This is an accepted version of a paper published in 2017 IEEE International Conference on
Acoustics, Speech and Signal Processing (ICASSP).
If you wish to cite this paper, please use the following reference:
T. Ohki and A. Otsuka, "Theoretical vulnerabilities in map speaker adaptation," 2017 IEEE
International Conference on Acoustics, Speech and Signal Processing (ICASSP), New Orleans, LA,
2017, pp. 2042-2046.
doi: 10.1109/ICASSP.2017.7952515© 2017 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained
for all other uses, in any current or future media, including reprinting/ republishing this material foradvertising or promotional purposes, creating new collective works, for resale or redistribution toservers or lists, or reuse of any copyrighted component of this work in other works.

THEORETICAL VULNERABILITIES IN MAP SPEAKER ADAPTATION
Tetsushi OHKI, Akira OTSUKA
National Institute of Advanced Industrial Science and Technology (AIST)
2-3-26 Aomi, Koto-ku, Tokyo, JAPANABSTRACTWe analyze the theoretical vulnerability of maximum a posteriori(MAP) speaker adaptation, which is widely used in practical speaker recognition systems. First, we proved that there
exist a set of feature vectors, what are called wolves, which
can impersonate almost all the registered speakers with probability asymptotically close to 1 with at most two trials. Second, our experiment shows that the wolves with appropriate
parameters achieved 0.99 of successful impersonation rate on
Spear speaker recognition toolkit with ATR speech database.
Index Terms— biometrics, speaker recognition, wolf attack, impersonation, MAP adaptation
1. INTRODUCTION
Security of biometric authentication systems is conventionally measured by the false acceptance rate (FAR), which
gives the average error rate, or equivalently successful impersonation rate when imposters present their biometric information. However, it is also possible that imposters present
more prospective biometric information taking advantage ofthe environmental conditions and matching algorithms. Une
et al. [1] and Inuma et al. [2] proposed the wolf attack andits success probability (WAP), which is a new measure thattakes such attacks into account. A wolf is the worst biometric
information that can impersonate any registered users with aprobability much higher than FAR.
The subject of this paper is to investigate the vulnerabilityof practical automatic speaker verification(ASV) systems,
specifically, maximum a posteriori (MAP) adaptation based
ASV systems, which derive the speaker model by updating the well-trained parameters in the Universal Background
Model (UBM) via adaptation. There are many previous
works involving spoofing through voice synthesis [3, 4, 5]
and voice conversion [6, 7, 8, 9, 10]. All of these works havenot evaluated the wolf attack. The main contributions of thiswork are as follows:
1. We proved the existence of an asymptotically universal
wolf which can impersonate all registered speakers in
MAP adaptation based ASV algorithms with the usual
linear scoring techniques.

2. Our wolf attack can achieve 99% of successful impersonation rate (WAP) at most two trials even when
speaker model has a large number of Gaussian components. This is experimentally examined using open
source speaker recognition toolkit Spear1 [11] alongwith ATR multi-speech database [12].
2. PREVIOUS WORKS
The name, wolf, came from the well-known Doddington
Zoo [13], which refers to a biometric information whichtends to impersonate others. The wolf attack probability is
the maximum false acceptance rate when a single live or fakebiometric information is presented [2, 1]. In other words,
the wolf attack probability (WAP) gives the upper-boundof successful impersonation probability for any subversive
presentation without stealing the victim’s biometric feature.
Une et al. [1] showed WAP=1.0 for a finger vein authentication algorithm [14]. Ohki et al. [15] experimentally showed
WAP=0.92 for vector quantization-based ASV systems when
up to 3 trials are allowed for failed attempts. Other previous
results show the vulnerabilities in more general classifiers.
Kryszczuk and Drygajlo [16] reported that likelihood-ratiobased face classifiers are easily spoofed by the face images towhich white Gaussian noise is superimposed. The noise contaminated face images give feature vectors with extremely
small likelihood values to a claimed user model and theworld model (UBM) simultaneously. They reported [16]“above 50% of noise almost every claim is accepted.” Ohkiand Otsuka [17] investigated more general vulnerability in thelikelihood-baed classifiers where the likelihood values are notnecessarily small. They focused on the approximation error
between UBM and true distribution of over the feature space.
Their experiments showed WAP=0.6 for the GMM-UBM
ASV system [18].
In the context of speaker verification, Reynolds [19]showed that maximum a posteriori (MAP) adaptation based
Gaussian mixture modeling provides high-accuracy speakerverification even under the situation where a few samples
are available to create each speaker model. MAP adaptation
derives each speaker model from UBM. Thus, it inherently
1 http://pypi.python.org/pypi/bob.spear

provides homogeneous models among the individual speakermodels and UBM. In the following section, we investigate thetheoretical vulnerability in the MAP adaptation-based ASV
systems [19].

