Pipe Overflow: Smashing Voice Authentication for Fun and Profit
  Recent years have seen a surge of popularity of acoustics-enabled personal
devices powered by machine learning. Yet, machine learning has proven to be
vulnerable to adversarial examples. Large number of modern systems protect
themselves against such attacks by targeting the artificiality, i.e., they
deploy mechanisms to detect the lack of human involvement in generating the
adversarial examples. However, these defenses implicitly assume that humans are
incapable of producing meaningful and targeted adversarial examples. In this
paper, we show that this base assumption is wrong. In particular, we
demonstrate that for tasks like speaker identification, a human is capable of
producing analog adversarial examples directly with little cost and
supervision: by simply speaking through a tube, an adversary reliably
impersonates other speakers in eyes of ML models for speaker identification.
Our findings extend to a range of other acoustic-biometric tasks such as
liveness, bringing into question their use in security-critical settings in
real life, such as phone banking.
