Speech adversarial sample detection method, device, equipment and computer-readable storage medium

Abstract

The present application provides a method for training a speech adversarial sample detection model, comprising: obtaining speech training samples, the speech training samples comprising a plurality of normal speech samples and a plurality of adversarial speech samples (110); extracting spectrogram features from the speech training samples to obtain a positive sample spectrogram and a negative sample spectrogram (120); inputting the positive sample spectrogram and the negative sample spectrogram into a preset neural network for training to obtain a speech adversarial sample detection model (130). The present application also provides a speech adversarial sample detection method, apparatus, device and computer-readable storage medium. The present application achieves accurate detection of speech adversarial samples.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of artificial intelligence technology, and specifically to a method for detecting speech adversarial samples, a training method, device, equipment and computer-readable storage medium for a speech adversarial sample detection model. Background Art

[0002] The goal of a speech recognition system is to translate a certain speech into text, that is, a speech-to-text translation process. In recent years, end-to-end speech recognition systems based on deep learning have gradually become popular in the market. However, the emergence of adversarial sample technology has caused security issues in end-to-end ASR. Current adversarial machine learning technology can generate adversarial samples of speech, and by adding carefully crafted disturbances to the audio, it intentionally causes ASR to have "translation errors", but the human ear cannot detect them. However, in the process of implementing the present invention, the inventors of the present application found that the existing adversarial sample technology can change the recognition results of the recognition system almost unlimitedly according to the ideas of the tamperer. After adding a slight "adversarial disturbance noise" to a normal speech, the original translation result changed from "I went out to play today" to "I stayed at home today". This kind of translation error can make certain keywords become "specific text" when translated. For people with ulterior motives, they can make the translation results become what they want at will. In addition to making keywords wrong in translation, the meaning of the entire sentence can also be completely replaced with another meaning in translation. More importantly, such tampered voice samples are difficult to detect. If used by a purposeful tamperer, it may cause various serious consequences. For example, adversarial samples can be used to unlock WeChat's "voice lock" and gain other people's WeChat usage rights. Therefore, detecting voice adversarial samples has become an important issue that needs to be solved urgently. Summary of the invention

[0003] In view of the above problems, the embodiments of the present invention provide a speech adversarial sample detection method, a speech adversarial sample detection model training method, device, equipment and computer-readable storage medium, which are used to solve the technical problem that adversarial speech data is difficult to recognize in the prior art.

[0004] According to one aspect of an embodiment of the present invention, a method for training a speech adversarial sample detection model is provided, the method comprising:

[0005] Acquire speech training samples, wherein the speech training samples include a plurality of normal speech samples and a plurality of adversarial speech samples; the adversarial speech samples are negative samples with tampered semantics;

[0006] Extracting spectrogram features from the speech training samples to obtain positive sample spectrograms and negative sample spectrograms;

[0007] The positive sample spectrogram and the negative sample spectrogram are respectively input into a preset neural network for training to obtain a speech adversarial sample detection model.

[0008] In an optional manner, the acquiring of speech training samples, wherein the speech training samples include normal speech samples and adversarial speech samples, includes: acquiring an original normal speech sample; generating an adversarial speech sample through an objective function according to the original normal speech sample;

[0009] The objective function is: min‖δ‖ 2 +l(x′+δ,t) stdb(δ)≤T

[0010] Where δ represents the adversarial perturbation, x′ is the original normal speech sample, t is the target sentence, l is the CTC loss, the distortion is expressed in decibels (·), which represents the relative loudness of the audio on a logarithmic scale, and T represents the threshold of the energy size of the adversarial perturbation.

[0011] In an optional manner, the speech training samples are subjected to spectrogram feature extraction to obtain positive sample spectrograms and negative sample spectrograms, respectively, including: dividing each of the speech training samples into a plurality of small speech segments; loading the plurality of small speech segments with a truncation window function to obtain a plurality of windowed small speech segments; and performing short-time Fourier transform on the plurality of windowed small speech segments to obtain a plurality of spectrograms corresponding to each of the speech training samples.

[0012] In an optional manner, the truncated window function is a Hanning window function; the step of loading the multiple speech segments with the truncated window function to obtain multiple windowed speech segments includes: loading the multiple speech segments with the Hanning window function to obtain multiple windowed speech segments.

