SirenAttack: Generating Adversarial Audio for End-to-End Acoustic Systems

Abstract

Despite their immense popularity, deep learning-based acoustic systems are inherently vulnerable to adversarial attacks, wherein maliciously crafted audios trigger target systems to misbehave. In this paper, we present SA, a new class of attacks to generate adversarial audios. Compared with existing attacks, SA highlights with a set of signicant features: (i) versatile-it is able to deceive a range of end-to-end acoustic systems under both white-box and black-box settings; (ii) eective-it is able to generate adversarial audios that can be recognized as specic phrases by target acoustic systems; and (iii) stealthy-it is able to generate adversarial audios indistinguishable from their benign counterparts to human perception. We empirically evaluate SA on a set of state-of-the-art deep learning-based acoustic systems (including speech command recognition, speaker recognition and sound event classication), with results showing the versatility, eectiveness, and stealthiness of SA. For instance, it achieves 99.45% attack success rate on the IEMOCAP dataset against the ResNet18 model, while the generated adversarial audios are also misinterpreted by multiple popular ASR platforms, including Google Cloud Speech, Microsoft Bing Voice, and IBM Speech-to-Text. We further evaluate three potential defense methods to mitigate such attacks, which leads to promising directions for further research.

On End-to-End White-Box Adversarial Attacks in Music Information Retrieval

“…The focus of this work is systems built on musical data, which we attack using a white-box adversarial approach with full knowledge of the attacked systems. Despite most research having been conducted on image data, audio systems have also been shown to be vulnerable, e.g., by Carlini and Wagner (2018); Du et al (2020). Different approaches in the audio domain adapt attacks from the image domain (Subramanian et al, 2020) or use "psychoacoustic hiding" in an attempt to make adversarial perturbations as imperceptible as possible (Schönherr et al, 2019;Qin et al, 2019).…”

Testing Machine Translation via Referential Transparency

“…However, these systems can generate erroneous outputs that, e.g., lead to fatal acci dents [52]- [54]. To explore the robustness of AI software, a line of research has focused on attacking different systems that use deep neural networks, such as autonomous cars [25], [55] and speech recognition services [20], [56]. These work aim to fool AI software by feeding input with imperceptible perturba tions (i.e., adversarial examples).…”

Audio-Visual Event Recognition Through the Lens of Adversary

“…We do not believe conventional wisdom could provide a "Panacea" at the moment. Inspired by [19] Adversarial examples were widely recognized to be a security concern for machine learning, and they are recently demonstrated to be equally effective in the audio domain [20], in the meantime, there were attempts to study them in audio tasks [21,22]. We are not only focusing on the security aspect of adversarial examples in this work, we also believe by going in the opposite direction of gradient descent (adversarial attack) we could potentially gain more insights.…”