# IG-Based Method for Voiceprint Universal Adversarial Perturbation Generation
## 4 IG-UAP Methodology  
In the iterative greedy approach, the primary aim is to minimize the objective function of a batch of samples from the dataset to calculate the generalizability against perturbations. An iterative greedy-based algorithmic process is designed to generate an adversarial perturbation algorithm for acoustic generalization. The symbols used in the algorithm are described in detail, followed by an explanation and analysis of the specific role of each step. The following section elaborates on the iterative optimization process, including the solution steps and schemes of the optimization problem. Additionally, a new objective function is designed to implement an iterative greedy-based adversarial perturbation generation method for acoustic generality. Relevant experimental analyses are carried out under target-attack and targetless-attack scenarios. This is because the objective function fundamentally characterizes the performance against such perturbations. In the context of perceiving noise in a sound pattern classifier, the degree of noise perception may be measured using a reliable metric, such as the sound pressure level (SPL), as demonstrated in Equation (1). Consequently, the SPL is implemented instead of the \(\mathbf{L_{p}}\) paradigm for constraints. This metric is utilized as one of the objective functions in the optimization problem of this paper. The goal is to lessen the SPL of the perturbation, which is measured in decibels (dB). The problem of creating perturbations in a target attack can be reformulated as the following constrained optimization problem. \[SPL(v)=20 logP(v) \tag{1}\]  
\[P(v)=\sqrt{\frac{1}{N}\sum_{n=1}^{N}v_{n}^{2}} \tag{2}\]  
The optimization problem presented in the equations can be solved with a gradient-based algorithm. As a result, a new parameter w must be introduced, which is defined in the equation. Audio example \(x_{i}\) must be transformed into the tan space, and then, the perturbation data can be converted into the effective range of [0, 1] using Equation (3). This ensures that the constraint of [0, 1] is met. \begin{table}
\begin{tabular}{c c} \hline \hline
**Symbolic** & **Meaning** \\ \hline X & Original audio samples \\ t & The predicted label of the target that the attacker wants the target model to output \\ \(y_{l}\) & A category in untargeted attacks \\ \(L(\cdot)\) & Objective function \\ \(G(\cdot)\) & Updated gradient \\ \(\delta\) & Expectation of deception rate \\ \(v^{\prime}\) & The generalization of this dataset against perturbations \\ c & Penalty constant factor \\ K & Confidence level for controlling sample misclassification \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Notation of attack description. \[w_{i}=\frac{1}{2}\big{(}\tan\big{(}x_{i}^{\prime}+v^{\prime}\big{)}+1\big{)} \tag{3}\]  
\[x_{i}^{\prime}=\tan^{-1}((2x_{i}-1)\times(1-\varepsilon)) \tag{4}\]  
\[v^{\prime}=\tan^{-1}((2v-1)\times(1-\varepsilon)) \tag{5}\]  
where \(\varepsilon\) is a small constant determined by the polarity of the transformed signal to prevent \(x_{0}^{\prime}\) and \(v_{0}^{\prime}\) from taking infinite values. The formula mentioned above is simplified to an optimization problem to obtain the best possible solution. Additionally, in the event of a target attack, the formula is presented in (6). \[w_{i_{min}}= \begin{cases}L(w_{i},t)=SPL\bigg{(}\frac{1}{2}\ln\bigg{(}\frac{w_{ i}}{1-w_{i}}\bigg{)}-{x_{i}}^{\prime}\bigg{)}+cG(w_{i},t)\\ G(w_{i},t)=max\{max\{f(w_{i})_{j}\}-f(w_{i})_{t},-\kappa\}\end{cases}  \tag{6}\]  
where the target category is represented by \(t\), the output of the presoftmax layer (logit) of the neural network for category \(j\) is represented by \(f(w_{i})_{j}\), a positive constant known as the \"penalty coefficient\" is represented by \(c\), and the confidence level that controls the misclassification of samples is represented by \(\kappa\). This formula enables the attacker to manage the confidence level of the attack. For untargeted attacks, we modify Equation (6) according to Equation (7). \[w_{i_{min}}=