# IG-Based Method for Voiceprint Universal Adversarial Perturbation Generation
## 6 Experimental Analysis
### Targeted Attack
The attack success rate on the 1 DCNN Rand model is the lowest, at 9%. However, it also demonstrates superior attack levels of 81.2%. The difference between the ASR outcomes on the training and test sets remains low, with a maximum differential of only 10.0%. This suggests that the IG-UAP algorithm is somewhat effective in reducing overfitting occurrences during targeted attacks. Analyzing the SNR metrics reveals that the SincNet model exhibits the highest SNR level, measuring at 30.241 dB. This indicates that the perturbation had a lesser impact on the acoustic pattern signal's original quality. Additionally, the other four methods exhibited similar SNR levels, which also maintained a lower impact on the original signal. ENVnet-V2, on the other hand, recorded the lowest SNR level at 21.146 dB. From the \(l_{d}B\) metrics' perspective, it was found that the SincNet model had the lowest value at \(-\)30.126, while the 1 DCNN Rand model had the highest value at \(-\)17.043. The interval of loudness levels falls within a range that is difficult to detect with the human ear. The paper findings are presented in Figure 8, where the engine_idling sound category samples were selected and subjected to generic adversarial perturbation. Figure 8 displays the spectrogram of the original audio sample, while Figure 8 exhibits the spectrogram of the audio sample following the generic adversarial perturbation. After carrying out attacks on various models and analyzing the experimental results, we proceed with a comparison experiment using similar methods. It should be noted that the FGSM-UAP method and the PGD-UAP method typically generate untargeted adversary samples, which means that there is no guarantee that the resulting adversary samples will be classified into the specified target category, even if the attacker specifies the category. Therefore, this comparison of three methods, VCGAN-UAP, C&W-UAP, and MSCW-UAP, in the context of a target attack is presented. SincNet was chosen as the target model and UrbanSound8K as the dataset, with the target attack category being dog_dark. The experimental hyperparameters are listed in Table 9. It is important to note that this analysis aims to achieve objectivity, coherence, and clarity, maintaining an appropriate academic structure and language register whilst avoiding biased language, complex terminology, and subjective evaluations. The experimental results are shown in Table 10.  
After conducting comparative experiments, it was found that when targeting the \"dog_dark\" category, the IG-UAP method demonstrates a superior attack success rate, an average signal-to-noise ratio (ASR), and an average generation time. The ASR reached 86.7%, which is 2.2% higher than the MSCW-UAP approach. Additionally, the average generation time of the IG-UAP method was 8.28 s faster than that of the MSCW-UAP approach, resulting in a significantly improved generation speed without compromising the attack success rate. The mean SNR is 28.145 dB, surpassing the C&W-UAP approach by  
Figure 8: Comparison of original and added adversarial perturbation audio sample spectrograms. (**a**) Original spectrogram of the audio sample; (**b**) adversarial spectrogram of the audio sample. 0.31 dB, yet the assault's success rate is 46.5% better, which guarantees a high SNR with a high accuracy level. Additionally, the typical generation time is 2.96 s. From a comprehensive analysis of each index, the IG-UAP method proposed in this chapter demonstrates a superior attack effectiveness and is the most efficient technique for generating voiceprints compared to the other two iterative methods in the context of a targeted attack. The method also exhibits excellent generalizability against perturbations and delivers the best overall performance.