~96%. We also detect unknown attacks with an equal error rate (EER) of ~9%, which is absolute improvement of ~12% from our previous work.