# IG-Based Method for Voiceprint Universal Adversarial Perturbation Generation
## 6 Experimental Analysis
### Summary of the Experiment  
In this chapter, evaluation metrics comprise the attack success rate, average signal-to-noise ratio, and loudness of the adversarial samples. Comparative experiments are conducted using the IG-UAP method to analyze five different acoustic pattern classification models under untargeted-attack and targeted-attack scenarios. In the untargeted attack, the five voiceprint classification models achieve an average attack success rate of 85.8%, with the lowest and highest values being 82.9% and 90.4%, respectively. The average signal-to-noise ratio is 22.451 dB, ranging from 18.425 dB to 29.886 dB, while the average  
\begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Attack Methods**} & \multicolumn{3}{c}{**Evaluation Indicators**} \\ \cline{2-4}  & **ASR/\%** & **Average SNR/dB** & **Average Spawn Time/s** \\ \hline IG-UAP & 86.7 & 28.145 & 2.96 \\ \hline PGD-UAP & 40.2 & 27.835 & 4.22 \\ \hline MSCW-UAP & 84.5 & 21.271 & 11.24 \\ \hline \hline \end{tabular}
\end{table}
Table 10: The success rate of IG-UAP on multiple target models.  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**Attack Methods**} & \multicolumn{6}{c}{**Parameter Type**} \\ \hline - & \(\mathbf{\alpha}\) & \(\mathbf{\varepsilon}\) & **Learning Rate** & **Epoch** & **Batch Size** & **Confidence \(\kappa\)** & **Expected Spoofing Rate \(\delta\)** & **Penalty Factor \(\mathbf{c}\)** \\ \hline IG-UAP & - & - & 0.0002 & 100 & 32 & 20 & 0.1 & 0.15 \\ \hline C\&W-UAP & 0.1 & - & 0.0001 & 100 & 32 & - & - & - \\ \hline MSCW-UAP & 1.5 & - & 0.001 & 100 & 32 & - & - & - \\ \hline \hline \end{tabular}
\end{table}
Table 9: Hyperparameters of experiments.  
loudness is \(-17.384\), with the lowest and highest values being \(-26.214\) and \(-11.320\). For jackhammer as the targeted attack category, the average success rate of the five acoustic classification models was 84.9%, with a minimum rate of 81.2% and a maximum of 90.9%. The average signal-to-noise ratio was 24.985 dB, with a range of 21.146 dB to 30.241 dB, and the average loudness was 19.858, with a minimum of \(-30.126\) and a maximum of \(-13.997\). Among the evaluation indices, the Generic Sound Generated Against Perturbation can be attacked effectively, and it exhibits consistent performance with minimal data variation.  
In this paper, the evaluation indexes include the attack success rate, average signal-to-noise ratio, and average generation time of the adversarial samples. Using the IG-UAP method, we compare and analyze experimentally five similar acoustic UAP generation methods in both untargeted-attack and targeted-attack scenarios. Additionally, technical abbreviations are explained upon first use. In an untargeted attack, the IG-UAP achieves an 85.6% success rate, significantly surpassing the results of the four other generation methods. Its average generation time is 2.47 s, with only a 2 s difference from the fastest FGSM-UAP method. Additionally, the IG-UAP produces an average SNR of 20.551 dB, making it a highly effective tool for auditory masking. In the given targeted attack aimed at the dog_dark category, the IG-UAP method exhibits optimal evaluation indices. The attack success rate reaches 86.7%, and the average SNR is 28.145 dB. Additionally, the average generation time stands at 2.96 s. Conclusively, the IG-UAP method provides better acoustic generalization when dealing with perturbations as compared to other similar generation methods.