Imperceptible, Robust and Targeted Adversarial Examples for - PowerPoint PPT Presentation

Imperceptible, Robust and Targeted Adversarial Examples for Automatic Speech Recognition 1 2 2 1 2 Yao Qin , Nicholas Carlini , Ian Goodfellow , Garrison Cottrell and Colin Raffel 1 2 UC San Diego Google Research Long Beach, ICML June 12, 2019

Our Goals ● Targeted Given an input audio 𝑦 , a targeted transcription 𝑧 , an automatic speech recognition system 𝑔(⋅) , our target is to find a perturbation 𝜀 , that 𝑔 𝑦 + 𝜀 = 𝑧 and 𝑔 𝑦 ≠ 𝑧 . ● Imperceptible Humans cannot differentiate 𝑦 and 𝑦 + 𝜀 when listening to these examples. ● Robust Played by a speaker and recorded by a microphone (over-the-air). (We don’t achieve this goal completely, but succeed at simulated rooms.)

Our Settings ● Threat Model White-box Attack ● ASR Model Lingvo ASR system (state-of-the-art) [1] [1] Shen, Jonathan, et al. "Lingvo: a Modular and Scalable Framework for Sequence-to-Sequence Modeling." arXiv preprint arXiv:1902.08295 (2019).

Imperceptibility ● Frequency Masking A louder signal (the “masker”) can make other signals at nearby frequencies (the “maskees”) imperceptible. Power Spectral Density Can hide sounds in here! Single tone (PSD) [dB] as an example Human perceptibility threshold Frequency [KHz]

Imperceptibility ● Loss function ℓ 𝑦, 𝜀, 𝑧 = ℓ ./0 𝑔 𝑦 + 𝜀 , 𝑧 + 𝛽 ⋅ ℓ 2 𝑦, 𝜀 q ℓ ./0 𝑔 𝑦 + 𝜀 , 𝑧 is the cross-entropy loss function; q ℓ 2 𝑦, 𝜀 = max{𝑞̅ 9 𝑙 − 𝜄 = 𝑙 , 0} is the imperceptibility loss Where 𝜀 is the perturbation, 𝑞̅ 9 𝑙 is the psd of 𝜀 and 𝜄 = 𝑙 is the masking threshold

Robustness ● Room Simulator q Simulate room impulse 𝑠 based on room configurations q Convolve speech with reverberation 𝑢 𝑦 = 𝑦 ∗ 𝑠, 𝑢 ~ T ● Robustness Loss Function q Minimize ℓ 𝑦, 𝜀, 𝑧 = E 0∼G [ℓ ./0 𝑔 𝑢(𝑦 + 𝜀) , 𝑧 ] such that 𝜀 < 𝜗

Imperceptible and Robust Attacks ● Combination Loss Function (imperceptibility & robustness) q Minimize ℓ 𝑦, 𝜀, 𝑧 = E 0∼G [ℓ ./0 𝑔 𝑢(𝑦 + 𝜀) , 𝑧 ] + 𝛽 ⋅ ℓ 2 (𝑦, 𝜀) Robustness loss Imperceptibility loss

Conclusions ● Construct effectively imperceptible adversarial examples using frequency masking. ● Develop robust adversarial examples that remain effective after playing over-the-air in the simulated rooms. ● Generate adversarial examples for non- ℓ L -based metrics.

Thanks! Come to our poster #65 ！ Project Webpage: http://cseweb.ucsd.edu/~yaq007/imperceptible-robust-adv.html Code: https://github.com/tensorflow/cleverhans/tree/master/examples/adversarial_asr