Black-box Attacks on Automatic Speaker Verification using Feedback-controlled Voice Conversion

TL;DR

This paper introduces a black-box attack framework on automatic speaker verification systems that uses feedback from the system's scores to generate more deceptive voice conversion adversarial samples without requiring system knowledge.

Contribution

It presents a novel feedback-controlled voice conversion method that enhances the effectiveness of black-box spoofing attacks on ASV systems.

Findings

Feedback-controlled voice conversion increases attack success rate.

Adversarial samples are perceptually natural and maintain voice quality.

The method outperforms straightforward voice conversion in deception effectiveness.

Abstract

Automatic speaker verification (ASV) systems in practice are greatly vulnerable to spoofing attacks. The latest voice conversion technologies are able to produce perceptually natural sounding speech that mimics any target speakers. However, the perceptual closeness to a speaker's identity may not be enough to deceive an ASV system. In this work, we propose a framework that uses the output scores of an ASV system as the feedback to a voice conversion system. The attacker framework is a black-box adversary that steals one's voice identity, because it does not require any knowledge about the ASV system but the system outputs. Experimental results conducted on ASVspoof 2019 database confirm that the proposed feedback-controlled voice conversion framework produces adversarial samples that are more deceptive than the straightforward voice conversion, thereby boosting the impostor ASV scores. Further, the perceptual evaluation studies reveal that converted speech does not adversely affect the voice quality from the baseline system.