Universal Adversarial Perturbations for Speech Recognition Systems

Neekhara, Paarth; Hussain, Shehzeen; Pandey, Prakhar; Dubnov, Shlomo; McAuley, Julian; Koushanfar, Farinaz

doi:10.48550/arxiv.1905.03828

Cited by 17 publications

(41 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this section, we briefly compare our study with two existing works [14,22]. Note that this paper studies a different problem from theirs, since the perturbation is input-agnostic as well as targeted.…”

Section: Comparing With Other Adversarial Attacksmentioning

confidence: 99%

“…where is the maximum allowed L∞ norm of the perturbation, following [14,13,22]. Since we are not concerned about imperceptibility in this work, we choose to be 2 15 , the signal range for a 16-bit PCM format audio, for most of the experiments.…”

Section: Targeted Universal Adversarial Perturbationmentioning

confidence: 99%

“…Note that this paper studies a different problem from theirs, since the perturbation is input-agnostic as well as targeted. In addition, we experiment with both additive and prepending perturbations, while [14,22] are limited to additive perturbations. However, it would be intuitive to compare different attacks and discuss why their method cannot solve the universal targeted perturbation problem.…”

Section: Comparing With Other Adversarial Attacksmentioning

confidence: 99%

“…In contrast, most of the studies on ASR adversarial attacks are limited to a single type of model. For example, [14] focuses on LAS model, and [13,22] on CTC.…”

Section: Introductionmentioning

confidence: 99%

“…Secondly, we find different e2e models behave differently against the perturbations. We compared two perturbations, additive perturbation, studied in [14,22], and prepending perturbation, a new type of perturbation for speech data. We find LAS model is vulnerable to both additive and prepending perturbations, while RNN-T is more robust against additive perturbation but becomes vulnerable to prepending perturbations.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Exploring Targeted Universal Adversarial Perturbations to End-to-end ASR Models

Lu¹,

Han²,

Cao³

2021

Preprint

View full text Add to dashboard Cite

Although end-to-end automatic speech recognition (e2e ASR) models are widely deployed in many applications, there have been very few studies to understand models' robustness against adversarial perturbations. In this paper, we explore whether a targeted universal perturbation vector exists for e2e ASR models. Our goal is to find perturbations that can mislead the models to predict the given targeted transcript such as "thank you" or empty string on any input utterance. We study two different attacks, namely additive and prepending perturbations, and their performances on the state-of-the-art LAS, CTC and RNN-T models. We find that LAS is the most vulnerable to perturbations among the three models. RNN-T is more robust against additive perturbations, especially on long utterances. And CTC is robust against both additive and prepending perturbations. To attack RNN-T, we find prepending perturbation is more effective than the additive perturbation, and can mislead the models to predict the same short target on utterances of arbitrary length.

show abstract

Section: Comparing With Other Adversarial Attacksmentioning

confidence: 99%

Section: Targeted Universal Adversarial Perturbationmentioning

confidence: 99%

Section: Comparing With Other Adversarial Attacksmentioning

confidence: 99%

“…In contrast, most of the studies on ASR adversarial attacks are limited to a single type of model. For example, [14] focuses on LAS model, and [13,22] on CTC.…”

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Exploring Targeted Universal Adversarial Perturbations to End-to-end ASR Models

Lu¹,

Han²,

Cao³

2021

Preprint

View full text Add to dashboard Cite

show abstract

Real-Time, Universal, and Robust Adversarial Attacks Against Speaker Recognition Systems

Xie

Shi

et al. 2020

ICASSP 2020 - 2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

View full text Add to dashboard Cite

As the popularity of voice user interface (VUI) exploded in recent years, speaker recognition system has emerged as an important medium of identifying a speaker in many security-required applications and services. In this paper, we propose the first real-time, universal, and robust adversarial attack against the state-of-the-art deep neural network (DNN) based speaker recognition system. Through adding an audio-agnostic universal perturbation on arbitrary enrolled speaker's voice input, the DNN-based speaker recognition system would identify the speaker as any target (i.e., adversary-desired) speaker label. In addition, we improve the robustness of our attack by modeling the sound distortions caused by the physical over-the-air propagation through estimating room impulse response (RIR). Experiment using a public dataset of 109 English speakers demonstrates the effectiveness and robustness of our proposed attack with a high attack success rate of over 90%. The attack launching time also achieves a 100× speedup over contemporary non-universal attacks.

show abstract

CommanderUAP: a practical and transferable universal adversarial attacks on speech recognition models

Sun,

Zhao,

Guo

et al. 2024

Cybersecurity

View full text Add to dashboard Cite

Most of the adversarial attacks against speech recognition systems focus on specific adversarial perturbations, which are generated by adversaries for each normal example to achieve the attack. Universal adversarial perturbations (UAPs), which are independent of the examples, have recently received wide attention for their enhanced real-time applicability and expanded threat range. However, most of the UAP research concentrates on the image domain, and less on speech. In this paper, we propose a staged perturbation generation method that constructs CommanderUAP, which achieves a high success rate of universal adversarial attack against speech recognition models. Moreover, we apply some methods from model training to improve the generalization in attack and we control the imperceptibility of the perturbation in both time and frequency domains. In specific scenarios, CommanderUAP can also transfer attack some commercial speech recognition APIs.

show abstract

Universal Adversarial Perturbations for Speech Recognition Systems

Cited by 17 publications

References 0 publications

Exploring Targeted Universal Adversarial Perturbations to End-to-end ASR Models

Exploring Targeted Universal Adversarial Perturbations to End-to-end ASR Models

Real-Time, Universal, and Robust Adversarial Attacks Against Speaker Recognition Systems

CommanderUAP: a practical and transferable universal adversarial attacks on speech recognition models

Contact Info

Product

Resources

About