# Adversarial Attack and Defense on Deep Neural Network-Based Voice Processing Systems: An Overview
## 3 Attack Threat Model Taxonomy  
In this section, depending on the adversary's background, prior knowledge, etc., we introduce the existing attack models in VPSes and classify them, and we hope to build an overall attack framework for comparison in future research. In addition, we also list some existing attack methods in Table 1 for intuitive understanding.  
\begin{table}
\begin{tabular}{l l l l l l l l l} \hline \hline
**Work** & **Year** & **Box** & **Target** & **Platform** & **Corpus** & **System** & **Real/Simulated** & **Feature** \\ \hline
[63] & 2017 & Black/White & Both & DeepSpeech2 & Librspeech & ASR & Simulated & STFT \\
[28] & 2018 & White & Targeted & DeepSpeech & MCVD [64] & ASR & Simulated & Waveform \\
[19] & 2018 & White & non-target & Kaldi & Random choice & ASR & Both & Waveform \\
[45] & 2018 & White & Targeted & ASV & YOHO [65] & ASV & Simulated & MFCC \\
[32] & 2018 & White & Targeted & DeepSpeech & Music clips & ASR & Real & waveform \\
[13] & 2018 & Black & non-target & CNNs [66] & Speech commands & ASR & Simulated & Waveform \\
[29] & 2018 & White & Targeted & [PERSON] & WS & ASR & Simulated & STFT \\
[45] & 2018 & White & non-target & SVs [9] & YOHO [65] & ASV & Simulated & MFCC/Mel-Spectrum \\
[14] & 2019 & Black & targeted & DeepSpeech & MCVD & ASR & Simulated & Waveform \\
[15] & 2019 & Grey & non-target & Kaldi & TTSREADER & ASR & Simulated & Waveform \\
[67] & 2019 & Grey & Both & Alexa [68] & 1 [69] & YAs & Both & Waveform \\
[30] & 2019 & White & Targeted & Lingy [36] & Librispeech [70] & ASR & Simulated & Waveform \\
[37] & 2019 & White & non-target & DeepSpeech & Librispeech & ASR & Simulated & Waveform \\
[54] & 2019 & Black & Targeted & Talentsechoft [71] & Voxceleb [70;72] & SBS & Real & Waveform \\
[46] & 2019 & White & non-target & SVs [73] & NTIMIT [74] & ASV & Simulated & feature \\
[75] & 2019 & White & Targeted & VGGV [72] & Voxceleb & SBS & Simulated & Spectrogram \\
[76] & 2020 & White & non-target & CTC-based [66] & MCVD & ASR & Simulated & MFCC \\
[52] & 2020 & Grey & non-target & VGs [66] & Speech commands [77] & VCs & Simulated & Waveform \\
[33] & 2020 & Black & Targeted & Alex, Google, Cortana & CommandSong [19] & ASR & Real & Spectrum \\
[48] & 2020 & White & Targeted & DNNs [40] & Aishel-1 [78] & SBS & Simulated & Waveform \\
[49] & 2020 & Both & non-target & SVs [79] & Voxceleb1 & ASV & Simulated & MFCC \\
[53] & 2020 & White & Both & Kaldi & CSTR VCTK [80] & SBS & Both & MFCC \\
[52] & 2020 & White & non-target & DNNs [40] & CSTR VCTK & SRS & Simulated & MFCC \\
[51] & 2020 & Gray & Targeted & SincNet [80] & NTIMIT/Librispeech & SBS & Simulated & Waveform \\
[53] & 2021 & White & Both & DNNs [40] & Voxceleb & SBS & Simulated & Waveform \\
[54] & 2021 & Black & Targeted & CNNs & Speech Command [66] & VCs & Simulated & MFCC \\ \hline \hline \end{tabular}
\end{table}
Table 1: The taxonomy of attack in speaker and speech recognition. ‘Box’ indicates the prior knowledge which the attacker master, which can be categorized by a white box, a gray box and a black box. ‘Platform’ is the certain attacked system. ‘System’ means the targeted system, especially the voice control system (VCs); ‘Real/Simulated’ shows whether the attack is in the real physical world.