Attacker Attribution of Audio Deepfakes

View on arXiv ← Back to list

Authors: Nicolas M. Müller, Franziska Dieckmann, Jennifer Williams

Published: 2022-03-28 09:25:31+00:00

AI Summary

This paper tackles the problem of audio deepfake attacker attribution, aiming to identify the creator of a fake audio recording. It proposes using recurrent neural network embeddings as attacker signatures, demonstrating superior performance compared to low-level acoustic features for distinguishing between deepfakes from different sources.

Abstract

Deepfakes are synthetically generated media often devised with malicious intent. They have become increasingly more convincing with large training datasets advanced neural networks. These fakes are readily being misused for slander, misinformation and fraud. For this reason, intensive research for developing countermeasures is also expanding. However, recent work is almost exclusively limited to deepfake detection - predicting if audio is real or fake. This is despite the fact that attribution (who created which fake?) is an essential building block of a larger defense strategy, as practiced in the field of cybersecurity for a long time. This paper considers the problem of deepfake attacker attribution in the domain of audio. We present several methods for creating attacker signatures using low-level acoustic descriptors and machine learning embeddings. We show that speech signal features are inadequate for characterizing attacker signatures. However, we also demonstrate that embeddings from a recurrent neural network can successfully characterize attacks from both known and unknown attackers. Our attack signature embeddings result in distinct clusters, both for seen and unseen audio deepfakes. We show that these embeddings can be used in downstream-tasks to high-effect, scoring 97.10% accuracy in attacker-id classification.

Key findings

Low-level acoustic features proved inadequate for attacker attribution. RNN embeddings successfully characterized attacks from known and unknown attackers, achieving 97.10% accuracy in attacker ID classification on ASVspoof 2019. The model also showed promising generalization to the unlabeled ASVspoof 2021 dataset.

Approach

The paper explores two methods for creating attacker signatures: low-level acoustic features and neural network embeddings. They find that RNN embeddings trained with Angular Prototypical loss are significantly more effective at clustering and classifying deepfakes based on their creator than low-level features.

Datasets

ASVspoof 2019 (Logical Access dataset), ASVspoof 2021 (unlabeled data used for visualization)

Model(s)

Recurrent Neural Network (RNN) with LSTM layers and a dense projection layer, trained using Angular Prototypical loss; a simple feed-forward neural network used for downstream classification.

Author countries

Germany, Germany, UK

← Previous