Sequential Randomized Smoothing for Adversarially Robust Speech Recognition

Published in

Conference on Empirical Methods in Natural Lang...(2021)

External Links:

Generate Graph DownloadPDF

TL;DR

This paper applies adaptive versions of state-of-the-art attacks, such as the Imperceptible ASR attack, to their model, and shows that the strongest defense is robust to all attacks that use inaudible noise, and can only be broken with very high distortion.

Abstract

While Automatic Speech Recognition has been shown to be vulnerable to adversarial attacks, defenses against these attacks are still lagging. Existing, naive defenses can be partially broken with an adaptive attack. In classification tasks, the Randomized Smoothing paradigm has been shown to be effective at defending models. However, it is difficult to apply this paradigm to ASR tasks, due to their complexity and the sequential nature of their outputs. Our paper overcomes some of these challenges by leveraging speech-specific tools like enhancement and ROVER voting to design an ASR model that is robust to perturbations. We apply adaptive versions of state-of-the-art attacks, such as the Imperceptible ASR attack, to our model, and show that our strongest defense is robust to all attacks that use inaudible noise, and can only be broken with very high distortion.

Authors

B. Raj

7 papers

R. Olivier

1 papers

References59 items

Hear "No Evil", See "Kenansville"*: Efficient and Transferable Black-Box Attacks on Speech Recognition and Voice Identification Systems

Adversarial Attacks and Defenses for Speech Recognition Systems

Denoised Smoothing: A Provable Defense for Pretrained Classifiers

Fast is better than free: Revisiting adversarial training

Adversarial Music: Real World Audio Adversary Against Wake-word Detection System

Sequential Randomized Smoothing for Adversarially Robust Speech Recognition

Published in

Conference on Empirical Methods in Natural Lang...(2021)

External Links:

Generate Graph DownloadPDF

TL;DR

Abstract

Authors

B. Raj

7 papers

R. Olivier

1 papers

References59 items

Hear "No Evil", See "Kenansville"*: Efficient and Transferable Black-Box Attacks on Speech Recognition and Voice Identification Systems

Adversarial Attacks and Defenses for Speech Recognition Systems

Denoised Smoothing: A Provable Defense for Pretrained Classifiers

Fast is better than free: Revisiting adversarial training

Adversarial Music: Real World Audio Adversary Against Wake-word Detection System

Robustness of Adversarial Attacks in Sound Event Classification

Hear "No Evil", See "Kenansville": Efficient and Transferable Black-Box Attacks on Speech Recognition and Voice Identification Systems

Espresso: A Fast End-to-End Neural Speech Recognition Toolkit

Perceptual Based Adversarial Audio Attacks

Adversarial Training and Robustness for Multiple Perturbations

Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition

Certified Adversarial Robustness via Randomized Smoothing

On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models

Robust Audio Adversarial Example for a Physical Attack

Characterizing Audio Adversarial Examples Using Temporal Dependency

Second-Order Adversarial Attack and Certifiable Robustness

Adversarial Attacks Against Automatic Speech Recognition Systems via Psychoacoustic Hiding

Differentiable Abstract Interpretation for Provably Robust Neural Networks

Training Augmentation with Adversarial Examples for Robust Speech Recognition

Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models

Thermometer Encoding: One Hot Way To Resist Adversarial Examples

Certified Robustness to Adversarial Examples with Differential Privacy

Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples

CommanderSong: A Systematic Approach for Practical Adversarial Voice Recognition

Audio Adversarial Examples: Targeted Attacks on Speech-to-Text

Towards Robust Neural Networks via Random Self-ensemble

Provable defenses against adversarial examples via the convex outer adversarial polytope

A Unified View of Piecewise Linear Neural Network Verification

Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification

DolphinAttack: Inaudible Voice Commands

Towards Deep Learning Models Resistant to Adversarial Attacks

Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods

SEGAN: Speech Enhancement Generative Adversarial Network

Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networks

Towards Evaluating the Robustness of Neural Networks

Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks

DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks

Librispeech: An ASR corpus based on public domain audio books

Explaining and Harnessing Adversarial Examples

Intriguing properties of neural networks

An efficient multistage Rover method for Automatic Speech recognition

Speech enhancement based on a priori signal to noise estimation

Center Smoothing for Certifiably Robust Vector-Valued Functions

Defending Against Imperceptible Audio Adversarial Examples Using Proportional Additive Gaussian Noise

note, certification with informative bounds and confidence requires many samples (in the tens of thousands)

Compression to the Rescue : Defending from Adversarial Attacks Across Modalities Extended Abstract

attacker uses are noisy and less informative than those of undefended models, thus making gradient-based attacks less effective

Houdini : Fooling Deep Structured Visual and Speech Recognition Models with Adversarial Examples

The ROVER voting algorithm ROVER (Haihua et al., 2009) works in two steps. First, it aligns all k sentences

On the Problem of the Most Efficient Tests of Statistical Hypotheses

Connectionist Temporal Classiﬁcation: Labelling Unsegmented Sequence Data with Recurrent Neural Networks

model f ( x + (cid:15) ) cannot access the gradients of the deterministic model ∇ x f ( x ) = ∇ x E [ f ( x + (cid:15) )]

This phenomenon should not be seen as a desirable feature: rather than making adversarial examples fail to break the defense

