PaperlayerView exact revision on arXiv

Source-linked AI summary

Inaudible Adversarial Perturbation: Manipulating the Recognition of User Speech in Real Time

Xinfeng Li, Chen Yan, Xuancun Lu, Zihan Zeng, Xiaoyu Ji, Wenyuan Xu

arXiv:2308.01040v3cs.CRcs.SDeess.AS

TL;DR

Prior inaudible ASR attacks largely overlook users who may notice feedback or disrupt manipulation while speaking. VRIFLE models ultrasonic delivery and augments perturbation generation for robust, real-time user-speech manipulation. Experiments report effectiveness across digital and physical settings, defenses, distances, and delivery devices, while retaining device-specific and black-box limitations.

  • Problem

    Prior attacks provide limited support for user-present scenarios because users may notice ASR feedback, issue remedy commands, or interfere with perturbations through their speech.

    Source: §I · p. 1

  • Method

    VRIFLE uses an ultrasonic transformation model plus speech, timing, loudness, reverberation, and noise augmentation to deliver inaudible perturbations during arbitrary user speech.

    Source: §I · p. 2

  • Results

    VRIFLE manipulates ASR output in real time across digital and physical configurations, extends attacks to 10m, and demonstrates delivery through portable devices and everyday-life loudspeakers.

    Source: §I · p. 3, §IX · p. 15

  • Takeaways & Limitations

    VRIFLE exposes a user-present attack surface in which ASR commands can be altered without prior knowledge of the user’s speech.

    Source: §IX · p. 15

    VRIFLE’s universality is limited under black-box settings, and its ultrasonic transformation model is currently device-specific.

    Source: §VII · p. 14

Abstract

from arXiv · show

Automatic speech recognition (ASR) systems have been shown to be vulnerable to adversarial examples (AEs). Recent success all assumes that users will not notice or disrupt the attack process despite the existence of music/noise-like sounds and spontaneous responses from voice assistants. Nonetheless, in practical user-present scenarios, user awareness may nullify existing attack attempts that launch unexpected sounds or ASR usage. In this paper, we seek to bridge the gap in existing research and extend the attack to user-present scenarios. We propose VRIFLE, an inaudible adversarial perturbation (IAP) attack via ultrasound delivery that can manipulate ASRs as a user speaks. The inherent differences between audible sounds and ultrasounds make IAP delivery face unprecedented challenges such as distortion, noise, and instability. In this regard, we design a novel ultrasonic transformation model to enhance the crafted perturbation to be physically effective and even survive long-distance delivery. We further enable VRIFLE's robustness by adopting a series of augmentation on user and real-world variations during the generation process. In this way, VRIFLE features an effective real-time manipulation of the ASR output from different distances and under any speech of users, with an alter-and-mute strategy that suppresses the impact of user disruption. Our extensive experiments in both digital and physical worlds verify VRIFLE's effectiveness under various configurations, robustness against six kinds of defenses, and universality in a targeted manner. We also show that VRIFLE can be delivered with a portable attack device and even everyday-life loudspeakers.

I. INTRODUCTION

VRIFLE targets a gap in prior inaudible ASR attacks by manipulating user speech in real time without alerting or being disrupted by the user. It combines ultrasonic transformation modeling with robustness measures to support universal, long-range delivery.

Motivation

  • VRIFLE extends inaudible adversarial perturbation attacks to user-present ASR scenarios, where users may notice feedback or issue remedy commands.The attack injects perturbations while users speak, seeking real-time alteration of recognition results under variable speech content, timing, volume, and environment.Source: §I · pp. 1–2

Challenges

  • Ultrasound offers inaudibility and expanded perturbation length, but its channel introduces distortion, anomalous noise, directional propagation, and hardware instability.These effects make fine-grained perturbations difficult to preserve after modulation, transmission, and demodulation.Source: §I · p. 2

Robustness

  • VRIFLE augments optimization across speech clips, timing, loudness, reverberation, and noise, while alter-and-mute strategies address arbitrary utterance lengths and user disruption.The design supports content-agnostic, synchronization-aided, user-factor-robust manipulation and introduces No-feedback and Man-in-the-middle attack strategies.Source: §I · p. 2

Approach

  • VRIFLE establishes an ultrasonic transformation model that characterizes anomalous noises, ultrasound frequency responses, and location variation for physically effective delivery.The model is designed to preserve perturbations over long distances and supports narrow-band USB-AM delivery with simplified devices.Source: §I · p. 2

Evaluation

  • VRIFLE extends attacks to 10m, mutes 27,531 unseen utterances with a single silence IAP, and alters 18,956 with a universal IAP.Experiments cover digital and physical settings, six defenses, portable devices, and everyday-life loudspeakers.Source: §I · pp. 2–3

II. BACKGROUND

The background introduces ASR pipelines, audio adversarial examples, ultrasound-based inaudible delivery, and the threat model for attacks against users speaking to ASR services.