[0013] In an optional manner, the positive sample spectrogram and the negative sample spectrogram are respectively input into the preset neural network for training to obtain the speech adversarial sample detection model, including: inputting the positive sample spectrogram and the negative sample spectrogram into the preset neural network for training to obtain a prediction result; calculating an energy loss function according to the label of the positive sample spectrogram, the label of the negative sample spectrogram and the prediction result; adjusting the parameters of the preset neural network according to the energy loss function, and re-inputting the positive sample spectrogram and the negative sample spectrogram into the preset neural network, calculating the energy loss function, and adjusting the parameters of the preset neural network until the energy loss function converges or reaches a preset threshold, thereby obtaining the speech adversarial sample detection model.

[0014] In an optional manner, the energy loss function is:

[0015]

[0016] Among them, E θ (Y,x)=-Y·F θ (x); θ is the parameter of the preset neural network, Y is the label of the speech training sample; x is the speech training sample; β is a normal number.

[0017] According to another aspect of an embodiment of the present invention, a method for detecting speech adversarial samples is provided, comprising:

[0018] Obtain the voice data to be detected;

[0019] Converting the speech data to be detected into a spectrogram to be detected;

[0020] Inputting the to-be-detected spectrogram into a speech adversarial sample detection model; the speech adversarial sample detection model is trained according to the training method;

[0021] Output the detection result of the voice data to be detected.

[0022] According to another aspect of an embodiment of the present invention, a training device for a speech adversarial sample detection model is provided, comprising:

[0023] A first acquisition module is used to acquire speech training samples, wherein the speech training samples include normal speech samples and adversarial speech samples; the adversarial speech samples are negative samples with tampered semantics;

[0024] An extraction module is used to extract spectrogram features from the speech training sample to obtain a positive sample spectrogram and a negative sample spectrogram;

[0025] The training module is used to input the positive sample spectrogram and the negative sample spectrogram into a preset neural network for training to obtain a speech adversarial sample detection model.

[0026] According to another aspect of an embodiment of the present invention, a device for detecting a speech adversarial sample is provided, comprising:

[0027] The second acquisition module is used to acquire the voice data to be detected;

[0028] A conversion module, used for converting the speech data to be detected into a spectrogram to be detected;

[0029] A detection module, used for inputting the to-be-detected spectrogram into a speech adversarial sample detection model; the speech adversarial sample detection model is trained according to the training method of the speech adversarial sample detection model or the training device of the speech adversarial sample detection model;

[0030] The output module is used to output the detection result of the voice data to be detected.

[0031] According to another aspect of an embodiment of the present invention, there is provided a computing device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; the memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute the training method of the speech adversarial sample detection model or the operation of the detection method of the speech adversarial sample.

[0032] According to another aspect of an embodiment of the present invention, there is provided a computer-readable storage medium, wherein at least one executable instruction is stored in the storage medium. When the executable instruction is executed on a computing device, the computing device executes the operation of the training method of the speech adversarial sample detection model or the detection method of the speech adversarial sample.

[0033] The embodiment of the present invention obtains speech training samples, performs spectrogram feature extraction on the speech training samples, obtains positive sample spectrograms and negative sample spectrograms, respectively, inputs the positive sample spectrograms and negative sample spectrograms into the preset neural network for training, and obtains the speech adversarial sample detection model, thereby forming an automated speech adversarial sample detection tool, which improves the efficiency of identifying fictitious speech while ensuring high judgment accuracy, provides front-end protection for the security of ASR, and prevents the adverse effects caused by adversarial samples that deliberately create tampering with semantics.

[0034] The above description is only an overview of the technical solution of the embodiment of the present invention. In order to more clearly understand the technical means of the embodiment of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the embodiment of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The accompanying drawings are only used to illustrate the embodiments and are not to be considered as limiting the present invention. In addition, the same reference symbols are used to represent the same components throughout the accompanying drawings. In the accompanying drawings:

[0036] Figure 1 A schematic diagram showing a speech recognition error caused by adding “anti-noise disturbance” provided by an embodiment of the present invention;

[0037] Figure 2 A schematic diagram of a flow chart of a method for training a speech adversarial sample detection model provided by an embodiment of the present invention is shown;

[0038] Figure 3 A flowchart of a method for detecting speech adversarial samples provided by an embodiment of the present invention;

[0039] Figure 4 A schematic diagram of the structure of a training device for a speech adversarial sample detection model provided by an embodiment of the present invention is shown;

[0040] Figure 5 A schematic diagram of the structure of a speech adversarial sample detection device provided by an embodiment of the present invention is shown;

[0041] Figure 6 A schematic diagram of the structure of a computing device provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0042] Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0043] The following is an explanation of the technical terms that appear in the embodiments of the present invention:

[0044] ASR: Automatic Speech Recognition, automatic speech recognition system.

