  Adversarial attacks pose a severe security threat to the state-of-the-art
speaker identification systems, thereby making it vital to propose
countermeasures against them. Building on our previous work that used
representation learning to classify and detect adversarial attacks, we propose
an improvement to it using AdvEst, a method to estimate adversarial
perturbation. First, we prove our claim that training the representation
learning network using adversarial perturbations as opposed to adversarial
examples (consisting of the combination of clean signal and adversarial
perturbation) is beneficial because it eliminates nuisance information. At
inference time, we use a time-domain denoiser to estimate the adversarial
perturbations from adversarial examples. Using our improved representation
learning approach to obtain attack embeddings (signatures), we evaluate their
performance for three applications: known attack classification, attack
verification, and unknown attack detection. We show that common attacks in the
literature (Fast Gradient Sign Method (FGSM), Projected Gradient Descent (PGD),
Carlini-Wagner (CW) with different Lp threat models) can be classified with an
accuracy of ~96%. We also detect unknown attacks with an equal error rate (EER)
of ~9%, which is absolute improvement of ~12% from our previous work.
