Adversarial Attacks against Neural Networks in Audio Domain: Exploiting Principal Components

Abstract

Adversarial attacks are inputs that are similar to original inputs but altered on purpose. Speech-to-text neural networks that are widely used today are prone to misclassify adversarial attacks. In this study, first, we investigate the presence of targeted adversarial attacks by altering wave forms from Common Voice data set. We craft adversarial wave forms via Connectionist Temporal Classification Loss Function, and attack DeepSpeech, a speech-to-text neural network implemented by Mozilla. We achieve 100% adversarial success rate (zero successful classification by DeepSpeech) on all 25 adversarial wave forms that we crafted. Second, we investigate the use of PCA as a defense mechanism against adversarial attacks. We reduce dimensionality by applying PCA to these 25 attacks that we created and test them against DeepSpeech. We observe zero successful classification by DeepSpeech, which suggests PCA is not a good defense mechanism in audio domain. Finally, instead of using PCA as a defense mechanism, we use PCA this time to craft adversarial inputs under a black-box setting with minimal adversarial knowledge. With no knowledge regarding the model, parameters, or weights, we craft adversarial attacks by applying PCA to samples from Common Voice data set and achieve 100% adversarial success under black-box setting again when tested against DeepSpeech. We also experiment with different percentage of components necessary to result in a classification during attacking process. In all cases, adversary becomes successful.

8 pages, 14 figures, fixed typos, enumerated equations, fixed equation (4) latex error, clarified author contributions via footnote

References in corpus (10)

• Sequence Transduction with Recurrent Neural Networks
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Adversarial Examples for Evaluating Reading Comprehension Systems
• Defensive Distillation is Not Robust to Adversarial Examples
• Robust Audio Adversarial Example for a Physical Attack
• Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong
• Adversarial Attacks on Convolutional Neural Networks in Facial Recognition Domain
• Perfecting the Crime Machine
• Towards Evaluating Driver Fatigue with Robust Deep Learning Models
• Towards Evaluating Gaussian Blurring in Perceptual Hashing as a Facial Image Filter

Cited by in corpus (7)

• Adversarial Attacks on Convolutional Neural Networks in Facial Recognition Domain
• Towards Evaluating Driver Fatigue with Robust Deep Learning Models
• Perfecting the Crime Machine
• Towards Evaluating Gaussian Blurring in Perceptual Hashing as a Facial Image Filter
• Towards Searching Efficient and Accurate Neural Network Architectures in Binary Classification Problems
• ATRAS: Adversarially Trained Robust Architecture Search
• Functional Protein Structure Annotation Using a Deep Convolutional Generative Adversarial Network