# IG-Based Method for Voiceprint Universal Adversarial Perturbation Generation
## 6 Experimental Analysis
### Untargeted Attack  
In the absence of a specific target, the objective of a malicious attacker is to deliberately cause misclassification of input samples by the classification model, resulting in a confidence level that deviates significantly from the actual label. Hence, in this section, we calculate the optimization problem of the objective function via Equation (7), derive the attack success rate via Equation (8), determine the average signal-to-noise ratio via Equation (11), and evaluate the loudness utilizing Equation (12) during experimental analysis of data. This section compares the effectiveness of generating adversarial samples for the five voiceprint classification models (1 DCNN Rand, 1 DCNN Gamma, ENVnet-V2, Sincnet, and SincNet+VGG19) in an untargeted attack scenario using the UrbanSound8K dataset. The experimental hyperparameters can be found in Table 3.  
Due to the potential impact of different confidence levels (\(\kappa\)) on experimental results, the ENVnet-V2 and 1 DCNN Gamma models were chosen as experimental objects to explore their impact on ASR, SNR, and \(l_{dB}\). The confidence interval used was [0, 80], with confidence levels incremented by 10 at a time. The experimental results for the ENVnet-V2 model are displayed in Figure 2a-c. The experimental results for the 1 DCNN Gamma model are shown in Figure 3a-c.  
From Figures 2 and 3, it is evident that the ASR displays a general upward trend as the confidence level improves, while the SNR exhibits an overall downward trend with improvement in confidence levels. Additionally, the \(l_{dB}\) shows a considerable decrease in the range of [0, 40], followed by a leveling off in the range of [40, 80] with an increase in the confidence level. Despite being two distinct models for acoustic pattern classification, these observations hold true. Therefore, when selecting the hyperparameter for the untargeted attack experiment, if a confidence level of 40 is chosen, the impact on the results of SNR, ASR, and \(l_{dB}\) can be considered in the comparison of different models. This allows for more stable and representative experimental result values. The corresponding experimental results are shown in Table 4.  
Table 4 shows that the success rate of the untargeted attacks on the five popular acoustic pattern classification models, with the help of acoustic pattern confrontation samples produced under the UrbanSound8K dataset, is the highest on the SincNet model from an ASR index perspective, reaching 90.4%, and the lowest is on the ENVnet-V2 model, but it also exhibits a superior attack level of 82.9%. The disparity between the training and test set ASR outcomes is minimal, with a maximum variance of only 6.2%. These findings suggest that the IG-UAP algorithm effectively curbs overfitting in untargeted attack situations. Based on SNR metrics, the SincNet model shows the highest SNR level of 29.886 dB, suggesting that adding the perturbation has minimal impact on the original acoustic pattern signal. The other four methods display comparable SNR levels with a lower effect on the initial signal. The ENVnet-V2, on the other hand, has the lowest SNR \begin{table}
\begin{tabular}{c c} \hline \hline
**Parameter Type** & **Parameter Value** \\ \hline Confidence \(\kappa\) & 40 \\ Expected Deception Rate \(\delta\) & 0.1 \\ Number of Iterations Epoch & 100 \\ Penalty Factor c & 0.2 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Hyperparameters of experiments. level of 18.425 dB. From an \(l_{dB}\) metrics perspective, the SincNet model shows the smallest value, \(-26.214\), while the ENVnet-V2 presents the highest value, \(-11.320\). Both models maintain a low loudness that is not easily detected by the human ear. The results of the experiment are displayed in Figure 4. In this figure, we selected audio samples from the gun_shot category, to which we added the acoustic pattern generality adversarial perturbation.