[论文解读] Robust Over-the-Air Adversarial Examples Against Automatic Speech Recognition Systems.

Lea Schönherr, Steffen Zeiler+2 more|arXiv (Cornell University)|Aug 5, 2019

Adversarial Robustness in Machine Learning参考文献 16被引用 5

一句话总结

本文提出了一种通用且鲁棒的方法，用于生成过空气（over-the-air）对抗性样本，即使在音频通过真实声学环境播放后，也能成功欺骗自动语音识别（ASR）系统。通过模拟房间脉冲响应并利用心理声学掩蔽效应，该方法在无需精确知晓房间信息的情况下，适用于多种房间环境，同时保持高迁移性和对人类听觉的不可察觉性。

ABSTRACT

Automatic speech recognition (ASR) systems are possible to fool via targeted adversarial examples. These can induce the ASR to produce arbitrary transcriptions in response to any type of audio signal, be it speech, environmental sounds, or music. However, in general, those adversarial examples did not work in a real-world setup, where the examples are played over the air but have to be fed into the ASR system directly. In some cases, where the adversarial examples could be successfully played over the air, the attacks require precise information about the room where the attack takes place in order to tailor the adversarial examples to a specific setup and are not transferable to other rooms. Other attacks, which are robust in an over-the-air attack, are either handcrafted examples or human listeners can easily recognize the target transcription, once they have been alerted to its content. In this paper, we demonstrate the first generic algorithm that produces adversarial examples which remain robust in an over-the-air attack such that the ASR system transcribes the target transcription after actually being replayed. For the proposed algorithm, guessing a rough approximation of the room characteristics is enough and no actual access to the room is required. We use the ASR system Kaldi to demonstrate the attack and employ a room-impulse-response simulator to harden the adversarial examples against varying room characteristics. Further, the algorithm can also utilize psychoacoustics to hide changes of the original audio signal below the human thresholds of hearing. We show that the adversarial examples work for varying room setups, but also can be tailored to specific room setups. As a result, an attacker can optimize adversarial examples for any target transcription and to arbitrary rooms. Additionally, the adversarial examples remain transferable to varying rooms with a high probability.

研究动机与目标

• 解决现有ASR系统对抗性攻击在真实过空气条件下因声学失真而失效的问题。
• 开发一种通用攻击方法，使其在无需直接访问目标房间的情况下，仍能有效作用于不同房间环境。
• 通过利用心理声学掩蔽效应，确保对抗性样本对人类听觉不可察觉。
• 在保持高成功率欺骗ASR系统的同时，提升对抗性样本在新、未见房间环境中的迁移能力。

提出的方法

• 该方法使用房间脉冲响应（RIR）模拟器，对对抗性样本进行建模与加固，以抵御过空气播放过程中引入的真实声学失真。
• 采用可微分的ASR损失函数，生成能诱导目标ASR系统（Kaldi）产生特定转录结果的定向对抗性样本。
• 该方法结合心理声学模型，将音频信号中的扰动掩蔽在人类听觉阈值以下，确保不可察觉性。
• 以房间特征的粗略近似（如混响时间、距离）作为输入，使攻击能够泛化至未知房间。
• 通过在对抗性样本生成过程中迭代优化并结合RIR模拟，确保样本在真实音频传播导致的退化后仍保持有效性。
• 该方法支持通用优化与房间特定优化，使攻击者可针对特定环境定制样本，或实现跨多个设置的泛化。

实验结果

研究问题

• RQ1 能否在无需精确房间校准的情况下，使对抗性样本对过空气音频退化具有鲁棒性？
• RQ2 对抗性样本在保持对ASR系统有效的同时，能在多大程度上对人类听觉不可察觉？
• RQ3 生成的对抗性样本在不同声学环境中的迁移能力如何？
• RQ4 单个对抗性样本是否能在具有不同脉冲响应的多个房间中均有效？
• RQ5 心理声学掩蔽的使用如何影响过空气攻击的不可察觉性与成功率？

主要发现

• 所提出的方法在未获知房间精确特征的情况下，仍能在多种房间中播放时保持高成功率，证明其有效性。
• 该攻击在多个房间设置中均保持有效，展现出对未见环境的强大迁移能力。
• 心理声学掩蔽成功隐藏了对抗性扰动，使样本在内容被提示后对人类听觉不可察觉。
• 通过在对抗性样本生成过程中模拟房间脉冲响应，该方法显著提升了过空气攻击的成功率，实现了显著的鲁棒性。
• 该方法可针对特定房间进行优化以提升效果，或泛化至多个房间以实现更广泛的应用。
• 即使房间特征仅被粗略估计，该攻击仍保持有效，显示出对环境参数不确定性的强鲁棒性。