# GANBA: Generative Adversarial Network for
## 5 Results
### Black-box Attacks Results  
Figures 5 and 6 show the EER\({}_{\text{joint}}\) of the state-of-the-art TDNN + PLDA / LCNN biometric system for the black-box scenario when it is attacked with three different student biometric systems in the PA and LA scenarios, respectively. As shown in Figure 2, the ASV system of the attacker is a TDNN + b-vector system. On the other hand, each student biometric system uses a different PAD system: ResNet34, SENet50, and LCNN. Moreover, three types of adversarial _spoofing_ attacks are employed by each student biometric system: FGSM (\(\epsilon=1.0\)), PGD (\(\epsilon=1.0\)) and the proposed GANBA attack. Figure 4: EER\({}_{\text{joint}}\)(%) of the white-box adversarial _spoofing_ attacks evaluated on the ASVspoof 2019 logical and physical access test datasets. The ASV and PAD systems are the state-of-the-art TDNN + PLDA and LCNN systems, respectively. \begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \multicolumn{2}{c}{**Biometric Systems**} & \multicolumn{4}{c}{**Logical Access Attacks**} & \multicolumn{4}{c}{**Physical Access Attacks**} \\ \hline
**PAD** & **ASV** & **EEE\({}_{PAD}\) (\%)** & **EEE\({}_{ASV}\) (\%)** & **EEE\({}_{joint}\) (\%)** & **min-IDCF** & **EEE\({}_{PAD}\) (\%)** & **EEE\({}_{RSV}\) (\%)** & **EEE\({}_{joint}\) (\%)** & **min-IDCF** \\ \hline LCNN & TRNN + PLDA & 5.85 & 4.7/30.88\({}^{*}\) & 19.87 & 0.1237 & 4.62 & 6.87/18.43\({}^{*}\) & 13.12 & 0.1221 \\ LCNN & TRNN + b-vector & 5.85 & 4.89/30.77\({}^{*}\) & 20.12 & 0.1256 & 4.62 & 7.13/19.21\({}^{*}\) & 13.89 & 0.1274 \\ SEM50 & TRNN + PLDA & 6.29 & 4.7/30.85\({}^{*}\) & 21.15 & 0.1307 & 5.17 & 6.87/18.43\({}^{*}\) & 14.48 & 0.1328 \\ SEM50 & TRNN + b-vector & 6.29 & 4.89/30.77\({}^{*}\) & 21.74 & 0.1332 & 5.17 & 7.13/19.21\({}^{*}\) & 14.81 & 0.1356 \\ ResNet34 & TRNN + PLDA & 6.75 & 4.71/30.58\({}^{*}\) & 22.68 & 0.1412 & 5.62 & 6.87/18.43\({}^{*}\) & 15.75 & 0.1415 \\ ResNet34 & TRNN + b-vector & 6.75 & 4.89/30.77\({}^{*}\) & 23.09 & 0.1456 & 5.62 & 7.13/19.21\({}^{*}\) & 15.97 & 0.1439 \\ \hline \end{tabular}
\end{table} 
Table 1: Results of different complete voice biometric systems evaluated on the ASVspoof 2019 logical access (L/A) and physical access (PA) test datasets in terms of \(\text{EER}_{PAD}(\%)\), \(\text{EER}_{RSV}(\%)\), \(\text{EER}_{joint}(\%)\) and min-IDCF (\(\%\)) The \(\text{EER}_{RSV}\) metric is evaluated considering both _bonfide_ and _spoying_ utterances. The proposed GANBA attack outperforms the best FGSM and PGD configurations (\(\epsilon=1.0\)) by 27.67% and 27.08% in the LA scenario when using the LCNN PAD system. In the PA scenario, the proposed GANBA attack also outperforms them by 17.09% and 16.32% with the LCNN PAD system, respectively. It is worth noticing that the LCNN PAD system is always better than the ResNet34 and SENet50 since this system has the same architecture as the PAD system of the target (teacher) system. However, the SENet50 PAD system achieves only 3.44% and 3.09% of slower absolute EERjoint when using the proposed GANBA attack compared to the LCNN PAD architecture, being able to effectively attack the teacher system achieving an EERjoint of 50.12% and 40.12% in the LA and PA scenarios, respectively. This result shows how vulnerable a black-box complete voice biometric system can be to adversarial _spoofing_ attacks. Figure 7 shows some examples of the spectrogram of _bonafide_ speech, _spoofing_ speech generated with a replay attack of the physical access ASVspoof 2019 database, adversarial _spoofing_ speech refined by the PGD method, and that refined by the proposed GANBA technique. As can be seen, it is difficult to visually differentiate between the original _spoofing_ spectrogram and the generated adversarial spectrogram with the proposed method. However, our technique is able to correct some of the _spoofing_ artifacts so that the replay attack is introduced in the spectrogram so that the PAD system misclassifies the generated adversarial _spoofing_ utterance as a bonafide utterance.