Source-linked AI summary
Characterizing Audio Adversarial Examples Using Temporal Dependency
Zhuolin Yang, Bo Li, Pin-Yu Chen, Dawn Song
TL;DR
Audio adversarial examples challenge ASR systems, and the paper asks whether domain-specific temporal structure can improve defenses beyond image-inspired transformations. It evaluates input transformations and temporal-dependency detection against several attacks, finding limited transformation robustness but promising resistance from temporal dependency.
Problem
The paper addresses the vulnerability of DNN-based audio recognition systems and the limited evidence that image-domain defenses transfer effectively to audio.
Method
The paper evaluates four audio input transformations and exploits temporal dependency to detect adversarial examples in ASR across datasets and attack settings.
Results
Temporal dependency identified adversarial examples and resisted considered adaptive attacks, whereas input transformations provided limited robustness against adaptive attacks.
Takeaways & Limitations
Exploiting audio's temporal dependency offers a promising way to characterize adversarial examples without model retraining.
Takeaways & Limitations
The reported adaptive-attack resistance is limited to the attacks and experimental settings considered by the paper.
Abstract
from arXiv · showhide
Recent studies have highlighted adversarial examples as a ubiquitous threat to different neural network models and many downstream applications. Nonetheless, as unique data properties have inspired distinct and powerful learning principles, this paper aims to explore their potentials towards mitigating adversarial inputs. In particular, our results reveal the importance of using the temporal dependency in audio data to gain discriminate power against adversarial examples. Tested on the automatic speech recognition (ASR) tasks and three recent audio adversarial attacks, we find that (i) input transformation developed from image adversarial defense provides limited robustness improvement and is subtle to advanced attacks; (ii) temporal dependency can be exploited to gain discriminative power against audio adversarial examples and is resistant to adaptive attacks considered in our experiments. Our results not only show promising means of improving the robustness of ASR systems, but also offer novel insights in exploiting domain-specific data properties to mitigate negative effects of adversarial examples.
1 INTRODUCTION
The paper studies audio adversarial examples in ASR and evaluates whether image-inspired defenses and audio's temporal dependency can improve robustness.
- Audio adversarial examples threaten widely deployed DNN-based recognition systems, including Google Home and Amazon Alexa.
- The paper first investigates four input transformations adapted to audio, including waveform quantization, temporal smoothing, down-sampling, and autoencoder reformation.
- These transformations provide limited robustness improvement against adaptive attacks designed to circumvent gradient obfuscation caused by input transformations.
- The paper then exploits temporal dependency to discriminate adversarial examples in ASR across the LIBRIS and Mozilla Common Voice datasets.
- The proposed approach identifies non-adaptive and adaptive attacks and resists adaptive attacks considered in the experiments, including attacks whose implementations are known.
2 DO LESSONS FROM IMAGE ADVERSARIAL EXAMPLES TRANSFER TO AUDIO DOMAIN?
Image and audio data have distinct domain properties, so image-based adversarial defenses may not transfer reliably to audio. The paper finds temporal dependency more useful for ASR adversarial-example detection.
- Images use spatial correlations, whereas audio waveforms exhibit temporal dependency commonly modeled by recurrent neural networks.
- Image-inspired audio input transformations are motivated by low cost and easy integration but can be bypassed by subsequent or adaptive attacks.
- Input transformations can create obfuscated gradients that produce a false sense of robustness and remain vulnerable when attackers circumvent them.
- Temporal dependency can detect audio adversarial examples while minimally affecting recognition performance on normal examples.
- An adaptive attacker knowing the deployed temporal-dependency method could not bypass it in the considered experiments.
3 INPUT TRANSFORMATION AND TEMPORAL DEPENDENCY IN AUDIO DATA
The paper contrasts simple audio transformations with a temporal-dependency method that compares ASR outputs from partial and complete audio sequences.
- The section examines basic input transformations and whether audio temporal dependency can discriminate adversarial examples.
- Input transformations: Quantization rounds sampled amplitudes to integer multiples of q to disrupt small perturbations, using q values 128, 256, 512, and 1024.
- Input transformations: Local smoothing replaces each sample with an average, median, or other statistic over a fixed neighboring window.
- Input transformations: Down-sampling reduces the original 16kHz audio to 8kHz before signal recovery, while the sequence-to-sequence autoencoder processes frame-level pieces before concatenation.
- Temporal dependency: The temporal-dependency method compares ASR transcription prefixes from an initial audio portion with the corresponding prefix from the whole sequence.
4 EXPERIMENTAL RESULTS
Experiments compare input-transformation defenses with temporal-dependency detection across audio attacks and adaptive attacks. Input transformations are often bypassed or degrade recognition, whereas temporal dependency achieves strong detection and remains robust in several adaptive settings.
- Defense methods: 84% average attack success fell to 2.1% after Quantization-256 for the audio classification attack, while benign accuracy changed from 89.2% to 89.0%.The transformation also converted 63.8% of adversarial instances back to their original label.
- Defense methods: Autoencoder defense reduced classification attack success to 8.2%, but this remained close to the 10% success rate achievable by destroying the original audio.The result makes its classification-defense performance difficult to distinguish from random guessing.
- Defense methods: Autoencoder transformation substantially worsened benign ASR and failed to recover adversarial audio, reaching 57.6 versus 27.5 WER on Common Voice and 99.4 WER on LIBRIS.On LIBRIS, benign WER was 30.0 with transformation versus 12.4 without it.
- Adaptive attacks: Adaptive attacks bypassed quantization and smoothing with only small additional perturbations, while stronger quantization also caused information loss.The smoothing attacks exploit differentiability or backpropagation through median filtering, rendering the transformations ineffective.
- Adaptive attacks: Segment attacks maintained a 2% success rate across 50 samples in both LIBRIS and Common Voice, indicating difficulty attacking isolated sections.The authors conjecture that temporal dependency makes a section alone insufficient to reach the adversarial target.
- Adaptive attacks: Concatenation attacks failed because separately attacked segments did not preserve the translation of their concatenation, whereas benign audio was negligibly affected.The authors identify this contrast as a promising direction for detecting adversarial audio.
- Adaptive attacks: For combination attacks, using a different attacker section produced AUC above 85% when |kA| = 1, while randomly sampling the defender section made adaptive attacks difficult across settings.When |kA| increased, attacker performance worsened; the authors report random-sample temporal dependency as robust in all tested cases.
5 CONCLUSION
The paper proposes exploiting temporal dependency in audio to characterize adversarial examples. Experiments show that primitive input transformations fail against adaptive attacks, whereas temporal dependency remains resistant in the tested settings.
- Temporal dependency is used to characterize audio adversarial examples.
- Four primitive audio input transformations fail to withstand adaptive adversarial attacks.
- Temporal dependency is resistant to the adaptive attacks considered in the experiments.
- The method characterizes adversarial examples generated by three state-of-the-art audio attacks.
- The proposed method is easy to operate and does not require model retraining.
APPENDIX
The appendix contains supplementary evaluations, attack examples, and detection results. It includes tables for multiple datasets and language-model settings, alongside figures reporting attack and unchanged-label rates before and after transformation.
- Supplementary evaluations cover Common Voice and LIBRIS with and without language-model processing.
- Figures report successful attack rates and unchanged-label rates before and after transformation.
- The appendix includes examples of Segment Attack and Concatenation attack outputs.
- Another table reports AUC for detecting Combination Attack using the temporal-dependency method.