{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,11]],"date-time":"2026-07-11T16:26:16Z","timestamp":1783787176770,"version":"3.55.0"},"reference-count":48,"publisher":"MDPI AG","issue":"8","license":[{"start":{"date-parts":[[2022,8,17]],"date-time":"2022-08-17T00:00:00Z","timestamp":1660694400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"2020 Purdue University Fort Wayne Graduate Research Assistantship"},{"name":"2020 Purdue University Fort Wayne Collaborative Research Grant"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Algorithms"],"abstract":"<jats:p>Speaker verification systems use human voices as an important biometric to identify legitimate users, thus adding a security layer to voice-controlled Internet-of-things smart homes against illegal access. Recent studies have demonstrated that speaker verification systems are vulnerable to adversarial attacks such as FakeBob. The goal of this work is to design and implement a simple and light-weight defense system that is effective against FakeBob. We specifically study two opposite pre-processing operations on input audios in speak verification systems: denoising that attempts to remove or reduce perturbations and noise-adding that adds small noise to an input audio. Through experiments, we demonstrate that both methods are able to weaken the ability of FakeBob attacks significantly, with noise-adding achieving even better performance than denoising. Specifically, with denoising, the targeted attack success rate of FakeBob attacks can be reduced from 100% to 56.05% in GMM speaker verification systems, and from 95% to only 38.63% in i-vector speaker verification systems, respectively. With noise adding, those numbers can be further lowered down to 5.20% and 0.50%, respectively. As a proactive measure, we study several possible adaptive FakeBob attacks against the noise-adding method. Experiment results demonstrate that noise-adding can still provide a considerable level of protection against these countermeasures.<\/jats:p>","DOI":"10.3390\/a15080293","type":"journal-article","created":{"date-parts":[[2022,8,17]],"date-time":"2022-08-17T21:23:56Z","timestamp":1660771436000},"page":"293","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":9,"title":["Defending against FakeBob Adversarial Attacks in Speaker Verification Systems with Noise-Adding"],"prefix":"10.3390","volume":"15","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2771-2756","authenticated-orcid":false,"given":"Zesheng","family":"Chen","sequence":"first","affiliation":[{"name":"College of Engineering, Technology, and Computer Science, Purdue University Fort Wayne, Fort Wayne, IN 46805, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Li-Chi","family":"Chang","sequence":"additional","affiliation":[{"name":"College of Engineering, Technology, and Computer Science, Purdue University Fort Wayne, Fort Wayne, IN 46805, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chao","family":"Chen","sequence":"additional","affiliation":[{"name":"College of Engineering, Technology, and Computer Science, Purdue University Fort Wayne, Fort Wayne, IN 46805, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Guoping","family":"Wang","sequence":"additional","affiliation":[{"name":"College of Engineering, Technology, and Computer Science, Purdue University Fort Wayne, Fort Wayne, IN 46805, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8145-7883","authenticated-orcid":false,"given":"Zhuming","family":"Bi","sequence":"additional","affiliation":[{"name":"College of Engineering, Technology, and Computer Science, Purdue University Fort Wayne, Fort Wayne, IN 46805, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2022,8,17]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Chang, L., Chen, Z., Chen, C., Wang, G., and Bi, Z. (2021, January 29\u201331). Defending against adversarial attacks in speaker verification systems. Proceedings of the IEEE International Performance Computing and Communications Conference (IPCCC), Austin, TX, USA.","DOI":"10.1109\/IPCCC51483.2021.9679446"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"8327","DOI":"10.1109\/JSEN.2022.3161797","article-title":"Internet of things (IoT) based activity recognition strategies in smart homes: A review","volume":"22","author":"Babangida","year":"2022","journal-title":"IEEE Sens. J."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Das, R.K., Tian, X., Kinnunen, T., and Li, H. (2020). The attacker\u2019s perspective on automatic speaker verification: An overview. arXiv.","DOI":"10.21437\/Interspeech.2020-1052"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Wang, S., Cao, J., He, X., Sun, K., and Li, Q. (2020, January 9\u201313). When the differences in frequency domain are compensated: Understanding and defeating modulated replay attacks on automatic speech recognition. Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security (CCS), Virtual Event.","DOI":"10.1145\/3372297.3417254"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"130","DOI":"10.1016\/j.specom.2014.10.005","article-title":"Spoofing and countermeasures for speaker verification: A survey","volume":"66","author":"Wu","year":"2015","journal-title":"Speech Commun."