# IG-Based Method for Voiceprint Universal Adversarial Perturbation Generation
## 6 Experimental Analysis
### Untargeted Attack
Figure 4a illustrates the original audio sample spectrogram, and Figure 4b portrays the spectrogram of the audio sample after adding the generality adversarial perturbation. This section bases its comparison experiments on the chosen 1 DCNN Gamma target model and UrbanSound8K dataset, analyzing five approach methods in the no target attack context. These five methods include IG-UAP, FGSM-UAP, PGD-UAP, C&W-UAP, and MSCW-UAP, which are proposed in this chapter. The batch processing method utilizes the mean value, while some hyperparameters are prioritized during high performance. Table 5 presents the specific experimental hyperparameters, and the experimental results can be seen in Table 6. \begin{table}
\begin{tabular}{c c c c c} \hline \hline  & \multicolumn{4}{c}{**Datesets**} \\ \cline{2-5}
**Target Model** & \multicolumn{2}{c}{**Training Sets**} & \multicolumn{2}{c}{**Testing Sets**} \\ \cline{2-5}  & **ASR/\%** & **ASR/\%** & **SNR/dB** & \(I_{dB}\) \\ \hline
1 DCNN Rand & 89.2 & 86.5 & 20.168 & \(-12.984\) \\
1 DCNN Gamma & 89.4 & 84.2 & 20.431 & \(-18.451\) \\ ENVnet-V2 & 89.1 & 82.9 & 18.425 & \(-11.320\) \\ SincNet & 90.1 & 90.4 & 29.886 & \(-26.214\) \\ SincNet+VGG19 & 88.3 & 85.2 & 23.346 & \(-17.952\) \\ \hline \hline \end{tabular}
\end{table} 
Table 4: The success rate of IG-UAP on multiple target models. Figure 3: Experimental results of 1 DCNN Gamma model at different confidence levels. (**a**) Effect of confidence value on ASR; (**b**) effect of confidence value on SNR; (**c**) effect of confidence value on \(l_{d}B\). Figure 2: Experimental results of ENVnet-V2 model at different confidence levels. (**a**) Effect of confidence value on ASR; (**b**) effect of confidence value on SNR; (**c**) effect of confidence value on \(l_{d}B\). After comparing the experiments, it has been observed that the method exhibiting the highest attack success rate is IG-UAP, achieving an ASR of 85.6%. Despite having the second-fastest average generation time, it exhibits the lowest average signal-to-noise ratio value, measuring at 20.551 dB. The fastest generation method is FGSM-UAP, clocking in with an average generation time of 0.55 s, which is notably higher than the other generation methods. The PGD-UAP method has the highest average SNR value of 39.05 dB, which is significantly higher than other generation methods. The IG-UAP method proposed in this chapter has the highest ASR and the best attack effect, while also having a longer average generation time compared to the PGD-UAP and C&W-UAP methods. However, the IG-UAP method has a higher production efficiency for the antagonistic samples. By combining all of the indicators, it can be concluded that the IG-UAP method is the most effective. Combined with the above findings, IG-UAP exhibits the most exceptional overall performance in creating acoustic generalizations against perturbations, compared to the other four methods, within the context of untargeted attacks. In addressing the issue of varying sample sizes in different datasets, it may occur that some datasets have few samples available. To mitigate this, the IG-UAP algorithm \begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Attack Methods**} & \multicolumn{3}{c}{**Evaluation Indicators**} \\ \cline{2-4}  & **ASR/\%** & **Average SNR/dB** & **Average Spawn Time/s** \\ \hline IG-UAP & **85.6** & 20.551 & 20.168 \\ FGSM-UAP & 64.78 & 22.42 & **0.55** \\ PGD-UAP & 47.6 & **39.05** & 4.22 \\ C\&W-UAP & 21.39 & 90.4 & 4.7 \\ MSCW-UAP & 30.12 & 24.89 & 14.66 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Comparative experimental results of untargeted attack. Figure 4: Effectiveness of five voiceprint classification models in the context of untargeted attacks. (**a**) Original spectrogram of the audio sample; (**b**) adversarial spectrogram of the audio sample.