3.1. Map Adaptation
Given a UBM as M -mixture of D-dimensional Gaussian distribution over feature space X s.t.
M!

wi pi (x)

(1)

i=1

where wi are the mixture weights sum to unity, pi (·) are theGaussian probability functions given below with µi and Σibeing the mean and the covariance matrix respectively.
Let U be a set of speakers. A training vector from the hypothesized speaker u ∈ U is denoted by X u = {xu1 , . . . , xuT }.
A speaker model p"(x|u) is adapted from the UBM as follows.
For mixture i in the UBM, we compute
wi pi (xut )Pr(i | xut ) = #M.
u
j=1 wj pj (xt )3.2. Likelihood Ratio

Likelihood-ratio-based decision is the following two-classhypothesis test. According to Neyman-Pearson lemma [20],this is known as the most powerful.

3. VULNERABILITY IN MAP ADAPTATION

p(x) =

where p"i (x | u) = N (x | µui , Σui ).

Lu (x) =p(x | u)p(x)(7)

where we assume p(x | u) ≈ p(x) with u = U \ {u} for a
sufficiently large speaker set U .
In the MAP adaptation, each speaker model is adaptedfrom the UBM learning the training vector X u . Thus, thereal decision is made by the following equation using Eq. (6),$u (x) = p"(x | u) .
L
p(x)

(8)

3.3. Wolf in Linear Scoring(2)

We define a wolf as a biometric feature which gives higher
acceptance rate, say δ ≥ FAR, than the normal features.

Using this Pr(i | xut ) and xut , we compute the weight, mean
and variance parameters for the expectation step.

Definition 1. (δ-wolf) Given a probability distributions p(x)representing UBM and p(x | u) representing speaker models
for all u ∈ U , and given a threshold t > 0, for any δ ≥ FAR,a feature vector x is said to be δ-wolf if it satisfies

ni

=

T
!
t=1

Ei (x) =⊤Ei (xx ) =Pr(i | xut )

(3)

T

1 !
Pr(i | xut )xut
ni t=1T
1 !
Pr(i | xut )xut xut ⊤ni t=1(4)(5)

where Ei (·) computes the expectation weighted by Pr(i | xut ).
In the adaptation step, we update the old UBM statistics tocreate adapted parameters with the following equations.
$iu
w
$ui
µ
$u
Σ
i

= [αiw ni /T + (1 − αiw )wi ]γ==

αim Ei (x) + (1 − αim )µi⊤

Reynolds et al. [19] introduced the adaptation coefficients{αiw , αim , αiv } which control the balance between old andnew estimates. The scale factor γ is introduced to ensure themixture weights sum to unity. αiv = 0 is called linear scoring$u = Σi .
where covariance matrices are invariant such that Σi
It is widely used for its significant reduction in computation.
With the MAP adapted parameters for the individual model$iu , µ$ui , σ$iu ), the model for the speaker u is given as
(w
M
!
i=1

$iu p"i (x|u),
w

(6)

(9)

where probability is taken over u ∈ U .

Lemma 1. Given a feature vector v ∈ X with ∥v∥ = 1 and a$uspeaker u ∈ U , compute the maximum standard deviation σ
and σ projected on the feature vector v as follows.
$u
σ

−2

σ −2

$u $u
αiv Ei (xx⊤ ) + (1 − αiv )(Σi + µi µ⊤i ) − µ iµ ip"(x|u) =$u (x) > t] ≥ δ
ARt (x) = Pr[L==$umin v ⊤ Σ
i

−1

1≤i≤M

v

min v ⊤ Σ−1
i v

1≤i≤M

(10)
(11)

$u > σ is satisfied, then for any threshold t > 0, there
If σexists λ0 > 0 such that for any λ > λ0 ,$u (λv) > t.
L(12)$u , which leads toProof. (Sketch) We take the log of L$u (λv) ≈ −λ
log L
2

2

%

1

1
2 − σ2$uσ&+ o(1).

(13)$u > σ.
This is a convex function of λ under the condition σHence the lemma.

