Generation of Black-box Audio Adversarial Examples Based on Gradient Approximation and Autoencoders

Huang, Po-Hao; Yu, Honggang; Panoff, Max; Wang, Ting-Chi

doi:10.1145/3491220

Cited by 4 publications

(4 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…An example of black-box attack methods is the gradient-free Alzantot method [4] that uses genetic algorithm optimization. Gradient approximation is used to generate black-box audio adversarial examples in [20].…”

Section: A White-box and Black-box Attacksmentioning

confidence: 99%

“…The chosen model architecture and hyperparameterisation mostly follows [17]. One change is to have a fixed input size as (31,20), corresponding to (#frames, #cepstral coefficients), throughout all experiments. Additionally our model has one single output for binary classification.…”

Section: B Detection Modelmentioning

confidence: 99%

“…We chose these to cover possible real world settings where ASR systems are employed and may be exposed to adversarial attacks, and these noise files are readily available online, making the experiments reproducible. We mix noise with speech at [0, 5,10,15,20] dB SNR levels.…”

Section: E Detection In Noisy Environmentsmentioning

confidence: 99%

See 2 more Smart Citations

Leveraging Domain Features for Detecting Adversarial Attacks Against Deep Speech Recognition in Noise

Nielsen

2023

IEEE Open J. Signal Process.

View full text Add to dashboard Cite

In recent years, significant progress has been made in deep model-based automatic speech recognition (ASR), leading to its widespread deployment in the real world. At the same time, adversarial attacks against deep ASR systems are highly successful. Various methods have been proposed to defend ASR systems from these attacks. However, existing classification based methods focus on the design of deep learning models while lacking exploration of domain specific features. This work leverages filter bank-based features to better capture the characteristics of attacks for improved detection. Furthermore, the paper analyses the potentials of using speech and non-speech parts separately in detecting adversarial attacks. In the end, considering adverse environments where ASR systems may be deployed, we study the impact of acoustic noise of various types and signal-to-noise ratios. Extensive experiments show that the inverse filter bank features generally perform better in both clean and noisy environments, the detection is effective using either speech or non-speech part, and the acoustic noise can largely degrade the detection performance.

show abstract

Section: A White-box and Black-box Attacksmentioning

confidence: 99%

Section: B Detection Modelmentioning

confidence: 99%

See 1 more Smart Citation

Leveraging Domain Features for Detecting Adversarial Attacks Against Deep Speech Recognition in Noise

Nielsen

2023

IEEE Open J. Signal Process.

View full text Add to dashboard Cite

show abstract

“…Mainstream black-box attack methods include score-based [7,9,11,12], decisionbased [13][14][15], and substitute-based [16][17][18][19] approaches.…”

Section: Introductionmentioning

confidence: 99%

Side Channel Based Substitute Adversarial Attack on Deep Learning Models

Chen,

Hu,

et al. 2024

Preprint

View full text Add to dashboard Cite

Deep learning models are highly susceptible to adversarial perturbations. Among model attackers, the black-box assumption, where no prior knowledge of the victim model is available, is the most common and practical scenario. Substitute attack, as a mainstream black-box attack method, involves training a surrogate model and leveraging the transferability property of its generated adversarial examples to attack the target model. However, existing approaches typically require a large number of queries to the victim model, resulting in reduced attack efficiency and performance. In this work, we propose an effective side channel attack method to estimate the fine-grained structure of the victim model. We leverage the adjacent intermediate layer perturbation technique to enhance the performance of adversarial attacks. Specifically, we demonstrate that the model structure at the layer level can be analyzed and revealed through a power side channel attack. Our experimental results indicate that the structure information can be successfully restored with an average success rate of 94\%, leading to a significant improvement in the attack success rate across multiple classic datasets.

show abstract