# GANBA: Generative Adversarial Network for
## 6 Conclusions  
In this paper, the robustness of state-of-the-art complete (ASV+PAD) voice biometric systems against adversarial _spoofing_ attacks was studied. Furthermore, we proposed a novel generative adversarial network for biometric anti-spoofing (GANBA) capable of fooling the anti-spoofing system without being detected by the ASV system, i.e., without changing the speaker information of the utterance. Furthermore, we employed the generated attacks for defending the system by either applying adversarial training or using the resulting PAD discriminator of the proposed GANBA framework.  
Experimental results showed that voice biometric systems are highly vulnerable to adversarial _spoofing_ attacks in both physical and logical access scenarios. However, we showed that the biometric system can be effectively defended using the PAD discriminator of the proposed GANBA system. In fact, the proposed defense technique resulted in being more robust against both adversarial and original _spoofing_ attacks. It is worth noting that the results presented here with the GANBA attacks can be directly compared with those of the adversarial biometric transformation network (ABTN) attacks in [15]. This comparison shows that although ABTN and GANBA follow the same strategy for attack generation, GANBA goes a step further in being trained as a generative adversarial network (GAN), and shows a higher capability for fooling the voice biometric system.  
In the future, we would like to explore a cross-database evaluation of the proposed defense technique for voice biometric systems against adversarial _spoofing_ attacks in order to study their generalization between different datasets [50].  
The individual contributions are provided as follows. Contributions: conceptualization, A.G.A., J.A.G.-L. and A.M.P.; methodology, A.G.A., J.A.G.-L. and A.M.P.; software, A.G.A.; validation, A.G.A., J.A.G.-L. and A.M.P.; formal analysis, A.G.A., J.A.G.-L. and A.M.P.; investigation, A.G.A., J.A.G.-L. and A.M.P.; resources, A.G.A., J.A.G.-L. and A.M.P.; data curation, A.G.A. and J.A.G.-L.; writing--original draft preparation, A.G.A., J.A.G.-L. and A.M.P.; writing--review and editing, A.G.A. and J.A.G.-L.; visualization, A.G.A.; supervision, J.A.G.-L. and A.M.P.; project administration, A.M.P.; funding acquisition, A.M.P. All authors have read and agreed to the published version of the manuscript.  
This work was supported by the FEDER/Junta de Andalucia-Consejeria de Transformacion Economica, Industria, Conocimiento y Universidades Proyecto PY20_00902, and by the project PID2019-104206 GB-I00 funded by MCIN/ AEI /10.13039/501100011033.  
The study was conducted according to the guidelines of the Declaration of Helsinki. Ethical review and approval were waived for this study, due to the usage of public datasets.  
Informed Consent Statement: Informed consent was obtained from all subjects involved in this study when acquiring the public datasets employed in this work.  
The ASVspoof 2019 datasets were used in this study. They are publicly available at [[https://datashare.ed.ac.uk/handle/10283/3336](https://datashare.ed.ac.uk/handle/10283/3336)]([https://datashare.ed.ac.uk/handle/10283/3336](https://datashare.ed.ac.uk/handle/10283/3336)) (accessed on 5 December 2021).  
[PERSON] holds a FPU fellowship (FPU16/05490) from the Spanish Ministry of Education and Vocational Training. [PERSON] also holds a [PERSON] fellowship (IJCI-2017-32926) from the Spanish Ministry of Science and Innovation. Furthermore, we acknowledge the support of Nvidia with the donation of a Titan X GPU.  
The authors declare no conflict of interest.