Noise Flooding for Detecting Audio Adversarial Examples Against Automatic Speech Recognition

Abstract

Neural models enjoy widespread use across a variety of tasks and have grown to become crucial components of many industrial systems. Despite their effectiveness and extensive popularity, they are not without their exploitable flaws. Initially applied to computer vision systems, the generation of adversarial examples is a process in which seemingly imperceptible perturbations are made to an image, with the purpose of inducing a deep learning based classifier to misclassify the image. Due to recent trends in speech processing, this has become a noticeable issue in speech recognition models. In late 2017, an attack was shown to be quite effective against the Speech Commands classification model. Limited-vocabulary speech classifiers, such as the Speech Commands model, are used quite frequently in a variety of applications, particularly in managing automated attendants in telephony contexts. As such, adversarial examples produced by this attack could have real-world consequences. While previous work in defending against these adversarial examples has investigated using audio preprocessing to reduce or distort adversarial noise, this work explores the idea of flooding particular frequency bands of an audio signal with random noise in order to detect adversarial examples. This technique of flooding, which does not require retraining or modifying the model, is inspired by work done in computer vision and builds on the idea that speech classifiers are relatively robust to natural noise. A combined defense incorporating 5 different frequency bands for flooding the signal with noise outperformed other existing defenses in the audio space, detecting adversarial examples with 91.8% precision and 93.5% recall.Index Terms-adversarial example detection, speech recognition, deep learning 978-1-5386-7568-7/18/$31.00

A Multiversion Programming Inspired Approach to Detecting Audio Adversarial Examples

“…Rajaratnam et al [9] proposed to detect audio AEs based on audio pre-processing methods. Yet, if an attacker knows the detection details, he can take the pre-processing effect into account when generating AEs.…”

“…However, as admitted by the authors [8], this method cannot handle "adaptive attacks", which may evade the detection by embedding a malicious command into one section alone. Rajaratnam et al [9] proposed detection based on audio pre-processing methods. Yet, if an attacker knows the detection details, he can take the pre-processing effect into account when generating AEs.…”

Adversarial Example Devastation and Detection on Speech Recognition System by Adding Random Noise

“…For the detection strategy, Samizade et al [24] designed a convolution neural network (CNN) based method to detect adversarial examples. Rajaratnam et al [25] detected adversarial examples by adding random noise to different frequency bands of speech. Rajaratnam et al [26] also proposed a method to detect speech adversarial examples by comparing the differences between adversarial examples and normal examples in feature space.…”

Adversarial Example Detection by Classification for Deep Speech Recognition

“…signal transformation [22] and obfuscated gradients [23], have also been investigated, but they provide rather limited robustness improvement in face of advanced attacks. Audio preprocessing methods and their ensemble for defense against black-box attacks are studied in [24]. In [25], noise flooding is applied to signals for defensing against black-box examples.…”

“…Audio preprocessing methods and their ensemble for defense against black-box attacks are studied in [24]. In [25], noise flooding is applied to signals for defensing against black-box examples. All these methods are concerned with modifying input signals and testing the behaviours of the recognition model and have moderate success.…”