A. Automatic Speech Recognition

  • ASR systems convert speech into features, estimate linguistic-unit probabilities, decode token sequences, and format the resulting text.The pipeline includes a spectrum generator, neural acoustic model, decoder, and punctuation-and-capitalization model.Source: A. Automatic Speech Recognition · p. 3

B. Audio Adversarial Examples

  • Audio adversarial examples add a constrained perturbation δ to benign audio so an ASR model produces a targeted transcription.The optimization uses CTC loss and an Lp penalty, while universal perturbations seek validity across user commands.Source: B. Audio Adversarial Examples · p. 3

C. Ultrasound-based Attacks

  • Inaudible ultrasound attacks modulate baseband audio onto high-frequency carriers, then exploit microphone nonlinearity to recover malicious audio before filtering.The recovered signal remains lossy because ultrasound-channel output differs from the original input.Source: C. Ultrasound-based Attacks · p. 3

D. Threat Model

  • The threat model assumes users may detect unintended ASR events and issue remedy commands, while adversaries deliver precomputed IAPs from nearby or distant transmitters.Attackers know the target ASR model and can access a same-brand recording device to model ultrasonic transformation, but do not know future user speech.Source: D. Threat Model · p. 4

III. PRELIMINARY INVESTIGATION

Traditional ultrasound attacks can recognize malicious commands in isolation but fail when user speech overlaps, while digital perturbations also fail after ultrasonic delivery. Audible-band RIR modeling does not transfer reliably to ultrasound, motivating a specialized transformation model.

A. Failure of Traditional Inaudible Attacks

  • Ultrasound is selected over laser because laser spots are visible, require strict line of sight, and suffer severe channel distortion.The paper also notes ultrasound supports practical, low-cost transducers and longer-range delivery at 25 kHz.Source: A. Failure of Traditional Inaudible… · p. 4
  • 96.01% average CER occurs when traditional ultrasound attacks overlap user speech, versus 10.8% for direct attacks and 6.88% for benign audio.The evaluation used 10 malicious commands, 20 benign utterances, four smartphones at 50 cm, and simultaneous signal emission.Source: A. Failure of Traditional Inaudible… · p. 4

B. Ultrasonic Adversarial Perturbation Delivery

  • Digitally effective perturbations fail after direct ultrasonic modulation and over-the-air delivery because the channel is lossy and distorted.The required transformation must model processing, transmission, and demodulation from digital perturbation to its physical version.Source: B. Ultrasonic Adversarial Perturbation… · p. 5

C. Attempts at Ultrasound Delivery Modeling

1) Modeled by room impulse response:

  • RIR modeling estimates audible playback closely but shows a significant mismatch for ultrasound, whose microphone-based delivery is nonlinear rather than LTI.The comparison uses audible RIR and ultra-RIR estimates against recorded audio.Source: 1) Modeled by room impulse response · p. 5, Figure 4 · p. 5

2) Modeled by Neural Network:

A small neural network can map digital to physical ultrasonic audio at a fixed position, but slight displacement causes anomalous noise and failure. The paper therefore frames ultrasonic complexity, user disruption, user variation, and physical robustness as joint design challenges for VRIFLE.

2) Modeled by Neural Network:

  • A 3 cm position displacement introduces anomalous noise that causes the trained 60k-parameter MLP to fail across positions.The MLP uses 120 seconds of aligned original and ultrasound attack audio pairs and remains restricted to a fixed relative position.Source: 2) Modeled by Neural Network · p. 5

D. Challenges in Ultrasonic Delivery Modeling

A. Overview

  • VRIFLE must suppress user disruption by breaking the user-ASR connection through perturbations that mute excessively long speech and remedy commands.The design goal targets real-time manipulation despite ASR responses to user commands.Source: A. Overview · p. 6
  • VRIFLE must remain universal despite unknown speech content, timing, and length, including arbitrary superimposed user-command time points.Naively mixing speech signals can produce undesirable ASR transcriptions.Source: A. Overview · p. 6
  • Physical attacks must tolerate user loudness, hardware instability, environmental reverberation, and unexpected sound leakage.These factors define the physical-robustness challenge for delivery in real-world settings.Source: A. Overview · p. 6
  • VRIFLE combines physically effective IAP delivery, real-time disruption handling, and improved stealthiness and practicality.Its optimization formulates targeted recognition of superimposed speech while allowing δ ∈[−1, 1]n under inaudible ultrasound modulation.Source: A. Overview · p. 6

B. Ultrasonic Transformation Modeling

VRIFLE models ultrasound-induced distortion, noise, frequency response, and location variation so inaudible perturbations remain physically effective. It also uses silence perturbations to suppress arbitrary user utterances and remedy commands.

