Membership inference attacks allow adversaries to determine whether a
particular example was contained in the model's training dataset. While
previous works have confirmed the feasibility of such attacks in various
applications, none has focused on speaker recognition (SR), a promising
voice-based biometric recognition technique. In this work, we propose SLMIA-SR,
the first membership inference attack tailored to SR. In contrast to
conventional example-level attack, our attack features speaker-level membership
inference, i.e., determining if any voices of a given speaker, either the same
as or different from the given inference voices, have been involved in the
training of a model. It is particularly useful and practical since the training
and inference voices are usually distinct, and it is also meaningful
considering the open-set nature of SR, namely, the recognition speakers were
often not present in the training data. We utilize intra-closeness and
inter-farness, two training objectives of SR, to characterize the differences
between training and non-training speakers and quantify them with two groups of
features driven by carefully-established feature engineering to mount the
attack. To improve the generalizability of our attack, we propose a novel
mixing ratio training strategy to train attack models. To enhance the attack
performance, we introduce voice chunk splitting to cope with the limited number
of inference voices and propose to train attack models dependent on the number
of inference voices. Our attack is versatile and can work in both white-box and
black-box scenarios. Additionally, we propose two novel techniques to reduce
the number of black-box queries while maintaining the attack performance.
Extensive experiments demonstrate the effectiveness of SLMIA-SR.

提出了 SLMIA-SR，该方法是第一个针对 SR 定制的成员推断攻击，使用声纹识别和训练目标特征工程，通过训练模型和攻击模型的相关性来验证声纹在训练集中的成员关系，实验证明了攻击的效果。