Universal adversarial examples in speech command classification

Abstract

Adversarial examples are inputs intentionally perturbed with the aim of forcing a machine learning model to produce a wrong prediction, while the changes are not easily detectable by a human. Although this topic has been intensively studied in the image domain, classification tasks in the audio domain have received less attention. In this paper we address the existence of universal perturbations for speech command classification. We provide evidence that universal attacks can be generated for speech command classification tasks, which are able to generalize across different models to a significant extent. Additionally, a novel analytical framework is proposed for the evaluation of universal perturbations under different levels of universality, demonstrating that the feasibility of generating effective perturbations decreases as the universality level increases. Finally, we propose a more detailed and rigorous framework to measure the amount of distortion introduced by the perturbations, demonstrating that the methods employed by convention are not realistic in audio-based problems.

arXiv comment14 pages, 2 figures, 4 tables; Revised external links

References in corpus (12)

• End to End Learning for Self-Driving Cars
• Deep Speech 2: End-to-End Speech Recognition in English and Mandarin
• Speech Commands: A Dataset for Limited-Vocabulary Speech Recognition
• Adversarially Robust Generalization Requires More Data
• Adversarial Examples Are Not Bugs, They Are Features
• Did you hear that? Adversarial Examples Against Automatic Speech Recognition
• Houdini: Fooling Deep Structured Prediction Models
• Fast Feature Fool: A data independent approach to universal adversarial perturbations
• Robustness of classifiers to universal perturbations: a geometric perspective
• Universal Adversarial Audio Perturbations
• Sufficient Conditions for Idealised Models to Have No Adversarial Examples: a Theoretical and Empirical Study with Bayesian Neural Networks
• An Overview of Vulnerabilities of Voice Controlled Systems

Cited by in corpus (5)

• A Survey On Universal Adversarial Attack
• A Zeroth-Order Block Coordinate Descent Algorithm for Huge-Scale Black-Box Optimization
• Exploring Targeted Universal Adversarial Perturbations to End-to-end ASR Models
• On the human evaluation of audio adversarial examples
• Extending Adversarial Attacks to Produce Adversarial Class Probability Distributions