Abstract:Adversarial attacks against commercial black-box speech platforms, including cloud speech APIs and voice control devices, have received little attention until recent years. Constructing such attacks is difficult mainly due to the unique characteristics of time-domain speech signals and the much more complex architecture of acoustic systems. The current "black-box" attacks all heavily rely on the knowledge of prediction/confidence scores or other probability information to craft effective adversarial examples (AEs), which can be intuitively defended by service providers without returning these messages. In this paper, we take one more step forward and propose two novel adversarial attacks in more practical and rigorous scenarios. For commercial cloud speech APIs, we propose Occam, a decision-only black-box adversarial attack, where only final decisions are available to the adversary. In Occam, we formulate the decision-only AE generation as a discontinuous large-scale global optimization problem, and solve it by adaptively decomposing this complicated problem into a set of sub-problems and cooperatively optimizing each one. Our Occam is a one-size-fits-all approach, which achieves 100% success rates of attacks (SRoA) with an average SNR of 14.23dB, on a wide range of popular speech and speaker recognition APIs, including Google, Alibaba, Microsoft, Tencent, iFlytek, and Jingdong, outperforming the state-of-the-art black-box attacks. For commercial voice control devices, we propose NI-Occam, the first non-interactive physical adversarial attack, where the adversary does not need to query the oracle and has no access to its internal information and training data. We, for the first time, combine adversarial attacks with model inversion attacks, and thus generate the physically-effective audio AEs with high transferability without any interaction with target devices. Our experimental results show that NI-Occam can successfully fool Apple Siri, Microsoft Cortana, Google Assistant, iFlytek and Amazon Echo with an average SRoA of 52% and SNR of 9.65dB, shedding light on non-interactive physical attacks against voice control devices.

PhoneyTalker: an Out-of-the-Box Toolkit for Adversarial Example Attack on Speaker Recognition

Echo: Reverberation-based Fast Black-Box Adversarial Attacks on Intelligent Audio Systems.

Spoofing Speaker Verification System by Adversarial Examples Leveraging the Generalized Speaker Difference.

Understanding and Benchmarking the Commonality of Adversarial Examples

The Silent Manipulator: A Practical and Inaudible Backdoor Attack against Speech Recognition Systems

BypTalker: an Adaptive Adversarial Example Attack to Bypass Prefilter-enabled Speaker Recognition

Push the Limit of Adversarial Example Attack on Speaker Recognition in Physical Domain

Parrot-Trained Adversarial Examples: Pushing the Practicality of Black-Box Audio Attacks against Speaker Recognition Models

Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition

Learning to Fool the Speaker Recognition

Imperceptible Black-Box Waveform-Level Adversarial Attack Towards Automatic Speaker Recognition

Selective Audio Adversarial Example in Evasion Attack on Speech Recognition System

VoiceCloak

Towards Resistant Audio Adversarial Examples

Adversarial Examples for Automatic Speech Recognition: Attacks and Countermeasures

Defending Adversarial Attacks on Cloud-aided Automatic Speech Recognition Systems.

Adversarial Example Detection by Classification for Deep Speech Recognition

A Non-intrusive and Adaptive Speaker De-Identification Scheme Using Adversarial Examples

Privacy-Utility Balanced Voice De-Identification Using Adversarial Examples

Black-box Adversarial Attacks on Commercial Speech Platforms with Minimal Information

Fake the Real: Backdoor Attack on Deep Speech Classification via Voice Conversion