AdvPulse: Universal, Synchronization-free, and Targeted Audio Adversarial Attacks via Subsecond Perturbations

Li, Zhuohang; Wu, Yi; Liu, Jian; Chen, Yingying; Yuan, Bo

doi:10.1145/3372297.3423348

Cited by 82 publications

(70 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Over-the-air transmission requires more detailed and computationally intensive optimization to avoid losing its adversarial properties during physical playing. Consequently, previous studies [28], [34], [35] were mainly conducted with white-box attacks. However, black-box attacks are difficult to perform because of lack of information.…”

Section: Discussionmentioning

confidence: 99%

“…Audio adversarial examples refer to adversarial examples that target auditory models such as automatic speech recognition. Developed from adversarial images, adversarial audios use the auditory characteristics [25]- [27] and attempt to retain adversarial properties when the audio is physical played [28], [29].…”

Section: B Adversarial Example On Audiomentioning

confidence: 99%

“…The over-the-air transmission problem is one of the main challenges in audio adversarial examples. Previous studies [28], [29], [34], [35] proposed robust audio adversarial examples to maintain adversarial properties in over-the-air transmission. They mainly pre-captured and incorporated the core of distortion (input, ambient noise, reflection, and echo) primarily during physical playing into the adversarial example optimization process.…”

Section: B Adversarial Example On Audiomentioning

confidence: 99%

See 2 more Smart Citations

Black-Box Audio Adversarial Attack Using Particle Swarm Optimization

et al. 2022

View full text Add to dashboard Cite

The development of artificial neural networks and artificial intelligence has helped to address problems and improve services in various fields, such as autonomous driving, image classification, medical diagnosis, and speech recognition. However, this technology has raised security threats that are different from existing ones. Recent studies have shown that artificial neural networks can easily malfunction by adversarial examples. The adversarial examples operate the neural network model as intended by the adversary. In particular, adversarial examples targeting speech recognition models is an area that has been actively studied in recent years. Existing studies have focused more on white-box methods. However, most speech recognition services are provided online and involve black-box, making it difficult or impossible for adversaries to attack. Black-box attacks have several challenges. Typically, they have a low success rate and high risk of detection. In particular, previously proposed genetic algorithm (GA)-based attacks are at a high risk of detection because they require numerous queries. Therefore, we propose an adversarial attack system using particle swarm optimization (PSO) algorithms to address these problems. The proposed system uses adversarial candidates as particles to obtain adversarial examples through iterative optimization. PSO-based adversarial attacks are more efficient in queries and have a higher attack success rate than the adversarial methods using GAs. In particular, our key function is that temporary particle generation maximizes query efficiency to reduce detection risk and prevent wastage of system resources. On average, our system exhibits 96% attack success rates with 1416.17 queries, indicating that is 71.41% and 8% better in terms of query and success rates than existing GA-based attacks, respectively.INDEX TERMS Adversarial example, automatic speech recognition, black-box attack, genetic algorithm (GA)-based attack, particle swarm optimization (PSO)

show abstract

Section: Discussionmentioning

confidence: 99%

Section: B Adversarial Example On Audiomentioning

confidence: 99%

Section: B Adversarial Example On Audiomentioning

confidence: 99%

See 1 more Smart Citation

Black-Box Audio Adversarial Attack Using Particle Swarm Optimization

et al. 2022

View full text Add to dashboard Cite

show abstract

“…Adversarial examples are maliciously crafted audio waves that are intended to cause mistranscriptions by the ASR systems [8,34,36]. Most attacks are aimed at producing the targeted malicious sentences; they are a severe security threat [9,20]. For example, an attacker may open a door by submitting adversarial examples that are perceived as "hello world" to the human hearing system (Figure 1).…”

Section: Related Work 31 Adversarial Attacks In Asrmentioning

confidence: 99%

Detecting Audio Adversarial Examples with Logit Noising

Park

Kim

2021

Annual Computer Security Applications Conference

View full text Add to dashboard Cite

Automatic speech recognition (ASR) systems are vulnerable to audio adversarial examples that attempt to deceive ASR systems by adding perturbations to benign speech signals. Although an adversarial example and the original benign wave are indistinguishable to humans, the former is transcribed as a malicious target sentence by ASR systems. Several methods have been proposed to generate audio adversarial examples and feed them directly into the ASR system (over-line). Furthermore, many researchers have demonstrated the feasibility of robust physical audio adversarial examples (over-air). To defend against the attacks, several studies have been proposed. However, deploying them in a real-world situation is difficult because of accuracy drop or time overhead.In this paper, we propose a novel method to detect audio adversarial examples by adding noise to the logits before feeding them into the decoder of the ASR. We show that carefully selected noise can significantly impact the transcription results of the audio adversarial examples, whereas it has minimal impact on the transcription results of benign audio waves. Based on this characteristic, we detect audio adversarial examples by comparing the transcription altered by logit noising with its original transcription. The proposed method can be easily applied to ASR systems without any structural changes or additional training. The experimental results show that the proposed method is robust to over-line audio adversarial examples as well as over-air audio adversarial examples compared with state-of-the-art detection methods. CCS CONCEPTS• Security and privacy; • Computing methodologies → Speech recognition;

show abstract

“…However, spoofing countermeasures are not considered in [30]. AdvPulse [44] is concerned with the physical access scenario and proposes a penalty-based approach combined with noise modeling to generate universal over-the-air adversarials. For a broader discussion of adversarial attacks on ASVs, we refer to Abdullah et al [18].…”

Section: Related Workmentioning

confidence: 99%

Practical Attacks on Voice Spoofing Countermeasures

Kassis¹,

Hengartner²

2021

Preprint

View full text Add to dashboard Cite

Voice authentication has become an integral part in security-critical operations, such as bank transactions and call center conversations. The vulnerability of automatic speaker verification systems (ASVs) to spoofing attacks instigated the development of countermeasures (CMs), whose task is to tell apart bonafide and spoofed speech. Together, ASVs and CMs form today's voice authentication platforms, advertised as an impregnable access control mechanism. We develop the first practical attack on CMs, and show how a malicious actor may efficiently craft audio samples to bypass voice authentication in its strictest form. Previous works have primarily focused on nonproactive attacks or adversarial strategies against ASVs that do not produce speech in the victim's voice. The repercussions of our attacks are far more severe, as the samples we generate sound like the victim, eliminating any chance of plausible deniability. Moreover, the few existing adversarial attacks against CMs mistakenly optimize spoofed speech in the feature space and do not take into account the existence of ASVs, resulting in inferior synthetic audio that fails in realistic settings. We eliminate these obstacles through our key technical contribution: a novel joint loss function that enables mounting advanced adversarial attacks against combined ASV/CM deployments directly in the time domain. Our adversarials achieve concerning black-box success rates against state-of-the-art authentication platforms (up to 93.57%). Finally, we perform the first targeted, overtelephony-network attack on CMs, bypassing several challenges and enabling various potential threats, given the increased use of voice biometrics in call centers. Our results call into question the security of modern voice authentication systems in light of the real threat of attackers bypassing these measures to gain access to users' most valuable resources.

show abstract

AdvPulse: Universal, Synchronization-free, and Targeted Audio Adversarial Attacks via Subsecond Perturbations

Cited by 82 publications

References 19 publications

Black-Box Audio Adversarial Attack Using Particle Swarm Optimization

Black-Box Audio Adversarial Attack Using Particle Swarm Optimization

Detecting Audio Adversarial Examples with Logit Noising

Practical Attacks on Voice Spoofing Countermeasures

Contact Info

Product

Resources

About