# GANBA: Generative Adversarial Network for
## 5 Results
### Defenses against Adversarial Spoofing Attacks  
Table 2 shows the performance metrics of the state-of-the-art TDNN + PLDA / LCNN biometric system when it applies two separate defense techniques: (i) adversarial training of the PAD discriminator using the generated adversarial _spoofing_ attacks, and (ii) using the PAD discriminator trained within the proposed GANBA framework. Both defense techniques employ the black-box adversarial attacks generated with the SENet50 PAD system employed in Section 5.3 as discriminator. Thus, we can evaluate a realistic scenario where the target PAD system (LCNN) does not match the same architecture as that of the attacker PAD system (SENet50). Figure 5: EERjoint(%) of the black-box adversarial _spoofing_ attacks evaluated on the ASVspoof 2019 logical access (LA) test dataset with the state-of-the-art TDNN + PLDA / LCNN biometric system. There are three attackers (student systems) which use the ResNet34, SENet50 and LCNN as PAD system, respectively. The ASV system of the attacker is a TDNN + b-vector system. Every student system generates three types of attacks: FGSM (\(\epsilon=1.0\)), PGD (\(\epsilon=1.0\)) and the proposed GANBA attack. Figure 6: \(\text{ER}_{\text{point}}(\%)\) of the black-box adversarial _spoofing_ attacks evaluated on the ASVspoof 2019 physical access (PA) test dataset with the state-of-the-art TDNN + PLDA/LCNN biometric system. There are three attackers (student systems) which use the ResNet34, SENet50 and LCNN as PAD system, respectively. The ASV system of the attacker is a TDNN + b-vector system. Every student system generates three types of attacks: FGSM \((\epsilon=1.0)\), PGD \((\epsilon=1.0)\) and the proposed GANBA attack. Figure 7: Spectrograms of the same utterance corresponding to: (**left upper**) bonafide speech, (**right upper**) spoofing speech generated with a replay attack, (**left bottom**) adversarial spoofing speech generated with the black-box PGD \((\epsilon=1.0)\) method, (**right bottom**) adversarial spoofing speech generated with the proposed black-box GANBA method. applying a different attack-defense combination: (i) the attack technique is one of the three types of adversarial _spoofing_ attacks (FGSM, PGD or GANBA) evaluated in this work; and (ii) the defense technique consists of applying adversarial training using the generated adversarial _spoofing_ attacks of one of the three black-box methods (FGSM, PGD or GANBA) evaluated in Section 5.3 and generated with the system which employs the SENet50 PAD discriminator. On the other hand, the three last rows of Table 2 shows the performance metrics of the biometric system when it is attacked by one type of adversarial _spoofing_ attack (FGSM, PGD or GANBA) and, at the same time, it is defended using the PAD discriminator trained with the proposed GANBA framework described in Section 3.2. As shown in Table 2, the adversarial training defense technique, which uses the generated GANBA attacks, significantly outperforms the adversarial training defense technique, which uses either FGSM or PGD attacks, by more than 2% of absolute EERjoint in both the PA and LA scenarios. However, the proposed GANBA adversarial _spoofing_ attacks are not effectively detected when using adversarial training with either the FGSM or PGD attacks, since the EERjoint is more than 34% in both the PA and LA scenarios. This result highlights the effectiveness of the proposed GANBA attacks. It is also very noticeable that adversarial training with the generated GANBA attacks is able to slightly improve the results of the baseline complete biometric system which is not exposed to any adversarial _spoofing_ attacks. This can be due to the effect of data augmentation on the generated GANBA attacks which helps to detect even more original _spoofing_ attacks of the ASVspoof 2019 evaluation dataset. Nevertheless, the best defense technique is that of using the PAD discriminator trained with the proposed GANBA framework which outperforms the adversarial training defense technique in all cases.