[0045] Waveform signal: time domain waveform signal of speech.

[0046] Adversarial perturbation: Adversarial perturbation is noise added to clean speech to make it an adversarial example of speech.

[0047] Adversarial samples: samples that deceive neural networks by adding perturbations that are difficult for humans to detect.

[0048] Short-time Fourier transform (STFT): Select a time-frequency localized window function, and analyze the signal segment by segment by moving the window function on the time axis to obtain a set of local "spectra" of the signal.

[0049] Spectrogram: spectrogram, speech spectrum analysis view.

[0050] Multispectrogram: Multiple STFT spectrograms of the speech signal.

[0051] CNN: Convolutional Neural Network.

[0052] EBM: energy-based model, model based on energy function.

[0053] First, the main idea of ​​the embodiment of the present invention is described. Figure 1As shown in the figure, the spectrum on the left is normal speech, and its recognition result is "I went out to play today"; the spectrum in the middle is adversarial noise perturbation; the spectrum on the right is a superposition of the normal speech spectrum on the left and the spectrum in the middle with adversarial noise perturbation, that is, a speech adversarial sample with tampered semantics, and the speech recognition result of the spectrum on the right is "I stayed at home today". It can be seen from the spectrum that the spectrums on the left and right are very similar, but the semantics are completely different. The generation methods of speech adversarial samples with tampered semantics can be roughly divided into white-box attacks and black-box attacks. White-box attacks assume that the model parameters can be accessed, and gradient-related data corrections are applied in a targeted manner to achieve the purpose of modifying the original data; in black-box attacks, the attacker cannot access the internal information of the model, and usually uses a tentative method to add noise and continuously adjust the added noise to achieve the purpose of modifying the original data. The inventor of the present application found through analysis that compared with normal speech, the STFT spectrogram obtained from the semantically tampered speech shows the following rules in terms of coherence estimate and cross-spectrum phase in different frequency bands: the higher the frequency band, the lower the consistency, and the greater the change in cross-spectrum phase. Therefore, the embodiment of the present invention uses the STFT spectrogram as a feature input to the convolutional neural network based on the characteristic difference between the normal speech sample and the speech adversarial sample in the STFT spectrogram, and uses an energy-based model for classification, so that the adversarial sample can be accurately identified.

[0054] Figure 2 The flowchart of the training method of the speech adversarial sample detection model provided by the embodiment of the present invention is shown, and the method is executed by a computing device. The computing device can be a computer device, such as a personal computer, a desktop computer, a tablet computer, etc.; it can also be other artificial intelligence devices or terminals, such as a robot, a mobile phone, etc., which is not specifically limited in the embodiment of the present invention. Figure 2 As shown, the method comprises the following steps:

[0055] Step 110: Acquire speech training samples, where the speech training samples include a plurality of normal speech samples and a plurality of adversarial speech samples; the adversarial speech samples are negative samples with tampered semantics.

[0056] Among them, the adversarial speech sample is a negative sample that tampered with the semantics, which refers to the speech that has been tampered with by adding adversarial noise disturbance. In an embodiment of the present invention, the speech adversarial sample that tampered with the semantics can be generated by a white-box attack or a black-box attack. White-box attacks (such as Taori Attack, an adversarial sample attack algorithm proposed by Taori et al. in 2019) assume that the model parameters can be accessed and gradient-related data corrections are applied in a targeted manner to achieve the purpose of modifying the original data. In a black-box attack (such as C&WAttack, C&W Attack is an adversarial sample attack algorithm proposed by Carlini and Wagner), the attacker cannot access the internal information of the model, uses a tentative method to add noise, and constantly adjusts the added noise to achieve the purpose of modifying the original data.

[0057] In the embodiment of the present invention, the specific process of generating a speech adversarial sample by the C&W Attack method may be: obtaining an original normal speech sample; generating an adversarial speech sample by using an objective function according to the original normal speech sample;

[0058] The objective function is:

[0059] min‖δ‖ 2 +l(x′+δ,t)

[0060] stdb(δ)≤T

[0061] in, δ represents adversarial perturbation, x′ is the original normal speech sample, represents a speech adversarial sample, t is the target sentence, l is the CTC loss, and the distortion is expressed by decibel db(·), which represents the relative loudness of the audio on a logarithmic scale, ‖·‖ 2 represents the bi-norm; st represents the constraint condition; T represents the threshold of the energy of the adversarial perturbation, and the threshold can be set accordingly according to the specific scenario in the embodiment of the present invention. In the embodiment of the present invention, the target sentence refers to the sentence with tampered semantics corresponding to the speech adversarial sample.

