Towards the universal defense for query-based audio adversarial attacks on speech recognition system
Abstract Recently, studies show that deep learning-based automatic speech recognition (ASR) systems are vulnerable to adversarial examples (AEs), which add a small amount of noise to the original audio examples. These AE attacks pose new challenges to deep learning security and have raised significa...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
SpringerOpen
2023-08-01
|
| Series: | Cybersecurity |
| Subjects: | |
| Online Access: | https://doi.org/10.1186/s42400-023-00177-6 |
| _version_ | 1827875478830055424 |
|---|---|
| author | Feng Guo Zheng Sun Yuxuan Chen Lei Ju |
| author_facet | Feng Guo Zheng Sun Yuxuan Chen Lei Ju |
| author_sort | Feng Guo |
| collection | DOAJ |
| description | Abstract Recently, studies show that deep learning-based automatic speech recognition (ASR) systems are vulnerable to adversarial examples (AEs), which add a small amount of noise to the original audio examples. These AE attacks pose new challenges to deep learning security and have raised significant concerns about deploying ASR systems and devices. The existing defense methods are either limited in application or only defend on results, but not on process. In this work, we propose a novel method to infer the adversary intent and discover audio adversarial examples based on the AEs generation process. The insight of this method is based on the observation: many existing audio AE attacks utilize query-based methods, which means the adversary must send continuous and similar queries to target ASR models during the audio AE generation process. Inspired by this observation, We propose a memory mechanism by adopting audio fingerprint technology to analyze the similarity of the current query with a certain length of memory query. Thus, we can identify when a sequence of queries appears to be suspectable to generate audio AEs. Through extensive evaluation on four state-of-the-art audio AE attacks, we demonstrate that on average our defense identify the adversary’s intent with over $$90\%$$ 90 % accuracy. With careful regard for robustness evaluations, we also analyze our proposed defense and its strength to withstand two adaptive attacks. Finally, our scheme is available out-of-the-box and directly compatible with any ensemble of ASR defense models to uncover audio AE attacks effectively without model retraining. |
| first_indexed | 2024-03-12T17:07:28Z |
| format | Article |
| id | doaj.art-c525888f6a854936a7901651563931cc |
| institution | Directory Open Access Journal |
| issn | 2523-3246 |
| language | English |
| last_indexed | 2024-03-12T17:07:28Z |
| publishDate | 2023-08-01 |
| publisher | SpringerOpen |
| record_format | Article |
| series | Cybersecurity |
| spelling | doaj.art-c525888f6a854936a7901651563931cc2023-08-06T11:18:10ZengSpringerOpenCybersecurity2523-32462023-08-016111810.1186/s42400-023-00177-6Towards the universal defense for query-based audio adversarial attacks on speech recognition systemFeng Guo0Zheng Sun1Yuxuan Chen2Lei Ju3School of Cyber Science and Technology, Shandong UniversitySchool of Cyber Science and Technology, Shandong UniversitySchool of Cyber Science and Technology, Shandong UniversitySchool of Cyber Science and Technology, Shandong UniversityAbstract Recently, studies show that deep learning-based automatic speech recognition (ASR) systems are vulnerable to adversarial examples (AEs), which add a small amount of noise to the original audio examples. These AE attacks pose new challenges to deep learning security and have raised significant concerns about deploying ASR systems and devices. The existing defense methods are either limited in application or only defend on results, but not on process. In this work, we propose a novel method to infer the adversary intent and discover audio adversarial examples based on the AEs generation process. The insight of this method is based on the observation: many existing audio AE attacks utilize query-based methods, which means the adversary must send continuous and similar queries to target ASR models during the audio AE generation process. Inspired by this observation, We propose a memory mechanism by adopting audio fingerprint technology to analyze the similarity of the current query with a certain length of memory query. Thus, we can identify when a sequence of queries appears to be suspectable to generate audio AEs. Through extensive evaluation on four state-of-the-art audio AE attacks, we demonstrate that on average our defense identify the adversary’s intent with over $$90\%$$ 90 % accuracy. With careful regard for robustness evaluations, we also analyze our proposed defense and its strength to withstand two adaptive attacks. Finally, our scheme is available out-of-the-box and directly compatible with any ensemble of ASR defense models to uncover audio AE attacks effectively without model retraining.https://doi.org/10.1186/s42400-023-00177-6Adversarial attacksDefenseMemory mechanismQuery-based |
| spellingShingle | Feng Guo Zheng Sun Yuxuan Chen Lei Ju Towards the universal defense for query-based audio adversarial attacks on speech recognition system Cybersecurity Adversarial attacks Defense Memory mechanism Query-based |
| title | Towards the universal defense for query-based audio adversarial attacks on speech recognition system |
| title_full | Towards the universal defense for query-based audio adversarial attacks on speech recognition system |
| title_fullStr | Towards the universal defense for query-based audio adversarial attacks on speech recognition system |
| title_full_unstemmed | Towards the universal defense for query-based audio adversarial attacks on speech recognition system |
| title_short | Towards the universal defense for query-based audio adversarial attacks on speech recognition system |
| title_sort | towards the universal defense for query based audio adversarial attacks on speech recognition system |
| topic | Adversarial attacks Defense Memory mechanism Query-based |
| url | https://doi.org/10.1186/s42400-023-00177-6 |
| work_keys_str_mv | AT fengguo towardstheuniversaldefenseforquerybasedaudioadversarialattacksonspeechrecognitionsystem AT zhengsun towardstheuniversaldefenseforquerybasedaudioadversarialattacksonspeechrecognitionsystem AT yuxuanchen towardstheuniversaldefenseforquerybasedaudioadversarialattacksonspeechrecognitionsystem AT leiju towardstheuniversaldefenseforquerybasedaudioadversarialattacksonspeechrecognitionsystem |