Method suitable for quickly acquiring voice confrontation sample under black box attack

Abstract

The invention relates to a method suitable for quickly acquiring a voice confrontation sample under a black box attack, and the method comprises the steps: S1, determining a decision boundary of an original audio x through employing a binary query algorithm, and carrying out the iteration in cooperation with a sliding window method, so as to select an optimal attack region [s: e], the initial value of s being 0, the initial value of e being 1, and 1 being the length of the original audio; and S2, adding disturbance in a low-frequency region in the selected attack region [s: e], determining an update step length by calculating a gradient direction, updating the disturbance, and obtaining an adversarial sample of the next iteration by using a binary query algorithm until the set sampling times are completed, thereby obtaining a final adversarial sample x *. According to the method, the confrontation sample generation efficiency is improved, and the attack efficiency is improved.

Description

technical field [0001] The invention relates to the field of speech processing, in particular to a method for rapidly acquiring speech confrontation samples under black-box attack. Background technique [0002] Black-box adversarial sample attack is a fair indicator and means to evaluate the security of a model, which generates adversarial samples by querying the model. The main application objects of the existing black-box attacks are the models in the image domain, and no corresponding work has been carried out in the speech domain. [0003] The audio data is a time series, which is a one-dimensional data, which contains a small amount of information, and it is difficult to estimate accurate gradient information, while the image is two-dimensional data, which contains a large amount of information, and has a strong information dependence in space. Information can be used; audio commonly used sampling points per second is more than 16000, and a speaker audio usually has a ...

AI Technical Summary

Problems solved by technology

[0004] For the above reasons, the voice is quite different from the image, which makes the black box attack need more queries when it is applied in the audio field, and it is more difficult to generate adversarial samples, which leads to low attack efficiency and cannot provide a fair judgment.

Images