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Wu, Z., and Li, H. (2014). Voice conversion versus speaker verification: An overview. APSIPA Transactions on Signal and Information Processing, Cambridge University Press.","DOI":"10.1017\/ATSIP.2014.17"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Chen, G., Chen, S., Fan, L., Du, X., Zhao, Z., Song, F., and Liu, Y. (2021, January 24\u201327). Who is real Bob? Adversarial attacks on speaker recognition systems. Proceedings of the IEEE Symposium on Security and Privacy, San Francisco, CA, USA.","DOI":"10.1109\/SP40001.2021.00004"},{"key":"ref_8","unstructured":"Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. (2014, January 14\u201316). Intriguing properties of neural networks. Proceedings of the International Conference on Learning Representations, Banff, AB, Canada."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"2805","DOI":"10.1109\/TNNLS.2018.2886017","article-title":"Adversarial examples: Attacks and defenses","volume":"30","author":"Yuan","year":"2019","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_10","unstructured":"Yang, Z., Li, B., Chen, P., and Song, D. (2019, January 6\u20139). Characterizing audio adversarial examples using temporal dependency. Proceedings of the International Conference on Learning Representations, New Orleans, LO, USA."},{"key":"ref_11","first-page":"138","article-title":"Voice recognition algorithms using mel frequency cepstral coefficient (MFCC) and dynamic time warping (DTW) techniques","volume":"2","author":"Muda","year":"2010","journal-title":"J. Comput."},{"key":"ref_12","unstructured":"Sainburg, T. (2022, July 12). timsainb\/noisereduce: V1.0. Zenodo. Available online: https:\/\/github.com\/timsainb\/noisereduce."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"19","DOI":"10.1006\/dspr.1999.0361","article-title":"Speaker verification using adapted Gaussian mixture models","volume":"10","author":"Reynolds","year":"2000","journal-title":"Digit. Signal Process."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"788","DOI":"10.1109\/TASL.2010.2064307","article-title":"Front-end factor analysis for speaker verification","volume":"19","author":"Dehak","year":"2011","journal-title":"IEEE Trans. Audio Speech Lang. Process."},{"key":"ref_15","unstructured":"Tramer, F., Carlini, N., Brendel, W., and Madry, A. (2020, January 6\u201312). On adaptive attacks to adversarial example defenses. Proceedings of the Conference on Neural Information Processing Systems (NeurIPS), Virtual."},{"key":"ref_16","unstructured":"(2022, July 12). Normal Distribution, Wikipedia. Available online: https:\/\/en.wikipedia.org\/wiki\/Normal_distribution."},{"key":"ref_17","unstructured":"(2022, July 12). Continuous Uniform Distribution, Wikipedia. Available online: https:\/\/en.wikipedia.org\/wiki\/Continuous_uniform_distribution."},{"key":"ref_18","unstructured":"(2022, July 12). Logistic Distribution, Wikipedia. Available online: https:\/\/en.wikipedia.org\/wiki\/Logistic_distribution."},{"key":"ref_19","unstructured":"(2022, July 12). Laplace Distribution, Wikipeida. Available online: https:\/\/en.wikipedia.org\/wiki\/Laplace_distribution."},{"key":"ref_20","unstructured":"(2022, July 12). Rademacher Distribution, Wikipedia. Available online: https:\/\/en.wikipedia.org\/wiki\/Rademacher_distribution."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Abdullah, H., Warren, K., Bindschaedler, V., Papernot, N., and Traynor, P. (2021, January 24\u201327). SoK: The faults in our ASRs: An overview of attacks against automatic speech recognition and speaker identification systems. Proceedings of the IEEE Symposium on Security and Privacy, San Francisco, CA, USA.","DOI":"10.1109\/SP40001.2021.00014"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"101199","DOI":"10.1016\/j.csl.2021.101199","article-title":"Adversarial attack and defense strategies for deep speaker recognition systems","volume":"68","author":"Jati","year":"2021","journal-title":"Comput. Speech Lang."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Villalba, J., Joshi, S., Zelasko, P., and Dehak, N. (September, January 30). Representation learning to classify and detect adversarial attacks against speaker and speech recognition systems. Proceedings of the Interspeech 2021, Brno, Czech Republic.","DOI":"10.21437\/Interspeech.2021-1759"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Li, X., Li, N., Zhong, J., Wu, X., Liu, X., Su, D., Yu, D., and Meng, H. (2020, January 25\u201329). Investigating robustness of adversarial samples detection for automatic speaker verification. Proceedings of the Interspeech 2020, Shanghai, China.","DOI":"10.21437\/Interspeech.2020-2441"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Wu, H., Li, X., Liu, A.T., Wu, Z., Meng, H., and Lee, H. (2021, January 6\u201311). Adversarial defense for automatic speaker verification by cascaded self-supervised learning models. Proceedings of the 2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Toronto, ON, Canada.","DOI":"10.1109\/ICASSP39728.2021.9413737"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"4811","DOI":"10.1109\/TIFS.2021.3116438","article-title":"Study of pre-processing defenses against adversarial attacks on state-of-the-art speaker recognition systems","volume":"16","author":"Joshi","year":"2021","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Wu, H., Zhang, Y., Wu, Z., Wang, D., and Lee, H. (September, January 30). Voting for the right answer: Adversarial defense for speaker verification. Proceedings of the Interspeech 2021, Brno, Czech Republic.","DOI":"10.21437\/Interspeech.2021-1452"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Byun, J., Go, H., and Kim, C. (2021). Small input noise is enough to defend against