SA: Sliding attack for synthetic speech detection with resistance to clipping and self-splicing

Deep neural networks are vulnerable to adversarial examples that mislead models with imperceptible perturbations. In audio, although adversarial examples have achieved incredible attack success rates on white-box settings and black-box settings, most existing adversarial attacks are constrained by the inputlength. AMorepracticalscenarioisthattheadversarialexamplesmustbeclippedorself-spliced andinputintotheblack-boxmodel. Therefore, itisnecessarytoexplorehowtoimprovetransferability in diﬀerent input length settings. In this paper, we take the synthetic speech detection task as an example and consider two representative SOTA models. We observe that the gradients of fragments with the same sample value are similar in diﬀerent models via analyzing the gradients obtained by feeding samples into the model after cropping or self-splicing.Inspired by the above observation, we propose a new adversarial attack method termed sliding attack. Speciﬁcally, we make each sampling point aware of gradients at diﬀerent locations, which can simulate the situation where adversarial examples are input to black-box models with varying input lengths. Therefore, instead of using the currentgradientdirectlyineachiterationofthegradientcalculation, wegothroughthefollowingthree steps. First, we extract subsegments of diﬀerent lengths using sliding windows. We then augment the subsegments with data from the adjacent domains. Finally, we feed the sub-segments into diﬀerent models to obtain aggregate gradients to update adversarial examples. Empirical results demonstrate that our method could signiﬁcantly improve the transferability of adversarial examples after clipping or self-splicing. Besides,


Introduction
Deep neural networks (DNNs) are vulnerable to adversarial examples [9,30] that, by adding small perturbations, are indistinguishable from legitimate examples but lead to incorrect model predictions.
Making adversarial examples has received increasing attention in recent years [2,3,18,21,25], as it can not only identify model vulnerabilities [25,30], but also help improve model robustness. In addition, adversarial examples also show good transferability between models [23,26], i.e., adversarial examples made for one model can still fool other models, enabling black-box attacks in real-world applications without any knowledge of the victim model. The existing adversarial attacks show significant effectiveness in the white-box setting, in which the attacker can access the structure and parameters of the target model [3,18], but the transferability in the black-box model is poor. To address this issue, recent works focus on improving the transferability of adversarial examples by advanced gradient calculation (e.g., Momentum, Nesterov's accelerated gradient, etc.) [5,22], attacking multiple models [23], or adopting various input transformations (e.g., random resizing and padding, translation, scale, admix, etc.) [6,22,36]. However, the above work is mainly applied in the image field, and there is a lack of related work on improving the transferability of adversarial examples in audio. Existing works [16,28,29] in audio only consider cases where the input lengths of black and white-box models are consistent. In images, the resizing operation can effectively solve the problem of varying input size and retaining most of the image information. However, in audio classification, it is common to clip too long or self-splice too short audio and input it to the model of the corresponding length, which makes the processed audio very different from the original input audio and dramatically reduces the transferability in black-box models.
In this paper, we evaluate several typical adversarial attack methods and observe that they are less transferable in the black-box model after clipping or self-splicing. Since attacking ensemble models effectively improves the transferability of adversarial examples, we intuitively think of attacking different input length models. However, previous ensemble attacks only consider integrating models with the same input length, and we need to input samples into models with different input lengths after clipping or self-splicing. Clipping and self-splicing lead to widely different input samples, and aggregating the gradients of these samples has the potential to produce misleading gradients. Therefore, we first analyze the sample's gradients after clipping and selfsplicing. Although clipped samples or self-spliced samples are quite different from the original samples, their sampling points are all derived from the original samples. Then we analyze the gradient of the common area of the original sample, the clipped sample, and the self-spliced sample, and the results show that the gradients of the fragments with the same sampling value are similar in different models. Hence aggregating these similar gradients can stabilize the gradient update direction and improve the attack success rate on whitebox models. Considering that the input length and cutting method of the black-box models are uncertain, the positions of the same sampling point on the samples before and after the preprocessing of the black-box model are different.
Based on the above observations, we propose a novel sliding attack (SA), which extracts sub-segments at different positions of the original sample through a sliding window and feeds them into different models to obtain gradients and aggregate these gradients to update adversarial examples. Furthermore, inspired by VI-FGSM [35], in each iteration, we not only compute the gradient of the current data point but also use the gradient of the data in the neighboring domain of the current data point. The rationale behind this design includes three aspects. First of all, we use sliding windows of different lengths to select sub-segments and input models of different input lengths, which simulates the change of the position of the sampling points after the black box preprocesses the input samples and allows each sampling point to perceive the gradient at different positions in models. Second, we observe that the gradients of segments with the same sampling value are similar across different models. Therefore, aggregating the gradients of these sub-segments selected by sliding windows can enhance the transferability of adversarial examples and improve the success rate of attacking white-box models. Finally, the data in the adjacent domain is similar to the original data point, so the gradient of the data point in the adjacent domain is similar to the gradient of the original data point. Aggregating these gradients can further effectively stabilize the gradient update direction and improve the threat of adversarial examples.
We implemented extensive experiments on two representative SOTA models (RawNets [31], LCNNs [19,39]) based on the ASVspoof2021 dataset [34,38]. Ablation experiments show that our proposed method significantly improves the current sota attack success rate on black-box Rawnets by 192%. In addition, SA can effectively improve the attack success rate of white-box models; for example, the attack success rate on the ensembled Rawnet is increased by 11.6%.
Our contributions are summarized as follows.
• We make the first steps to study the effect of clipping and self-splicing on adversarial examples. By conducting a comprehensive experiment, we observe that existing adversarial attacks are difficult to maintain threatening after clipping or self-splicing.
• We define gradient similarity, study the gradients of adversarial examples after clipping and self-splicing, and show that subsegments with the same sampling value are similar across models.
• We propose an adversarial attack method against audio, called a sliding attack (SA). The proposed method can craft adversarial examples that are still fool blackbox models after being clipped or self-spliced.
The rest of the paper is organized as follows: We present related work in Section 2 and formulate the problem mathematically in Section 3. We introduce the detailed design of SA in Section 4. We then offer experimental results and some discussions in Section 5. Finally, we summarize our work in Section 6.

