PaperlayerView exact revision on arXiv

Source-linked AI summary

Deep Learning and Music Adversaries

Corey Kereliuk, Bob L. Sturm, Jan Larsen

arXiv:1507.04761v1cs.LGcs.NEcs.SD

TL;DR

Deep music-analysis systems can appear successful while responding to features that do not reflect meaningful musical content, prompting questions about their adversarial robustness. The paper adapts an adversary to music inputs and finds it defeats systems across architectures and benchmark settings, while convolutional systems are more robust and adversarial training does not improve resilience to the same adversary.

  • Problem

    High-performing deep systems may confidently misclassify inputs, and music systems often take feature representations rather than raw pixels or audio, leaving open how adversaries apply to them.

    Source: §I · p. 1, §III · p. 5

  • Method

    The authors adapt a gradient-based adversary to magnitude-STFT inputs, projecting perturbed representations back toward valid audio and testing systems trained on benchmark datasets.

    Source: §III · p. 5, A. Adversaries for music audio · pp. 6–7

  • Results

    The adversary defeats deep systems across architectures and benchmark datasets; convolutional networks are more robust than deep neural networks, and adversarial training does not improve resilience to the same adversary.

    Source: §IV · p. 9, §VI · p. 11

  • Takeaways & Limitations

    Small perturbations can leave the music unchanged while fooling deep systems, and the observed sensitivity suggests high-frequency energy distribution can influence their decisions.

    Source: §V · p. 11

Abstract

from arXiv · show

An adversary is essentially an algorithm intent on making a classification system perform in some particular way given an input, e.g., increase the probability of a false negative. Recent work builds adversaries for deep learning systems applied to image object recognition, which exploits the parameters of the system to find the minimal perturbation of the input image such that the network misclassifies it with high confidence. We adapt this approach to construct and deploy an adversary of deep learning systems applied to music content analysis. In our case, however, the input to the systems is magnitude spectral frames, which requires special care in order to produce valid input audio signals from network-derived perturbations. For two different train-test partitionings of two benchmark datasets, and two different deep architectures, we find that this adversary is very effective in defeating the resulting systems. We find the convolutional networks are more robust, however, compared with systems based on a majority vote over individually classified audio frames. Furthermore, we integrate the adversary into the training of new deep systems, but do not find that this improves their resilience against the same adversary.

I. INTRODUCTION

Deep learning has expanded music content analysis, but strong benchmark performance may not show that systems have learned meaningful musical content. The paper asks whether adversaries can expose such weaknesses in music systems and whether adversarial training can improve robustness.

I. INTRODUCTION

  • Music information retrieval aims to make music or information about it easier to find, supporting applications from identification and recommendation to transcription and musicology.The authors note that searchable music descriptions could reduce the cost of processing large and growing music collections.Source: §I · p. 1
  • Deep learning methods require substantial data to estimate parameters and generalize well.Prior music-content studies reported automatically learned features for tasks such as genre and style recognition,,,,,,,.Source: §I · p. 1
  • Adversaries can make high-performing recognition systems confidently misclassify inputs, raising questions about whether their apparent performance reflects content recognition.Prior examples include synthetic images and rhythms, as well as imperceptible image perturbations.Source: §I · p. 1
  • The paper asks how image-based adversaries transfer to music systems with feature inputs, whether generated perturbations remain perceptually identical, and whether adversarial training improves robustness.It also asks whether adversaries can help compare deep systems with systems using hand-crafted features.Source: §I · pp. 1–2
  • The study extends preliminary adversarial work to convolutional systems, a larger benchmark dataset, and experiments incorporating adversaries into training.The earlier work showed that small magnitude-spectrum perturbations could make systems assign chosen labels with high confidence.Source: §I · p. 2

II. DEEP LEARNING FOR MUSIC CONTENT ANALYSIS

The paper reviews deep learning for music content analysis, then introduces two architectures and evaluates systems trained on benchmark datasets.

II. DEEP LEARNING FOR MUSIC CONTENT ANALYSIS

  • The paper begins with an overview of deep learning research in music content analysis.This overview precedes the architecture and system experiments.Source: §II · p. 2
  • The authors discuss two deep-learning architectures and train music-content-analysis systems using them.The systems are then used in the experiments described in Section IV.Source: §II · p. 2
  • The trained systems are tested on two benchmark MIR datasets.Source: §II · p. 2

A. Overview

Prior music-analysis work applies deep architectures across recognition and description tasks, using varied audio representations and classification setups. The paper’s illustrated CDNN uses convolutional and pooling layers to summarize a 2.35-second spectrogram input.