Lemma 1 holds for the general MAP adaptation. It implies that injecting sufficiently large vectors in a speaker voicesample will make impersonation successful regardless of thethreshold. This result cannot directly apply to the linear scor$u = σ for all u ∈ U . Interestingly, however,ing case where σsimilar analysis can lead to 0.5-wolf as stated below.
Theorem 1. In the case of linear scoring in MAP adaptation,
there exists λt > 0 for all threshold t ∈ R such that exactly
half of the feature vectors in a set {x ∈ X | ∥x∥ ≥ λt } are
0.5-wolf. Namely,$u (x) > t] ≥ 0.5
Pr[L

(14)

$u (x) > t] + Pr[L$u (−x) > t] = 1
Pr[L

(15)

where the probability is taken over u ∈ U . More precisely,
every vector x ∈ {y ∈ X | ∥y∥ ≥ λt } satisfies the following.
$u = Σi for all u ∈ U in linear
Proof. From the definition, Σiu$scoring. Apparently, σ = σ holds for all u ∈ U from Eq.(10)and Eq.(11). Given v, let i give the minimum in Eq. (11). For
brevity, we write$uσ −2 = σ−2= v ⊤ Σ−1
i v.

(16)

$u (λv) can be written as follows.
Let x = λv with λ > 0. log L$u (λv)
log L

≈

=
=

$ui )⊤ Σ−1$u−(λv − µi (λv − µi )2−(λv − µi )⊤ Σ−1i (λv − µi )−+ o(1)
2$uiµi + µ$ui − µi )⊤ Σ−1−(µ) + o(1)i (λv −
2$ui − µi )⊤ Σ−1
−λ(µ
(17)
i v + o(1)This is a linear function of λ. Set λt as1''' log t + o(1) '''λt > max '',u )⊤ Σ−1 v '$u∈U '(µ − µ
i
i
i

(18)

Then, for all x ∈ {y ∈ X | ∥y∥ ≥ λt }, each u′ ∈ U satisfies((Lu′ (x) > t or Lu′ (−x) > t. Thus, a vector x divides U into−
′ ((Ux+ = {u′ | Lu′ (x) > t} and Ux = {u | Lu′ (−x) > t}.

It is easily proved that U = Ux+ ∪ Ux− and Ux+ ∩ Ux− = ∅.
Thus,$u (x) > t] =Pr[L| Ux+ |,|U |$u (−x) > t] =Pr[L| Ux− |
(19)
|U |where the probability is taken over u ∈ U . Eq. (19) directly
implies Eq. (15). Further, we see the complementary relation−+in Ux+ = U−x
and Ux− = U−x. This implies that exactly halfof the set satisfies Eq. (14). Hence the theorem.
1 We assume (µu ⊤ −1!
i − µi ) Σi v ̸= 0 for all u ∈ U for brevity of proof.
u for all u. Choosing orthogonal v is negiligible.
!
From performance, µi ̸= µi

4. EXPERIMENT
4.1. Wolf Attack
While the discussion on the theoretical vulnerability of an
ASV system, we assume the ideal ASV system where all
acoustic equipment and environment have ideal characteristics so that an attacker can control a feature vector received
by the system completely as intended. Namely, the attacker
can input an arbitrary biometric feature to a matching algorithm.
From Theorem 1, a feature vector x ∈ X with sufficiently
larger norm than λt is a 0.5-wolf . One can create such a wolffeature by sampling a feature vector x from a training set, say
X, and scale it by a fixed large constant C. Our wolf feature
vector VW ∈ X is simply constructed as follows:
VW = Cxfor every sampled x ∈ X(20)

We define two types of attack samples as a sequence of feature vectors of length F . The first type is called “full-frame
wolf,” which is comprised of VW in every occurrence of afeature vector. The second type is called “single-frame wolf,”
which is comprised of the real feature vectors but exactly oneof the occurrences is replaced with VW . In our experiment,
we selected the feature vector x randomly from UBM mean
vectors. Our experiment shows that C ≤ 1000 achieved sufficiently high WAP at all settings. Furthermore, we examined
the impact of double trials using both positive VW and negative −VW wolf features as described in 3.3. This is only
applicable if the targeted ASV system allows multiple trials.
4.2. Experimental Setup
We evaluated the proposed wolf attack using the speech
data included in the ATR multi-speaker database [12]. The
database is a collection of short time 16kHz sampled utterances of 294 male speakers and 410 female speakers. For
each speaker there are 50 utterances of approximately 4 seconds. We used 200 male and 200 female to keep the ratioof male to female speaker to the same for overall evaluation.
We conduct our wolf attack experiments on Spear, an open
source toolbox for speaker recognition. Spear implements a
set of complete speaker recognition toolchain including MAP
adaptation based GMM-UBM algorithm. Spear filters out thenon-speech part using VAD algorithm [21] and calculates 60
coefficients MFCC for each frame.
The evaluation was conducted using 200 speakers as the
UBM training set and 100 speakers as the development set
and remaining 100 speakers as the evaluation set. For the development and the evaluation set, we separated each speaker’s
50 utterances to 15 utterances for speaker model training and
35 utterances for score calculation. UBM model order MU
was varied in the range 64, 128, 256, and 512 components.
Since the speaker model is derived by updating the well-Table 1: List of EER, WAP, WAP (threshold t was fixed totEER ). second trial shows a WAP at most two trials.
UBM / Speaker Model Order
64

