Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition

By Yao Qin, Nicholas Carlini, Ian J. Goodfellow, Garrison W. Cottrell, Colin Raffel. International Conference on Machine Learning, 2019

439 citations recorded by the source corpus.

Adversarial examples are inputs to machine learning models designed by an adversary to cause an incorrect output. So far, adversarial examples have been studied most extensively in the image domain. In this domain, adversarial examples can be constructed by imperceptibly modifying images to cause misclassification, and are practical in the physical world. In contrast, current targeted adversarial examples applied to speech recognition systems have neither of these properties: humans can easily identify the adversarial perturbations, and they are not effective when played over-the-air. This paper makes advances on both of these fronts. First, we develop effectively imperceptible audio adversarial examples (verified through a human study) by leveraging the psychoacoustic principle of auditory masking, while retaining 100% targeted success rate on arbitrary full-sentence targets. Next, we make progress towards physical-world over-the-air audio adversarial examples by constructing perturbations which remain effective even after applying realistic simulated environmental distortions.

Subfields: Artificial Intelligence, Statistical and Nonlinear Physics

View Paper: https://www.semanticscholar.org/paper/361c7858fa8f55928dc6358bc25d18fe3316d735

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

Real-Time Adversarial Attacks (2019, background): “…non-real-time audio adversarial attack technologies presented in [ Carlini et al. , 2016; Yakura and Sakuma, 2018; Gong and Poellabauer, 2018; Qin et al. , 2019 ] , the key advantage of the real-time audio adversarial attack scheme is that only by using this scheme the attacker is able to…”
A Survey of Deep Active Learning (2020, background): “ublication of a large number of existing annotation datasets [16, 87], in recent years, DL has made breakthroughs in various fields including machine translation [4, 13, 159, 168], speech recognition [110, 116, 120, 136], and image classification [60, 106, 115, 174]. However, this comes at the cost ”