Typical Adversarial Attacks
Here we introduce several typical white-box adversarial attacks. The Fast Gradient Sign Method (FGSM) assumes the linear behavior in high-dimensional spaces is sufficient to generate adversarial inputs [9]. Therefore, it constructs adversarial samples by applying a first-order approximation of the loss function. An adversarial example can be generated with a one-step update. As an iterative version of FGSM, the Projected Gradient Descent (PGD) [17] selects the original sample as a starting point and generates adversarial examples with multi-step. It is a powerful adversarial attack method and is therefore often used as a baseline attack for evaluating defense designs. Inspired by the momentum optimizer, Dong et al. [5] proposed to integrate the momentum memory into the iterative process and derived a new iterative algorithm, called momentum iterative FGSM (MI-FGSM). Generally, momentum-based adversarial examples are more transferable on black-box models. DeepFool is also an iterative attack method, which has been proposed to generate an adversarial example with the minimum perturbation on the decision boundary of a classifier. The Carlini & Wagner (CW) attack method [3] takes a Lagrangian form and adopts Adam [15] for optimization.

Synthetic speech detection
Synthetic speech detection [38] focuses on detecting spoof speech in non-auto speaker verification scenarios. It reflects the scenario in which an attacker has access to the voice data of a targeted victim, e.g., data posted to social media. The victim might be a celebrity, a social media influencer, or an ordinary citizen. The attackers' incentive might be, e.g., to blackmail the victim or to denigrate his or her reputation in some way by spreading spoken misinformation. Synthetic speech techniques commonly use by attackers include textto-speech (TTS) [7] and speech conversion (VC) [24,32]. In order to detect this kind of attack, researchers have proposed a variety of countermeasures [12,27]. In this paper, considering the practical hazards of synthetic speech, our research is based on the standard ASVspoof2021 dataset, a practical dataset for promoting the development of synthetic speech detection.

