Synthesising Audio Adversarial Examples for Automatic Speech Recognition

Xinghua Qu, pengfei wei, Mingyong Gao, Zhu Sun, Yew-Soon Ong, Zejun MA

Keywords: Adversarial Attack, Speech Synthesise, Automatic Speech Recognition

Abstract: Adversarial examples in automatic speech recognition (ASR) are naturally sounded by humans yet capable of fooling well trained ASR models to transcribe incorrectly. Existing audio adversarial examples are typically constructed by adding constrained perturbations on benign audio inputs. Such attacks are therefore generated with an audio dependent assumption. For the first time, we propose the Speech Synthesising based Attack (SSA), a novel threat model that constructs audio adversarial examples entirely from scratch, i.e., without depending on any existing audio) to fool cutting-edge ASR models. To this end, we introduce a conditional variational auto-encoder (CVAE) as the speech synthesiser. Meanwhile, an adaptive sign gradient descent algorithm is proposed to solve the adversarial audio synthesis task. Experiments on three datasets (i.e., Audio Mnist, Common Voice, and Librispeech) show that our method could synthesise audio adversarial examples that are naturally sounded but misleading the start-of-the-art ASR models. The project webpage containing generated audio demos is at https://sites.google.com/view/ssa-asr/home.

One-sentence Summary: A novel audio-independent adversarial attack using speech synthesis based on a conditional variational auto-encoder.