Research map / Adversarial robustness and security / Certified and empirical robustness
Certification of Speaker Recognition Models to Additive Perturbations
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Transfers randomized smoothing certification to speaker identification embedding models, using a scalar mapping of the smoothed embedding and Hoeffding-based confidence intervals to certify l2-bounded additive perturbations on VoxCeleb.
Problem
Speaker recognition models are vulnerable to adversarial additive perturbations, and no provable robustness certificates existed for speaker recognition embedding models in few-shot (enrollment-centroid) identification.
Approach
Replaces the smoothed-classifier certificate with a scalar mapping phi of the smoothed embedding onto the bisector between the two closest enrollment centroids, yielding a certified l2 radius sigma*Phi^-1(phi) for nearest-centroid matching; Hoeffding confidence bounds make the estimate practical.
Key results
- Proposed scalar-mapping certificate gives a marginal but consistent improvement in certified accuracy over the Smoothed Embeddings (SE) baseline across the swept settings (sigma, M, K, audio length) for ECAPA-TDNN and Pyannote backbones.
- ECAPA-TDNN (d=192) reaches plain accuracy 95.0% with EER 0.34% for f and 0.89% for smoothed g; Pyannote-based f reaches 88.3% accuracy with EER 1.17%.
- Empirical robust accuracy under PGD and Gaussian noise is substantially higher than certified accuracy, indicating a gap between empirical and certified robustness.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Increase smoothing noise standard deviation σ (ablation) | Randomized smoothing certification (ours, SE, and RS) · Speaker identification | certified robustness | Mixed |
| Vary confidence level α (ablation) | Proposed certification method · Speaker identification | certification | No clear effect |
| Increase the number of enrollment audios M (ablation) | Proposed certification method · Speaker identification | certified accuracy | No clear effect |
| Increase audio length (ablation) | Proposed certification method · Speaker identification | certified accuracy | Helped |
| Increase maximum sample count N_max (ablation) | Proposed certification method · Speaker identification | certification | Helped |
| Increase the number of enrolled speakers K (ablation) | Proposed certification method · Speaker identification | classification difficulty | Hurt |
| Use the proposed certification method instead of Smoothed Embeddings | Proposed method and SE · Speaker identification | certified accuracy | Helped |
| Use vanilla randomized smoothing over class probabilities instead of embedding-space certification | Proposed certification method · Speaker identification | certified radius | Hurt |
Surprising findings
- Empirical robustness under PGD is far above certified accuracy, and the authors note stronger attacks may push worst-case ERA closer to CA.
- Certified radii from vanilla RS over class probabilities are better than the proposed embedding-based certificate, though the proposed method does not need class probabilities.
Limitations
- Improvement over SE is only marginal in the reported experiments.
- Certification applies only to additive perturbations for a fixed voiceprint and does not transfer to new utterances of the same speaker.
- Not applicable to speaker verification (ASV) directly; evaluated only in the identification setting.
Experimental setup
Datasets: VoxCeleb1 VoxCeleb2
Benchmarks: VoxCeleb1 VoxCeleb2
Metrics: certified accuracy empirically robust accuracy equal error rate accuracy
Baselines: Smoothed Embeddings (SE) vanilla randomized smoothing (classification) Projected Gradient Descent (empirical) Gaussian noise
Builds on: randomized smoothing Smoothed Embeddings Clopper-Pearson
Closest papers by meaning
- Speech Robust Bench: A Robustness Benchmark For Speech Recognition (ICLR 2025 · similarity 0.86)
- What Was That Again? Certified Robustness for Automatic Speech Recognition (NeurIPS 2026 · similarity 0.86)
- Incremental Randomized Smoothing Certification (ICLR 2024 · similarity 0.83)
- Certified Adversarial Robustness via Randomized $\alpha$-Smoothing for Regression Models (NeurIPS 2024 · similarity 0.83)
- Learning Better Certified Models from Empirically-Robust Teachers (NeurIPS 2026 · similarity 0.83)
- Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing (ICML 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.