Universal Adversarial Perturbations for Speech Recognition Systems

Abstract

In this work, we demonstrate the existence of universal adversarial audio perturbations that cause mis-transcription of audio signals by automatic speech recognition (ASR) systems. We propose an algorithm to find a single quasi-imperceptible perturbation, which when added to any arbitrary speech signal, will most likely fool the victim speech recognition model. Our experiments demonstrate the application of our proposed technique by crafting audio-agnostic universal perturbations for the state-of-the-art ASR system -Mozilla DeepSpeech. Additionally, we show that such perturbations generalize to a significant extent across models that are not available during training, by performing a transferability test on a WaveNet based ASR system.

Weight Poisoning Attacks on Pretrained Models

“…A closely related topic are adversarial attacks, first investigated by Szegedy et al (2013) and Goodfellow et al (2015) in computer vision and later extended to text classification (Papernot et al, 2016;Ebrahimi et al, 2018b;Li et al, 2018;Hosseini et al, 2017) and translation (Ebrahimi et al, 2018a;Michel et al, 2019). Of particular relevance to our work is the concept of universal adversarial perturbations (Moosavi-Dezfooli et al, 2017;Wallace et al, 2019;Neekhara et al, 2019), perturbations that are applicable to a wide range of examples. Specifically the adversarial triggers from Wallace et al (2019) are reminiscent of the attack proposed here, with the crucial difference that their attack fixes the model's weights and finds a specific trigger, whereas the attack we explore fixes the trigger and changes the model's weights to introduce a specific response.…”

Deep Speaker Recognition: Process, Progress, and Challenges

“…Such a technique is often referred to as perturbations. Further, a single noise input can cause false recognition of any speech input, and it is termed as universal perturbation [76], [77]. Adversarial attacks can be non-targeted and targeted.…”

Real-Time, Universal, and Robust Adversarial Attacks Against Speaker Recognition Systems

“…However, all the aforementioned ASR adversarial attacks are individual attack through solving an optimization problem for each individual input audio, which needs high run-time requirements (e.g., several hours) to compute the adversarial examples per input audio. Alternatively, a more recent work [12] produces a single universal perturbation which can fool ASR systems causing an error in transcription. This work is in the case of untargeted attack, in which the adversary cannot specify the expected speech transcription during the phase of adversary example generation.…”