Problem Formulation
In the section, we first define the basic notations, clipping and self-splicing. Then, the problem to be solved will be described.
We denote initial input sample as , its ground-truth label as , the corresponding adversarial example as , the model with input length as  , where  ( ) = and  ( ) ≠  ( ). We use to denote parameters of network  and use ( , ; ) denote the loss for . To generate the adversarial example, the goal is to maximize the loss ( , ; ) for the input sample . Considering that, in audio, the speeches' length and requirements of the input model are usually inconsistent, the input speeches will be clipped or self-spliced. We formally define the operation of clipping and self-splicing as follows. Clipping: When the length of the input speech exceeds the input length required by the model, the speech needs to be clipped. The clipping rule is unknown to attackers under the black-box setting. Therefore, we assume one practical case where the victim model employs random clipping for extremely long inputs. The operation of clipping is shown in Fig. 1(a) and abbreviated as (⋅) and formulated as follows.
where is clipped length, is start sampling index of clipping operation, [ ∶ + ] is the clipped segment from the to + in , and + must be less than or equal to the length of . Self-splicing: When the input speech's length is shorter than the input length required, the speech needs to be self-spliced, clipping a segment from the input speech and splicing this segment after the input speech. Although the victim model can arbitrarily choose the region to be self-spliced, one of the most widely-adopted strategies is to select the head segment to splice the tail of the input. Therefore, the operation of self-splicing is shown in Fig. 1(b) and abbreviated as (⋅) and formulated as follows. where The goal of prior works in the literature is to generate the adversarial example that satisfies: where is a tiny distortion that keeps sound similar to the original audio . However, we consider a more practical scenario where the input length of the victim model is unknown. Therefore, after the adversarial example is generated by the attacker, it needs to be clipped or self-spliced before it can be input into the victim model. More specifically, when the input length of the victim model is required to be shorter than , we assume that the victim model is  , it's input length is , and its parameter is . We require that the adversarial example is still adversarial after self-splicing, which is defined as follows: When the input length of the victim model is required to be longer than , we assume that the victim model is  , its input length is , and it's parameter is . We require that the adversarial example is still adversarial after clipping, which is defined as follows: However, existing adversarial attacking methods cannot strike a good balance between the quality of adversarial examples and the adversarial after clipping or self-splicing operations. As shown in Table 2 and Table 3, adversarial examples generated by typical adversarial attacks are much less threatening to the victim model after clipping or self-splicing. More details can be found in Section 5.3. In the following, we propose an adversarial attacking method, which can effectively improve the threat of adversarial examples after clipping or self-splicing.

Proposed Method
In this section, we are inspired by prior work in the literature in Section 4.1 and hope to improve the threat of adversarial examples by attacking the ensemble model. However, previous ensembled attacks only consider integrating models with the same input length, and we need to input samples into models with different input lengths after clipping or self-splicing. Clipping and self-splicing lead to widely different input samples, and aggregating the gradients of these samples has the potential to produce misleading gradients. Therefore, we analyze the sample's gradients after clipping and self-splicing in Section 4.2 and, based on the above observations, propose the SA attack method and describe it in detail in Section 4.3.

Gradient-based Adversarial Attack Method
Empirical studies of most gradient-based attacks (such as DIFGSM [36], TIFGSM [6], NIFGSM [22] and VIFGSM [35]) show that ensembles of more gradients can generate more powerful adversarial examples. Taking a typical ensemble adversarial attack as an example, the attacker inputs into multiple models to obtain gradients and then aggregate the gradients to update the adversarial examples. The aggregation formula of the gradient is as follows: where is the number of models, is the weights of gradients, and represents parameters from different models. Inspired by ensemble attacks, we hope to improve the transferability of adversarial examples after clipping or self-splicing by aggregating gradients from models of different input lengths. Convolutional neural networks are supposed to have the translation-invariant property, according to [20], that an object in the input can be recognized in spite of its position. In practice, CNNs are not truly translation-invariant [8,13]. We follow the assumption of [18] that the translation-invariant property is nearly held with very small translations. Previous work improves the transferability of adversarial examples by attacking ensemble models with the same input length. In this case, aggregating gradients from different models can improve the transferability of adversarial examples since the samples input to models is the same, and the gradients obtained by backpropagation are also similar. However, we consider a more practical case where we need to input samples into models after clipping or self-splicing. This results in widely different input samples and cannot preserve translationinvariant properties. This means that the gradients we obtain may be dissimilar and the aggregated gradient will deviate from the correct direction, as shown in Fig. 2.
Therefore, we define the gradient aggregation and gradient similarity formula in the following subsections and then analyze the gradient of the common area of the original sample, the clipped sample, and the self-spliced sample.

