Universal Adversarial Audio Perturbations

Abstract

We demonstrate the existence of universal adversarial perturbations, which can fool a family of audio classification architectures, for both targeted and untargeted attack scenarios. We propose two methods for finding such perturbations. The first method is based on an iterative, greedy approach that is well-known in computer vision: it aggregates small perturbations to the input so as to push it to the decision boundary. The second method, which is the main contribution of this work, is a novel penalty formulation, which finds targeted and untargeted universal adversarial perturbations. Differently from the greedy approach, the penalty method minimizes an appropriate objective function on a batch of samples. Therefore, it produces more successful attacks when the number of training samples is limited. Moreover, we provide a proof that the proposed penalty method theoretically converges to a solution that corresponds to universal adversarial perturbations. We also demonstrate that it is possible to provide successful attacks using the penalty method when only one sample from the target dataset is available for the attacker. Experimental results on attacking various 1D CNN architectures have shown attack success rates higher than 85.0% and 83.1% for targeted and untargeted attacks, respectively using the proposed penalty method.

References in corpus (15)

• Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift
• ADADELTA: An Adaptive Learning Rate Method
• WaveNet: A Generative Model for Raw Audio
• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• Speech Commands: A Dataset for Limited-Vocabulary Speech Recognition
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Learning from Between-class Examples for Deep Sound Recognition
• Did you hear that? Adversarial Examples Against Automatic Speech Recognition
• Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition
• Robust Audio Adversarial Example for a Physical Attack
• Adversarial vulnerability for any classifier
• Characterizing Audio Adversarial Examples Using Temporal Dependency
• Unsupervised Cross-Modal Alignment of Speech and Text Embedding Spaces
• Robustness of classifiers to universal perturbations: a geometric perspective
• Adversarial Attacks in Sound Event Classification

Cited by in corpus (9)

• Universal adversarial examples in speech command classification
• Geometry-Inspired Top-k Adversarial Perturbations
• Beyond $L_p$ clipping: Equalization-based Psychoacoustic Attacks against ASRs
• Blind Adversarial Network Perturbations
• Active Subspace of Neural Networks: Structural Analysis and Universal Attacks
• On the human evaluation of audio adversarial examples
• A Tandem Framework Balancing Privacy and Security for Voice User Interfaces
• Exploring Targeted Universal Adversarial Perturbations to End-to-end ASR Models
• Cortical Features for Defense Against Adversarial Audio Attacks