# Adversarial Attack and Defense on Deep Neural Network-Based Voice Processing Systems: An Overview
## 2 Background
### Attack
#### 2.1.1 Adversarial Examples
[10] proposed DeepFool to compute a minimal norm adversarial perturbation by the basic ideal of the distance from the input \(x\) to the boundaries of the classifier. That is, they assume \(\hat{k}(x)=sign(f(x))\), where \(f\) is an binary classification function and satisfies \(f(x)=w^{T}x+b\). It can be easily seen that its affine plane is \(\mathcal{F}=x:w^{T}x+b=0\). When a disturbance is added to a point \(x_{0}\) and perpendicular to the plane \(\mathcal{F}\), the disturbance added is the smallest and can meet the iteration requirements, as in the formula:  
\[\delta_{i}(x_{0}) : = argmin||\delta||_{2}\] \[=-\frac{f(x_{0})}{||w||_{2}^{2}}\]  
Furthermore, in the overall iterative process, the generation of adversarial examples can be expressed as:  
\[\operatorname*{arg\,min}_{\delta_{i}}||\delta||_{2}\quad s.t.\ f(x_{i})+ \
abla f(x_{i})^{T}\delta_{i}=0 \tag{6}\]  
DeepFool uses iteration to generate the minimum norm to counter the disturbance. At each step, the data values located within the classification boundary are modified step by step to outside the boundary until a classification error occurs. This method maintains almost the same resistance as FGSM, while the disturbances generated are smaller. Jacobian-based Saliency Map Attack (JSMA): JSMA [11] was proposed by [PERSON] et al. It is a method for generating adversarial examples for the type of deep neural network. It uses the forward guide number to implement it. The generation of the forward guide number uses the Jacobian matrix of the function function in the trained network. Given the function of network \(F\), we can obtain the forward derivative by this formula:  
\[\
abla F(X)=\frac{\partial F(X)}{\partial(X)}=[\frac{\partial F_{j}(X)}{ \partial x_{i}}]_{i\in\mathbb{I}.M,j\in\mathbb{I}.N} \tag{7}\]  
Universal adversarial examples: Methods such as FGSM, and DeepFool can only generate a single audio against perturbations, while universal adversarial examples [12] can generate perturbations almost imperceptible that attack any voice processing systems, and these perturbations are also harmful to humans. The method used in this paper [12] is similar to DeepFool, which uses anti-disturbance to push the image out of the classification boundary, but the same disturbance is for all. Although this article only targets a single network, ResNet, it has been proven that this malicious perturbation can be generalized to other networks. Genetic algorithm: It can be seen that the methods mentioned above for generating adversarial examples are all based on the system loss function or the gradient of the system's network function. Unfortunately, the above method usually does not work when the attacker does not know the prior information of the system's loss function and network function. Hence, researchers [13; 14; 15] use a genetic algorithm to generate a black-box adversarial example. A genetic algorithm is a gradient-free optimization method, which avoids having to grasp the prior information of the attacked systems. The algorithm accepts the original audio clip \(x\) and target output label \(\tilde{y}\) as entries. Adding random noise to a set of patterns in a given audio clip creates many candidate adversarial examples. To minimize the impact of noise on people, it is only necessary to place the sound in the least prominent position of the random system of audio examples. Calculate the fitness score of each population member based on the predicted score of the target output label, and apply selection, crossover, and mutation [16] to create adversarial examples from the current generation to the next generation. Choice means that more adaptable members may become part of the next generation. Crossover population members and mix them to produce new 'child' added to the new population. In the end, mutation adds random noise to the child with a small probability, then passed on to the next generation. The algorithm iterates on this process for the preset number of epochs or before the attack is successful.