Source-linked AI summary
Crafting Adversarial Examples For Speech Paralinguistics Applications
Yuan Gong, Christian Poellabauer
TL;DR
Security-sensitive paralinguistic systems can be vulnerable to small, designed perturbations, while prior speech attacks targeted recognition and often operated on features. This paper perturbs raw audio directly and reports effective attacks across three tasks with minimal sound-quality impact.
Problem
Prior speech-related attacks targeted speech recognition rather than paralinguistic tasks, despite the security risks small perturbations pose to systems such as speaker verification.
Source: §1.1 · p. 1Method
The approach generates adversarial examples by perturbing raw audio waveforms directly, avoiding feature-to-waveform reconstruction.
Source: §1.2.2 · p. 2Results
Across three paralinguistic tasks, the attack effectively targets WaveRNN; at perturbation factor 0.02, gender recognition error rises from 12% to 31% for WaveRNN.
Source: §3.3 · p. 6, §5 · p. 7Takeaways & Limitations
The reported attacks affect model outcomes while minimally impairing sound quality, and use smaller perturbations than prior feature-based techniques.
Source: §5 · p. 7Generalization beyond WaveCNN and WaveRNN is suggested only for models with similar front-end layers, contingent on the proposed shared-representation explanation.
Source: §4 · p. 7
Abstract
from arXiv · showhide
Computational paralinguistic analysis is increasingly being used in a wide range of cyber applications, including security-sensitive applications such as speaker verification, deceptive speech detection, and medical diagnostics. While state-of-the-art machine learning techniques, such as deep neural networks, can provide robust and accurate speech analysis, they are susceptible to adversarial attacks. In this work, we propose an end-to-end scheme to generate adversarial examples for computational paralinguistic applications by perturbing directly the raw waveform of an audio recording rather than specific acoustic features. Our experiments show that the proposed adversarial perturbation can lead to a significant performance drop of state-of-the-art deep neural networks, while only minimally impairing the audio quality.
1 INTRODUCTION
The introduction frames adversarial speech as a security risk for paralinguistic systems and distinguishes this work through direct waveform attacks rather than feature reconstruction. Experiments report model impact with minimal sound-quality loss.
1.1 Background
- Small, well-designed perturbations can make otherwise robust models produce wrong results in security-sensitive paralinguistic applications.Potential targets include speaker verification, deceptive-speech detection, and medical diagnostics.Source: §1.1 · p. 1
- The proposed examples affect state-of-the-art paralinguistic models while minimally impairing sound quality.The approach directly perturbs raw audio rather than manipulating acoustic features.Source: §1.1 · p. 2
1.2.1 Computer Vision.
- Prior adversarial-example research established gradient-based attacks and studied transfer to camera inputs and attacks without model details.The cited work includes foundational neural-network vulnerability research in computer vision.Source: §1.2.1 · p. 2
1.2.2 Speechand Audio Processing.
- Earlier audio attacks used hidden voice commands, spectrogram perturbations, or MFCC perturbations followed by reconstruction, which could make examples unlike the original speech.The paper identifies lossy MFCC conversion as a source of substantial difference from the original samples.Source: §1.2.2 · p. 2
- Prior speech-related attacks targeted speech recognition, while paralinguistic tasks typically involve classification or regression and had not yet been studied.Feature-level attacks also require reconstruction that can further modify the original audio.Source: §1.2.2 · p. 2
1.3 Contributions of this Paper
- The paper presents the first computational speech-paralinguistics attack, directly perturbs waveforms, substitutes a feed-forward convolutional structure for recurrent networks, and evaluates three tasks.The experiments also indicate generalization to other models.Source: §1.3 · p. 2
2 SPEECH ADVERSARIAL EXAMPLES
This section formalizes speech adversarial-example generation, reviews gradient-sign attacks, and develops a raw-waveform approach with a substitution model to address feature-conversion loss and vanishing gradients.
2.1 Definitions
- The formulation represents a waveform classifier, its continuous loss, the ground-truth label, and an additive perturbation as an optimization problem.Source: §2.1 · p. 3
2.2 Gradient Based Adversarial Attacks
- FGSM approximates the perturbation under a max-norm constraint; in high-dimensional audio, small per-sample changes can accumulate into large activation shifts.Source: §2.2 · p. 3
2.3 End-to-end Adversarial Example Generation
- Feature-level attacks incur unrecoverable reconstruction loss and may optimize a different problem because features need not vary linearly with waveform amplitude; the proposed method perturbs raw audio directly.Source: §2.3 · p. 3
2.4 The Vanishing Gradient Problem of Gradient Based Attacks on RNNs
- For long sequences, gradients with respect to early inputs disappear and gradient-based attacks fail; even WaveRNN with LSTM layers has near-zero derivatives for its first 60,000 data points.Source: §2.4 · p. 4, Figure 5 · p. 5
2.5 The Substitution Model Approach
- WaveCNN replaces recurrence with convolutions over concatenated frame outputs, restoring gradients across inputs while retaining temporal information and near-WaveRNN performance across tasks.Source: §2.5 · p. 5, Figure 5 · p. 5
3 EXPERIMENTAL EVALUATION
Across three speech-paralinguistic tasks, waveform attacks substantially increased model error and transferred from WaveCNN to WaveRNN. The experiments also compare model behavior, perturbation visibility, and human perception under the stated dataset and test setup.
