Universal Convolutive Attacks

• Universal Convolutive Attacks are adversarial perturbations that use a fixed LTI filter to degrade classifier performance in audio and time-series applications.
• They employ optimization techniques with constraints like central-tap reset and in-band filtering to ensure stealth and robustness against standard defenses.
• Empirical evaluations show marked increases in error rates for systems such as speaker verification, deepfake detection, and keyword classification under both digital and OTA conditions.

Universal Convolutive Attacks are a class of adversarial attacks on time-series classifiers, especially those in the audio and speech domains, characterized by the application of a fixed, input-agnostic perturbation generated through convolution with a linear time-invariant (LTI) filter. These attacks are designed to be universal (reusable across inputs of arbitrary content and duration), time-invariant, and robust to real-world conditions and standard pre-processing defenses such as filtering or synchronization misalignments. Research demonstrates their effectiveness in degrading the performance of state-of-the-art systems for speaker verification spoofing, deepfake detection, keyword classification, and general time-series inference under both digital and over-the-air (OTA) conditions (Panariello et al., 2023, Fakih et al., 2023, Coda et al., 2022).

1. Conceptual Foundations

Universal Convolutive Attacks operate by applying a fixed LTI filter to the input signal, resulting in a convolutive distortion that is shared, or "universal," across all attacked inputs. If $x(t)$ denotes an input waveform and $h(t)$ denotes the impulse response of the universal LTI filter, the adversarial example is constructed as

$x_{\mathrm{adv}}(t) = (h * x)(t)\,,$

where $*$ denotes convolution. The filter $h(t)$ (or its discrete counterpart $h[n]$) is optimized once and for all and subsequently used across diverse inputs, ensuring attack transferability across speakers, content, and durations (Panariello et al., 2023, Coda et al., 2022).

The universality property leverages the tendency of model-specific artifacts or vulnerabilities to cluster in similar regions of the spectral domain for a given attack or spoofing algorithm. By optimizing a filter that exploits these spectral weaknesses, the attack can be generalized beyond specific input samples (Panariello et al., 2023).

2. Mathematical Formulation and Optimization Objectives

The optimization of the universal filter is typically posed as the minimization or maximization of a loss function over a training set of target inputs, subject to constraints ensuring fidelity and stealth. Two canonical formulations appear in the literature:

1. Direct score maximization (e.g., for spoofing countermeasures $f_{\mathrm{CM}}$ with large scores reflecting bona fide content):

$\max_{m} \sum_{i=1}^N f_{\mathrm{CM}}(s_i * m)\,,$

where $m$ collects the $L$ filter coefficients and $h(t)$0 are training samples (Panariello et al., 2023).

2. Cross-entropy surrogate (for classifiers with softmax output):

$h(t)$1

Fidelity and imperceptibility constraints are implemented in multiple ways:

• Impulse-preserving initialization and central-tap reset: The central coefficient of $h(t)$2 is pinned at unity, with off-center taps initialized to small values and forcibly reset after each update, maintaining proximity to the identity filter.
• Filter length ($h(t)$3) as distortion control: Larger $h(t)$4 increases convolutional strength (and attack efficacy) but may introduce perceptible reverberation (Panariello et al., 2023).
• Frequency constraints: The filter’s frequency response may be restricted to in-band frequencies present in the original data, which enhances stealth and makes the perturbation robust to filtering (Coda et al., 2022).

In the frequency-domain approaches, e.g., the Universal Fourier Attack and AudioFool, the attack is formulated as

$h(t)$5

with $h(t)$6 selected in the Fourier domain via gradient ascent to maximize adversarial loss while matching the data’s spectral support, ensuring the perturbation remains in-band and filter-resistant (Coda et al., 2022, Fakih et al., 2023).

3. Algorithmic Approaches

The design of universal convolutive attacks involves training a small set of filter parameters using first-order optimization, often in a white-box setting. The general procedure includes:

• Filter initialization (Dirac-like or zero in the frequency domain).
• Mini-batch training: Sample batches from the training set and apply the current filter to produce adversarial examples.
• Loss computation and backpropagation: Compute the attack objective (e.g., maximization of spoof CM score, classification loss) and its gradient with respect to filter coefficients.
• Update with optimizer: Parameters updated using Adam, SGD, or momentum in the appropriate domain.
• Constraint enforcement: Central-tap reset (Malafide), $h(t)$7 norm projection (AudioFool, Universal Fourier Attack).

A representative pseudocode for Malafide (white-box mode) (Panariello et al., 2023):

$h(t)$9

In the frequency-domain, e.g., the Universal Fourier Attack (Coda et al., 2022), random time shifts and spectral masking are employed to guarantee time-invariance and in-band support.

The AudioFool attack exploits zero-phase (cyclic) structure to guarantee shift-invariance:

$h(t)$8

Updates are made in the frequency domain and projected back to respect an SNR or energy constraint (Fakih et al., 2023).

