# GANBA: Generative Adversarial Network for
## 3 Proposed Method
### Black-Box GANBA  
Figure 3 depicts the proposed GANBA architecture for the black-box scenario. Similar to the white-box case, the goal of the proposed system is the generation of adversarial _spoofing_ attacks capable of fooling the target PAD system (teacher PAD) and bypassing the target ASV system (teacher ASV) by not modifying the x-vector representation which encodes the speaker information of the utterance. However, the main limitation of the black-box scenario is that the attacker does not have access to the target system (teacher) parameters.  
In the proposed GANBA framework, the attacker makes requests to the black-box target (teacher) biometric system but only obtains a binary decision response of acceptance/rejection. The binary response is considered to be the ground-truth label for training  
Figure 3: Generative adversarial network for biometric anti-spoofing (GANBA) framework for black-box scenarios. Step 1: generator-only training (ASV and PAD parameters frozen, with encircled outputs corresponding to Equations (11) and (12), respectively). Step 2: discriminator (ASV + PAD) training (encircled outputs corresponding to classical cross-entropy loss function).  
the student PAD and b-vector [28] systems of the GANBA discriminator. It is worth noticing that we assume that a rejection of the teacher system is made by the teacher PAD system since we make sure that the x-vector representation of the utterance is minimally perturbed by the adversarial _spoofing_ attack. Thus, the student b-vector and PAD systems are trained as binary classifiers able to imitate the behavior of the teacher ASV and PAD systems, respectively. In particular, the student b-vector system computes the probability that the two input x-vectors represent the same speaker, i.e., that \(P(b(\mathbf{x}_{\text{vector}},\mathbf{\tilde{x}}_{\text{vector}})=1)\), with \(b\) denoting the b-vector model.  
As shown in Figure 3, there are again two different steps for training the whole architecture. Step 1 denotes again the training of the GANBA generator, where the ASV and PAD network parameters are not modified but the gradients are back-propagated to the GANBA generator. Thus, Step 1 is in charge of optimizing the parameters of the GANBA generator in the black-box (b-box) case by minimizing the following loss function:  
\[L_{\text{GANBA\_b-box}}=L_{\text{PAD\_GANBA\_b-box}}(\mathbf{s}_{ \text{PAD}}^{\text{spoof}}) \tag{10}\] \[+\beta\cdot L_{\text{ASV\_GANBA\_b-box}}(\mathbf{x}_{\text{vector}}^ {\text{spoof}},\mathbf{\tilde{x}}_{\text{vector}}^{\text{spoof}}),\]  
where  
\[L_{\text{ASV\_GANBA\_b-box}}(\mathbf{x}_{\text{vector}}^{\text{spoof}},\mathbf{x}_{ \text{vector}}^{\text{spoof}})=1-P(b(\mathbf{x}_{\text{vector}}^{\text{spoof}},\mathbf{ x}_{\text{vector}}^{\text{spoof}})=1), \tag{11}\]  
\[L_{\text{PAD\_GANBA\_b-box}}(\mathbf{s}_{\text{PAD}}^{\text{spoof}})=\left\| \text{onehot}(k=0)-\mathbf{s}_{\text{PAD}}^{\text{spoof}}\right\|_{2}. \tag{12}\]  
\(L_{\text{ASV\_GANBA\_b-box}}\) and \(L_{\text{PAD\_GANBA\_b-box}}\) are the loss components associated with the ASV and PAD systems, respectively. Furthermore, onehot is the one-hot function [42] and \(k=0\) is the _bonafide_ class index. Using this function, the input _spoofing_ utterance is presented as _bonafide_ and the PAD is fooled.  
On the other hand, Step 2 denotes the training of the student biometric system (ASV b-vector + PAD) which acts as the discriminator of the GAN. The TDNN employed for x-vector extraction is pretrained and its parameters are also frozen in this step. However, the b-vector system is trained as a binary classifier [28] employing the test and enrollment utterances from the _bonafide_ speech dataset. Likewise, the PAD system is also trained as a binary classifier using both _bonafide_ and _spoofing_ utterances. In both cases, the ground truth labels are taken from the binary responses of the black-box target/teacher biometric system. Similar to the white-box scenario, Step 1 and Step 2 follow each other in order to train the proposed GANBA as a typical GAN.