[0062] Among them, the speech adversarial sample can be obtained by the gradient descent method according to the objective function set above.

[0063] Step 120: extract spectrogram features from the speech training samples to obtain positive sample spectrograms and negative sample spectrograms.

[0064] Among them, since the adversarial perturbation generated based on the B-RNN network gradient is distributed in speech time series data, the embodiment of the present invention divides the speech training sample into multiple short time frames, and the length of the short time frame can be hundreds of milliseconds. Specifically, each of the speech training samples is divided into multiple small speech segments; the multiple small speech segments are loaded with a truncated window function to obtain multiple windowed speech segments; the multiple windowed speech segments are respectively subjected to short-time Fourier transform to obtain multiple spectrograms corresponding to each of the speech training samples, thereby converting the speech training samples into the frequency domain.

[0065] The conversion process is as follows:

[0066]

[0067] Among them, P t (w,m) is the spectrogram corresponding to each speech segment, w[m] is a window sequence of length L, m = 0, 1, ..., L, N is the number of DFT points used in the transformation. In the embodiment of the present invention, the truncated window function is a Hanning window function. The Hanning window of the Hanning window function can be set to L = 512, and the speech sample signal x t Pass through the window, so that the x of a variable is converted into t Mapped as a function of two variables, namely w in the time domain and m in the frequency domain.

[0068] Step 130: Input the positive sample spectrogram and the negative sample spectrogram into a preset neural network for training respectively to obtain a speech adversarial sample detection model.

[0069] After obtaining the positive sample spectrogram and the negative sample spectrogram, a label is added to each positive sample spectrogram and the negative sample spectrogram, wherein the label of the positive sample spectrogram can be set to 1, and the label of the negative sample spectrogram is -1. The positive sample spectrogram and the negative sample spectrogram with labels are respectively input into the preset neural network for iterative training, thereby obtaining a speech adversarial sample detection model.

[0070] In an embodiment of the present invention, the preset neural network is a convolutional neural network, which includes a convolutional layer, a downsampling layer, a fully connected layer and an output layer. In one embodiment of the present invention, it can be specifically: 3 convolutional layers and 2 downsampling layers are alternately combined, and then connected to 3 fully connected layers, and the final output layer is a node, and the node value of the output layer represents the output value of the model. After setting the convolutional neural network, the labeled positive sample spectrogram and negative sample spectrogram are respectively input into the convolutional neural network for iterative training, so as to obtain a speech adversarial sample detection model.

[0071] In the embodiment of the present invention, the convolutional neural network can be iteratively trained by an energy loss function, specifically:

[0072] The labeled positive sample spectrogram and the labeled negative sample spectrogram are respectively input into the preset neural network for training to obtain the prediction results. For each model speech training sample x, set its label to Y∈(1,-1). First, input it into the model to obtain the model output value, denoted as F θ (x). The output F of the speech adversarial sample detection model is θ When (x) is greater than 0, it is judged as a positive sample spectrogram, F θ When (x) is less than 0, it is judged as a negative sample spectrogram.

[0073] An energy loss function is calculated according to the label of the positive sample spectrogram, the label of the negative sample spectrogram and the prediction result.

[0074] Among them, the process of calculating the energy loss function is:

[0075] First, the energy value is calculated according to the label of the positive sample spectrogram, the label of the negative sample spectrogram and the prediction result:

[0076] E θ (Y, x) = -Y·F θ (x);

[0077] Then calculate the energy loss function:

[0078]

[0079] Wherein, θ is a parameter of the preset neural network, Y is a label of the speech training sample, x is the speech training sample, and β is a positive constant. In the embodiment of the present invention, β=0.5.

[0080] The parameters of the preset neural network are adjusted according to the obtained energy loss function, and the positive sample spectrogram and the negative sample spectrogram are re-input into the preset neural network respectively, the energy loss function is calculated, the parameters of the preset neural network are adjusted, and iterative training is performed until the energy loss function converges or reaches a preset threshold, and the optimal parameters are obtained, thereby obtaining the final speech adversarial sample detection model. In an embodiment of the present invention, when adjusting the parameters of the preset neural network according to the obtained energy loss function, the parameter θ can be adjusted by the gradient descent method.