4. Empirical Evaluation and Impact

Universal convolutive attacks are benchmarked primarily on audio and time-series classification tasks, including speaker verification spoofing countermeasures (CMs), keyword spotting, and unintended radiated emission recognition. The primary attack metrics include classification error rates (EER, adversarial success rate) pre- and post-attack, as well as the robustness of the attack to black-box transfer, common filtering operations, and over-the-air deployment:

Malafide (spoofing detection systems) (Panariello et al., 2023):

• On AASIST CM, EER increases from 0.71% (no filter) to 9.73% (attack), RawNet2 from 3.29% to 21.46%.
• Black-box transfer: filter learned on one CM raises the EER on other CMs by up to an order of magnitude.
• SASV system (AASIST+ASV) EER increases from 1.23% to 11.21% under attack.

AudioFool (ASR DoS) (Fakih et al., 2023):

• On AudioNet (92.28% baseline accuracy), attack reduces OTA accuracy to 12% at SNR=10 dB.
• Frequency-domain perturbations robust across 0–30 dB SNR; maintain high fool rate across models.
• Notch/band-stop filters ineffective due to attack in-band energy and zero-phase structure.

Universal Fourier Attack (general time series) (Coda et al., 2022):

• On Speech Commands, adversarial success rate (ASR) remains ≥ 20% below SNR 14 dB (white-box), with strong black-box transfer.
• Resilient against MP3 compression, quantization, and transform-and-compare defenses.

Table: Empirical Impact of Universal Convolutive Attacks

Attack	Target System	Baseline Error	Post-attack Error	Transferability / Robustness
Malafide	AASIST CM	0.71% EER	9.73% EER	Strong black-box generalization
Malafide	SASV (AASIST+ASV)	1.23% EER	11.21% EER	Weak against SSL-based CMs
AudioFool	AudioNet (OTA, SNR=10 dB)	92% Acc.	12% Acc.	Robust to OTA, notch filtering
UFA	Speech Commands (ResNet-18)	—	≥20% ASR <14 dB	Not detected by standard defenses

Universal convolutive attacks degrade classifier reliability by an order of magnitude under practical conditions.

5. Robustness, Transferability, and Limitations

Universal convolution-based attacks achieve synchronization-free effectiveness, meaning they do not require knowledge of or alignment with the utterance start time and can succeed in the presence of temporal offsets (as required for OTA scenarios) (Fakih et al., 2023). Their core reliance on frequency-domain properties and time-invariance permits high transferability across:

• Input content (utterance, speaker)
• System architectures (as evidenced by AudioFool transfer rates, >90% fooling across distinct models)
• Some black-box attack scenarios

However, defenses exist. Self-supervised learning (SSL)–based countermeasures exhibit heightened resilience, with near-baseline error rates even under attack, likely due to their aggregation of higher-level representations less vulnerable to simple frequency-domain manipulations (Panariello et al., 2023). Integrated systems combining ASV and SSL-based CMs retain robustness, and simple filtering is ineffective provided the perturbation's energy is strictly within the data band.

Limitations include:

• Attacks are generally untargeted (cause misclassification but not specific outputs).
• Perceptibility trade-offs: longer filter lengths may introduce audible artifacts. In practice, lengths of 257–513 taps yield acceptable distortion (Panariello et al., 2023, Coda et al., 2022).
• Physical-world (e.g., room OTA) attack efficacy is demonstrated for AudioFool, though similar deployment for time-series attacks outside speech remains largely untested (Fakih et al., 2023, Coda et al., 2022).

6. Defenses and Future Directions

Defensive strategies explored and suggested in the cited research include:

• Adversarial training with LTI-filter-based perturbations: Augmenting training data with convolutionally perturbed inputs may build resilience (Panariello et al., 2023).
• Randomized front-end filtering or transform-invariant models: May disrupt the regularities exploited by the universal filter but at potential fidelity cost.
• Joint ASV+CM architectures: May suppress attack transfer by requiring agreement across multiple, mutually robust components.
• Band-limited filtering constraints: Restricting attacks to data band limits filtering defenses; future defenses might instead sample randomized or multi-band filters in adversarial training (Coda et al., 2022).

A plausible implication is that as universal convolutive attacks become more powerful and stealthy, defense strategies may need to move beyond input pre-processing toward joint, end-to-end robust model architectures and exhaustive adversarial exposure during training.

7. Extensions and Applications

Although audio and speech are the primary focus, the Fourier-based universal convolutive paradigm generalizes to arbitrary time-series data, such as radiated emission signatures, ECG, finance, or sensor streams (Coda et al., 2022). Extensions may include:

• Targeting multi-channel or multi-rate systems via joint optimization of filter sets.
• Combining with state-dependent or spatially-varying filters for more targeted attack scenarios.
• Optimizing for physical-world deployment conditions, including propagation, reverberation, and device characteristics.

Universal convolutive attacks thus represent a durable, flexible adversarial strategy, exposing vulnerabilities in a wide class of time-series inference systems across digital and real-world modalities (Panariello et al., 2023, Fakih et al., 2023, Coda et al., 2022).