A. Overview

  • Deep architectures have been motivated as a way to learn hierarchical relationships in music, beyond reliance on shallow, hand-designed features.The cited account describes pitch and loudness combining over time into chords, melodies, and rhythms.Source: A. Overview · p. 2
  • Early music deep-learning studies explored learned features for genre and artist recognition, including convolutional belief networks trained on spectrograms and convolutional networks using MFCC sequences [35].The described genre-recognition CDNN summarizes events over 2.2 seconds.Source: A. Overview · p. 2
  • For genre recognition, Hamel and Eck report accuracy above 0.84 using aggregated activations from three hidden layers, while Sigtia and Dixon report about 0.83 using aggregated hidden-layer activations,.Both works use hidden-layer activations as features for a separate classifier.Source: A. Overview · p. 2
  • Dieleman et al. use beat-averaged chroma and timbre features, music-informed architecture choices, and output posteriors for classification.Their experiments cover a portion of the Million Song Dataset.Source: A. Overview · pp. 2–3
  • The paper’s CDNN processes a 100-time-slice spectrogram through convolutional and max-pooling layers before a 50-unit hidden layer and softmax output.The final layer summarizes 2.35 seconds of input; the first convolutional layer has 32 filters.Source: Figure 1 · p. 3
  • Other cited work applies deep architectures to autotagging from raw audio, mood, beat-number, and chord or guitar-fingering recognition,,,,.Source: A. Overview · p. 3

B. Two types of deep architectures

The paper contrasts fully connected deep neural networks with convolutional networks that share weights across locations. It describes gradient-based training and common techniques used to augment it.

B. Two types of deep architectures

  • A deep neural network chains hidden layers that apply nonlinear transformations, producing composite representations of the input.The authors note that this can give deep networks greater representational power than shallower networks with an equivalent parameter count.Source: B. Two types of deep architectures · p. 3
  • A CDNN shares weights across positions, reducing trainable parameters and turning matrix multiplications into efficient convolutions.The authors note that audio contains repeated harmonic and temporal structures that CDNNs can learn.Source: B. Two types of deep architectures · p. 3
  • Deep architectures are usually trained with gradient descent and backpropagated cost-function derivatives, often augmented by methods such as dropout, weight decay, and momentum.Source: B. Two types of deep architectures · p. 3

C. Deep learning with two music genre benchmarks

The study evaluates DNNs and convolutional DNNs on GTZAN and the Latin Music Database (LMD), using multiple dataset partitionings and audio-derived inputs. It also compares direct deep-network classification with random-forest classification over aggregated DNN features.

C. Deep learning with two music genre benchmarks

  • GTZAN, and the private LMD supply the two ten-category benchmarks; only the first 30 seconds of each LMD track are used.GTZAN has 100 thirty-second excerpts per category; LMD has 3,229 full-length tracks distributed nonuniformly across categories.Source: C. Deep learning with two music genre… · p. 3
  • Artist-filtered and random partitions are evaluated for both datasets, with GTZAN’s artist-filtered split also removing replicas and distorted files.The GTZAN artist-filtered split contains 443/197/290 training/validation/test excerpts; LMD retains all 213 replicas.Source: C. Deep learning with two music genre… · p. 4
  • Inputs derive from 46 ms Hann-window STFT frames, using 1,024-sample windows and a 512-sample hop.DNNs process 513-dimensional frames, while CDNNs process sequences of 100 frames.Source: C. Deep learning with two music genre… · p. 4
  • The DNNs use three fully connected hidden layers; the CDNN uses two convolutional and pooling layers followed by a 50-unit fully connected layer.The DNN hidden layers have either 50 or 500 units; the CDNN’s first convolutional layer uses 32 filters in a 400 × 4 grid.Source: C. Deep learning with two music genre… · p. 4
  • A random forest with 500 trees classifies concatenated hidden-layer activations summarized by means and standard deviations over five-second windows.The windows hop by 50%, and recording-level labels use majority voting across window classifications.Source: C. Deep learning with two music genre… · p. 4

D. Preliminary evaluation

Performance differed substantially between random and artist-filtered partitions. The fault-filtered GTZAN results were markedly lower, consistent with the importance of partitioning by artist.