Gradient Similarity Analysis
We first define the gradient aggregation formula for models with different input lengths as follows: Gradients obtained from samples without preprocessing are usually similar, and the aggregated gradients are oriented toward the . However, when we attack an ensemble model composed of models of different lengths, we need to clip or self-splice the sample and input them into the corresponding model. Both the samples and the model are quite different, so gradients may be dissimilar and the aggregated gradient is likely be "away" from where 1 , 2 , 3 are the number of different models, 1 , 2 , 3 are weights. Then, given two gradients and of length ′ , we define the gradient similarity calculation formula as follows: where ⊙ is Exclusive NOR, sign(⋅) denotes the sign function. Since gradient-based adversarial attacks usually take the gradient sign, we do not directly count the similarity of the actual value of the gradient (e.g., using the cosine distance) but first do the sign for gradients and then count the proportion of sampling points with consistent gradient. The gradient similarity of two randomly input samples is about 0.5 because the result of the sign only includes -1 and 1. Therefore, the value of is distributed between 0 and 1. When ( , ) > 0.5, it means that the is similar to , and when is equal to 1, it means that the two gradients are completely consistent.
Next, to better observe the gradients of the clipped samples, the self-spliced samples, and the original samples, we select the gradients of their common areas for analysis. Since in (⋅) is arbitrary, we need to fix for a coherent analysis of gradient similarity. We set = 0, where the head gradient aggregation of adversarial examples has the highest complexity. As shown in the Fig. 3, when = 0, the head of the aggregated gradient is aggregated from the gradients of four regions, including   that case, we assume that the gradients of the sub-segments with the same sampling value are similar in different models, and aggregating these gradients can improve the attack success rate of the white-box model. We select PGD to attack representative model Rawnets on standard ASVspoof 2019 and calculate the average similarity between * and , , and . We select three required input length models in this experiment, including 40000,56000, and 72600. These models' accuracy and required input length are shown in Table 1. Moreover, we set all and all equal to 1. For simplicity, we abbreviate ( * , ),..., ( * , ) as ,..., , where represents -th iteration. The result is shown in Fig. 4. We can find that the gradient finally stabilizes above 0.6 as the number of iterations increases, proving that sub-segments with the same sampling value have similar gradients on models with different input lengths.
Based on the above observations, aggregating these similar gradients can stabilize the gradient update direction and improve the attack success rate on white-box models. We proposed a novel sliding attack named SA and introduced the detail in the following subsection 4.3.

Sliding Attack
This subsection provides a comprehensive introduction to the SA implementation process. The purpose of SA is to generate an adversarial example of length , and we hope to enhance the transferability of after being clipped or self-spliced. Attacking the ensemble model effectively improves the attack success rate of adversarial examples on the white-box model and the transferability on the black-box model. Therefore, the proposed method attacks the ensemble model, consisting of three models with different input lengths, namely  ,  , and  . The  ,  , and  input lengths are , , and , respectively. In the experiment, we choose the first quartile, median and third quartile as , , and according to the length distribution of the audio in the dataset.
Reviewing our scenario, we hope adversarial examples retain transferability after clipping or self-splicing. However, the input length of the black-box models and the clipping method are uncertain. We cannot predict where a particular sampling point on the adversarial example will appear in the processed sample and design the corresponding algorithm to improve transferability. Although we can improve the transferability of adversarial examples by integrating a large number of models with different input lengths, training the model takes a lot of time and computational resources. Therefore, we hope to simulate more black-box situations with a limited model. Specifically, as shown in Fig. 5, SA uses sliding windows of different lengths to sample sub-segments of different lengths on the original sample. For ease of understanding, we arbitrarily select a sample point on the and mark it with a blue vertical line and trace it. We can observe that after the sliding window extraction, the marked sampling points are located at different positions of the sub-segments, which simulates the different situations of black-box models and make the sampling point preceptive more gradients with a different location. According to our observation in Section 4.2, the gradients of segments with the same sampling values are similar across different models. Therefore, we aggregate the gradients of these sub-segments to increase the attack success rate on the white-box model and improve the transferability on the black-box model. The process of extracting subsegments is shown in lines 8-14 of Algorithm 1. We use sliding windows of different lengths ( , ) to extract sub-segments on respectively. We can directly extract the sub-segment of length from the because < . When we want to extract the sub-segment of length , we first concatenate the ⌈ ∕ ⌉ s to and then extracted the sub-segments on it. Typical gradient-based iterative attacks (e.g. I-FGSM) greedily search an adversarial example in the direction of the sign of the gradient at each iteration, which may easily fall into poor local optima and "overfit" the model. Inspired by VI-FGSM, in each iteration, we not only compute the gradient of the current data point, but also use the gradient of the data in the adjacent domain of the current data point to avoid adversarial examples falling into local optima. Specifically, we design the function (⋅; ) to add tiny noise to the extracted sub-segments (e.g., line 9 and 11). Given an input sample of dimension , the noise function (⋅, ) is defined as follows: Here the result of ( , ) is a set, is the number of noise, ∼ [−( ) , ( ) ], [−( ) , ( ) ] stands for the uniform distribution in dimensions and we set = 0.1 in practice.
Next, input the data of the sub-segments and the adjacent domain into the model of the corresponding length to obtain the gradients (e.g., line 10 and 12) and aggregate these gradients by Equal 8. Note that we did not add different weights to the gradient, because the input length of the black box is unknown, so taking the same weight can better take care of the unknown case.