B. Ultrasonic Transformation Modeling

1) Tackling Anomalous Noises:

  • Carrier-determined anomalous noises vary with injection angle and distance, so VRIFLE samples location-dependent noise clips during optimization.The noise dataset contains 25 ten-second clips recorded with 25 kHz ultrasound at varying angles.Source: 1) Tackling Anomalous Noises · pp. 6–7

2) Ultrasonic Frequency Response:

  • Sine-sweep deconvolution isolates the ultrasonic frequency response, producing a holistic UFR for estimating received perturbations despite noise and nonlinear demodulation.The sweep ranges from 50–7800 Hz and is designed to shield noise effects during frequency-response measurement.Source: 2) Ultrasonic Frequency Response · p. 7

3) Enabling Location-Variable:

  • Location-variable delivery combines UFRs with propagation and randomly samples matched UFR/noise pairs to mimic attacks from different positions.Collecting the complete UFR and noise set for optimization takes approximately 8.3 minutes.Source: 3) Enabling Location-Variable · p. 7

C. Silence Perturbation

  • Silence perturbations superimpose on arbitrary speech to produce blank ASR transcriptions, with 5-second perturbations repeated for excessively long utterances.This design breaks the user–ASR connection when needed and supports alter-and-mute attacks against long commands or remedy commands.Source: C. Silence Perturbation · pp. 7–8

D. Universal Perturbation

VRIFLE addresses the difficulty of universal attacks on context-dependent CTC-based ASRs by exploiting inaudibility and combining universal alteration with silence-based muting. VAD-triggered delivery and timing augmentation support real-time operation despite uncertain speech timing.

D. Universal Perturbation

  • CTC-based end-to-end ASRs make universal optimization difficult because losses depend on continuous speech context and must converge across mixed signals.This differs from earlier CNN-based command-classification settings that exploited temporal insensitivity.Source: D. Universal Perturbation · p. 8

1) Content-Agnostic:

  • VRIFLE uses inaudibility to remove length and amplitude constraints, enabling a universal perturbation that alters varied speech into a target intent.A 1.2-second perturbation is tailored to transform speech into “open the door.”Source: 1) Content-Agnostic · p. 8, D. Universal Perturbation · p. 8
  • The universal perturbation is paired with silence perturbation so user commands are altered while subsequent commands or remedies are muted.The sequence δ : ξ̂ places the universal perturbation before the crafted silence perturbation.Source: 1) Content-Agnostic · p. 8

2) Synchronization-Aided:

  • A VAD-based synchronizer detects user speech and triggers IAP emission, with optimization randomizing superposition time within T = 100 ms.At 4 m, the average overall delay is approximately 27 ms, below the 100 ms maximum tolerated during optimization.Source: 2) Synchronization-Aided · p. 8

1) Loudness Adaptive and Hardware Instability:

VRIFLE augments training for speech loudness, reverberation, and noise, and uses single-sideband modulation to reduce leakage from portable or everyday loudspeakers. Experiments use DeepSpeech2, speech-command data, multiple devices, and ASR-specific metrics.

1) Loudness Adaptive and Hardware Instability:

  • Relative-volume augmentation randomizes the energy relationship between user speech and perturbations to handle changing loudness and hardware instability.The hyperparameter β represents a range of user speech volumes during crafting.Source: 1) Loudness Adaptive and Hardware… · pp. 8–9

2) Attack at Different Environments:

  • Random room impulse responses and noise clips from the AIR Database expose training to small, medium, and large rooms and corridors.This augmentation targets reverberation and ambient noise affecting audible-band user speech.Source: 2) Attack at Different Environments · p. 9

3) Single-Sideband Extension:

  • USB-AM uses one sideband and therefore halves bandwidth while reducing intermodulation-related sound leakage compared with DSB-AM.The paper selects upper rather than lower sideband modulation because experiments found better inaudibility.Source: 3) Single-Sideband Extension · p. 9

