# Defending against FakeBob Adversarial Attacks in Speaker Verification Systems with Noise-Adding +
## 7 Conclusions and Future Work  
In this work, we have attempted to design and implement a defense system that is simple, light-weight, and effective against adversarial attacks in SV systems. Our designed system is based on the observations that the perturbations in an adversarial audio are very small and similar to white noise, but are not random and intentionally designed to fool SV. We have proposed to add the plugin function to preprocess an input audio so that perturbations can be removed or modified to lose their effectiveness. We have studied two opposite plugin functions, i.e., denoising and noise-adding, and found that noise-adding has much better performance against FakeBob adversarial attacks than denoising. For example, noise-adding with \(\sigma=0.002\) in a GMM SV system is able to slow down the speed of FakeBob to generate adversarial audios 25 times and reduce the targeted ASR from 100% to 5.20%. Moreover, noise-adding with \(\sigma=0.002\) only has a minor effect on normal operations of an SV system and has a slightly higher EER than that in the SV system without the defense. Therefore, we believe that this simple solution, i.e., the noise-adding plugin, should be applied to any SV system to counteract adversarial attacks such as FakeBob. To the best of our knowledge, this is the first attempt in applying the noise-adding method  
Figure 8: Performance of the noise-adding defense with different types of noise on the normal operations of GMM SV systems.  
Figure 9: Performance of the noise-adding defense with different types of noise on FakeBob adversarial audios in GMM SV systems.  
to defend against adversarial attacks in SV systems. The part of source code used in this paper can be found from GitHub [47].  
Moreover, we have studied two possible strategies that can be potentially used by adaptive FakeBob attacks against our proposed noise-adding defense. One is to bypass the plugin function, and the other is to update the objective function, when FakeBob generates adversarial audios. We have demonstrated through experiments that under these countermeasures, noise-adding with \(\sigma=0.002\) can still provide a considerable level of protection and reduce the ASR of adaptive FakeBob attacks with \(a=30\%\) from 89.40% to 49.81%.  
As our on-going work, we will extend our study to other SV systems such as d-vector [29] and x-vector [30]. Moreover, we plan to research the effect of adding other different types of noise that is not probability based, such as Rustle noise [48], on the normal operations of an SV system and against adversarial attacks. Meanwhile, how to apply other denoising algorithms, which can be more robust than the one we studied in this paper, is a direction of our future work. Furthermore, we are interested in designing a defense system that can counteract adversarial attacks, replay attacks, and voice cloning attacks. From the perspective of adversarial attacks, the perturbations in FakeBob are based on Gaussian noise [38]. Applying different types of noise to generate perturbations is an interesting research problem as well.  
Conceptualization, Z.C., L.-C.C., G.W. and Z.B.; Formal analysis, Z.C. and L.-C.C.; Funding acquisition, Z.C., G.W. and Z.B.; Investigation, Z.C. and L.-C.C.; Methodology, Z.C. and C.C.; Project administration, Z.C.; Resources, Guoping Wang; Software, Z.C. and L.-C.C.; Supervision, Z.C.; Validation, Z.C., L.-C.C., C.C., G.W. and Z.B.; Writing--original draft, Z.C. and L.-C.C.; Writing--review & editing, C.C., G.W. and Z.B. All authors have read and agreed to the published version of the manuscript. This research was funded by 2020 Purdue University Fort Wayne Graduate Research Assistantship and 2020 Purdue University Fort Wayne Collaborative Research Grant.  
Not applicable.  
The authors declare no conflict of interest.