128

256

512

Baseline Performance
EER

0.014
trial

(a) full-frame attack (C = 100, F = 400)

Fig. 1: Wolf attack probability in proposed wolf attack. DET
curve of wolf attacks drawn by FRR and WAP were labelled
as “FRR-WAP”. DET curve of baseline system drawn by FRR
and FAR was labeled as “FRR-FAR”.
trained parameters in the UBM via adaptation, speaker modelorder is always equivalent to the UBM model order.
We evaluated two types of wolf attack described in 4.1.
For the full-frame attack, we set the frame length F to 400
frames. Constant factor C is set to 100 for full-frame attackand 1000 for single-frame attack, respectively.

0.009

0.008

full-frame attack

WAP

first
second

0.52
0.99

0.51
0.98

0.48
0.99

0.51
0.99

WAP

first
second

0.52
0.99

0.50
0.99

0.51
0.99

0.51
0.98

trial

(b) single-frame attack (C = 1000)

0.012

single-frame attack

WAP

first
second

0.28
0.46

0.39
0.54

0.34
0.69

0.31
0.53

WAP

first
second

0.28
0.47

0.38
0.57

0.37
0.69

0.29
0.49

Error Rate (EER) for the baseline performance. Table 1 indicates EER, WAP and WAP when threshold t was set to tEER .
WAP is calculated using the development set. In Table 1, we
also show the WAP in case the targeted system allows at most
two trials. In this experiment, imposter uses VW and −VW
for the two trials.
As shown in Table 1, the full-frame attack can achieve almost 50% of WAP regardless of the number of Gaussian components. Moreover, it achieved 99% of WAP when targeted
system allows at most two trials. These results confirms theexistence of 0.5-wolf proved in the Theorem 1. Additionally,
we can see that single-frame attack achieved 28% to 39% in
the first trial and 46% to 69% of WAP in the second trial. This
fact means that an attacker can impersonate to the targeted
system with quite high probability using the voice which contains only single frame (10ms) of wolf sample.
5. CONCLUSION

4.3. Experimental Results
Fig.1(a), (b) shows the wolf attack probability calculated in
our proposed wolf attack along with baseline performance. In
this evaluation, DET curve was drawn between the FRR and
WAP instead of FAR. Note that DET curve indicates better
performance when it is closer to the lower-left corner of thegraph. In other words, wolf attack is more efficient when it
is closer to the upper-right corner of the graph. As shownin both figures, we can see that the proposed wolf achieved
clearly high impersonation performance.
Let t = tEER be the threshold that can achieve Equal

In this study, we investigated theoretical vulnerabilities in
MAP adaptation based speaker recognition system. Our remarkable result is that the proposed wolf attack achieved 99%
of successful impersonation with at most two trials on Spear
toolkit and ATR speech database even when the speakermodel has a large number of Gaussian components. Since weassumed the ideal attacker in this study, it is left to investigate
how to apply our wolf attack to microphone or transmission
level spoofing attacks such as voice conversion attacks. Possible countermeasures may include that UBM takes larger
variance than individual speaker models in MAP adaptation.

6. REFERENCES[1] M. Une and A. Otsuka, “Wolf attack probability: a new
security measure in biometric authentication systems,”
Lee, S.-W., Li, S.Z.(eds.) ICB 2007, LNCS, vol. 4642,
pp. 396–406, 2007.
[2] M. Inuma and H. Otsuka, A. Imai, “Theoretical framework for constructing matching algorithms in biometricauthentication systems,” in Proc. Third IAPR/IEEE International Conference on Biometrics (ICB 2009). Sept.
2009, vol. LNCS 5558, pp. 293–300, Springer-Verlag.
[3] Takashi Masuko Keiichi, Keiichi Tokuda, and Takao
Kobayashi, “Imposture using synthetic speech against
speaker verification based on spectrum and pitch,” inProc. the International Conference on Spoken Language
Processing, 2000, pp. 302–305.

