# IG-Based Method for Voiceprint Universal Adversarial Perturbation Generation
## 6 Experimental Analysis
### Targeted Attack  
In targeted attacks, the objective is to cause the classification model to misclassify input samples with high confidence, resulting in the label specified by the attacker. In this section, we compute the optimization problem of the objective function using Equation (6), evaluate the attack success rate using Equation (8), calculate the average signal-to-noise ratio using Equation (11), and measure the loudness using Equation (12) for the purpose of data analysis and experiments. In this paper, we evaluate the efficacy of generating adversarial samples in the UrbanSound8K dataset for five voiceprint classification models, 1 DCNN Rand, 1 DCNN Gamma, ENVnet-V2, Sincnet, and SincNet+VGG19, in the presence of target-attack scenarios. The experimental hyperparameters are illustrated in Table 7.  
As different confidence levels can impact experimental outcomes, we chose the ENVnet-V2 and 1 DCNN Gamma models as the objects of experimentation to evaluate their \begin{table}
\begin{tabular}{c c} \hline \hline
**Parameter Type** & **Parameter Value** \\ \hline Confidence \(\kappa\) & 20 \\ Expected Deception Rate \(\delta\) & 0.1 \\ Number of Iterations Epoch & 100 \\ Penalty Factor c & 0.15 \\ Type of Targeted Attack & jackhammer \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Hyperparameters of experiments. Figure 5: Attack effect diagram for a single sample. effect on ASR, SNR, and \(l_{dB}\). The experiments were conducted with a confidence interval of [0, 80], incrementing the confidence level by 10 for each test. The results for the ENVnet-V2 model are presented in Figure 6a-c, while the results for the 1 DCNN Gamma model are presented in Figure 7a-c.  
Based on the data presented in Figures 6 and 7, two distinct acoustic pattern classification models were observed. The ASR exhibited an increase in the [0, 20] range and then plateaued between [20, 80] as the confidence level improved. The SNR showed a general trend of smoothness as the confidence level improved, whereas the \(l_{d}B\) also displayed an overall smooth trend with an increased confidence level. It is worth noting that the aforementioned results were observed despite the use of different classification models. Therefore, when selecting 20 as the confidence level hyperparameter in the target attack experiment carried out to compare various models, the effect of confidence level on the outcomes of SNR and ASR, as well as \(l_{d}B\), can be factored in. Consequently, the experimental results are more stable and uniformly distributed. The experimental results are shown in Table 8.  
According to Table 8, following an untargeted attack on five popular acoustic classification models, namely 1 DCNN Rand, 1 DCNN Gamma, ENVnet-V2, SincNet, and \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Target Model**} & \multicolumn{4}{c}{**Datesets**} \\ \cline{2-5}  & **Training Sets** & \multicolumn{4}{c}{**Testing Sets**} \\ \cline{2-5}  & **ASR/\%** & **ASR/\%** & **SNR/dB** & \(l_{dB}\) \\ \hline
1 DCNN Rand & 91.2 & 81.2 & 24.218 & \(-\)17.043 \\ \hline
1 DCNN Gamma & 90.9 & 83.7 & 22.654 & \(-\)17.211 \\ \hline ENVnet-V2 & 91.9 & 83.1 & 21.146 & \(-\)13.997 \\ \hline SincNet & 96.5 & 90.9 & 30.241 & \(-\)30.126 \\ \hline SincNet+VGG19 & 91.1 & 85.8 & 26.667 & \(-\)20.912 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: The success rate of IG-UAP on multiple target models. Figure 6: Experimental results of the ENVnet-V2 model at different confidence levels. (**a**) Effect of confidence value on ASR; (**b**) effect of confidence value on SNR; (**c**) effect of confidence value on \(l_{d}B\). Figure 7: Experimental results of the 1 DCNN Gamma model at different confidence levels. (**a**) Effect of confidence value on ASR; (**b**) effect of confidence value on SNR; (**c**) effect of confidence value on \(l_{d}B\). SincNet+VGG19, using generated acoustic confrontation samples from the UrbanSound8K dataset, and assessed using ASR metrics, the SincNet model achieved the highest attack success rate of 90%.