query-based black-box attacks. arXiv.","DOI":"10.1109\/WACV51458.2022.00387"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Variani, E., Lei, X., McDermott, E., Moreno, I.L., and Gonzalez-Dominguez, J. (2014, January 4\u20139). Deep neural networks for small footprint text-dependent speaker verification. Proceedings of the 2014 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Florence, Italy.","DOI":"10.1109\/ICASSP.2014.6854363"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Snyder, D., Garcia-Romero, D., Sell, G., McCree, A., Povey, D., and Khudanpur, S. (2019, January 12\u201317). Speaker recognition for multi-speaker conversations using X-vectors. Proceedings of the 2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Brighton, UK.","DOI":"10.1109\/ICASSP.2019.8683760"},{"key":"ref_31","unstructured":"Cheng, J.M., and Wang, H.C. (2004, January 15\u201318). A method of estimating the equal error rate for automatic speaker verification. Proceedings of the IEEE International Symposium on Chinese Spoken Language Processing, Hong Kong, China."},{"key":"ref_32","unstructured":"Biggio, B., Corona, I., Maiorca, D., Nelson, B., Srndic, N., Laskov, P., Giacinto, G., and Roli, F. (September, January ). Evasion attacks against machine learning at test time. Proceedings of the European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases (ECML PKDD), Prague, Czech Republic."},{"key":"ref_33","unstructured":"Goodfellow, I.J., Shlens, J., and Szegedy, C. (2015). Explaining and harnessing adversarial examples. arXiv."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"5103","DOI":"10.1109\/JIOT.2020.2975654","article-title":"Adversarial attacks and defenses on cyber\u2013physical systems: A survey","volume":"7","author":"Li","year":"2020","journal-title":"IEEE Internet Things J."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"9603","DOI":"10.1109\/JIOT.2020.3013710","article-title":"Adversarial examples\u2014Security threats to COVID-19 deep learning systems in medical IoT devices","volume":"8","author":"Rahman","year":"2021","journal-title":"IEEE Internet Things J."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"2443","DOI":"10.1109\/TII.2021.3093386","article-title":"Adversarial attacks on neural-network-based soft sensors: Directly attack output","volume":"18","author":"Kong","year":"2022","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_37","unstructured":"Kurakin, A., Goodfellow, I.J., and Bengio, S. (2017, January 24\u201326). Adversarial examples in the physical world. Proceedings of the 5th International Conference on Learning Representations, Toulon, France."},{"key":"ref_38","unstructured":"Ilyas, A., Engstrom, L., Athalye, A., and Lin, J. (2018, January 10\u201315). Black-box adversarial attacks with limited queries and information. Proceedings of the 35th International Conference on Machine Learning, Stockholm, Sweden."},{"key":"ref_39","unstructured":"McClellan, J.H., Schafer, R.W., and Yoder, M.A. (2016). DSP First, Pearson Education, Inc.. [2nd ed.]."},{"key":"ref_40","unstructured":"(2022, July 12). Librosa, a Python Package for Music and Audio Analysis. Available online: https:\/\/librosa.org\/."},{"key":"ref_41","unstructured":"Athalye, A., Carlini, N., and Wagner, D. (2018, January 10\u201315). Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. Proceedings of the 35th International Conference on Machine Learning (ICML), Stockholm, Sweden."},{"key":"ref_42","unstructured":"Athalye, A., Engstrom, L., Ilyas, A., and Kwok, K. (2018). Synthesizing robust adversarial examples. arXiv."},{"key":"ref_43","unstructured":"Google (2022, July 12). Google Cloud Platform. Available online: https:\/\/cloud.google.com\/."},{"key":"ref_44","unstructured":"Povey, D., Ghoshal, A., Boulianne, G., Burget, L., Glembek, O., Goel, N., Hannemann, M., Motlicek, P., Qian, Y., and Schwarz, P. (2011, January 11\u201315). The Kaldi speech recognition toolkit. Proceedings of the 2011 IEEE Workshop on Automatic Speech Recognition and Understanding, Waikoloa, HI, USA."},{"key":"ref_45","unstructured":"Nagrani, A., Chung, J.S., and Zisserman, A. (2018, January 27). VoxCeleb2: Deep speaker recognition. Proceedings of the Interspeech 2018, Hyderabad, India."},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Panayotov, V., Chen, G., Povey, D., and Khudanpur, S. (2015, January 19\u201324). Librispeech: An ASR corpus based on public domain audio books. Proceedings of the 2015 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), South Brisbane, Australia.","DOI":"10.1109\/ICASSP.2015.7178964"},{"key":"ref_47","unstructured":"(2022, July 12). defense_FakeBob. GitHub. Available online: https:\/\/github.com\/zeshengchen\/defense_FakeBob."},{"key":"ref_48","unstructured":"(2022, July 12). Rustle Noise, Wikipedia. Available online: https:\/\/en.wikipedia.org\/wiki\/Rustle_noise."}],"container-title":["Algorithms"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-4893\/15\/8\/293\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T00:11:19Z","timestamp":1760141479000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-4893\/15\/8\/293"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,8,17]]},"references-count":48,"journal-issue":{"issue":"8","published-online":{"date-parts":[[2022,8]]}},"alternative-id":["a15080293"],"URL":"https:\/\/doi.org\/10.3390\/a15080293","relation":{},"ISSN":["1999-4893"],"issn-type":[{"value":"1999-4893","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,8,17]]}}}