Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

DUAP: Dual-task Universal Adversarial Perturbations Against Voice Control Systems

Suyang Sun, Weifei Jin, Yuxin Cao, Wei Song, Jie Hao

TL;DR

This work proposes Dual-task Universal Adversarial Perturbation (DUAP), which employs a targeted surrogate objective to effectively disrupt ASR transcription and introduces a Dynamic Normalized Ensemble (DNE) strategy to enhance transferability across diverse SR models.

Abstract

Modern Voice Control Systems (VCS) rely on the collaboration of Automatic Speech Recognition (ASR) and Speaker Recognition (SR) for secure interaction. However, prior adversarial attacks typically target these tasks in isolation, overlooking the coupled decision pipeline in real-world scenarios. Consequently, single-task attacks often fail to pose a practical threat. To fill this gap, we first utilize gradient analysis to reveal that ASR and SR exhibit no inherent conflicts. Building on this, we propose Dual-task Universal Adversarial Perturbation (DUAP). Specifically, DUAP employs a targeted surrogate objective to effectively disrupt ASR transcription and introduces a Dynamic Normalized Ensemble (DNE) strategy to enhance transferability across diverse SR models. Furthermore, we incorporate psychoacoustic masking to ensure perturbation imperceptibility. Extensive evaluations across five ASR and six SR models demonstrate that DUAP achieves high simultaneous attack success rates and superior imperceptibility, significantly outperforming existing single-task baselines.

DUAP: Dual-task Universal Adversarial Perturbations Against Voice Control Systems

TL;DR

This work proposes Dual-task Universal Adversarial Perturbation (DUAP), which employs a targeted surrogate objective to effectively disrupt ASR transcription and introduces a Dynamic Normalized Ensemble (DNE) strategy to enhance transferability across diverse SR models.

Abstract

Modern Voice Control Systems (VCS) rely on the collaboration of Automatic Speech Recognition (ASR) and Speaker Recognition (SR) for secure interaction. However, prior adversarial attacks typically target these tasks in isolation, overlooking the coupled decision pipeline in real-world scenarios. Consequently, single-task attacks often fail to pose a practical threat. To fill this gap, we first utilize gradient analysis to reveal that ASR and SR exhibit no inherent conflicts. Building on this, we propose Dual-task Universal Adversarial Perturbation (DUAP). Specifically, DUAP employs a targeted surrogate objective to effectively disrupt ASR transcription and introduces a Dynamic Normalized Ensemble (DNE) strategy to enhance transferability across diverse SR models. Furthermore, we incorporate psychoacoustic masking to ensure perturbation imperceptibility. Extensive evaluations across five ASR and six SR models demonstrate that DUAP achieves high simultaneous attack success rates and superior imperceptibility, significantly outperforming existing single-task baselines.
Paper Structure (18 sections, 10 equations, 4 figures, 3 tables)

This paper contains 18 sections, 10 equations, 4 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Audio Attacks on Automatic Speech Recognition
  4. Audio Attacks on Speaker Recognition
  5. Methodology
  6. Design Intuition
  7. Problem Formulation
  8. Overview of DUAP
  9. Dual-Task Adversarial Optimization
  10. Targeted ASR Optimization
  11. Dynamic Normalization Ensemble for SR
  12. Psychoacoustic Regularization
  13. Overall Objective
  14. Experiments
  15. Experimental Setup
  16. ...and 3 more sections

Figures (4)

  • Figure 1: Illustration of our attack scenario.
  • Figure 2: Distribution of cosine similarity between ASR and SR gradients. The concentration around zero indicates that the optimization directions for the two tasks are nearly orthogonal, validating the feasibility of joint optimization.
  • Figure 3: Overview of the proposed dual-task universal adversarial attack framework. A single perturbation $\delta$ is optimized with ASR, SR, and psychoacoustic objectives, enabling simultaneous disruption of ASR content and targeted speaker impersonation, while generalizing across speakers, utterances, and unseen models.
  • Figure 4: Impact of hyperparameters $\lambda_1$ and $\lambda_2$.