Beyond $L_p$ clipping: Equalization-based Psychoacoustic Attacks against ASRs
This work addresses the vulnerability of ASR systems to imperceptible attacks, impacting security in voice-controlled applications, but it is incremental as it extends psychoacoustic attacks to newer models.
The authors tackled the problem of adversarial audio attacks on both traditional and end-to-end automatic speech recognition (ASR) systems by proposing an equalization-based psychoacoustic attack, achieving 80 out of 100 participants rating it as less noisy than the state-of-the-art.
Automatic Speech Recognition (ASR) systems convert speech into text and can be placed into two broad categories: traditional and fully end-to-end. Both types have been shown to be vulnerable to adversarial audio examples that sound benign to the human ear but force the ASR to produce malicious transcriptions. Of these attacks, only the "psychoacoustic" attacks can create examples with relatively imperceptible perturbations, as they leverage the knowledge of the human auditory system. Unfortunately, existing psychoacoustic attacks can only be applied against traditional models, and are obsolete against the newer, fully end-to-end ASRs. In this paper, we propose an equalization-based psychoacoustic attack that can exploit both traditional and fully end-to-end ASRs. We successfully demonstrate our attack against real-world ASRs that include DeepSpeech and Wav2Letter. Moreover, we employ a user study to verify that our method creates low audible distortion. Specifically, 80 of the 100 participants voted in favor of all our attack audio samples as less noisier than the existing state-of-the-art attack. Through this, we demonstrate both types of existing ASR pipelines can be exploited with minimum degradation to attack audio quality.