Abstract:DNNs have achieved remarkable success across various domains, and their commercial value has led to their classification as intellectual property (IP) for their creators. While model watermarking is commonly employed for DNN IP protection, it is limited to post-hoc forensics. In contrast, model access control offers a more effective, proactive approach to prevent IP infringement through authentication. However, existing model access control methods primarily focus on image classification models and are not suitable for automatic speech recognition (ASR) models, which are also widely used in commercial applications. To address the above limitation, inspired by audio adversarial examples, we propose the first model access control scheme for IP protection of ASR models, which utilizes audio adversarial examples with target labels as user identity information, serving as identity-proof samples. However, a unique challenge arises in the form of interception attacks, in which an attacker detects and hijacks an authorized sample to bypass the authentication process. To remedy it, we introduce the hidden adversarial examples (HAEs) for authentication, which embed the authorized information by slightly modifying the logits and behaving like clean audios, thereby making them difficult to be detected by analyzing the predicted results. To further evade detection by steganalysis, which can be employed for adversarial example detection, we design a distortion cost function inspired by adaptive steganography to guide the generation of HAEs. We conduct extensive experiments on the open-source ASR system DeepSpeech, demonstrating that our proposed scheme effectively protects ASR models proactively and is resistant to unique interception attacks.

A Non-intrusive and Adaptive Speaker De-Identification Scheme Using Adversarial Examples

Privacy-Utility Balanced Voice De-Identification Using Adversarial Examples

VoiceCloak

UltraBD: Backdoor Attack against Automatic Speaker Verification Systems via Adversarial Ultrasound

FenceSitter: Black-box, Content-Agnostic, and Synchronization-Free Enrollment-Phase Attacks on Speaker Recognition Systems

Understanding and Benchmarking the Commonality of Adversarial Examples

Spoofing Speaker Verification System by Adversarial Examples Leveraging the Generalized Speaker Difference.

BypTalker: an Adaptive Adversarial Example Attack to Bypass Prefilter-enabled Speaker Recognition

On-Device Speaker Anonymization of Acoustic Embeddings for ASR based onFlexible Location Gradient Reversal Layer

VoiceListener

PhoneyTalker: an Out-of-the-Box Toolkit for Adversarial Example Attack on Speaker Recognition

Model Access Control Based on Hidden Adversarial Examples for Automatic Speech Recognition

Asynchronous Voice Anonymization Using Adversarial Perturbation On Speaker Embedding

Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition

Imperceptible Black-Box Waveform-Level Adversarial Attack Towards Automatic Speaker Recognition

Toward Improving Synthetic Audio Spoofing Detection Robustness via Meta-Learning and Disentangled Training With Adversarial Examples

AdvTTS: Adversarial Text-to-Speech Synthesis Attack on Speaker Identification Systems.

Speaker Anonymization for Personal Information Protection Using Voice Conversion Techniques

GhostVec: A New Threat to Speaker Privacy of End-to-End Speech Recognition System

Black-box Attacks on Automatic Speaker Verification using Feedback-controlled Voice Conversion

Privacy against Real-Time Speech Emotion Detection via Acoustic Adversarial Evasion of Machine Learning