Experiments
In this section, we present the experimental results to demonstrate the effectiveness of the proposed method. We first specify the experimental settings in Section 5.1 and metrics in Section 5.2. Then we conduct extensive experiments on the attack success rate and transferability of baseline adversarial attack methods in Section 5.3. Then we compare the results of the proposed method with the baseline methods in Section 5.4 and we finally, in Section 5.5, evaluate the transferability of SA across models with different architectures.

Experimental Settings
Datasets: We use the standard ASVspoof2021 dataset introduced for the speech deepfake challenge. The training dataset contains 2580 bonafide speeches and 22800 spoofed speeches. The test dataset contains 2548 bonafide speech and 22296 spoofed speech. This dataset is suitable for our study because the input length of the victim model is inaccessible, but an approximate input range can be predicted based on the dataset. We selected five data lengths, including 40000, 48000, 56000, 64600, and 72600, as input length requirements of the model according to the audio data length distribution of ASVspoof2021 in Fig. 6. In particular, pay attention to the following two points: • In all experiments in this paper, we generate adversar- Set start positions and steps for sliding windows Victim Models: Considering that the attacker does not have access to the model structure and there are various feature extraction methods in audio, we refer to the baseline of ASVspoof2021 and select two representative models, including waveform+Rawnet and LFCC+LCNN. These two models represent the widely used one-dimensional and two-dimensional features in audio classification models, respectively. Rawnet is direct modelling of raw waveforms using deep neural networks, which has achieved state-of-the-art in speaker classification and synthetic speech detection. Linear frequency cepstral coefficients (LFCC) [14,37] are a popular feature used for synthetic speech detection. The LFCC process has two steps: 1) Using linear filters and logarithmic compression power spectrum; 2) Perform DCT to produce the cepstral coefficients.
In the experiments, we retained 60 LFCC coefficients and concatenated LFCC, Delta-LFCC, and Delta-Delta-LFCC as input features. Where delta and delta-delta [4,10] can record some dynamic information, such as the change of LFCC over time. LCNN is a typical CNN model, which performs better in the classification of two-dimensional features such as LFCC, spectrogram [1], CQCC [33], and MFCC [40]. More specifically, accuracies, input lengths, and model names are shown in Table 1.

Metrics
The experimental evaluation criteria include the quality of adversarial examples, the attack success rate (ASR), and transfer success rate (TSR). SNR: To quantify the distortion introduced by an adversarial audio, we use the signal-to-noise ratio (SNR) [11] measure. SNR is a logarithmic scale that measures the relative loudness of an audio sample. This measure is a relative measure, hence we use the original waveform as the reference point for the distortion .
ASR: Attack success rate is an important indicator to evaluate the performance of adversarial attack algorithms. Considering that there are a small number of misclassified samples, the attack success rate of model is calculated as follows: where is all data of dataset, is a data set that misclassified by model , num(⋅) is a count function, and̂ is the adversarial examples generated based on model and data set . TSR: The transfer success rate is the probability that adversarial examples generated on white-box model can mislead black-box model . The TSR from to can be formulated