Connectionist Temporal Classiﬁcation: Labelling Unsegmented Sequences with Recurrent Neural Networks

This amounts to assuming that the attacker ignores the existence of the defense, and tends to lead inﬂated accuracy for the defender

A The need for adaptive attacks A.1 Background In some previous works

who uses an adaptive attack rather than the vanilla attack. One simple ﬁx to the noisy gradient phenomenon is Expectation over Transformation (EoT)

on Computer Aided Veriﬁcation (CAV ’17)

Field of Study

Computer Science

Venue Information

Name

Conference on Empirical Methods in Natural Language Processing

Type

conference

URL

https://www.aclweb.org/portal/emnlp

Alternate Names

Empir Method Nat Lang Process
Empirical Methods in Natural Language Processing
Conf Empir Method Nat Lang Process
EMNLP

TL;DR

Abstract

Authors

References59 items

Hear "No Evil", See "Kenansville"*: Efficient and Transferable Black-Box Attacks on Speech Recognition and Voice Identification Systems

Adversarial Attacks and Defenses for Speech Recognition Systems

Denoised Smoothing: A Provable Defense for Pretrained Classifiers

Fast is better than free: Revisiting adversarial training

Adversarial Music: Real World Audio Adversary Against Wake-word Detection System

TL;DR

Abstract

Authors

References59 items

Hear "No Evil", See "Kenansville"*: Efficient and Transferable Black-Box Attacks on Speech Recognition and Voice Identification Systems

Adversarial Attacks and Defenses for Speech Recognition Systems

Denoised Smoothing: A Provable Defense for Pretrained Classifiers

Fast is better than free: Revisiting adversarial training

Adversarial Music: Real World Audio Adversary Against Wake-word Detection System

Robustness of Adversarial Attacks in Sound Event Classification

Hear "No Evil", See "Kenansville": Efficient and Transferable Black-Box Attacks on Speech Recognition and Voice Identification Systems

Espresso: A Fast End-to-End Neural Speech Recognition Toolkit

Perceptual Based Adversarial Audio Attacks

Adversarial Training and Robustness for Multiple Perturbations

Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition

Certified Adversarial Robustness via Randomized Smoothing

On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models

Robust Audio Adversarial Example for a Physical Attack

Characterizing Audio Adversarial Examples Using Temporal Dependency

Second-Order Adversarial Attack and Certifiable Robustness

Adversarial Attacks Against Automatic Speech Recognition Systems via Psychoacoustic Hiding

Differentiable Abstract Interpretation for Provably Robust Neural Networks

Training Augmentation with Adversarial Examples for Robust Speech Recognition

Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models

Thermometer Encoding: One Hot Way To Resist Adversarial Examples

Certified Robustness to Adversarial Examples with Differential Privacy

Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples

CommanderSong: A Systematic Approach for Practical Adversarial Voice Recognition

Audio Adversarial Examples: Targeted Attacks on Speech-to-Text

Towards Robust Neural Networks via Random Self-ensemble

Provable defenses against adversarial examples via the convex outer adversarial polytope

A Unified View of Piecewise Linear Neural Network Verification

Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification

DolphinAttack: Inaudible Voice Commands

Towards Deep Learning Models Resistant to Adversarial Attacks

Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods

SEGAN: Speech Enhancement Generative Adversarial Network

Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networks

Towards Evaluating the Robustness of Neural Networks

Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks

DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks

Librispeech: An ASR corpus based on public domain audio books

Explaining and Harnessing Adversarial Examples

Intriguing properties of neural networks

An efficient multistage Rover method for Automatic Speech recognition

Speech enhancement based on a priori signal to noise estimation

Center Smoothing for Certifiably Robust Vector-Valued Functions

Defending Against Imperceptible Audio Adversarial Examples Using Proportional Additive Gaussian Noise

note, certification with informative bounds and confidence requires many samples (in the tens of thousands)

Compression to the Rescue : Defending from Adversarial Attacks Across Modalities Extended Abstract

attacker uses are noisy and less informative than those of undefended models, thus making gradient-based attacks less effective

Houdini : Fooling Deep Structured Visual and Speech Recognition Models with Adversarial Examples

The ROVER voting algorithm ROVER (Haihua et al., 2009) works in two steps. First, it aligns all k sentences

On the Problem of the Most Efficient Tests of Statistical Hypotheses

Connectionist Temporal Classiﬁcation: Labelling Unsegmented Sequence Data with Recurrent Neural Networks

model f ( x + (cid:15) ) cannot access the gradients of the deterministic model ∇ x f ( x ) = ∇ x E [ f ( x + (cid:15) )]

York, NY, USA

This phenomenon should not be seen as a desirable feature: rather than making adversarial examples fail to break the defense

Connectionist Temporal Classiﬁcation: Labelling Unsegmented Sequences with Recurrent Neural Networks

This amounts to assuming that the attacker ignores the existence of the defense, and tends to lead inﬂated accuracy for the defender

A The need for adaptive attacks A.1 Background In some previous works

who uses an adaptive attack rather than the vanilla attack. One simple ﬁx to the noisy gradient phenomenon is Expectation over Transformation (EoT)

on Computer Aided Veriﬁcation (CAV ’17)

Field of Study

Venue Information

Name

Type

URL

Alternate Names