# Defending against FakeBob Adversarial Attacks in Speaker Verification Systems with Noise-Adding +
## 3 Background  
### Speaker Verification Systems  
Speaker verification (SV) systems have been widely used to identify a person through their voice. In our work, we focus on score-based SV systems, which most state-of-the-artSV systems belong to. A score-based SV system contains two phases: speaker enrollment and speaker recognition, as shown in Figure 1.  
In the speaker enrollment phase, a speaker needs to provide an identifier and their audio clips. The SV system transfers the speaker's voice into a fixed length low dimensional vector called _speaker embedding_. Basically, the speaker embedding represents the features of a speaker's voice and is used to calculate the level of similarity between two audio clips. Different SV systems use different approaches to obtain speaker embedding. The state-of-the-art SV systems include i-vector [14], GMM [13], d-vector [29], and x-vector [30]. In this work, we focus on GMM and i-vector, since they have been widely used in real life and applied by many as the baseline for comparisons. Here, we use the notation \(SE_{R}\) to refer to the vector of speaker embedding of the registered speaker \(R\).  
Besides obtaining the speaker embedding, the SV system attempts to find a proper threshold for this speaker during the enrollment phase. Such a threshold is a key consideration for a score-based SV system. To understand the importance of the threshold, we first look at the recognition phrase. As shown in Figure 1, when a test audio clip is provided to the SV system, it abstracts the speaker embedding of this audio, which is referred by \(SE_{T}\). Then, the SV system calculates a similarity score between vector \(SE_{R}\) and vector \(SE_{T}\). A higher score reflects more similarity between two vectors of speaker embedding. Finally, the similarity score is compared with the threshold. If the score is higher than or equal to the threshold, the system will accept the test audio clip and treat the speaker as the registered user. Otherwise, the system will reject the access of the speaker.  
There are two basic false cases for an SV system: (1) accepting an illegal speaker, i.e., a speaker who is not the registered user, and (2) rejecting the registered speaker. For these two cases, we define two measures to evaluate the performance of an SV system, i.e., the false acceptance rate (FAR) and the false rejection rate (FRR), as follows:  
\[\text{FAR}=\frac{\text{number of falsely accepted illegal speaker audios}}{\text{total number of all illegal speaker audios}} \tag{1}\]  
\[\text{FRR}=\frac{\text{number of falsely rejected registered speaker audios}}{\text{total number of all registered speaker audios}} \tag{2}\]  
For an ideal SV system, both FAR and FRR are 0. However, in a real SV system, there is a tradeoff between FAR and FRR, which makes it hard to keep both of them at 0. In general, when one decreases, the other will increase. Intuitively, when the threshold increases, it becomes more difficult for an audio clip to be accepted. As a result, FAR will decrease, while FRR will increase. A common practice is to choose a proper threshold that generates the same value for FAR and FRR. Such a value is called the equal error rate (EER) [31].  
To find the EER and the corresponding threshold, both registered speaker audio clips and illegal speaker audio clips need to be provided during the enrollment phase. An SV system calculates the similarity scores for all provided audio clips and then finds the threshold that can lead to the EER.  
Figure 1: A score-based speaker verification system.