SirenAttack: Generating Adversarial Audio for End-to-End Acoustic Systems

Abstract

Despite their immense popularity, deep learning-based acoustic systems are inherently vulnerable to adversarial attacks, wherein maliciously crafted audios trigger target systems to misbehave. In this paper, we present SirenAttack, a new class of attacks to generate adversarial audios. Compared with existing attacks, SirenAttack highlights with a set of significant features: (i) versatile -- it is able to deceive a range of end-to-end acoustic systems under both white-box and black-box settings; (ii) effective -- it is able to generate adversarial audios that can be recognized as specific phrases by target acoustic systems; and (iii) stealthy -- it is able to generate adversarial audios indistinguishable from their benign counterparts to human perception. We empirically evaluate SirenAttack on a set of state-of-the-art deep learning-based acoustic systems (including speech command recognition, speaker recognition and sound event classification), with results showing the versatility, effectiveness, and stealthiness of SirenAttack. For instance, it achieves 99.45% attack success rate on the IEMOCAP dataset against the ResNet18 model, while the generated adversarial audios are also misinterpreted by multiple popular ASR platforms, including Google Cloud Speech, Microsoft Bing Voice, and IBM Speech-to-Text. We further evaluate three potential defense methods to mitigate such attacks, including adversarial training, audio downsampling, and moving average filtering, which leads to promising directions for further research.

arXiv commentThe experimental results were not up to our expectation

References in corpus (5)

• Wide Residual Networks
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Houdini: Fooling Deep Structured Prediction Models
• Exploring Neural Transducers for End-to-End Speech Recognition
• The Insecurity of Home Digital Voice Assistants -- Amazon Alexa as a Case Study

Cited by in corpus (7)

• SLMIA-SR: Speaker-Level Membership Inference Attacks against Speaker Recognition Systems
• Towards Resistant Audio Adversarial Examples
• Adversarial Attacks in Sound Event Classification
• Beyond $L_p$ clipping: Equalization-based Psychoacoustic Attacks against ASRs
• Structure-Invariant Testing for Machine Translation
• On the human evaluation of audio adversarial examples
• Testing Machine Translation via Referential Transparency