{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T16:54:38Z","timestamp":1783184078062,"version":"3.54.6"},"reference-count":47,"publisher":"Association for Computing Machinery (ACM)","issue":"3s","license":[{"start":{"date-parts":[[2021,10,31]],"date-time":"2021-10-31T00:00:00Z","timestamp":1635638400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Science Foundation of China","doi-asserted-by":"crossref","award":["62025101620 and 61961130392"],"award-info":[{"award-number":["62025101620 and 61961130392"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"name":"PKU-Baidu Fund","award":["2019BD003"],"award-info":[{"award-number":["2019BD003"]}]},{"name":"High-performance Computing Platform of Peking University"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Multimedia Comput. Commun. Appl."],"published-print":{"date-parts":[[2021,10,31]]},"abstract":"<jats:p>\n            Due to the widespread deployment of fingerprint\/face\/speaker recognition systems, the risk in these systems, especially the adversarial attack, has drawn increasing attention in recent years. Previous researches mainly studied the adversarial attack to the vision-based systems, such as fingerprint and face recognition. While the attack for speech-based systems has not been well studied yet, although it has been widely used in our daily life. In this article, we attempt to fool the state-of-the-art speaker recognition model and present\n            <jats:italic>speaker recognition attacker<\/jats:italic>\n            , a lightweight multi-layer convolutional neural network to fool the well-trained state-of-the-art speaker recognition model by adding imperceptible perturbations onto the raw speech waveform. We find that the speaker recognition system is vulnerable to the adversarial attack, and achieve a high success rate on both the non-targeted attack and targeted attack. Besides, we present an effective method by leveraging a pretrained phoneme recognition model to optimize the speaker recognition attacker to obtain a tradeoff between the attack success rate and the perceptual quality. Experimental results on the TIMIT and LibriSpeech datasets demonstrate the effectiveness and efficiency of our proposed model. And the experiments for frequency analysis indicate that high-frequency attack is more effective than low-frequency attack, which is different from the conclusion drawn in previous image-based works. Additionally, the ablation study gives more insights into our model.\n          <\/jats:p>","DOI":"10.1145\/3468673","type":"journal-article","created":{"date-parts":[[2021,11,15]],"date-time":"2021-11-15T17:56:12Z","timestamp":1636998972000},"page":"1-21","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":25,"title":["Learning to Fool the Speaker Recognition"],"prefix":"10.1145","volume":"17","author":[{"given":"Jiguo","family":"Li","sequence":"first","affiliation":[{"name":"Institute of Computing Technology, Chinese Academy of Sciences &amp; University of Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xinfeng","family":"Zhang","sequence":"additional","affiliation":[{"name":"University of Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jizheng","family":"Xu","sequence":"additional","affiliation":[{"name":"Bytedance Inc, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Siwei","family":"Ma","sequence":"additional","affiliation":[{"name":"Peking University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wen","family":"Gao","sequence":"additional","affiliation":[{"name":"Peking University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2021,11,15]]},"reference":[{"key":"e_1_3_2_2_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2001.941023"},{"key":"e_1_3_2_3_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2807385"},{"key":"e_1_3_2_4_2","article-title":"Did you hear that? Adversarial examples against automatic speech recognition","author":"Alzantot Moustafa","year":"2018","unstructured":"Moustafa Alzantot, Bharathan Balaji, and Mani Srivastava. 