Neural models enjoy widespread use across a variety of tasks and have grown to become crucial components of many industrial systems. Despite their effectiveness and extensive popularity, they are not without their exploitable flaws. Initially applied to computer vision systems, the generation of adversarial examples is a process in which seemingly imperceptible perturbations are made to an image, with the purpose of inducing a deep learning based classifier to misclassify the image. Due to recent trends in speech processing, this has become a noticeable issue in speech recognition models. In late 2017, an attack was shown to be quite effective against the Speech Commands classification model. Limited-vocabulary speech classifiers, such as the Speech Commands model, are used quite frequently in a variety of applications, particularly in managing automated attendants in telephony contexts. As such, adversarial examples produced by this attack could have real-world consequences. While previous work in defending against these adversarial examples has investigated using audio preprocessing to reduce or distort adversarial noise, this work explores the idea of flooding p articular frequency bands of an audio signal with random noise in order to detect adversarial examples. This technique of flooding, which does not require retraining or modifying the model, is inspired by work done in computer vision and builds on the idea that speech classifiers are relatively robust to natural noise. A combined defense incorporating 5 different frequency bands for flooding the signal with noise outperformed other existing defenses in the audio space, detecting adversarial examples with 91.8 precision and 93.5 recall.
While the aforementioned defenses focus on removing or distorting adversarial noise, one could also defend against an adversarial example by adding noise to the signal. Artificial neural network (ANN) classifiers are relatively robust to natural noise, whereas adversarial examples are less so. @cite_13 used this observation and proposed a procedure for defending against adversarial images that involves corrupting localized regions of the image through the redistribution of pixel values. This procedure, which they refer to as "pixel deflection," was shown to be very effective for retrieving the true class of an adversarial attack. The strategy of defense proposed by is more sophisticated than merely corrupting images by indiscriminately redistributing pixels; they target specific pixels of the image to deflect and also perform a subsequent wavelet-based denoising procedure for softening the corruption's impact on benign inputs. Regardless of the many aspects of the pixel deflection defense that seem to only be directly applicable to defenses within computer vision, the fundamental motivating idea behind this strategy---that ANN classifiers are robust to natural noise on benign inputs relative to adversarial inputs---is an observation that should also hold true for audio classification.
@cite_13
2962933288
CNNs are poised to become integral parts of many critical systems. Despite their robustness to natural variations, image pixel values can be manipulated, via small, carefully crafted, imperceptible perturbations, to cause a model to misclassify images. We present an algorithm to process an image so that classification accuracy is significantly preserved in the presence of such adversarial manipulations. Image classifiers tend to be robust to natural noise, and adversarial attacks tend to be agnostic to object location. These observations motivate our strategy, which leverages model robustness to defend against adversarial perturbations by forcing the image to match natural image statistics. Our algorithm locally corrupts the image by redistributing pixel values via a process we term pixel deflection. A subsequent wavelet-based denoising operation softens this corruption, as well as some of the adversarial changes. We demonstrate experimentally that the combination of these techniques enables the effective recovery of the true class, against a variety of robust attacks. Our results compare favorably with current state-of-the-art defenses, without requiring retraining or modifying the CNN.