# Adversarial Attack and Defense on Deep Neural Network-Based Voice Processing Systems: An Overview
## 1 Introduction  
With the successful application of deep neural networks in the field of speech processing, automatic speech recognition systems (ASR) and automatic speaker recognition systems (SRS) have become ubiquitous in our lives, including personal voice assistants (VAs) (e.g., Apple Siri ([[https://www.apple.com/in/siri](https://www.apple.com/in/siri)]([https://www.apple.com/in/siri](https://www.apple.com/in/siri)) (accessed on 9 September 2021)), Amazon Alexa ([[https://developer.amazon.com/en-US/alexa](https://developer.amazon.com/en-US/alexa)]([https://developer.amazon.com/en-US/alexa](https://developer.amazon.com/en-US/alexa)) (accessed on 9 September 2021)), Google Assistant ([[https://assistant.google.com/](https://assistant.google.com/)]([https://assistant.google.com/](https://assistant.google.com/)) (accessed on 9 September 2021)), iFLY-TEK ([[http://www.iflytek.com/en/index.html](http://www.iflytek.com/en/index.html)]([http://www.iflytek.com/en/index.html](http://www.iflytek.com/en/index.html)) (accessed on 9 September 2021))), voiceprint recognition systems on mobile phones, bank self-service voice systems, and forensic testing [1]. The application of these systems has brought great convenience to people's personal and public lives, and, to a certain extent, enables people to access help more efficiently and conveniently.  
Recent research, however, has shown that the neural network systems are vulnerable to adversarial attacks [2, 3, 4, 5]. This will threaten personal identity information and property security and leaves an opportunity for criminals. From the perspective of security, the privacy of the public is in danger. Therefore, for the purpose of public and personal safety, mastering the methods of attack and defense will enable us to prevent problems before their probable occurrence.  
In response to the problems mentioned above, the concept of adversarial examples [2] was born. The original adversarial examples were applied to image recognition systems [3, 4, 6, 7] and then researchers expanded the adversarial examples to include speech recognition, speaker recognition, and other systems. Compared with the problem of adversarial example classification on pictures, the voice presents the following challenges: first, when disturbance is added to audio, it can be heard by humans, but the disruption of pictures is aimed at the pixels, and is harder to discover for humans. Secondly, in a practicalsense, image classification systems are primarily used in medical imaging, etc. Still, voice recognition systems are more valuable and are closely related to everyone who has a smartphone. Wrong instructions may cause the loss of a large amount of users' property.  
With the further development of science and technology, new types of speech systems may emerge in an endless stream, but the problem that neural networks are vulnerable to attacks has not been solved. Therefore, before solving new issues, overview research on existing technologies is essential and vital. This article upholds this original intention, and the main contributions made in this paper are:  
* In order to better illustrate the application of adversarial attacks and defenses in sound processing systems, we introduce in detail the contents of adversarial attacks, including methods for generating adversarial examples and metrics for adversarial attacks. At the same time, we summarize the main methods of adversarial aggression and defense in speaker recognition and speech recognition, respectively.
* Based on the above research methods, we systematically categorize the methods of adversarial attack and defense.  
This overview is organized as follows. We first review the background information about attacks and VPSes by showing the basic concept of adversarial examples, automatic speech recognition systems, speaker recognition systems, and defense. Moreover, we introduce the threat model in detail. Accordingly, the methods of adversarial defense are categorized through their characteristics.