[11] E. Khoury, L. El Shafey, and S. Marcel, “Spear: An
open source toolbox for speaker recognition based on
Bob,” in IEEE Intl. Conf. on Acoustics, Speech and Signal Processing (ICASSP), 2014.
[12] “ATR Promotions Inc. multi speaker database: SDB,”
http://www.atr-p.com/sdb.html.
[13] G. Doddington, W. Liggett, A. Martin, M. Przybocki,
and D. Reynolds, “Sheeps, Goats, Lambs and Wolves:
A Statistical Analysis of Speaker Performance in the
NIST 1998 Speaker Recognition Evaluation,” in Proc.
ICSLD 98, Nov. 1998.
[14] N. Miura, A. Nagasaka, and T. Miyatake, “Extraction ofFinger-Vein Patterns Using Maximum Curvature Points
in Image Profiles,” in Proc. the 9th IAPR Conference on
Machine Vision Applications, May 2005, pp. 347–350.

[4] P. L. De Leon, M. Pucher, and J. Yamagishi, “Revisiting the security of speaker verification systems against
imposture using synthetic speech,” in Proc. 2010 IEEE
International Conference on Acoustics Speech and Signal Processing (ICASSP), 2010.

[15] T. Ohki, S. Hidano, and T. Takehisa, “Evaluation ofwolf attack for classified target on speaker verification
systems.,” in Proc. International Conference on Control, Automation, Robotics and Vision (ICARCV), 2012,
pp. 182–187.

[5] P. L. De Leon, M. Pucher, J. Yamagishi, I. Hernaez, and
I. Saratxaga, “Evaluation of speaker verification security
and detection of hmm-based synthetic speech,” IEEE
Trans. Audio, Speech and Language Processing, vol. 20,
no. 8, pp. 2280–2290, Oct 2012.

[16] Krzysztof Kryszczuk and Andrzej Drygajlo, “Addressing the vulnerabilities of likelihood-ratio-based face verification,” in Proc. Audio- and Video-Based Biometric
Person Authentication (AVBPA), 2005, pp. 426–435.

[6] P. Z. Patrick, G. Aversano, R. Blouet, M. Charbit, and
G. Chollet, “Voice forgery using alisp: Indexation ina client memory,” in Proc. 2005 IEEE International
Conference on Acoustics Speech and Signal Processing(ICASSP), March 2005, vol. 1, pp. 17–20.
[7] D. Matrouf, J. F. Bonastre, and C. Fredouille, “Effectof speech transformation on impostor acceptance,” inProc. 2006 IEEE International Conference on Acoustics Speech and Signal Processing (ICASSP), May 2006,
vol. 1.
[8] T. Kinnunen, Z. Z. Wu, K. A. Lee, F. Sedlak, E. S. Chng,and H. Li, “Vulnerability of speaker verification systems
against voice conversion spoofing attacks: The case of
telephone speech,” March 2012.
[9] F. Alegre, A. Amehraye, and N. Evans, “A one-classclassification approach to generalised speaker verification spoofing countermeasures using local binary patterns,” in Proc. 2013 IEEE Sixth International Conference on Biometrics: Theory, Applications and Systems(BTAS), Sept 2013, pp. 1–8.
[10] Z. Wu, A. Larcher, K. A. Lee, E. Chng, T. Kinnunen,and H. Li, “Vulnerability evaluation of speaker verification under voice conversion spoofing: the effect of text
constraints.,” in Proc. Interspeech, 2013.

[17] T. Ohki and A. Otsuka, “Theoretical vulnerability inlikelihood-ratio-based biometric verification,” in Proc.
2014 IEEE International Joint Conference on Biometrics (IJCB), Sept 2014, pp. 1–8.
[18] Douglas A Reynolds, “Speaker identification and verification using Gaussian mixture speaker models,” Speechcommunication, vol. 17, no. 1, pp. 91–108, 1995.
[19] Douglas A Reynolds, Thomas F Quatieri, and Robert B
Dunn, “Speaker Verification Using Adapted Gaussian
Mixture Models,” Digital Signal Processing, vol. 10,
no. 1-3, pp. 19–41, Jan 2000.
[20] Jerzy. Neyman and E. Pearson, “On the Problem of the
Most Efficient Tests of Statistical Hypotheses,” Philosophical Trans. the Royal Society of London. Series A,
Containing Papers of a Mathematical or Physical Character, vol. 231, pp. 289–337, 1933.
[21] T. Kinnunen and P. Rajan, “A practical, self-adaptive
voice activity detector for speaker verification withnoisy telephone and microphone data,” in Proc. 2013
IEEE International Conference on Acoustics, Speechand Signal Processing (ICASSP), May 2013, pp. 7229–
7233.