[Paper Review] Perceptual Based Adversarial Audio Attacks

Joseph Szurley, J. Zico Kolter|arXiv (Cornell University)|Jun 14, 2019

Adversarial Robustness in Machine Learning25 references18 citations

TL;DR

This paper proposes a perceptually grounded, physically realizable adversarial audio attack that leverages psychoacoustic masking to generate imperceptible perturbations in the time domain. By optimizing for both adversarial success and perceptual quality using PESQ and robustness via synthetic room impulse responses, the method achieves 0% WER and CER in over-the-air tests with a language model decoder, even under degraded SNR conditions.

ABSTRACT

Recent work has shown the possibility of adversarial attacks on automatic speechrecognition (ASR) systems. However, in the vast majority of work in this area, theattacks have been executed only in the digital space, or have involved short phrasesand static room settings. In this paper, we demonstrate a physically realizableaudio adversarial attack. We base our approach specifically on a psychoacoustic-property-based loss function, and automated generation of room impulse responses, to create adversarial attacks that are robust when played over a speaker in multiple environments. We show that such attacks are possible even while being virtually imperceptible to listeners.

Motivation & Objective

• To develop a physically realizable adversarial audio attack that remains imperceptible to human listeners while successfully fooling automatic speech recognition (ASR) systems.
• To integrate psychoacoustic masking thresholds into the adversarial optimization process to reduce perceptual distortion without relying on frequency-domain back-propagation.
• To ensure robustness of adversarial examples across over-the-air conditions by incorporating synthesized room impulse responses during attack generation.
• To eliminate reliance on subjective listening tests by using the PESQ score as an objective measure of perceptual quality.
• To evaluate the attack in realistic physical environments, including multi-speaker and variable SNR scenarios, to demonstrate real-world feasibility.

Proposed method

• The method formulates the adversarial attack in the time domain by extracting psychoacoustic masking thresholds from the original audio's frequency-domain representation using DFT symmetry, avoiding unstable frequency-domain back-propagation.
• It uses an $ l_2 $-norm constrained optimization with projected gradient descent to generate adversarial perturbations that maximize ASR misclassification while minimizing perceptual distortion.
• The perceptual quality is optimized using the Perceptual Evaluation of Speech Quality (PESQ) score, which serves as a proxy for human listening tests.
• Synthetic room impulse responses are generated and applied during attack synthesis to simulate real-world over-the-air propagation effects, enhancing robustness.
• The attack is evaluated using both greedy and language model-based ASR decoders to assess error rates under varying signal-to-noise ratios (SNR).
• The approach is validated in anechoic and multi-speaker environments, including a 4-inch speaker separation setup with a 6-inch microphone distance, to test physical robustness.

Experimental results

Research questions

• RQ1 Can adversarial audio attacks be made physically realizable and imperceptible to human listeners using psychoacoustic principles?
• RQ2 How does incorporating perceptual quality metrics like PESQ improve the effectiveness and realism of adversarial audio attacks?
• RQ3 To what extent do synthetic room impulse responses enhance the robustness of adversarial examples in over-the-air ASR attacks?
• RQ4 How do different ASR decoding strategies (greedy vs. language model) affect the success rate of adversarial attacks under varying SNR conditions?
• RQ5 Can perceptually optimized adversarial examples maintain high attack success even when subjected to physical distortions like clipping and path loss?

Key findings

• The proposed attack achieved a word error rate (WER) of 0% and character error rate (CER) of 0% in 3 out of 4 trials using a language model decoder in a two-speaker over-the-air setup with an average SNR of 66.7 dBA.
• At an SNR of 60–70 dBA, the language model decoder achieved WER=4.0 and CER=2.4, while the greedy decoder achieved WER=3.0 and CER=2.25, demonstrating improved robustness with language modeling.
• The attack maintained high perceptual quality, with PESQ scores indicating improved speech quality despite adversarial perturbations, confirming the effectiveness of the psychoacoustic loss.
• Clipping at high SNR (due to signal amplitude exceeding microphone limits) significantly increased WER and CER, highlighting the importance of amplitude control in physical deployments.
• The method successfully generated adversarial examples that were both imperceptible and robust across multiple physical environments, including anechoic chambers and multi-speaker scenarios.
• The attack demonstrated strong generalization under physical channel effects, with performance remaining stable even as SNR decreased with increasing speaker-microphone distance.