# GANBA: Generative Adversarial Network for
## 2 Background
### Adversarial Spoofing Attacks  
Adversarial _spoofing_ attacks can be generated by adding a minimally perceptible perturbation to the input _spoofing_ utterance. The core idea of this type of adversarial attack is to refine the original _spoofing_ attack so that it is more difficult to be detected by the PAD system. In other words, the goal of adversarial _spoofing_ attacks is to fool the anti-spoofing or PAD system by maximizing the _bonafide_ class likelihood with respect to that of the _spoofing_ class.  
Adversarial _spoofing_ attacks can be generated by freezing the parameters \(\mathbf{\theta}\) of the DNN-based anti-spoofing model and performing a gradient descent algorithm which is able to update the input spectrum features \(\mathbf{X}\) of the _spoofing_ utterance so that the PDA misclassifies it as _bonafide_. Mathematically, it is an optimization problem which tries to find a sufficiently small perturbation \(\delta\) which satisfies:  
\[\begin{split}&\tilde{\mathbf{X}}=\mathbf{X}+\delta,\\ & f_{\theta}(\mathbf{\hat{X}})=\tilde{y},\\ & f_{\theta}(\mathbf{X})=y,\end{split} \tag{3}\]where \(\mathbf{\tilde{X}}\) denotes the perturbed input spectrum features, \(f\) denotes a well-trained DNN-based anti-spoofing model parameterized by \(\theta\), \(\delta\) is the additive spectrum perturbation, \(y\) is the ground-truth label corresponding to the original input spectrum features \(\mathbf{X}\), and \(\mathbf{\tilde{y}}\) denotes the label of the targeted class of the adversarial _spoofing_ attack, i.e., the label of the _bonafide_ class. Normally, the subspace of allowed perturbations is denoted by \(\mathbf{\Delta}\), so that the perturbation \(\delta\in\mathbf{\Delta}\). In other words, the manipulative capability of the adversarial attack is formalized by the subspace \(\mathbf{\Delta}\). Typically, \(\mathbf{\Delta}\) is a small \(l_{\infty}\)-norm sphere (\(\mathbf{\Delta}=\{\delta\ |\ \|\delta\|_{\infty}\leq\epsilon\}\), \(\epsilon\geq 0\in\mathbb{R}\)).  
Two of the most popular adversarial attack techniques are: (i) gradient sign method (FGSM) [40], and (ii) projected gradient descent (PGD) [41]. The FGSM attack generates the perturbation \(\delta\) by taking a single step toward the direction pointed by the gradient as follows,  
\[\delta=\epsilon\cdot\text{sign}(\
abla_{\mathbf{X}}\text{Loss}(\mathbf{\theta},\mathbf{X},y)), \tag{4}\]  
where sign is an operation which takes the sign of its argument, and Loss is the loss function of the well-trained PAD neural network whose parameters are denoted by \(\mathbf{\theta}\). Unlike FGSM, implemented as a single-step procedure, PGD is iterative. Thus, initializing with the original input _spoofing_ spectrum features \(\mathbf{X}_{0}=\mathbf{X}\), the spectra of the _spoofing_ attack is iteratively updated as follows,  
\[\mathbf{X}_{n+1}=\text{clip}(\mathbf{X}_{n}+\alpha\cdot\text{sign}(\
abla_{\mathbf{X}}Loss (\mathbf{\theta},\mathbf{X},y)),\ \forall\ n=0,...,N-1, \tag{5}\]  
where \(n=0,...,N-1\) denotes the iteration index (up to \(N\) iterations), and clip denotes a function which applies element-wise clipping such that \(\left\|\mathbf{X}_{n}-\mathbf{X}\right\|_{\infty}\leq\epsilon\), \(\epsilon\geq 0\in\mathbb{R}\).