[Paper Review] Weighted-Sampling Audio Adversarial Example Attack

Xiaolei Liu, Xiaosong Zhang+3 more|arXiv (Cornell University)|Jan 26, 2019

Adversarial Robustness in Machine Learning41 references4 citations

TL;DR

This paper proposes a fast, robust audio adversarial attack using Weighted Perturbation Technology (WPT) and Sampling Perturbation Technology (SPT), which optimize the number and weights of perturbed audio points to accelerate generation and enhance noise robustness. The method achieves imperceptible, highly robust adversarial examples in just 4–5 minutes—significantly faster than prior methods—while improving audio fidelity via a total variation distance (TVD) loss function.

ABSTRACT

Recent studies have highlighted audio adversarial examples as a ubiquitous threat to state-of-the-art automatic speech recognition systems. Thorough studies on how to effectively generate adversarial examples are essential to prevent potential attacks. Despite many research on this, the efficiency and the robustness of existing works are not yet satisfactory. In this paper, we propose~ extit{weighted-sampling audio adversarial examples}, focusing on the numbers and the weights of distortion to reinforce the attack. Further, we apply a denoising method in the loss function to make the adversarial attack more imperceptible. Experiments show that our method is the first in the field to generate audio adversarial examples with low noise and high audio robustness at the minute time-consuming level.

Motivation & Objective

• To address the inefficiency of existing audio adversarial attack methods, which require over an hour to generate a single example.
• To improve the robustness of adversarial audio examples against common audio distortions such as random noise introduced during recording and playback.
• To investigate the impact of different loss function metrics on audio adversarial example quality and imperceptibility.
• To introduce the novel concept of optimizing both the number and weights of perturbed audio points, rather than perturbing all points uniformly.
• To enable practical, over-the-air adversarial attacks by generating examples that remain effective under real-world audio degradation.

Proposed method

• Proposes Weighted Perturbation Technology (WPT), which assigns adaptive weights to distortion points based on their importance in the audio signal, improving attack efficiency by focusing on key regions.
• Introduces Sampling Perturbation Technology (SPT), which reduces the number of perturbed points to 75% of the audio vector, leveraging speech context correlation to maintain robustness.
• Employs a hybrid loss function combining model loss (to match target transcription) and metric loss (to preserve audio similarity), using Total Variation Distance (TVD) as the metric for improved imperceptibility.
• Applies a denoising mechanism within the loss function to enhance robustness against pointwise random noise during audio transmission.
• Uses a beam-search decoder and a learning rate decay strategy (β = 0.8) to stabilize training and accelerate convergence.
• Optimizes hyperparameters including c = 0.001, γ = 10, and initial learning rate of 100, with decay every 50 iterations upon successful adversarial example generation.

Experimental results

Research questions

• RQ1 Can reducing the number of perturbed points in audio adversarial examples improve robustness against real-world audio degradation?
• RQ2 Does assigning variable weights to distortion points enhance attack efficiency and maintain high success rates?
• RQ3 How does the choice of metric in the loss function affect the imperceptibility and robustness of audio adversarial examples?
• RQ4 Can a combination of WPT and SPT generate adversarial examples faster than state-of-the-art methods while maintaining high robustness?
• RQ5 Is it possible to generate audio adversarial examples that remain effective after adding imperceptible noise, such as that introduced during recording or transmission?

Key findings

• The proposed method generates audio adversarial examples in just 4–5 minutes, a substantial improvement over prior methods that require over an hour.
• The method achieves high attack success rates while maintaining low perceptual distortion, as confirmed by listening tests on the provided website.
• SPT with 75% perturbed points significantly improves robustness against random noise compared to full-vector perturbation methods.
• Using TVD as the metric loss function leads to more imperceptible adversarial examples than standard lp-norms.
• The method is complementary to existing attacks and can be applied to enhance the performance of other adversarial attack frameworks.
• Experiments show that adversarial examples remain effective even after adding imperceptible noise, demonstrating strong robustness in real-world conditions.