Abstract:Adversarial attacks against commercial black-box speech platforms, including cloud speech APIs and voice control devices, have received little attention until recent years. Constructing such attacks is difficult mainly due to the unique characteristics of time-domain speech signals and the much more complex architecture of acoustic systems. The current "black-box" attacks all heavily rely on the knowledge of prediction/confidence scores or other probability information to craft effective adversarial examples (AEs), which can be intuitively defended by service providers without returning these messages. In this paper, we take one more step forward and propose two novel adversarial attacks in more practical and rigorous scenarios. For commercial cloud speech APIs, we propose Occam, a decision-only black-box adversarial attack, where only final decisions are available to the adversary. In Occam, we formulate the decision-only AE generation as a discontinuous large-scale global optimization problem, and solve it by adaptively decomposing this complicated problem into a set of sub-problems and cooperatively optimizing each one. Our Occam is a one-size-fits-all approach, which achieves 100% success rates of attacks (SRoA) with an average SNR of 14.23dB, on a wide range of popular speech and speaker recognition APIs, including Google, Alibaba, Microsoft, Tencent, iFlytek, and Jingdong, outperforming the state-of-the-art black-box attacks. For commercial voice control devices, we propose NI-Occam, the first non-interactive physical adversarial attack, where the adversary does not need to query the oracle and has no access to its internal information and training data. We, for the first time, combine adversarial attacks with model inversion attacks, and thus generate the physically-effective audio AEs with high transferability without any interaction with target devices. Our experimental results show that NI-Occam can successfully fool Apple Siri, Microsoft Cortana, Google Assistant, iFlytek and Amazon Echo with an average SRoA of 52% and SNR of 9.65dB, shedding light on non-interactive physical attacks against voice control devices.

Query-Efficient Black-Box Adversarial Attacks on Automatic Speech Recognition.

Echo: Reverberation-based Fast Black-Box Adversarial Attacks on Intelligent Audio Systems.

Query-Efficient Adversarial Attack with Low Perturbation Against End-to-End Speech Recognition Systems

Towards Query-Efficient Adversarial Attacks Against Automatic Speech Recognition Systems

Understanding and Benchmarking the Commonality of Adversarial Examples

The Silent Manipulator: A Practical and Inaudible Backdoor Attack against Speech Recognition Systems

Improving Query Efficiency of Black-box Adversarial Attack

A Practical Black-Box Attack Against Autonomous Speech Recognition Model

KENKU: Towards Efficient and Stealthy Black-box Adversarial Attacks against ASR Systems

Towards the Universal Defense for Query-Based Audio Adversarial Attacks on Speech Recognition System

Zero-Query Adversarial Attack on Black-box Automatic Speech Recognition Systems

Transferable Adversarial Attacks against ASR

Towards the Universal Defense for Query-Based Audio Adversarial Attacks

Devil's Whisper: A General Approach for Physical Adversarial Attacks Against Commercial Black-box Speech Recognition Devices.

Defending Adversarial Attacks on Cloud-aided Automatic Speech Recognition Systems.

ALIF: Low-Cost Adversarial Audio Attacks on Black-Box Speech Platforms using Linguistic Features

AdvDDoS: Zero-Query Adversarial Attacks Against Commercial Speech Recognition Systems

TransAudio: Towards the Transferable Adversarial Audio Attack via Learning Contextualized Perturbations

Imperceptible Black-Box Waveform-Level Adversarial Attack Towards Automatic Speaker Recognition

IMPGA: an Effective and Imperceptible Black-Box Attack Against Automatic Speech Recognition Systems.

Black-box Adversarial Attacks on Commercial Speech Platforms with Minimal Information