Can I Hear Your Face? Pervasive Attack on Voice Authentication Systems with a Single Face Image

Can I Hear Your Face? Pervasive Attack on Voice Authentication Systems with a Single Face Image

Speakers: Nan Jiang, Jun Han

Conference: USENIX Security '24

YouTube: https://www.youtube.com/watch?v=H6gKHqu4Rdg

Overview

This talk introduces "Voice," a groundbreaking generative model that demonstrates a pervasive new attack vector against voice authentication systems. Traditionally, deepfake attacks on voice authentication require high-quality voice recordings of the victim, which are often difficult to obtain due plagued by issues like background noise or limited availability. Voice fundamentally shifts this paradigm by synthesizing voice recordings from a single, readily available face image of the target. This innovative approach significantly lowers the bar for attackers, enabling them to bypass widely used voice authentication platforms and activate voice assistants with unprecedented ease.

The research presented by Nan Jiang and Jun Han, with the presentation delivered by B from National University of Singapore, highlights a critical security vulnerability that extends beyond public figures to everyday users. By leveraging the subtle correlations between facial appearance and vocal characteristics, Voice can generate diverse candidate voice recordings that successfully fool commercial systems. This work serves as a stark warning to both researchers and industry professionals, urging a re-evaluation of current voice authentication security measures and the immediate adoption of more robust defenses against these evolving deepfake threats.

The implications of "Voice" are far-reaching, demonstrating that an attacker, armed with nothing more than a profile picture from social media or a captured image, could potentially gain unauthorized access to accounts or control smart devices. The study not only exposes the fragility of existing systems but also predicts an escalating threat landscape as these techniques advance, emphasizing the urgent need for a "wakeup call" to enhance security protocols before such attacks become commonplace.

Background

▶ Watch: Introduction: Pervasive attack on voice authentication with face image (0:00)

Voice authentication has become an integral part of modern digital life, offering convenience and a seemingly intuitive layer of security. Platforms like WeChat allow users to log in by reading digits, while voice assistants such as Siri, Alexa, and Google Assistant provide personalized services by recognizing a user's unique vocal signature. This widespread adoption, however, has also made these systems attractive targets for malicious actors.

Existing voice deepfake attacks have certainly demonstrated the potential to compromise these systems, but they have historically been constrained by significant practical limitations. The primary hurdle has been the requirement for high-quality voice recordings of the victim. Obtaining such recordings is a non-trivial task; downloading them online restricts the pool of potential victims, often limiting attacks to public figures whose voices are readily available. Covertly recording a target's voice in real-world scenarios frequently results in recordings marred by background noise, distortion, or insufficient length, rendering them ineffective for sophisticated deepfake synthesis. These challenges have kept voice deepfake attacks from becoming truly pervasive against a broad range of targets.

The core premise behind "Voice" is an exploration of the subtle, often subconscious, association between a person's face and their voice. While the connection between external facial features and the complex internal mechanisms of voice production (such as vocal cord shape, chest cavity resonance) is weak, the human brain instinctively forms expectations. For instance, a narrow lower face might be associated with a brighter sound, while a wider chest space could suggest a deeper voice. These physiological connections, though not direct predictors, hint at a latent correlation that advanced machine learning models can exploit. By posing the question: "Can we launch a voice deepfake attack leveraging only a single image of the victim without requiring voice recordings?", the researchers set out to overcome the long-standing limitation of voice deepfake attacks and pave the way for a new, more pervasive threat model.

Key Findings

▶ Watch: Exploring the correlation between facial appearance and voice (3:00)

The research behind "Voice" yielded several critical findings that underscore the pervasive vulnerability of current voice authentication systems:

Firstly, "Voice" successfully demonstrated its ability to attack all eight tested systems, encompassing both popular commercial authentication platforms and cutting-edge research-based models. This included widely used services like WeChat, Microsoft, and iFLYTEX, as well as common voice assistants such as Siri, Google Assistant, and Baidu. This broad success rate highlights a systemic weakness across diverse implementations of voice-based authentication.

A significant quantitative finding was that "Voice" achieved an attack success rate of at least 50% for on-device authentication applications. This means that for at least half of the subjects in the test set, their voice authentication could be bypassed using a voice synthesized solely from their face image. This percentage is particularly alarming for daily-use applications, indicating a substantial security risk for ordinary users.

Furthermore, the study revealed that combining facial features with voice synthesis significantly enhances attack efficacy. When compared to state-of-the-art voice deepfake models that rely solely on voice recordings, "Voice" demonstrated comparable attack performance. More strikingly, when the attack leveraged both face and voice information (implying a scenario where some voice data might be available, but augmented by facial features), the attack success rate improved by more than three times. This indicates a powerful synergy between the two modalities.

