Signal Processing Interpretation for Adversarial Examples in Speaker Verification

To safeguard automatic speaker verification (ASV) systems due to attacks from adversarial examples, it is important to understand the characteristics of the adversarial noise, and its effect on the speech signal. This study aims at explaining the effect of adversarial noise on signal characteristics in the spectral domain. The adversarial examples seem to exploit the low energy regions in the time-frequency (TF) representation of the test speech signal to alter the decision of the ASV system. It appears that the phase of the adversarial noise plays a role in increasing the spectral dynamic range of the test speech signal, resulting in peaks and valleys in the spectral envelope in the low-energy frequency components. Based on these new insights, we explain the reasons behind the success of the existing preprocessing defense strategies. This work may help researchers to develop more intuitive defense strategies.