RTA3: A Real Time Adversarial Attack on Recurrent Neural Networks

Christopher R. Serrano, Pape M. Sylla, Sicun Gao, Michael A. Warren

Abstract: Recurrent neural networks are widely used in machine learning systems that process time series data including health monitoring, object tracking in video, and automatic speech recognition (ASR). While much work has been done demonstrating the vulnerability of deep neural networks to socalled adversarial perturbations, the majority of this work has focused on convolutional neural networks that process non-sequential data for tasks like image recognition. We propose that the unique memory and parameter sharing properties of recurrent neural networks make them susceptible to periodic adversarial perturbations that can exploit these unique features. In this paper, we demonstrate a general application of deep reinforcement learning to the generation of periodic adversarial perturbations in a black-box approach to attack recurrent neural networks processing sequential data. We successfully learn an attack policy to generate adversarial perturbations against the DeepSpeech ASR system and further demonstrate that this attack policy generalizes to a set of unseen examples in real time.