A. Experiment Setup

  • Experiments target DeepSpeech2 in digital and physical settings, using 896 samples for crafting and 29,150 unseen samples for evaluation.The dataset contains 30,046 Fluent Speech Command samples from a 10-person validation set.Source: A. Experiment Setup · p. 9, 2) Dataset · p. 9

4) Metrics

  • The evaluation uses success rate, character error rate, SNR, and L2-distortion to measure targeted alteration, transcription error, and audibility-related cost.Lower CER indicates more effective tampering, while higher SNR and lower L2 generally indicate less noticeable audible perturbations.Source: 4) Metrics · p. 9

B. Digital Attack Performance

Digital experiments show that larger optimization space improves VRIFLE’s convergence and universality, while targeted commands remain effective across many transcripts. Physical evaluation uses synchronized attacks at 4 m under varied devices and environments.

1) Impact of Optimization Space:

2) Comparison of Convergence Overhead and Audibility Cost for the Universality Goal:

3) Different Target Commands:

  • Most targeted commands achieved 100% success rate and 0% CER; the lowest success rate was 92.82% and the highest CER was 0.50%.These results were obtained across 72,000 samples covering ten malicious target commands.Source: 3) Different Target Commands · p. 10

C. Physical Attack Performance

  • Physical experiments trigger IAP delivery when VAD detects speech, using a 4 m default distance and a custom ultrasonic transmitter in a mildly noisy laboratory.The setup evaluates performance across distances, environments, recording devices, and modeling conditions.Source: C. Physical Attack Performance · p. 10

1) Ablation Experiments w/o Transformation Modeling:

VRIFLE remains effective across distances, angles, scenes, ambient noises, and recording devices, with ultrasonic transformation modeling enabling physical robustness.

1) Ablation Experiments w/o Transformation Modeling:

  • Transformation modeling is necessary for physical effectiveness: modeled VRIFLE succeeds, whereas attacks without modeling reach 0% attack performance.The study compares direct ultrasound, no transformation, low-pass filtering, and VRIFLE using 480 mixed samples.Source: 1) Ablation Experiments w/o… · pp. 10–11, Table IV · p. 11

2) Different Attack Distances:

  • 100% SR and 0% CER persist from 1m to 9m, while 10m still reaches 88.7% SR and 3.25% CER before attenuation reduces performance farther away.The experiment spans 1m–13m and attributes the decline at 11m–13m to ultrasound attenuation.Source: 2) Different Attack Distances · p. 11, Figure 12 · p. 11

3) Different Attack Angles:

  • 100% success rates hold across attack angles from 15° to 150°, with asymmetric performance at 0° and 180° caused by differing microphone placement.The reported endpoint rates are 79% at 0° and 49% at 180°; effectiveness depends on covering the bottom microphone.Source: 3) Different Attack Angles · p. 11, Figure 13 · p. 11

4) Different Scenes:

  • VRIFLE shows no significant performance difference across four rooms, indicating robustness to the tested scene-dependent reverberation variations.The evaluated environments include offices, a lounge, a laboratory, and a corridor.Source: 4) Different Scenes · p. 11, Table V · p. 11

5) Different Ambient Noises:

  • At 65 dB ambient noise, VRIFLE averages 97.65% SR, but office noise lowers performance to 87.5% because crisp high-frequency sounds interfere more strongly.The tested noises represent cafeteria, office, laboratory, and outdoor scenes.Source: 5) Different Ambient Noises · p. 11, Figure 14 · p. 12

6) Different Recording Devices:

  • Across recording devices, average performance reaches 96.8% SR and 0.50% CER, while transferability ranges from 94.2% on Pixel 3aXL to 31.7% on iPhone14 pro.Mix2s reaches 100% SR and 0% CER on device-specific perturbations; transfer performance varies with microphone frequency selectivity.Source: 6) Different Recording Devices · pp. 11–12, Figure 15 · p. 12

D. Attack with Portable Device and Off-the-shelf Loudspeaker

VRIFLE operates with a portable transmitter and off-the-shelf loudspeakers, while remaining effective against several audio-processing and detection defenses.

