DiffAttack: Diffusion-based Timbre-reserved Adversarial Attack in Speaker Identification

TL;DR

This paper introduces DiffAttack, a diffusion-based adversarial attack method that generates realistic fake audio to deceive speaker identification systems while maintaining speech quality.

Contribution

It proposes a novel adversarial attack leveraging diffusion-based voice conversion with constraints, enhancing attack success without degrading speech quality.

Findings

Significantly higher attack success rate than baseline methods

Maintains speech quality despite adversarial constraints

Effective in fooling speaker identification systems on LibriTTS

Abstract

Being a form of biometric identification, the security of the speaker identification (SID) system is of utmost importance. To better understand the robustness of SID systems, we aim to perform more realistic attacks in SID, which are challenging for both humans and machines to detect. In this study, we propose DiffAttack, a novel timbre-reserved adversarial attack approach that exploits the capability of a diffusion-based voice conversion (DiffVC) model to generate adversarial fake audio with distinct target speaker attribution. By introducing adversarial constraints into the generative process of the diffusion-based voice conversion model, we craft fake samples that effectively mislead target models while preserving speaker-wise characteristics. Specifically, inspired by the use of randomly sampled Gaussian noise in conventional adversarial attacks and diffusion processes, we incorporate adversarial constraints into the reverse diffusion process. These constraints subtly guide the reverse diffusion process toward aligning with the target speaker distribution. Our experiments on the LibriTTS dataset indicate that DiffAttack significantly improves the attack success rate compared to vanilla DiffVC and other methods. Moreover, objective and subjective evaluations demonstrate that introducing adversarial constraints does not compromise the speech quality generated by the DiffVC model.