D. Preliminary evaluation

  • Mean recall on fault-filtered GTZAN was over 30 percentage points lower in most classes than on the random test partition.Similar performance drops persisted with dropout regularization.Source: D. Preliminary evaluation · p. 4
  • Partitioning by artist is recommended to avoid bias, and the fault-filtered GTZAN partition had not been used in many benchmark experiments.The passage notes that GTZAN artist information had only recently become available.Source: D. Preliminary evaluation · p. 4
  • The preliminary comparison used random-forest classification of DNN-derived features across the two GTZAN partitionings.Figure 2 and Table I report the comparison.Source: D. Preliminary evaluation · p. 4

III. ADVERSARIES IN MUSIC CONTENT ANALYSIS

Prior work frames adversarial examples as small input changes that can alter a deep classifier’s prediction. This section asks whether such attacks transfer to music systems, whose inputs often are spectral features, and whether training can improve robustness.

III. ADVERSARIES IN MUSIC CONTENT ANALYSIS

  • An adversary is framed as an agent seeking to defeat a classifier to maximize its gain, while deep-learning attacks use classifier knowledge to induce misclassification with a small perturbation, [54].The cited formulation asks for a minimum-norm change that produces a requested class.Source: §III · pp. 4–5
  • Szegedy et al. [54] report that adversarial examples can fool classifiers trained independently of the model used to generate them.For a requested class, their method searches along the network loss direction from the original input.Source: §III · p. 5
  • Goodfellow et al. [24] explain that small per-dimension changes can accumulate through high-dimensional network projections, with perturbation direction especially important.They show examples generated using the sign of the loss gradient for the requested class.Source: §III · p. 5
  • The paper asks whether music classifiers can be made to output any high-confidence label through imperceptible audio changes, and whether adversarial training can improve robustness.Its approach must account for systems that take magnitude-STFT features rather than raw audio samples.Source: §III · p. 5

A. Adversaries for music audio

The adversary searches for a perturbed music input that a deep system confidently assigns to a target class, while constraining the perturbation and ensuring the resulting spectral sequence corresponds to valid audio. The section also presents FoM results for deep-learning classifiers under two LMD partitioning strategies.

A. Adversaries for music audio

  • The adversary seeks a perturbed input that a deep system confidently classifies as a chosen target class, subject to a maximum-perturbation constraint.Its search uses the network loss and gradient information to find an adversarial sequence.Source: A. Adversaries for music audio · pp. 5–7
  • Figure 3 reports FoM for deep-learning classifiers across two LMD partition strategies, rather than random-forest classification from hidden-layer features.The caption points to Figure 2 for the FoM interpretation.Source: Figure 3 · p. 6
  • Gradient updates are projected onto feasible sequences, and the search stops when the target-confidence threshold is reached or the iteration limit is met.The procedure uses projected gradient descent and an SNR constraint.Source: A. Adversaries for music audio · p. 7
  • Overlapping analysis windows make adjacent spectral frames dependent, so arbitrary frame changes may not correspond to valid time-domain audio.The method projects perturbed sequences onto time-frequency coefficients arising from valid signals using Griffin and Lim [25].Source: A. Adversaries for music audio · p. 7
  • The reconstruction uses the exemplar’s Fourier phase and an inverse-then-forward Fourier transform to produce a valid input sequence.The reconstructed spectrum replaces the exemplar spectrum when building the network input.Source: A. Adversaries for music audio · p. 7

B. Training with adversaries for music audio

The section describes training deep systems with adversarial examples generated during training. Because iterative adversary generation is too slow for the training schedule, it uses a single gradient step; the generated inputs often confuse the network but typically do not do so with high confidence.

B. Training with adversaries for music audio

  • The training procedure generates adversarial examples during training and updates the network using the original labels.It uses a single gradient step because iterative generation is too slow for the roughly 50–200 training epochs required.Source: B. Training with adversaries for music… · p. 7
  • The one-step procedure often creates inputs that confuse the network, but typically not with high confidence.Adversarial examples are generated from training sequences using adversarial labels.Source: B. Training with adversaries for music… · p. 7
  • The approach supplies a potentially infinite stream of new training samples from adversaries generated for the deep system.The passage describes this as a possible regularizer for creating systems robust against adversarial inputs.Source: B. Training with adversaries for music… · p. 7

IV. EXPERIMENTAL RESULTS

The adversary sought high-confidence classifications under bounded perturbation constraints, and it substantially reduced classification accuracy across the tested systems. CDNNs were more robust than the DNN-based system, while adversarial training provided little to no advantage against new attacks.