Baseline Adversarial Attack
To test the effect of clipping and self-splicing on the transferability of adversarial examples, we conduct extensive experiments on representative Rawnet and LCNN models with typical adversarial attack methods. We first perform five adversarial attacks on a single neural network: CW, DeepFool, FGSM, PGD, and MIFGSM. We craft adversarial examples on normally trained networks (e.g., Rawnet 56 or LCNN 56 ) and test them on different input length neural networks we consider. The results are shown in Table 2 and Table 3. More specifically, we generate adversarial examples based on the white-box model in the first column of the table and then input them into five black-box models after clipping or self-splicing. The second and third columns show the attack method and its attack success rate on the white-box model, respectively.
From Table 2 and Table 3, a first glance shows that gradientbased adversarial attacks outperform other baseline attacks (e.g. CW, DeepFool) by a large margin on all black-box models and maintains high success rates on black-box model with same input length. We can observe that after clipping or self-splicing, adversarial examples almost lose their transferability on Rawnet models, and the average TSR drops by 41% on LCNN models. Meanwhile, we find that the adversarial samples generated by gradient-based adversarial attacks are the most threatening, such as PGD and MIFGSM. Hyper-parameters: For CW, we set = 10, learning rate = 0.001 and Optimization steps=100. For FGSM, we set step size = 0.015. For PGD-20, we set the step size = 0.01 and the number of iteration = 20. For PGD-20, we set the number of iteration = 40. For MIFGSM-10, we set the decay factor = 1.0 and = 10.

Transferability of proposed method among models with the same architecture
In this subsection, we conduct a series of ablation experiments to study the impact of different parameters on the effectiveness of SA. We only consider attacking an ensemble of networks here, since it is much stronger than attacking a single network and can provide a more accurate evaluation of the network's robustness. We choose models with lengths of 40,000, 56,000 and 72,600 as ensemble whitebox models and craft adversarial examples with the length of 56000. Then we input the adversarial examples into five black-box models of different lengths after clipping or selfsplicing, such as columns 6 to 10 in the second row in Tables 4  The results of the ablation experiments are shown in Tables 4 and 5. Note that we have marked the row with parameter = 0 and = 0 in grey. This is because SA is equivalent to MIFGSM when =0 and = 0. The third column shows the attack success rate of the ensemble model in the white-box, and the fourth column shows the quality of the generated adversarial examples, the higher the better for both metrics. In Table 4 22.58, which is 3.67 higher than that generated by Rawnet, which indicates that Rawnet is more robust than LCNN.

Transferability of proposed method across models with different architecture
In subsection 5.4, we evaluate the transferability of adversarial examples generated by SA between the same model and input lengths. In this section, we conduct the more practical case where the victim's model structure is different from the white-box model. We choose Rawnet as the white-box model and generate adversarial examples of length 56000 on the ensemble model Rawnet 4 +Rawnet 56 +Rawnet 726 . These adversarial examples are input into LCNNs of different lengths after clipped or self-spliced, and the corresponding TSRs are calculated.
The hyperparameter settings for this experiment follow the setting of subsection 5.4. The results are shown in Table  6, where we observe that the transferability of adversarial examples between different models is greatly reduced compared to Table 5. This is because although we attack the ensemble model, the structure of the ensemble model is the same, which is equivalent to attacking a single model. As in Table 4 and Table 5, the row marked gray in Table 6 represents MIFGSM ( = 0, = 0). Compared with the first row (MIFGSM), our proposed method improves TSR by 13.1% on LCNN 4 , 6.0% on LCNN 48 , 23.5% on LCNN 56 , 2.9% on LCNN 646 , and 30.0% on LCNN 726 . The results show that SA can effectively improve the transferability of adversarial examples between models with different structures after clipping or self-splicing.

CONCLUSION
In this paper, we consider the more practical case where the input length of the victim model is inconsistent with the input length of the white-box model used by the attacker. Therefore, the victim classifier usually needs to clipping or self-splicing the input samples to ensure that the input length is consistent. We extensively evaluate typical adversarial attacks and observe that they produce adversarial examples Table 6 The TSR(%) on LCNNs with different input lengths, where we attack an ensemble model (Rawnet 4 +Rawnet 56 +Rawnet 726 ) using SA. that are clipped or self-spliced to be much less threatening to the victim model. We observe that segments with the same sample value have similar gradients in different models. We, therefore, propose an adversarial attack SA that attacks models of different lengths. SA is an ensembled adversarial attack, where the ensemble model consists of three models with different input lengths. We obtain the number of sub-segments of different lengths through a sliding window and noise function and feed them into models of different lengths, which allows us to capture more gradients and avoid local optima. We hope our proposed attack strategy can serve as a benchmark for improving the transferability of adversarial examples after clipping or self-splicing.