Adversarial Sample Generation Against Audio Forensics

Digital audio,as a common digital media carrier in our society,can be obtained and modified easily via the audio processing software such as Cool Edit,Cakewalk and Audition CS6.Recently,digital audio has an increasingly growth to the court as evidence.Therefore,for protecting the security and information,a lot of digital audio forensic technologies have been proposed to verify the source,authenticity,and integrity of digital audio.So far,digital audio forensic technologies have been rapid development,and achieved a significant result.Most existing audio forensic methods,however,are focus on the detection accuracy of distinguishing the falsified audios from original ones.Generally,the forensic researchers have taken a little consideration on the safety and reliability aspects when they design the forensic method.It is assumed that the audio is never been processed via an anti-forensic manipulation by the illegal person who may falsified the audio before the forensic detection.It is obvious that the illegal person will take some manipulations to hide their falsified artifact to avoid the detection of forensic researchers.Hence,most existing forensic technology will fail if the anti-forensic techniques are applied in the falsified audios.Recently,forensic technology has increasingly growth in many areas to defend the illegal manipulations.However,to be an adversary of the forensic method,there have a little consideration about the research of anti-forensics.It is very important to take some anti-forensic research to expose the weakness of the existing audio forensic methods.To be honest,antiforensics can force the forensics have a significant development and improvement.Hence,the audio anti-forensics is the focus of this thesis.This thesis studies the algorithm of audio source identification and audio compression history detection and design the specific post-manipulations to attack those forensic algorithms.In this thesis,the research work has been carried out mainly from the following three aspects.Firstly,three algorithms of audio source identification and AMR compression detection have been selected to evaluate the preliminary anti-forensic performance,respectively.Before carrying out anti-forensic study,we first construct the corresponding evidence database for training these forensic algorithms.Secondary,to expose the weakness of the audio source identification,we designed two strategies: confusing attack and misleading attack.And the corresponding loss function have been designed for building these attacks.The generative adversarial network is applied for our attack task with an additional forensic model,which can force the generator to obtain a well attack performance.Specially,to obtain a well quality of the generated audios,a perceptual loss function is designed to constraint the modified altitude by the generator.In the iterative training of three model,we trained the generator by data-driven manner.Experimental results show that the proposed method can significantly reduce the detection accuracies of three identification methods from about 97% to less than 5% in confusing attack.For the misleading attack,a misleading rate of more than 81.32% has been achieved while ensuring the perceptual quality of the anti-forensic audio.The average PESQ scores of the audios are both maintained in about 3.4.Finally,we have made an extensive analysis for the AMR compression detection and proposed two anti-forensic scenes.In first scene,it is assumed that the anti-forensic audios should be compressed to AMR-format if the investigators only received the AMR-format.To improve the perceptual quality of the anti-forensic audios and remove the artifact introduced by AMR compression,we applied the generative adversarial network for reversing the transformation of the AMR compression.The experimental results demonstrate that the proposed method is capable of removing the forensically detectable artifacts of AMR compression under various ratios with an average successful attack rate about 94.75%,which means the modified audios generated by our well-trained generator can treat the forensic detector effectively.Moreover,we show that the perceptual quality of the generated AMR audio is well preserved which obtained an average PESQ value about 3.3.In second scene,it is assumed that the investigators only received the WAVformat audios.We applied two optimization algorithms(Fast Gradient Method,FGSM and Jacobian-based Saliency Map Attack,JSMA)to build our attack.In the FGSM and JSMA,as long as a few values of the audio samples are changed,it is able to force the double compressed audio be similar with the single compressed on in statistical distribution.The average PESQ score of those adversarial audios are about 4.2 modified by the two optimization methods while the successful attack rate remained at 94%.It is obviously that the FGSM and JSMA can both perform an effective attack while maintaining the perceptual quality.