# IG-Based Method for Voiceprint Universal Adversarial Perturbation Generation
## 1 Introduction  
In recent years, the field of artificial intelligence has seen rapid development, and hardware equipment has substantially increased in arithmetic power. Consequently, current deep learning technology finds diverse applications in fields like computer vision [1], network security, medical analysis, computer graphics, and recommender systems. Specific scenarios such as speech recognition, image recognition, credit assessment, filtering malicious emails, resisting malicious code attacks, and cyber attacks have fostered the advancement of diverse fields and industries. Since the publication of the AlexNet convolutional neural network model by [PERSON] et al. in 2012 [2], deep learning models have made significant progress in classification effectiveness, surpassing traditional classification methods. Successive neural network models, including the ResNet model [3], the VGG model [4], and the GoogleNet model [5], have further improved classification performance, making deep learning models widely used in image classification and voice print recognition.  
With the advancement of artificial intelligence, voiceprint recognition authentication has become an increasingly important aspect of our daily lives and work. Security concerns resulting from this are gaining significant attention. Signal processing and deep learning algorithm models have significantly enhanced the accuracy and reliability of voiceprint recognition in comparison to conventional speech recognition methods. However, although there are benefits, several security concerns have arisen.  
[PERSON] et al. originally proposed the concept of adversarial samples in 2014 [6]. They discovered that neural network models can make classification errors due to adversarial perturbations. Furthermore, these neural network models, which have excellent classification performance, can also experience incorrect classification predictions when under attack from malicious adversarial samples. [PERSON] et al. introduced the concept of generic adversarial perturbation which can be used to deceive neural network models [7]. They developed a Greedy-based attack algorithm to target image classification models in untargeted scenarios. This technique presents various opportunities and possibilities for deception. This approach to producing usual adversarial perturbations involves normalizing them by combining all of the adversarial perturbations of each sample in the original dataset. Every targeted adversarial perturbation will shift the initial data to the decision boundary of the target classifier, lowering the target model's genuine category classification confidence. Furthermore, a significant association between the decision boundary's structure and generalized adversarial perturbations was presented by [PERSON] et al. [8]. In 2019, [PERSON] et al. were the first to demonstrate the presence of generalized adversarial perturbations in the audio domain [9], which do not relate to any specific audio sample in the dataset but can be added to any of the audio samples.  
In this paper, an acoustic genericity adversarial perturbation generation method is designed based on the iterative greedy method. The acoustic features of audio samples are computed in the iterative process to generate an acoustic genericity adversarial perturbation, which improves the production efficiency of the adversarial perturbation and the efficiency of the adversarial attack.