The Audio Auditor: User-Level Membership Inference in Internet of Things Voice Services

Abstract

With the rapid development of deep learning techniques, the popularity of voice services implemented on various Internet of Things (IoT) devices is ever increasing. In this paper, we examine user-level membership inference in the problem space of voice services, by designing an audio auditor to verify whether a specific user had unwillingly contributed audio used to train an automatic speech recognition (ASR) model under strict black-box access. With user representation of the input audio data and their corresponding translated text, our trained auditor is effective in user-level audit. We also observe that the auditor trained on specific data can be generalized well regardless of the ASR model architecture. We validate the auditor on ASR models trained with LSTM, RNNs, and GRU algorithms on two state-of-the-art pipelines, the hybrid ASR system and the end-to-end ASR system. Finally, we conduct a real-world trial of our auditor on iPhone Siri, achieving an overall accuracy exceeding 80%. We hope the methodology developed in this paper and findings can inform privacy advocates to overhaul IoT privacy.

User-Level Membership Inference Attack against Metric Embedding Learning

“…In the literature, there are only a few studies on user-level MI attacks. In Miao et al (2021), the authors investigate MI attacks on speech recognition task to infer if any users' data (voice samples) have been used during training. In Song & Shmatikov (2019), the authors propose a user-level MI attack on text generative models.…”

“…Baselines: To the best of our knowledge, there is no user-level MI attack on metric embedding learning. The two user-level MI attacks in literature (Song & Shmatikov, 2019;Miao et al, 2021) require generative models where the victim model's output is a word. Hence, there is no trivial way to adopt them for metric embedding scenario.…”

Untitled

“…Specifically, a service provider that trains an ML model with user data without adequate consent may violate data protection regulations. In this case, MI can be used to assert whether or not a data sample was used during training, protecting both users and service providers [8,9,10].…”

“…MI is, thus, an important aspect of trustworthy machine learning, that should be studied in all its facets and for all types of data. However, while MI has been extensively studied in the realms of image and text data [11], the focus on speech data, particularly in what concerns ASR models, remains limited [12,13,9,14,15,10].…”

“…Most of the scarce literature on MI in ASR has focused on the use of transcription errors [14], transcription-reference similarity scores [9], or both [10], as features to classify membership. Tseng et al [15] is an exception to this and explore MI in self-supervised speech models, using frame-similarity scores instead.…”