IV. EXPERIMENTAL RESULTS

  • For the main attack, the adversary drew a dataset label uniformly and sought a valid perturbation within 100 iterations, with Rmin = 0.9 and a 15 dB SNR limit.The attack used step size µ = 0.1 and sought to make the classifier correct with probability p = 0.1.Source: §IV · p. 7, Figure 4 · p. 8
  • For the same 30-second GTZAN excerpts, two adversary ensembles elicited high-confidence classifications for every label but one case, with average SNR 34.5 dB at Rmin = 0.5 and 26.8 dB at Rmin = 0.9.Source: Table II · p. 8, §IV · pp. 8–9
  • The adversary reduced the DNN-based system’s normalized accuracy from 0.49 to no better than random while targeting the DNN, although classification used a random forest over hidden-layer activations.A shown adversarial example had an SNR of 21.1 dB and differed most visibly at high frequencies.Source: §IV · p. 8, Figure 4 · p. 8, Figure 5 · p. 9
  • The adversary reduced CDNN normalized accuracy from 0.63 to 0.41, while the DNN-based system was confused to no better than random.The CDNN was more difficult to fool; the DNN-based system’s baseline normalized accuracy was 0.49.Source: §IV · pp. 8–9
  • With Rmin = 0.5 and an SNR constraint of −300 dB, the adversary reduced CDNN normalized accuracy to 0.28, with mean SNR 11.15 ± 8.32 dB.This setting relaxed the minimum confidence and SNR constraint relative to the earlier attack.Source: §IV · p. 8
  • The adversarial perturbations were perceptible, but the music remained the same in pitches, rhythm, lyrics, instrumentation, dynamics, and style.The authors note that low- to mid-frequency content differed little from the original, with more significant differences in high-frequency spectra.Source: §IV · p. 9
  • Training against adversarial examples did not reduce misclassification against new adversarial examples, and slightly deflated accuracy on new test data.The authors suggest that densely packed adversarial examples in a high-dimensional input space may make training on a small sample insufficient for generalization.Source: §IV · p. 9, Table III · p. 9

V. DISCUSSION

The discussion uses artist-filtered evaluation and adversarial probing to qualify what benchmark performance says about music-content learning. The systems’ vulnerability is clear, but whether their learned cues are relevant remains unresolved.

V. DISCUSSION

  • Figure 6’s hand-crafted baseline reproduces more GTZAN ground truth than the DNN in Fig. 2(b), but less LMD ground truth than the (C)DNN in Fig. 3(b,d).The authors therefore reject the conclusion that deep-learning features perform better for the architectures considered, calling for different experiments.Source: Figure 6 · p. 10, §V · p. 10
  • Artist-filtered GTZAN results are significantly worse than random-partition results, showing that reported performance depends on the evaluation partition.The discussion notes that artist information for GTZAN was unavailable until 2012.Source: §V · p. 10
  • Above-chance accuracy does not establish relevant learning: systems can exploit training-test characteristics introduced by dataset curation and partitioning.Artist-filtered splits control some such variables; whether a cue is relevant still depends on how the task defines relevant knowledge.Source: §V · pp. 10–11
  • Systems that reproduce ground truth through different correlations may be solving different problems, making their FoM comparisons difficult to interpret and their usability uncertain.The discussion warns that optimizing for any dataset correlation can make “relevant knowledge” circular and misaligned with users’ needs.Source: §V · p. 11
  • The adversary nearly always fools high-performing DNNs into high-confidence class choices without changing the music; CDNNs are also defeated but require lower-SNR perturbations.Adversarial examples differ little from originals at low to mid frequencies but more at high frequencies, suggesting high-frequency energy affects the systems’ decisions and raising concerns about generalisation.Source: §V · p. 11
  • Correct labels on benchmark data do not by themselves show that a system understands the task it appears to solve.The discussion calls such a system a “horse,” invoking Clever Hans to illustrate how uncontrolled evaluation can mistake cues for ability.Source: §V · p. 11

VI. CONCLUSION

The conclusion presents an adversary adapted for music-content analysis and reports that it defeats systems across architectures and benchmark datasets. Convolutional networks are more robust than deep neural networks, while adversarial training does not improve resilience to the same adversary.

VI. CONCLUSION

  • The paper adapts Szegedy et al.’s adversary to deep-learning systems for music-content analysis.The authors frame probing and breaking systems as a route to insight about their mechanisms and the validity of their evaluation.Source: §VI · pp. 11–12
  • The adversary fools systems of different architectures trained on different benchmark datasets, and convolutional networks are more robust than deep neural networks.Source: §VI · p. 11
  • Training with the adversary leaves the systems as sensitive to that same adversary.Source: §VI · p. 11
Loading 1507.04761v1…