Audio adversarial examples (AEs) have posed significant security challenges
to real-world speaker recognition systems. Most black-box attacks still require
certain information from the speaker recognition model to be effective (e.g.,
keeping probing and requiring the knowledge of similarity scores). This work
aims to push the practicality of the black-box attacks by minimizing the
attacker's knowledge about a target speaker recognition model. Although it is
not feasible for an attacker to succeed with completely zero knowledge, we
assume that the attacker only knows a short (or a few seconds) speech sample of
a target speaker. Without any probing to gain further knowledge about the
target model, we propose a new mechanism, called parrot training, to generate
AEs against the target model. Motivated by recent advancements in voice
conversion (VC), we propose to use the one short sentence knowledge to generate
more synthetic speech samples that sound like the target speaker, called parrot
speech. Then, we use these parrot speech samples to train a parrot-trained(PT)
surrogate model for the attacker. Under a joint transferability and perception
framework, we investigate different ways to generate AEs on the PT model
(called PT-AEs) to ensure the PT-AEs can be generated with high transferability
to a black-box target model with good human perceptual quality. Real-world
experiments show that the resultant PT-AEs achieve the attack success rates of
45.8% - 80.8% against the open-source models in the digital-line scenario and
47.9% - 58.3% against smart devices, including Apple HomePod (Siri), Amazon
Echo, and Google Home, in the over-the-air scenario.

通过最小化黑箱攻击者对目标说话者识别模型的了解，我们提出了一种新机制，称为鹦鹉训练，通过生成听起来像目标说话者的合成语音样本来针对目标模型生成对抗样本，并在联合可迁移性和感知质量框架下研究不同的方法来生成具有高可迁移性和良好人类知觉质量的对抗样本。在真实世界的实验中，得到的对抗样本在数字线路场景中对开源模型的攻击成功率为 45.8% - 80.8%，在无线场景中对包括苹果 HomePod（Siri），亚马逊 Echo 和谷歌 Home 在内的智能设备的攻击成功率为 47.9% - 58.3%。