2018. Did you hear that? Adversarial examples against automatic speech recognition. arXiv:1801.00554. Retrieved from https:\/\/arxiv.org\/abs\/1801.00554.","journal-title":"arXiv:1801.00554"},{"key":"e_1_3_2_5_2","doi-asserted-by":"publisher","DOI":"10.5555\/3305381.3305404"},{"key":"e_1_3_2_6_2","article-title":"Recent advances in adversarial training for adversarial robustness","author":"Bai Tao","year":"2021","unstructured":"Tao Bai, Jinqi Luo, Jun Zhao, and Bihan Wen. 2021. Recent advances in adversarial training for adversarial robustness. arXiv:2102.01356. Retrieved from https:\/\/arxiv.org\/abs\/2102.01356.","journal-title":"arXiv:2102.01356"},{"key":"e_1_3_2_7_2","doi-asserted-by":"publisher","DOI":"10.5555\/3504035.3504363"},{"key":"e_1_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.5555\/3042573.3042761"},{"key":"e_1_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.5555\/3241094.3241135"},{"key":"e_1_3_2_10_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"e_1_3_2_11_2","article-title":"Adversarial attacks and defences: A survey","author":"Chakraborty Anirban","year":"2018","unstructured":"Anirban Chakraborty, Manaar Alam, Vishal Dey, Anupam Chattopadhyay, and Debdeep Mukhopadhyay. 2018.Adversarial attacks and defences: A survey. arXiv:1810.00069. Retrieved from https:\/\/arxiv.org\/abs\/1810.00069.","journal-title":"arXiv:1810.00069"},{"key":"e_1_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1145\/1014052.1014066"},{"key":"e_1_3_2_13_2","doi-asserted-by":"publisher","DOI":"10.1109\/TASL.2010.2064307"},{"key":"e_1_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.1145\/2666620.2666623"},{"key":"e_1_3_2_15_2","first-page":"(2000), 185\u2013193","volume-title":"J. Eng. Sci","author":"Erta\u015f Figen","year":"2000","unstructured":"Figen Erta\u015f. 2000. Fundamentals of Speaker Recognition. J. Eng. Sci. 2\u20133 (2000), 185\u2013193."},{"key":"e_1_3_2_16_2","doi-asserted-by":"publisher","DOI":"10.5555\/39857"},{"key":"e_1_3_2_18_2","article-title":"Crafting adversarial examples for speech paralinguistics applications","author":"Gong Yuan","year":"2017","unstructured":"Yuan Gong and Christian Poellabauer. 2017. Crafting adversarial examples for speech paralinguistics applications. arXiv:1711.03280. Retrieved from https:\/\/arxiv.org\/abs\/1711.03280.","journal-title":"arXiv:1711.03280"},{"key":"e_1_3_2_19_2","volume-title":"Proceedings of the 3rd International Conference on Learning Representations (ICLR\u201915)","author":"Goodfellow Ian J.","year":"2015","unstructured":"Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and harnessing adversarial examples. In Proceedings of the 3rd International Conference on Learning Representations (ICLR\u201915), Yoshua Bengio and Yann LeCun (Eds.)."},{"key":"e_1_3_2_20_2","doi-asserted-by":"publisher","DOI":"10.5555\/3045118.3045167"},{"key":"e_1_3_2_21_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2018.8462575"},{"key":"e_1_3_2_22_2","volume-title":"Proceedings of the 3rd International Conference on Learning Representations (ICLR\u201915)","author":"Kingma Diederik P.","year":"2015","unstructured":"Diederik P. Kingma and Jimmy Ba. 2015. Adam: A method for stochastic optimization. In Proceedings of the 3rd International Conference on Learning Representations (ICLR\u201915), Yoshua Bengio and Yann LeCun (Eds.)."},{"key":"e_1_3_2_23_2","doi-asserted-by":"publisher","DOI":"10.1109\/BTAS.2016.7791200"},{"key":"e_1_3_2_24_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2018.8462693"},{"key":"e_1_3_2_25_2","article-title":"Adversarial examples in the physical world","author":"Kurakin Alexey","year":"2016","unstructured":"Alexey Kurakin, Ian Goodfellow, and Samy Bengio. 2016. Adversarial examples in the physical world. arXiv:1607.02533. Retrieved from https:\/\/arxiv.org\/abs\/1607.02533.","journal-title":"arXiv:1607.02533"},{"key":"e_1_3_2_26_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP40776.2020.9053058"},{"key":"e_1_3_2_27_2","volume-title":"Proceedings of the 6th International Conference on Learning Representations (ICLR\u201918)","author":"Madry Aleksander","year":"2018","unstructured":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards deep learning models resistant to adversarial attacks. In Proceedings of the 6th International Conference on Learning Representations (ICLR\u201918)."