1) Portable Device:

2) Off-the-shelf Loudspeaker:

  • An off-the-shelf loudspeaker enables approximately 20 cm of attack distance with 11.07% CER after selecting a 25.2 kHz carrier.The carrier is embedded through USB-AM audio in files played by computers or smartphones.Source: 2) Off-the-shelf Loudspeaker · p. 12, Figure 17 · p. 12

VI. ANTI-DEFENSE EXPERIMENT

  • Quantization, VAD, and Opus compression preserve at least 95.93% attack success, while stronger band-pass filtering or down-sampling progressively degrades naive attacks.Extreme preprocessing settings were excluded because they raised benign transcription CER above 45%.Source: §VI · p. 13, Table VI · p. 13, Table VII · p. 13
  • Adaptive attacks retain 78.88% SR and 5.34% CER under 50–3000 Hz band-pass filtering, and 81.42% SR with 4.38% CER at down-sampling rate 0.4.The adaptive adversary incorporates the defense during perturbation optimization.Source: §VI · p. 13
  • LipRead detects naive VRIFLE with 45.07% accuracy and adaptive VRIFLE with only 30.55% accuracy.The adaptive attack constrains LipRead features toward normal samples during generation.Source: §VI · p. 13, Figure 18 · p. 13

VII. DISCUSSION AND FUTURE WORK

The discussion positions VRIFLE as a broadly applicable inaudible attack while identifying device specificity, black-box limits, and discomfort from excessively long commands.

VII. DISCUSSION AND FUTURE WORK

  • VRIFLE’s range cannot increase indefinitely because self-demodulation can make the modulated baseband audible beyond a certain power.The paper limits maximum power to 3.2W and uses 25 kHz carriers and hardware designed to suppress nonlinear distortion.Source: §VII · p. 14
  • The attack remains limited in black-box user-present settings because targeted universal attacks must handle variable user factors and remain unsolved.The demonstrated universality relies on DeepSpeech2 gradient information.Source: §VII · p. 14
  • The ultrasonic transformation model is device-specific, and transfer performance depends on microphone frequency selectivity.The authors propose a device-generic transformation model as future work.Source: §VII · p. 14, §VIII · p. 15
  • Excessively long replayed commands may cause discomfort or alert users, motivating future use of short synthetic commands based on inferred intent.This boundary comes from the authors’ user-testing results.Source: §VII · p. 14
  • A preliminary ECAPA-TDNN experiment altered any user’s voice samples toward a targeted speaker in a 10-person set.The authors present speaker-recognition attacks as a planned extension rather than the paper’s main evaluation.Source: §VII · p. 14

IX. CONCLUSION

  • VRIFLE’s ultrasonic transformation modeling supports complete inaudibility, targeted universality, real-time manipulation, and long-range delivery in user-present scenarios.The conclusion reports effectiveness and robustness across digital and physical experiments.Source: §IX · p. 15, §VIII · p. 15

APPENDIX

The appendix explains how USB-AM ultrasound signals are recovered by microphone nonlinearities, then describes VRIFLE’s real-world setup, targeted-command materials, and universal-perturbation generation.

A. SINGLE-SIDEBAND AMPLITUDE MODULATION

  • USB-AM is selected over LSB-AM because its maximum leaked energy is 87% of LSB-AM when emitting the same perturbation.Source: A. SINGLE-SIDEBAND AMPLITUDE MODULATION · p. 16
  • The USB-AM microphone output contains high-frequency, DC, and audible components, with the audible component passing microphone filtering to reach ASR systems.The high-frequency component is filtered by the low-pass filter, while the DC component is filtered by the microphone capacitor.Source: A. SINGLE-SIDEBAND AMPLITUDE MODULATION · p. 17

B. REAL-WORLD SCENARIO

D. ALGORITHM OF VRIFLE

  • VRIFLE’s universal-perturbation algorithm takes an ASR model, CTC loss, scoring module, learning rate, time range, and optimization settings to output perturbation δ.The appendix states that silence and universal perturbations share the workflow but differ in optimization objective and hyper-parameters.Source: D. ALGORITHM OF VRIFLE · p. 17

E. DIFFERENT SPEECH & PERTURBATION LOUDNESS

The appendix evaluates how relative speech and perturbation loudness affect attack metrics and tests whether delayed ASR responses make users aware of an attack. In the user study, delays below 2.7 seconds were more often comfortable, and only 11 of 140 participants suspected an attack.

E. DIFFERENT SPEECH & PERTURBATION LOUDNESS

F. USER TESTING

  • Among 140 participants, delays below 2.7 seconds were more often comfortable than uncomfortable, while only 11 suspected an attack.Most other participants attributed uncomfortable delays to network latency, congestion, or a stuck device.Source: F. USER TESTING · p. 18, Figure 21 · p. 18
Loading 2308.01040v3…