[Paper Review] Adversarial Attacks on Speech Recognition Systems for Mission-Critical Applications: A Survey

Ngoc Dung Huynh, Mohamed Reda Bouadjenek+5 more|arXiv (Cornell University)|Feb 22, 2022

Adversarial Robustness in Machine Learning4 citations

TL;DR

This survey investigates adversarial attacks on speech recognition systems in mission-critical applications, analyzing attack methods like FGSM and optimization-based techniques, and evaluating defenses such as adversarial training and detection. It identifies key challenges in real-world applicability, including over-the-air attacks and multi-input feature vulnerabilities, and provides actionable defense recommendations for robust system design.

ABSTRACT

A Machine-Critical Application is a system that is fundamentally necessary to the success of specific and sensitive operations such as search and recovery, rescue, military, and emergency management actions. Recent advances in Machine Learning, Natural Language Processing, voice recognition, and speech processing technologies have naturally allowed the development and deployment of speech-based conversational interfaces to interact with various machine-critical applications. While these conversational interfaces have allowed users to give voice commands to carry out strategic and critical activities, their robustness to adversarial attacks remains uncertain and unclear. Indeed, Adversarial Artificial Intelligence (AI) which refers to a set of techniques that attempt to fool machine learning models with deceptive data, is a growing threat in the AI and machine learning research community, in particular for machine-critical applications. The most common reason of adversarial attacks is to cause a malfunction in a machine learning model. An adversarial attack might entail presenting a model with inaccurate or fabricated samples as it's training data, or introducing maliciously designed data to deceive an already trained model. While focusing on speech recognition for machine-critical applications, in this paper, we first review existing speech recognition techniques, then, we investigate the effectiveness of adversarial attacks and defenses against these systems, before outlining research challenges, defense recommendations, and future work. This paper is expected to serve researchers and practitioners as a reference to help them in understanding the challenges, position themselves and, ultimately, help them to improve existing models of speech recognition for mission-critical applications. Keywords: Mission-Critical Applications, Adversarial AI, Speech Recognition Systems.

Motivation & Objective

• To analyze the vulnerability of speech recognition systems in mission-critical applications to adversarial attacks.
• To evaluate the effectiveness of existing adversarial attack techniques—such as FGSM and optimization-based methods—on speech recognition models.
• To survey current defense strategies, including reactive and proactive defenses, and assess their limitations.
• To identify open research challenges, such as over-the-air attacks and transferability across models.
• To provide actionable recommendations for improving robustness in real-world mission-critical deployments.

Proposed method

• Systematically reviewed speech recognition techniques, including HMMs and end-to-end deep learning models like CTC and attention-based networks.
• Surveyed adversarial attack methods, including FGSM for generating perturbations and optimization-based approaches like those by Carlini and Wagner.
• Evaluated attacks on different input representations, such as raw waveforms, spectrograms, and MFCCs, to assess feature-specific vulnerability.
• Analyzed over-the-air attack feasibility using acoustic room simulators and real-world propagation models.
• Reviewed defense mechanisms, including adversarial training, network verification, and denoising using GANs.
• Classified defenses into reactive (detection-based) and proactive (robustification-based) categories, assessing their strengths and weaknesses.

Experimental results

Research questions

• RQ1 How effective are existing adversarial attack methods—such as FGSM and optimization-based attacks—on speech recognition systems in mission-critical contexts?
• RQ2 To what extent do adversarial examples transfer across different speech recognition models, especially in real-world over-the-air conditions?
• RQ3 How do different input representations (e.g., waveforms, spectrograms, MFCCs) influence the success rate of adversarial attacks?
• RQ4 What are the key limitations of current defense strategies, particularly in handling white-box and low-distortion adversarial examples?
• RQ5 What are the open challenges in creating physically realizable, over-the-air adversarial examples that bypass real-world system constraints?

Key findings

• Adversarial attacks significantly degrade speech recognition performance, with even small perturbations causing misclassification, as demonstrated in scenarios like a patient falsely reporting 'all is well' due to injected noise.
• Over-the-air adversarial attacks remain a major challenge, as most prior methods rely on idealized conditions (e.g., quiet background), limiting real-world applicability.
• Transferability of adversarial examples across models is observed but not guaranteed, especially across diverse architectures, indicating a need for deeper theoretical understanding.
• Defenses such as adversarial training and GAN-based denoising show promise, but are often ineffective against white-box or low-distortion attacks.
• Reactive defenses like network verification and ensemble detection are effective but sensitive to transferability and perturbation characteristics.
• Targeted attacks on non-waveform features (e.g., spectrograms, MFCCs) remain underexplored, suggesting a gap in understanding feature-specific vulnerability.