Imperceptible, Robust and Targeted Adversarial Examples for - - PowerPoint PPT Presentation

β–Ά
imperceptible robust and targeted adversarial examples
SMART_READER_LITE
LIVE PREVIEW

Imperceptible, Robust and Targeted Adversarial Examples for - - PowerPoint PPT Presentation

Apr 21, 2023 275 likes β€’375 views

Imperceptible, Robust and Targeted Adversarial Examples for Automatic Speech Recognition 1 2 2 1 2 Yao Qin , Nicholas Carlini , Ian Goodfellow , Garrison Cottrell and Colin Raffel 1 2 UC San Diego Google Research Long Beach, ICML June

slide-1
SLIDE 1

Imperceptible, Robust and Targeted Adversarial Examples for Automatic Speech Recognition

Yao Qin , Nicholas Carlini , Ian Goodfellow , Garrison Cottrell and Colin Raffel UC San Diego Google Research

Long Beach, ICML June 12, 2019

1 1 2 2 2 2 1

slide-2
SLIDE 2

Our Goals

  • Targeted

Given an input audio 𝑦, a targeted transcription 𝑧, an automatic speech recognition system 𝑔(β‹…), our target is to find a perturbation πœ€, that 𝑔 𝑦 + πœ€ = 𝑧 and 𝑔 𝑦 β‰  𝑧.

  • Imperceptible

Humans cannot differentiate 𝑦 and 𝑦 + πœ€ when listening to these examples.

  • Robust

Played by a speaker and recorded by a microphone (over-the-air). (We don’t achieve this goal completely, but succeed at simulated rooms.)

slide-3
SLIDE 3

Our Settings

  • Threat Model

White-box Attack

  • ASR Model

Lingvo ASR system (state-of-the-art) [1]

[1] Shen, Jonathan, et al. "Lingvo: a Modular and Scalable Framework for Sequence-to-Sequence Modeling." arXiv preprint arXiv:1902.08295 (2019).

slide-4
SLIDE 4

Imperceptibility

  • Frequency Masking

A louder signal (the β€œmasker”) can make other signals at nearby frequencies (the β€œmaskees”) imperceptible.

Can hide sounds in here! Human perceptibility threshold Single tone as an example

Power Spectral Density (PSD) [dB] Frequency [KHz]

slide-5
SLIDE 5

Imperceptibility

  • Loss function β„“ 𝑦, πœ€, 𝑧 = β„“./0 𝑔 𝑦 + πœ€ , 𝑧 + 𝛽 β‹… β„“2 𝑦, πœ€

q β„“./0 𝑔 𝑦 + πœ€ , 𝑧 is the cross-entropy loss function; q β„“2 𝑦, πœ€ = max{π‘žΜ…9 𝑙 βˆ’ πœ„= 𝑙 , 0} is the imperceptibility loss

Where πœ€ is the perturbation, π‘žΜ…9 𝑙 is the psd of πœ€ and πœ„= 𝑙 is the masking threshold

slide-6
SLIDE 6

Robustness

  • Room Simulator

q Simulate room impulse 𝑠 based on room configurations q Convolve speech with reverberation 𝑒 𝑦 = 𝑦 βˆ— 𝑠, 𝑒 ~ T

  • Robustness Loss Function

q Minimize β„“ 𝑦, πœ€, 𝑧 = E0∼G [β„“./0 𝑔 𝑒(𝑦 + πœ€) , 𝑧 ] such that πœ€ < πœ—

slide-7
SLIDE 7

Imperceptible and Robust Attacks

  • Combination Loss Function (imperceptibility & robustness)

q Minimize β„“ 𝑦, πœ€, 𝑧 = E0∼G [β„“./0 𝑔 𝑒(𝑦 + πœ€) , 𝑧 ] + 𝛽 β‹… β„“2(𝑦, πœ€)

Robustness loss Imperceptibility loss

slide-8
SLIDE 8
  • Construct effectively imperceptible adversarial examples using

frequency masking.

  • Develop robust adversarial examples that remain effective after

playing over-the-air in the simulated rooms.

  • Generate adversarial examples for non-β„“L-based metrics.

Conclusions

slide-9
SLIDE 9

Thanks! Come to our poster #65！

Project Webpage: http://cseweb.ucsd.edu/~yaq007/imperceptible-robust-adv.html Code: https://github.com/tensorflow/cleverhans/tree/master/examples/adversarial_asr