# Defending against FakeBob Adversarial Attacks in Speaker Verification Systems with Noise-Adding +
## 3 Background
### Adversarial Attacks against Speaker Verification Systems
Specifically, it applies the following gradient decent function  
\[f_{\bar{g}}(y)=\bigtriangledown_{y}L(y). \tag{7}\]  
Note that here the gradient decent is different from the back-propagation that is widely used in deep learning, and the differentiation is based on input audios, instead of the weights of the machine learning model. Define a sign function \(f_{sign}(y)\) in the following way: For each element (i.e., \(y_{i}\)) in the vector \(y\), a sign function gets the sign of the value of each element in the vector, _i.e._,  
\[f_{sign}(y_{i})=\left\{ \begin{array}{ll}1,&\text{if }y_{i}>0\\ 0,&\text{if }y_{i}=0\\ -1,&\text{if }y_{i}<0\end{array} \right. \tag{8}\]  
Moreover, assume \(x_{i}\) (\(1\leq i\leq n\)) is a signal in the original clean audio (i.e., \(x\)) from an illegal speaker, \(x_{i}^{k}\) (\(1\leq i\leq n\)) is the corresponding signal in the adversarial audio at k-th iteration (i.e., \(x^{k}\)), and \(\epsilon\) is the perturbation threshold shown in Equation (4). Based on the assumption in Equation (4), a clip function is defined as follows  
\[f_{c}(x_{i}^{k})=\left\{ \begin{array}{ll}x_{i}^{k},&\text{if }|x_{i}^{k}-x_{i}|< \epsilon\\ x_{i}+\epsilon,&\text{if }x_{i}^{k}\geq x_{i}+\epsilon\\ x_{i}-\epsilon,&\text{if }x_{i}^{k}\leq x_{i}-\epsilon\end{array} \right. \tag{9}\]  
Using the above functions, FakeBob updates the input audio through the following iteration  
\[x^{k}=f_{c}\Big{(}x^{k-1}-lr\times f_{sign}(f_{g}(x^{k-1}))\Big{)} \tag{10}\]  
where \(lr\) is the learning rate. The FakeBob attack is summarized in Algorithm 1. To better understand the FakeBob attack, we look into an example of an adversarial audio in both the time domain and the Mel spectrogram. Specifically, applying the FakeBob with the perturbation threshold of 0.002, we obtained an adversarial audio that is falsely accepted by the GMM SV system. Figure 3 shows the time waveform of the adversarial audio and the perturbations (i.e., \(p\) in Equation (3)) in both the time domain and the Mel spectrogram. It can be observed from Figure 3b that the perturbations used in the FakeBob attack are very small, i.e., \(-0.002\leq p_{i}\leq 0.002\). Moreover, the perturbations are similar to white noise, i.e., the perturbations are everywhere with the similar color in the Mel spectrogram, as shown in Figure 3c. On the other hand, from FakeBob attacks shown in Algorithm 1, it can be observed that these perturbations are not random, but are intentionally designed to fool the SV system. Figure 2: The process of FakeBob adversarial attacks. ```
1:Input: an audio signal array, threshold of the SV system
2:Output: an adversarial audio
3:Require: threshold of targeted SV system \(\theta\), audio signal array \(A\), maximum iteration \(m\), score function \(S\), gradient decent function \(f_{g}\), clip function \(f_{c}\), learning rate \(lr\), and sign function \(f_{sign}\)
4:
5:\(\mathit{adver}\gets A\)
6:for\(i=0;\ i<m;\ i++\)do
7:\(\mathit{score}\gets S(\mathit{adver})\)
8:if\(\mathit{score}\geq\theta\)then
9:return\(\mathit{adver}\)
10:endif
11:\(\mathit{adver}\gets f_{c}(\mathit{adver}-lr\times f_{sign}(f_{g}( \mathit{adver})))\)
12:endfor
```  
**Algorithm 1** FakeBob Attacks