3.1 Dataset and Test Strategy
- Experiments used IEMOCAP’s 10,039 utterances from 10 speakers across gender, binary emotion, and four-speaker recognition tasks, with a 75%/5%/20% train/validation/test split.Utterances were padded or cut to six seconds, scaled to [0,1], and represented as 96,000-dimensional vectors at 16 kHz; hyperparameters were tuned on validation data.Source: §3.1 · p. 5
3.2 Network Training
- WaveRNN and WaveCNN performed similarly: both reached 88% gender accuracy, while emotion accuracy was 84% and 85%, and speaker accuracy was 69% and 73%, respectively.The authors state that convolutional back-end layers can also process audio sequences well.Source: §3.2 · p. 5
3.3 Adversarial Attack Evaluation
- At ε=0.02, gender error rose from 12% to 31% (WaveRNN) and 12% to 25% (WaveCNN); at ε=0.015, emotion error rose from 16% to 48% and 15% to 42.5%, respectively.Figure 6 plots error against perturbation factor for gender, emotion, and speaker recognition.Source: §3.3 · p. 6, Figure 6 · p. 6
- At ε=0.032, speaker error rose from 31% to 62% (WaveRNN) and 29% to 44% (WaveCNN); WaveCNN-crafted examples also degraded WaveRNN, whose error changed rapidly above a perturbation threshold.WaveCNN error increased linearly with perturbation factor, while WaveRNN showed little change at small factors and a gender-task fluctuation before error rose again.Source: §3.3 · pp. 6–7, Figure 6 · p. 6
3.4 Perturbation Analysis
- At ε=0.08, all classifiers were near random guesses, with less perturbation than the MFCC feature-level method’s 0.101 reconstruction distortion alone.At ε=0.02, the proposed emotion-task examples produced error rates of 51% for WaveRNN and 46.5% for WaveCNN.Source: §3.4 · p. 7
- In a 10-subject hearing test, 100% of proposed examples were judged natural, while 98% were classified correctly for gender and 100% for emotion.For MFCC-reconstructed examples, the corresponding results were 6% natural, 58% gender-correct, and 84% emotion-correct; white-noise examples scored 100% on all three measures.Source: §3.4 · p. 7
- Figure 7 compares original and adversarial waveforms and spectrograms; the perturbation spans a broad spectrum, making simple filtering difficult.The comparison shows the adversarial example in the upper graphs and the original in the lower graphs.Source: Figure 7 · p. 6, §3.4 · p. 7
4 DISCUSSION
The discussion proposes shared front-end representations as one possible explanation for transfer between WaveCNN and WaveRNN, and relates adversarial vulnerability to sparse regions in learned input spaces.
4 DISCUSSION
- Because WaveCNN and WaveRNN share front-end layers despite different back ends, the authors suggest similar learned representations may help explain attack transfer; they condition broader vulnerability on that assumption.They extend the possibility to end-to-end speech models with similar front-end structures.Source: §4 · p. 7
- The authors attribute vulnerability to blind spots where data are sparse in the higher-dimensional spaces used by end-to-end models, and suggest training with known adversarial examples as a possible defense.They state that end-to-end audio processing has paid little attention to this risk and frame their work as informing future robust-model research.Source: §4 · p. 7
5 CONCLUSIONS
The conclusion presents direct raw-waveform perturbation as an end-to-end attack scheme and reports effects on WaveRNN across three paralinguistic tasks with smaller perturbations than prior feature-based techniques.
5 CONCLUSIONS
- The proposed raw-waveform attack affected WaveRNN in three paralinguistic tasks while adding much smaller perturbations than previous feature-based audio attacks.The conclusion frames adversarial attacks on computational paralinguistic systems as a critical security risk that has not received sufficient attention.Source: §5 · p. 7
6 APPENDIX
The appendix gives WaveRNN and WaveCNN architecture details and summarizes their training configuration.
6 APPENDIX
- WaveRNN and WaveCNN were trained with Adam, cross-entropy loss, learning-rate decay of 0.1, a batch size of 100, and up to 200 epochs.The initial learning rate was selected by binary search over [1e-5,1e-2].Source: §6.1 · p. 8, Table 2 · p. 8