Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Transferable Adversarial Attacks against ASR

Xiaoxue Gao, Zexin Li, Yiming Chen, Cong Liu, Haizhou Li

TL;DR

A speech-aware gradient optimization approach (SAGO) for ASR, which forces mistranscription with minimal impact on human imperceptibility through voice activity detection rule and a speech-aware gradient-oriented optimizer is proposed.

Abstract

Given the extensive research and real-world applications of automatic speech recognition (ASR), ensuring the robustness of ASR models against minor input perturbations becomes a crucial consideration for maintaining their effectiveness in real-time scenarios. Previous explorations into ASR model robustness have predominantly revolved around evaluating accuracy on white-box settings with full access to ASR models. Nevertheless, full ASR model details are often not available in real-world applications. Therefore, evaluating the robustness of black-box ASR models is essential for a comprehensive understanding of ASR model resilience. In this regard, we thoroughly study the vulnerability of practical black-box attacks in cutting-edge ASR models and propose to employ two advanced time-domain-based transferable attacks alongside our differentiable feature extractor. We also propose a speech-aware gradient optimization approach (SAGO) for ASR, which forces mistranscription with minimal impact on human imperceptibility through voice activity detection rule and a speech-aware gradient-oriented optimizer. Our comprehensive experimental results reveal performance enhancements compared to baseline approaches across five models on two databases.

Transferable Adversarial Attacks against ASR

TL;DR

A speech-aware gradient optimization approach (SAGO) for ASR, which forces mistranscription with minimal impact on human imperceptibility through voice activity detection rule and a speech-aware gradient-oriented optimizer is proposed.

Abstract

Given the extensive research and real-world applications of automatic speech recognition (ASR), ensuring the robustness of ASR models against minor input perturbations becomes a crucial consideration for maintaining their effectiveness in real-time scenarios. Previous explorations into ASR model robustness have predominantly revolved around evaluating accuracy on white-box settings with full access to ASR models. Nevertheless, full ASR model details are often not available in real-world applications. Therefore, evaluating the robustness of black-box ASR models is essential for a comprehensive understanding of ASR model resilience. In this regard, we thoroughly study the vulnerability of practical black-box attacks in cutting-edge ASR models and propose to employ two advanced time-domain-based transferable attacks alongside our differentiable feature extractor. We also propose a speech-aware gradient optimization approach (SAGO) for ASR, which forces mistranscription with minimal impact on human imperceptibility through voice activity detection rule and a speech-aware gradient-oriented optimizer. Our comprehensive experimental results reveal performance enhancements compared to baseline approaches across five models on two databases.

Paper Structure

This paper contains 16 sections, 5 equations, 1 figure, 2 tables.

Table of Contents

  1. Introduction
  2. Transferable Adversarial Attacks
  3. Problem Formulation
  4. Transferable Attack via Gradient Optimization
  5. Speech-Aware Gradient Optimization
  6. Momentum Based Gradient Optimization
  7. Time-Domain Attack
  8. Experiments
  9. Datasets
  10. Experimental Setups
  11. Results and Discussion
  12. White-box Attacks
  13. Noise Sensitivity
  14. Transferable Attacks
  15. Human Imperceptibility
  16. ...and 1 more sections

Figures (1)

  • Figure 1: The overview network architecture of the proposed three transferable attacks (1) Speech-aware gradient optimization (SAGO) (2) MI-FGSM and (3) VMI-FGSM.