Reproduce “Audio Adversarial Examples: Targeted Attacks on Speech-to-Text” on OpenResearch

About this paper

Nicholas Carlini, David Wagner

Researchers at UC Berkeley developed targeted audio adversarial examples that manipulate existing audio waveforms to be transcribed by state-of-the-art speech-to-text systems as any chosen phrase, achieving a 100% success rate with an average perturbation of -31dB, largely imperceptible to human listeners. Their method can also embed long phrases into short clips and cause non-speech audio to be recognized as speech.

Key insights

• Targeted audio adversarial examples are highly effective against state-of-the-art ASR systems, successfully changing transcriptions to arbitrary phrases with near-imperceptible distortions, contrary to previous beliefs about their difficulty.
• The efficacy of these attacks relies critically on iterative optimization due to the non-linear nature of the audio CTC loss landscape, rendering single-step methods like FGSM ineffective for targeted audio adversarial examples.
• Beyond simple misclassification, attacks can achieve high information density (e.g., 50 characters/second from short audio), cause non-speech audio to be recognized as speech, and even effectively 'silence' spoken words.

Summary by alphaXiv.