Adversarial sample attack method for voice keyword classification network

Abstract

The invention discloses an adversarial sample attack method for a voice keyword classification network. The adversarial sample attack method comprises the following steps: (1) selecting training dataand a target tag of trained batch sizes according to a training strategy; (2) inputting the data and the tags into a generator G, generating adversarial disturbance, and constructing a corresponding adversarial sample; (3) respectively inputting the generated adversarial samples into a discriminator D and a target victim model to obtain corresponding losses, calculating the corresponding losses, and updating parameters of the network; (4) repeating steps (1) to (4) until a training stop condition is met, and finally obtaining a trained model; and (5) using the model, loading model parameters,and inputting a voice sample and the target tag to quickly generate an adversarial sample. By using the method provided by the invention, the adversarial sample attack based on the voice keyword classification network application in a real-time scene can be realized.

Description

technical field [0001] The invention relates to the technical field of adversarial sample generation based on a conditional generative adversarial network, in particular to an adversarial sample attack method for a voice keyword classification network. Background technique [0002] As the core function of the voice wake-up function, the voice keyword classifier based on deep learning is widely used in smart devices, such as smart phones, smart speakers and smart voice-activated door locks. Since speech keyword classifiers are vulnerable to adversarial sample attacks, this type of application poses a potential security risk. In order to eliminate these security risks, the research on adversarial samples is very necessary. Adversarial examples refer to in-depth learning where subtle and purposeful modifications to the input of the network cause the network to make erroneous outputs, or even the output specified by the attacker. In general, adversarial samples need to meet th...

AI Technical Summary

Problems solved by technology

[0004] Method 1 uses a large number of iterations to find adversarial samples, which consumes a lot of time and computer resources, while Method 2 needs to train a generator for each target, which leads to low efficiency in training and use.

In addition, the voice quality of the adversarial samples generated by this method is not high

Images