Recent work has shown the possibility of adversarial attacks on automatic speechrecognition (ASR) systems. However, in the vast majority of work in this area, theattacks have been executed only in the digital space, or have involved short phrasesand static room settings. In this paper, we demonstrate a physically realizableaudio adversarial attack. We base our approach specifically on a psychoacoustic-property-based loss function, and automated generation of room impulse responses, to create adversarial attacks that are robust when played over a speaker in multiple environments. We show that such attacks are possible even while being virtually imperceptible to listeners.
In @cite_20 these attacks were extended to incorporate typical transformations in the adversarial generation process that an audio signal encounters from source to receiver. This was shown to improve the robustness of the attacks for over-the-air broadcasting but were more perceptible to listeners. Psychoacoustic properties were used to reduce the perceptibility of the adversarial signal in @cite_15 @cite_4 , but both methods encountered instability during back-propagation in the frequency domain. These methods were also not explored in the physical domain, i.e., they were conducted in the pure digital domain. Due to path effects from the speaker to the receiver, as well as additive noise, the success of the adversary may be severely affected in an over-the air scenario.
@cite_15 @cite_4 @cite_20
2898435086 2952730822 2951954400 2540574196
We propose a method to generate audio adversarial examples that can attack a state-of-the-art speech recognition model in the physical world. Previous work assumes that generated adversarial examples are directly fed to the recognition model, and is not able to perform such a physical attack because of reverberation and noise from playback environments. In contrast, our method obtains robust adversarial examples by simulating transformations caused by playback or recording in the physical world and incorporating the transformations into the generation process. Evaluation and a listening experiment demonstrated that our adversarial examples are able to attack without being noticed by humans. This result suggests that audio adversarial examples generated by the proposed method may become a real threat. Adversarial examples are inputs to machine learning models designed by an adversary to cause an incorrect output. So far, adversarial examples have been studied most extensively in the image domain. In this domain, adversarial examples can be constructed by imperceptibly modifying images to cause misclassification, and are practical in the physical world. In contrast, current targeted adversarial examples applied to speech recognition systems have neither of these properties: humans can easily identify the adversarial perturbations, and they are not effective when played over-the-air. This paper makes advances on both of these fronts. First, we develop effectively imperceptible audio adversarial examples (verified through a human study) by leveraging the psychoacoustic principle of auditory masking, while retaining 100 targeted success rate on arbitrary full-sentence targets. Next, we make progress towards physical-world over-the-air audio adversarial examples by constructing perturbations which remain effective even after applying realistic simulated environmental distortions. When generating adversarial examples to attack deep neural networks (DNNs), Lp norm of the added perturbation is usually used to measure the similarity between original image and adversarial example. However, such adversarial attacks perturbing the raw input spaces may fail to capture structural information hidden in the input. This work develops a more general attack model, i.e., the structured attack (StrAttack), which explores group sparsity in adversarial perturbations by sliding a mask through images aiming for extracting key spatial structures. An ADMM (alternating direction method of multipliers)-based framework is proposed that can split the original problem into a sequence of analytically solvable subproblems and can be generalized to implement other attacking methods. Strong group sparsity is achieved in adversarial perturbations even with the same level of Lp norm distortion as the state-of-the-art attacks. We demonstrate the effectiveness of StrAttack by extensive experimental results onMNIST, CIFAR-10, and ImageNet. We also show that StrAttack provides better interpretability (i.e., better correspondence with discriminative image regions)through adversarial saliency map (, 2016b) and class activation map(, 2016). Motivated by cognitive radio applications, we consider mitigating the effect of interference by exploiting known properties about its signal structure. Specifically, we analyze communication between a source and destination with an interferer that induces random variations in the source-destination channel. The interferer transmits a sequence chosen uniformly from a randomly generated codebook, which has an i.i.d. structure, or a superposition structure. It is assumed that both the encoder and decoder know the interferer's codebook. We first provide a definition of capacity for these settings. When the encoder knows the interferer's message noncausally, it can use Gel'fand-Pinsker (GP) encoding to precode against interference. Alternatively, it can encode by taking into account that the interference is a codeword, to enable the decoder to decode both messages. It is demonstrated by an example that the latter can outperform GP encoding. Two upper bounds to the performance of this channel are then presented. Next, a more realistic scenario is considered in which the interference is learned at the cognitive encoder causally through a noisy channel. It is shown that for the case of i.i.d. generated interference, this information has no value. In contrast, when the interference is a codeword from an i.i.d. generated codebook, this fact can be exploited to obtain higher rates between the cognitive pair.