# GANBA: Generative Adversarial Network for
## 3 Proposed Method
### White-Box GANBA  
Figure 2 depicts the proposed GANBA architecture for the white-box scenario. The inputs to the GANBA generator are the short-time Fourier transform (STFT) features of a _spoofing_ utterance, so that it modifies its spectra in order to refine the _spoofing_ attack. The output of the GANBA generator is fed to the PAD and ASV subsystems of the target biometric system. The ASV system only consists of a time-delay neural network (TDNN) [21] for x-vector extraction (the only component of the ASV system needed in the white-box scenario). This feature extractor is fed with the Mel-frequency cepstral coefficients (MFCCs) of the corresponding utterance obtained through the log-power magnitude spectrum features (STFT) extracted previously, as shown in the diagram of Figure 2. On the other hand, the PAD  
system based on DNNs is also fed with the STFT features of the corresponding utterance and it provides the softmax output vector of the utterance, whose first component indicates the probability of the utterance being _bonafide_. The goal of the proposed framework is to train a GANBA generator capable of generating adversarial _spoofing_ attacks which can fool the anti-spoofing system while not causing any changes to the ASV x-vector output, i.e., the adversarial attacks should not change the feature x-vector since it contains the speaker information of the utterance. As is shown in Figure 2, there are two different steps for training the whole architecture. Step 1 denotes the training of the GANBA generator, where the PAD and ASV parameters are not modified but gradients are computed and back-propagated to the GANBA generator. At this stage, the _spoofing_ speech dataset is used only to train the GANBA generator. On the other hand, Step 2 denotes the training of the biometric system, PAD and ASV components, which makes up the discriminator of the GANBA framework. While the TDNN of the ASV system is trained using only the _bonafide_ speech dataset, the PAD system is trained using both the _bonafide_ and _spoofing_ speech datasets. Step 1 is in charge of optimizing the GANBA generator parameters in the white-box (w-box) scenario. In particular, the following loss function is minimized:  
\[L_{\text{GANBA\_w-box}}=L_{\text{PAD\_GANBA\_w-box}}(\mathbf{s}_{\text{PAD} }^{\text{spoof}},\mathbf{s}_{\text{PAD}}^{\text{spoof}}) \tag{6}\]  
\[+\beta\cdot L_{\text{ASV\_GANBA\_w-box}}(\mathbf{x}_{\text{vector}}^{\text{ spoof}},\mathbf{x}_{\text{vector}}^{\text{spoof}}),\]  
where  
\[L_{\text{ASV\_GANBA\_w-box}}(\mathbf{x}_{\text{vector}}^{\text{spoof}}, \mathbf{\tilde{x}}_{\text{vector}}^{\text{spoof}})=\left\|\mathbf{x}_{\text{ vector}}^{\text{spoof}}-\mathbf{\tilde{x}}_{\text{vector}}^{\text{spoof}} \right\|_{2}, \tag{7}\]  
\[L_{\text{PAD\_GANBA\_w-box}}(\mathbf{s}_{\text{PAD}}^{\text{spoof}},\mathbf{ \tilde{s}}_{\text{PAD}}^{\text{spoof}})=\left\|r_{\alpha}(\mathbf{s}_{\text{ PAD}}^{\text{spoof}})-\mathbf{\tilde{s}}_{\text{PAD}}^{\text{spoof}}\right\|_{2}. \tag{8}\]  
\(L_{\text{ASV\_GANBA\_w-box}}\) and \(L_{\text{PAD\_GANBA\_w-box}}\) are the loss functions associated with the ASV and PAD systems, respectively, and \(\beta\) is a hyper-parameter which weights the relative importance of these two losses. \(\mathbf{x}_{\text{vector}}^{\text{spoof}}\) and \(\mathbf{\tilde{x}}_{\text{vector}}^{\text{spoof}}\) denote the x-vectors of the original and adversarial _spoofing_ utterances, respectively. Likewise, vectors \(\mathbf{s}_{\text{PAD}}^{\text{spoof}}\) and \(\mathbf{s}_{\text{PAD}}^{\text{spoof}}\) represent the output probability sets provided by the PAD system for the original and adversarial  
Figure 2: Generative adversarial network for biometric anti-spoofing (GANBA) framework for white-box scenarios. Step 1: generator-only training (ASV and PAD parameters frozen, with encircled outputs corresponding to Equations (7) and (8), respectively). Step 2: discriminator (ASV + PAD) training (encircled outputs corresponding to classical cross-entropy loss function). spoofing_ utterances, respectively.