A Multiversion Programming Inspired Approach to Detecting Audio Adversarial Examples

Abstract

Adversarial examples (AEs) are crafted by adding human-imperceptible perturbations to inputs such that a machine-learning based classifier incorrectly labels them. They have become a severe threat to the trustworthiness of machine learning. While AEs in the image domain have been well studied, audio AEs are less investigated. Recently, multiple techniques are proposed to generate audio AEs, which makes countermeasures against them an urgent task. Our experiments show that, given an AE, the transcription results by different Automatic Speech Recognition (ASR) systems differ significantly, as they use different architectures, parameters, and training datasets. Inspired by Multiversion Programming, we propose a novel audio AE detection approach, which utilizes multiple off-the-shelf ASR systems to determine whether an audio input is an AE. The evaluation shows that the detection achieves accuracies over 98.6%.

arXiv comment8 pages, 4 figures, AICS 2019, The AAAI-19 Workshop on Artificial Intelligence for Cyber Security (AICS), 2019

References in corpus (12)

• Deep Speech 2: End-to-End Speech Recognition in English and Mandarin
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• The Space of Transferable Adversarial Examples
• Did you hear that? Adversarial Examples Against Automatic Speech Recognition
• Dense Prediction on Sequences with Time-Dilated Convolutions for Speech Recognition
• Isolated and Ensemble Audio Preprocessing Methods for Detecting Adversarial Examples against Automatic Speech Recognition
• Constructing Long Short-Term Memory based Deep Recurrent Neural Networks for Large Vocabulary Speech Recognition
• A Cross-Architecture Instruction Embedding Model for Natural Language Processing-Inspired Binary Code Analysis
• Exploiting the Inherent Limitation of L0 Adversarial Examples

Cited by in corpus (3)

• LanCe: A Comprehensive and Lightweight CNN Defense Methodology against Physical Adversarial Attacks on Embedded Multimedia Applications
• DoPa: A Comprehensive CNN Detection Methodology against Physical Adversarial Attacks
• Privacy Leakage in Smart Homes and Its Mitigation: IFTTT as a Case Study