Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition

Abstract

Adversarial examples are inputs to machine learning models designed by an adversary to cause an incorrect output. So far, adversarial examples have been studied most extensively in the image domain. In this domain, adversarial examples can be constructed by imperceptibly modifying images to cause misclassification, and are practical in the physical world. In contrast, current targeted adversarial examples applied to speech recognition systems have neither of these properties: humans can easily identify the adversarial perturbations, and they are not effective when played over-the-air. This paper makes advances on both of these fronts. First, we develop effectively imperceptible audio adversarial examples (verified through a human study) by leveraging the psychoacoustic principle of auditory masking, while retaining 100% targeted success rate on arbitrary full-sentence targets. Next, we make progress towards physical-world over-the-air audio adversarial examples by constructing perturbations which remain effective even after applying realistic simulated environmental distortions.

International Conference on Machine Learning (ICML), 2019

Cited by in corpus (46)

• Black-box Adversarial Attacks on Commercial Speech Platforms with Minimal Information
• Malware Makeover: Breaking ML-based Static Analysis by Modifying Executable Bytes
• Characterizing Speech Adversarial Examples Using Self-Attention U-Net Enhancement
• Weighted-Sampling Audio Adversarial Example Attack
• Advbox: a toolbox to generate adversarial examples that fool neural networks
• Universal Adversarial Audio Perturbations
• CrossASR++: A Modular Differential Testing Framework for Automatic Speech Recognition
• ECGadv: Generating Adversarial Electrocardiogram to Misguide Arrhythmia Classification System
• Towards Feature Space Adversarial Attack
• Probabilistic Margins for Instance Reweighting in Adversarial Training
• VSMask: Defending Against Voice Synthesis Attack via Real-Time Predictive Perturbation
• Inaudible Adversarial Perturbations for Targeted Attack in Speaker Recognition
• Towards Security Threats of Deep Learning Systems: A Survey
• SoK: Machine Learning Governance
• Identifying Audio Adversarial Examples via Anomalous Pattern Detection
• Adversarial Attacks and Defenses for Speech Recognition Systems
• WaveGuard: Understanding and Mitigating Audio Adversarial Examples
• Towards Resistant Audio Adversarial Examples
• SPARK: Spatial-aware Online Incremental Attack Against Visual Tracking
• $n$-ML: Mitigating Adversarial Examples via Ensembles of Topologically Manipulated Classifiers
• Adversarial Detection: Attacking Object Detection in Real Time
• Sequential Randomized Smoothing for Adversarially Robust Speech Recognition
• Visualizing Automatic Speech Recognition -- Means for a Better Understanding?
• Towards Making Deep Learning-based Vulnerability Detectors Robust
• Voting for the right answer: Adversarial defense for speaker verification
• Adversarial attacks on audio source separation
• Language Dependencies in Adversarial Attacks on Speech Recognition Systems
• Targeted Attack for Deep Hashing based Retrieval
• Dompteur: Taming Audio Adversarial Examples
• On the Exploitability of Audio Machine Learning Pipelines to Surreptitious Adversarial Examples
• Structure-Invariant Testing for Machine Translation
• Perceptual-based deep-learning denoiser as a defense against adversarial attacks on ASR systems
• Robustifying automatic speech recognition by extracting slowly varying features
• Using Inaudible Audio and Voice Assistants to Transmit Sensitive Data over Telephony
• SAD: Saliency-based Defenses Against Adversarial Examples
• A Tandem Framework Balancing Privacy and Security for Voice User Interfaces
• Can audio-visual integration strengthen robustness under multimodal attacks?
• Exploring Targeted Universal Adversarial Perturbations to End-to-end ASR Models
• Fashion-Guided Adversarial Attack on Person Segmentation
• Self-Gradient Networks
• Cortical Features for Defense Against Adversarial Audio Attacks
• End-to-End Adversarial White Box Attacks on Music Instrument Classification
• Testing Machine Translation via Referential Transparency
• Generating Watermarked Adversarial Texts
• Adversarial Ranking Attack and Defense
• An Integrated Algorithm for Robust and Imperceptible Audio Adversarial Examples