arXiv:2502.09553cs.CRcs.LG2025-02被引 4

用合成噪音攻击语音验证系统,让其识别准确率降至14%。

SyntheticPop: Attacking Speaker Verification Systems With Synthetic VoicePops

  • 在伪造音频中嵌入合成爆破音,干扰语音验证系统的声学特征识别。
  • 在20%训练数据被污染时,攻击成功率超95%,系统准确率降至14%。
  • 针对语音验证+语音特征增强的防御机制,适合安全研究人员参考。

语音认证(VA),又称自动语音验证(ASV),广泛应用于银行等自动化系统中作为用户身份二次验证。尽管广泛应用,VA系统仍面临重放、模仿及深度伪造音频等攻击威胁。为应对风险,有研究提出语音特征增强(Voice Pop)技术,在注册阶段区分个体特有的音素发音。然而,该技术对逻辑或对抗性攻击的有效性尚未充分评估。本文提出一种新型攻击方法——SyntheticPop,通过在伪造音频中嵌入合成的“pop”噪声,显著削弱VA+VoicePop系统的性能。实验表明,在20%训练数据被污染的情况下,攻击成功率超过95%;系统在正常条件下的准确率为69%,基础标签翻转攻击下降至37%,而本方法下仅剩14%,凸显了攻击的有效性。

原文摘要 · Abstract (English)

Voice Authentication (VA), also known as Automatic Speaker Verification (ASV), is a widely adopted authentication method, particularly in automated systems like banking services, where it serves as a secondary layer of user authentication. Despite its popularity, VA systems are vulnerable to various attacks, including replay, impersonation, and the emerging threat of deepfake audio that mimics the voice of legitimate users. To mitigate these risks, several defense mechanisms have been proposed. One such solution, Voice Pops, aims to distinguish an individual's unique phoneme pronunciations during the enrollment process. While promising, the effectiveness of VA+VoicePop against a broader range of attacks, particularly logical or adversarial attacks, remains insufficiently explored. We propose a novel attack method, which we refer to as SyntheticPop, designed to target the phoneme recognition capabilities of the VA+VoicePop system. The SyntheticPop attack involves embedding synthetic "pop" noises into spoofed audio samples, significantly degrading the model's performance. We achieve an attack success rate of over 95% while poisoning 20% of the training dataset. Our experiments demonstrate that VA+VoicePop achieves 69% accuracy under normal conditions, 37% accuracy when subjected to a baseline label flipping attack, and just 14% accuracy under our proposed SyntheticPop attack, emphasizing the effectiveness of our method.

语音安全对抗攻击深度伪造

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。