The research also confirmed that "Voice" significantly outperforms attacks that rely only on generic demographic information like age and gender, affirming the model's ability to extract and utilize more specific, individual characteristics from a face image. Finally, the attack proved robust to various image conditions, including occlusion (e.g., part of the face covered) and low resolution, further broadening the practical applicability of the attack in real-world scenarios where perfect image quality is not always guaranteed. These findings collectively paint a concerning picture of the current state of voice authentication security.

Technical Deep Dive

▶ Watch: High-level design of the VoiceFace generative model (5:10)

The core innovation of "Voice" lies in its ability to bridge the gap between a static face image and dynamic voice characteristics. The researchers conceptualized human voice features as comprising two distinct types: face-dependent features and supplementary features. Face-dependent features are those aspects of a voice that might correlate with facial appearance, such as pitch or certain tonal qualities. Supplementary features, on the other hand, encompass the vast majority of vocal nuances that are largely independent of external facial structure, influenced instead by internal anatomy like vocal cord shape and chest resonance. The challenge was to extract the former from an image and then intelligently generate the latter to create a complete, authentic-sounding voice.

The high-level design of "Voice" involves a two-stage process. First, a neural network is employed to take a single face image as input and extract the corresponding face-dependent features. This initial step quantifies the subtle vocal cues that can be inferred from a person's appearance. The more complex challenge then arises: how to generate the crucial supplementary features, for which a face offers almost no direct insight.

This is where the generative power of the model comes into play. A sophisticated generative model takes the extracted face-dependent features as its primary input. Its task is to automatically synthesize the supplementary features, effectively "filling in the blanks" to construct a complete set of voice features. Once both sets of features are combined, they are fed into a voice synthesizer module (not explicitly detailed in the transcript, but implied by the process) to produce the final voice recordings.

The training of this generative model, particularly for synthesizing supplementary features, is the technical cornerstone of "Voice." The researchers utilized a Variational Autoencoder (VAE) architecture, a powerful class of generative models known for learning latent representations of data.

During the training phase, the VAE was fed two types of input:

1. Ground truth voice features: These were complete sets of voice features obtained from a large YouTube video dataset, providing a rich source of real human voices.
2. Face-dependent features: These were extracted from the corresponding face images within the same dataset.

The VAE's architecture was specifically designed to handle these inputs:

• Encoder: This component of the VAE takes only the ground truth complete voice features as input. Its crucial role is to act as a "funnel," filtering out the face-dependent features present in the ground truth and isolating only the supplementary features. This is achieved through careful design and dimensionality reduction.
• Decoder: The decoder then receives two distinct inputs: the face-dependent features (extracted directly from the face image) and the output of the encoder (the isolated supplementary features). Its objective is to combine these two inputs to reconstruct the complete set of voice features.

To ensure the encoder effectively isolates supplementary features and the overall model accurately synthesizes voices, several key training objectives and techniques were employed:

1. Reconstruction Loss: The primary objective during joint training of the encoder and decoder was to minimize the distance between the ground truth voice features and the reconstructed voice features produced by the decoder. This ensures the synthetic voice features closely resemble real human voices.
2. Optimal Encoder Dimension: A critical empirical decision involved choosing the appropriate dimension for the encoder's latent space. If the dimension is too wide, the encoder might retain too many features, failing to discard the unwanted face-dependent information. Conversely, if it's too narrow, it might discard too much vital supplementary information. The researchers empirically determined the optimal dimension that effectively discards face-dependent features while preserving all necessary supplementary features. This fine-tuning is crucial for the model's ability to generalize and synthesize diverse voices.
3. KL Divergence Loss: To further regularize the encoder's output and make the supplementary features easily manipulable during the testing phase, a Kullback-Leibler (KL) divergence loss was applied. This loss function forces the encoder's output (representing supplementary features) to follow a Gaussian distribution. Representing supplementary features as simple Gaussian vectors is immensely beneficial during testing.

In the testing phase, this Gaussian representation becomes the key to generating diverse candidate voices. Instead of requiring ground truth supplementary features, the model can simply sample random Gaussian vectors. Each unique Gaussian vector represents a different permutation of supplementary features. These sampled vectors are then combined with the face-dependent features extracted from the target's single face image, fed into the decoder, and subsequently synthesized into a variety of candidate voice recordings. This iterative sampling process allows the attacker to generate multiple synthetic voices, increasing the probability that at least one will successfully bypass the target voice authentication system.

The technical elegance of "Voice" lies in its ability to implicitly learn the complex relationship between facial features and voice components, then disentangle and recombine them to produce convincing fakes, all from a single visual input.

Demo / Proof of Concept

▶ Watch: Detailed explanation of generative model training using VAE (6:00)

While the talk did not feature a live, interactive demonstration of the "Voice" system in action, the researchers clearly articulated two primary attack scenarios to illustrate the practical implications of their work: remote attacks and proximity attacks. These scenarios serve as conceptual proof-of-concept, outlining how an attacker, whom they refer to as "Mallory," could leverage the synthetic voices generated by "Voice."

