General directional voice confrontation sample generation method and system, medium and equipment

Abstract

The invention discloses a universal directional voice confrontation sample generation method and system, a medium and equipment, and the method comprises the steps: designing a target optimization loss function to achieve the versatility of voice disturbance, minimizing the confidence coefficient of classification as an original correct category, maximizing the confidence coefficient of classification as a target category, and improving the classification accuracy. Meanwhile, the decibel difference between voice disturbance and original voice is introduced into a loss function, the disturbance size is limited, and the lp norm of the voice disturbance is restrained within a specified spherical range; the disturbance is covered by using the daily noise and psychoacoustic principle, and the influence of sound propagation in the air is introduced when the voice disturbance is generated, so that the generated general voice disturbance is still applicable to the physical world; the universal directional speech adversarial sample is generated after the universal speech disturbance is added to any original speech command data, the speech data is wrongly recognized as a specified target category by a speech command classifier based on the convolutional neural network, and the method has great significance for the research on the robustness of the deep neural network.

Description

technical field [0001] The invention belongs to the field of security technology based on deep learning, and in particular relates to a method, system, medium and device for generating a general directional speech confrontation sample. Background technique [0002] In recent years, with the continuous improvement of the robustness of deep neural networks, many applications based on deep learning have emerged one after another, involving images, speech, text and other fields. However, recent studies have found that applications based on deep neural networks are prone to misidentification of adversarial sample data. The so-called adversarial samples refer to the addition of tiny perturbations that are imperceptible to human senses in the original data, so that the model can identify (classify) wrong false positive data. [0003] Specifically, according to whether the model structure of the network is predicted in advance, it is divided into white-box adversarial samples and b...

AI Technical Summary

Problems solved by technology

Since the introduction of speech disturbance will bring certain noise on the one hand, and on the other hand, the sound propagation will have attenuation and other phenomena, so the generated speech disturbance cannot be directly realized in the physical world.

In order to solve the noise problem of speech disturbance, the existing methods generate specific disturbances for each piece of raw data, which is not very practical; there are also some methods that can generate general disturbances, but on the one hand, they do not consider the distortion of the speech propagation process in the real world, etc. The problem, on the other hand, only generates non-directional disturbances, which are not practical enough to be easily detected

In order to achieve physical speech perturbation, the existing methods only add random noise during the training process, and do not take into account some attenuation, distortion and reflection phenomena that occur during speech propagation in the air, and the robustness is not strong

Images