},{"key":"e_1_3_2_28_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.17"},{"key":"e_1_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2018.8462165"},{"key":"e_1_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.5555\/3104322.3104425"},{"key":"e_1_3_2_31_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2015.7178964"},{"key":"e_1_3_2_32_2","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"e_1_3_2_33_2","first-page":"5231","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Qin Yao","year":"2019","unstructured":"Yao Qin, Nicholas Carlini, Garrison Cottrell, Ian Goodfellow, and Colin Raffel. 2019.Imperceptible, robust, and targeted adversarial examples for automatic speech recognition. In Proceedings of the International Conference on Machine Learning. PMLR, 5231\u20135240."},{"key":"e_1_3_2_34_2","unstructured":"Mirco Ravanelli and Yoshua Bengio. 2018. Interpretable convolutional filters with SincNet."},{"key":"e_1_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1109\/SLT.2018.8639585"},{"key":"e_1_3_2_36_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2019.8683713"},{"key":"e_1_3_2_37_2","doi-asserted-by":"publisher","DOI":"10.1006\/dspr.1999.0361"},{"key":"e_1_3_2_38_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2001.941023"},{"key":"e_1_3_2_39_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23288"},{"key":"e_1_3_2_40_2","doi-asserted-by":"publisher","DOI":"10.5555\/3367471.3367512"},{"key":"e_1_3_2_41_2","article-title":"Caad 2018: Generating transferable adversarial examples","author":"Sharma Yash","year":"2018","unstructured":"Yash Sharma, Tien-Dung Le, and Moustafa Alzantot. 2018. Caad 2018: Generating transferable adversarial examples. arXiv:1810.01268. Retrieved from https:\/\/arxiv.org\/abs\/1810.01268.","journal-title":"arXiv:1810.01268"},{"key":"e_1_3_2_42_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2018.8461375"},{"key":"e_1_3_2_43_2","doi-asserted-by":"publisher","DOI":"10.1109\/SLT.2016.7846260"},{"key":"e_1_3_2_44_2","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2019.2890858"},{"key":"e_1_3_2_45_2","volume-title":"Proceedings of the 2nd International Conference on Learning Representations (ICLR\u201914)","author":"Szegedy Christian","year":"2014","unstructured":"Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. 2014.Intriguing properties of neural networks. In Proceedings of the 2nd International Conference on Learning Representations (ICLR\u201914), Yoshua Bengio and Yann LeCun (Eds.)."},{"key":"e_1_3_2_46_2","article-title":"Perceptual based adversarial audio attacks","author":"Szurley Joseph","year":"2019","unstructured":"Joseph Szurley and J Zico Kolter. 2019. Perceptual based adversarial audio attacks. arXiv:1906.06355. Retrieved from https:\/\/arxiv.org\/abs\/1906.06355.","journal-title":"arXiv:1906.06355"},{"key":"e_1_3_2_47_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11633-019-1211-x"},{"key":"e_1_3_2_48_2","doi-asserted-by":"publisher","DOI":"10.5555\/3277203.3277208"},{"key":"e_1_3_2_49_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134052"}],"container-title":["ACM Transactions on Multimedia Computing, Communications, and Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3468673","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3468673","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T20:17:18Z","timestamp":1750191438000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3468673"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,10,31]]},"references-count":47,"journal-issue":{"issue":"3s","published-print":{"date-parts":[[2021,10,31]]}},"alternative-id":["10.1145\/3468673"],"URL":"https:\/\/doi.org\/10.1145\/3468673","relation":{},"ISSN":["1551-6857","1551-6865"],"issn-type":[{"value":"1551-6857","type":"print"},{"value":"1551-6865","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,10,31]]},"assertion":[{"value":"2020-12-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2021-05-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2021-11-15","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}