In a remote attack scenario, Mallory targets an individual like "Bob." The attack vector begins with Mallory obtaining a single face image of Bob, for example, from his LinkedIn profile. This profile photo is then input into the "Voice" generative model, which synthesizes a series of candidate voice recordings. Mallory would then use Bob's contact information, such as his phone number or email (acting as the account ID), and play these synthetic voice recordings through an external speaker to attempt to remotely log into Bob's account. This demonstrates how readily available online images can be weaponized against remote authentication systems.

The proximity attack scenario illustrates a different, but equally concerning, threat. Imagine a smart home environment where voice commands control devices like door locks. Mallory, acting as a malicious visitor, could use a face image of the homeowner (perhaps captured surreptitiously or obtained beforehand) as input to "Voice." The generated synthetic voices could then be used to execute malicious commands on the homeowner's smart devices, such as "opening the door" or disabling security systems. This highlights the risk to physical security and smart infrastructure, where a malicious actor gains physical access or control by impersonating the legitimate user's voice.

These articulated scenarios effectively convey the pervasive nature of the "Voice" attack, demonstrating its applicability in both digital and physical realms without needing a complex live demo. The threat model assumes the attacker's goal is to compromise voice authentication systems and that they can obtain at least one face image of the victim, which the outlined attacks clearly satisfy.

Defensive Implications

▶ Watch: Evaluation methodology across various authentication systems (8:30)

The "Voice" research presents a critical wakeup call for the cybersecurity community, highlighting significant defensive implications for voice authentication systems. The immediate and most pressing implication is the demonstrated pervasive vulnerability of existing systems. With "Voice" successfully attacking major commercial platforms like WeChat, Microsoft, and iFLYTEX, and achieving a 50% success rate on on-device applications, it's clear that current defenses are insufficient against this new class of attack.

The researchers explicitly state that "Voice" is "just the beginning, not the upper limit of novel voice deepfake attacks." They anticipate the development of even stronger attacks, particularly by leveraging dynamic facial features through video inputs rather than static images, and through continuous optimization of model structures. As these techniques inevitably advance, the threat posed by voice deepfakes will only grow in sophistication and effectiveness. This necessitates a proactive approach to defense, moving beyond reactive patching to fundamental architectural improvements.

A key concern raised is the lack of adoption of existing countermeasures in real-world systems. Technologies like deepfake detection and liveness detection exist, designed to differentiate between genuine human input and synthetic or recorded audio. However, their widespread implementation in commercial voice authentication platforms remains limited. The "Voice" attack demonstrates that voice deepfakes are no longer confined to public figures or highly targeted victims; they can be launched against anyone with an accessible face image. This broadens the threat surface dramatically, making the integration of robust liveness detection and deepfake detection mechanisms an urgent priority.

Defenders need to consider multi-modal authentication that incorporates more than just voice, or advanced liveness checks that challenge the user in ways difficult for AI to mimic (e.g., asking them to say specific randomized phrases, or detecting subtle physiological cues in the voice that are hard to synthesize). Furthermore, security awareness campaigns are crucial to inform users about the risks of sharing face images online, especially when linked to their identity. Ultimately, the research calls for a concerted effort from researchers and industry stakeholders to not only develop more resilient voice authentication algorithms but also to ensure their practical deployment to safeguard against the escalating risks posed by AI-driven voice impersonation.

Key Takeaways

• Voice authentication systems, including major commercial platforms (WeChat, Microsoft, iFLYTEX) and voice assistants (Siri, Google Assistant), are vulnerable to a new class of deepfake attack.
• The "Voice" model can synthesize convincing voice recordings from just a single face image of a target, eliminating the need for high-quality voice recordings.
• The attack achieves an impressive success rate of at least 50% for on-device authentication applications, making everyday users susceptible.
• Current deepfake detection and liveness detection countermeasures are not widely adopted in real-world voice authentication systems, leaving a critical security gap.
• The threat is expected to escalate with advancements like leveraging dynamic facial features from video inputs and further model optimization, necessitating proactive and robust defensive strategies.
• There is an urgent need for increased awareness among users and a concerted effort from industry and researchers to implement stronger, multi-modal authentication and advanced liveness detection to safeguard against pervasive voice deepfake attacks.

About the Speaker(s)

The research presented in the talk "Can I Hear Your Face? Pervasive Attack on Voice Authentication Systems with a Single Face Image" was conducted by Nan Jiang and Jun Han. While the presentation at USENIX Security '24 was delivered by B from National University of Singapore, Nan Jiang and Jun Han are credited as the authors of this significant work. Their expertise lies in the intersection of artificial intelligence, security, and human-computer interaction, focusing on the vulnerabilities and defensive strategies related to emerging technologies like deepfakes and voice authentication. Their contributions highlight a critical area of research concerning the security implications of advanced generative models.