2018

Audio Adversarial Examples: Targeted Attacks on Speech-to-Text

Carlini, Nicholas, Wagner, David

Understand

We construct targeted audio adversarial examples on automatic speech recognition.

Given any audio waveform, we can produce another that is over 99.9% similar, but transcribes as any phrase we choose (recognizing up to 50 characters per second of audio).
We apply our white-box iterative optimization-based attack to Mozilla's implementation DeepSpeech end-to-end, and show it has a 100% success rate.
The feasibility of this attack introduce a new domain to study adversarial examples.

Built on

Long short-term memory
S. Hochreiter and J. Schmidhuber · 1997
Earlier work this paper cites.
The scientist and engineer’s guide to digital signal processing
S. W. Smith et al · 1997
Earlier work this paper cites.
Adversarial learning
D. Lowd and C. Meek · 2005
Earlier work this paper cites.
Can machine learning be secure?
M. Barreno, B. Nelson, R. Sears, A. D. Joseph, and J. D. Tygar · 2006
Earlier work this paper cites.
Connectionist temporal classification: labelling unsegmented sequence data with recurrent neural networks
A. Graves, S. Fernández, F. Gomez, and J. Schmidhuber · 2006
Earlier work this paper cites.
The security of machine learning
M. Barreno, B. Nelson, A. D. Joseph, and J. Tygar · 2010
Earlier work this paper cites.
Estimating or propagating gradients through stochastic neurons for conditional computation
Original
Y. Bengio, N. Léonard, and A. Courville · 2013
Earlier work this paper cites.
Evasion attacks against machine learning at test time
B. Biggio, I. Corona, D. Maiorca, B. Nelson, N. Šrndić, P. Laskov, G. Giacinto, and F. Roli · 2013
Earlier work this paper cites.
Intriguing properties of neural networks
C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus · 2013
Earlier work this paper cites.
Explaining and harnessing adversarial examples
Original
I. J. Goodfellow, J. Shlens, and C. Szegedy · 2014
Earlier work this paper cites.
Deep speech: Scaling up end-to-end speech recognition
Original
A. Hannun, C. Case, J. Casper, B. Catanzaro, G. Diamos, E. Elsen, R. Prenger, S. Satheesh, S. Sengupta, A. Coates, et al · 2014
Earlier work this paper cites.
Adam: A method for stochastic optimization
Original
D. Kingma and J. Ba · 2014
Earlier work this paper cites.
Deep learning and music adversaries
C. Kereliuk, B. L. Sturm, and J. Larsen · 2015
Earlier work this paper cites.

Similar

Deep neural networks are easily fooled: High confidence predictions for unrecognizable images
A. Nguyen, J. Yosinski, and J. Clune · 2015
Cited alongside, same era.
Hidden voice commands
N. Carlini, P. Mishra, T. Vaidya, Y. Zhang, M. Sherr, C. Shields, D. Wagner, and W. Zhou · 2016
Cited alongside, same era.
Adversarial perturbations against deep neural networks for malware classification
Original
K. Grosse, N. Papernot, P. Manoharan, M. Backes, and P. McDaniel · 2016
Cited alongside, same era.
Adversarial examples in the physical world
Original
A. Kurakin, I. Goodfellow, and S. Bengio · 2016
Cited alongside, same era.
Delving into transferable adversarial examples and black-box attacks
Original
Y. Liu, X. Chen, C. Liu, and D. Song · 2016
Cited alongside, same era.
Universal adversarial perturbations
Original
S.-M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard · 2016
Cited alongside, same era.
Adversarial diversity and hard positive generation
A. Rozsa, E. M. Rudd, and T. E. Boult · 2016
Cited alongside, same era.
Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition
M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter · 2016
Cited alongside, same era.
On the robustness of semantic segmentation models to adversarial attacks
Original
A. Arnab, O. Miksik, and P. H. Torr · 2017
Cited alongside, same era.
Synthesizing robust adversarial examples
Original
A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok · 2017
Cited alongside, same era.
Vulnerability of deep reinforcement learning to policy induction attacks
Original
V. Behzadan and A. Munir · 2017
Cited alongside, same era.
Towards evaluating the robustness of neural networks
N. Carlini and D. Wagner · 2017
Cited alongside, same era.

Then

Crafting adversarial examples for speech paralinguistics applications
Original
Y. Gong and C. Poellabauer · 2017
Later among the works it cites.
Sequence modeling with ctc
A. Hannun · 2017
Later among the works it cites.
Generating adversarial malware examples for black-box attacks based on gan
Original
W. Hu and Y. Tan · 2017
Later among the works it cites.
Adversarial attacks on neural network policies
Original
S. Huang, N. Papernot, I. Goodfellow, Y. Duan, and P. Abbeel · 2017
Later among the works it cites.
Query-efficient black-box adversarial examples
Original
A. Ilyas, L. Engstrom, A. Athalye, and J. Lin · 2017
Later among the works it cites.
Adversarial examples for evaluating reading comprehension systems
Original
R. Jia and P. Liang · 2017
Later among the works it cites.
Adversarial examples for generative models
Original
J. Kos, I. Fischer, and D. Song · 2017
Later among the works it cites.
Towards deep learning models resistant to adversarial attacks
Original
A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu · 2017
Later among the works it cites.
Project deepspeech
Mozilla · 2017
Later among the works it cites.
Inaudible voice commands
Original
L. Song and P. Mittal · 2017
Later among the works it cites.
Dolphinatack: Inaudible voice commands
G. Zhang, C. Yan, X. Ji, T. Zhang, T. Zhang, and W. Xu · 2017
Later among the works it cites.
Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples
Original
A. Athalye, N. Carlini, and D. Wagner · 2018
Closest in time.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…