[0081] In the embodiment of the present invention, since a speech training sample is divided into a plurality of small speech segments, each speech training sample corresponds to a plurality of spectrograms. After obtaining the final speech adversarial sample detection model, the probability of each speech training sample being a positive sample or a negative sample is calculated, thereby determining whether the speech training sample is a normal speech or a speech adversarial sample. Specifically, the probability can be calculated by a softmax function: the speech adversarial sample detection model outputs the output result of whether the spectrogram of each small segment is a positive sample or a negative sample, and the total number of spectrograms that are positive samples and negative samples is counted by a softmax function. If more of the N small speech segments of the speech training sample are judged as positive samples, the speech sample is considered to be a normal speech sample; otherwise, the speech segment is considered to be a speech adversarial sample.

[0082] The embodiment of the present invention obtains speech training samples, performs spectrogram feature extraction on the speech training samples, obtains positive sample spectrograms and negative sample spectrograms, respectively, inputs the positive sample spectrograms and negative sample spectrograms into the preset neural network for training, and obtains the speech adversarial sample detection model, thereby forming an automated speech adversarial sample detection tool, which improves the efficiency of identifying fictitious speech while ensuring high judgment accuracy, provides front-end protection for the security of ASR, and prevents the adverse effects caused by adversarial samples that deliberately create tampering with semantics.

[0083] Figure 3 The flowchart of the method for detecting speech adversarial samples provided by another embodiment of the present invention is shown, and the method is executed by a computing device. The computing device can be a computer device, such as a personal computer, a desktop computer, a tablet computer, etc.; it can also be other artificial intelligence devices or terminals, such as a robot, a mobile phone, etc., which is not specifically limited in the embodiment of the present invention. Figure 3 As shown, the method comprises the following steps:

[0084] Step 210: Acquire the voice data to be detected.

[0085] Step 220: Convert the speech data to be detected into a spectrogram to be detected.

[0086] In an embodiment of the present invention, after obtaining the speech to be detected, it is necessary to divide the speech data to be detected into a plurality of small speech segments to be detected according to a preset rule; load the truncated window function on the plurality of small speech segments to be detected to obtain a plurality of small windowed speech segments to be detected; perform short-time Fourier transform on the plurality of small windowed speech segments to be detected respectively to obtain a plurality of spectrograms to be detected corresponding to the speech data to be detected. This process is generally consistent with the process of converting to a spectrogram during the training process of the speech adversarial sample detection model, and will not be repeated here.

[0087] Step 230: input the to-be-detected spectrogram into a speech adversarial sample detection model; the speech adversarial sample detection model is trained according to the training method.

[0088] In an embodiment of the present invention, after a plurality of to-be-detected spectrograms are input into an adversarial detection model, output results of the to-be-detected spectrograms are obtained, and the detection results of the to-be-detected speech data are obtained by calculation through a softmax function.

[0089] Step 240: Output the detection result of the speech data to be detected.

[0090] The detection result is used to characterize whether the voice data to be detected is normal voice or adversarial voice with tampered semantics. The detection result is output to the user so that the user can perform corresponding operations according to the detection result.

[0091] The embodiment of the present invention obtains speech training samples, performs spectrogram feature extraction on the speech training samples, obtains positive sample spectrograms and negative sample spectrograms, respectively, inputs the positive sample spectrograms and negative sample spectrograms into the preset neural network for training, and obtains the speech adversarial sample detection model, thereby forming an automated speech adversarial sample detection tool, which improves the efficiency of identifying fictitious speech while ensuring high judgment accuracy, provides front-end protection for the security of ASR, and prevents the adverse effects caused by adversarial samples that deliberately create tampering with semantics.

[0092] Figure 4 FIG. 1 is a schematic diagram showing the structure of a training device for a speech adversarial sample detection model provided by an embodiment of the present invention. Figure 4 As shown, the device 300 includes: a first acquisition module 310, an extraction module 320 and a training module 330.

[0093] The first acquisition module 310 is used to acquire speech training samples, where the speech training samples include normal speech samples and adversarial speech samples; the adversarial speech samples are negative samples with tampered semantics.

[0094] The extraction module 320 is used to extract spectrogram features from the speech training samples to obtain positive sample spectrograms and negative sample spectrograms.

[0095] The training module 330 is used to input the positive sample spectrogram and the negative sample spectrogram into the preset neural network for training respectively to obtain the speech adversarial sample detection model.

[0096] The specific working process of the training device for the speech adversarial sample detection model in the embodiment of the present invention is generally consistent with the method steps of the above-mentioned training method for the speech adversarial sample detection model embodiment, and will not be repeated here.

[0097] The embodiment of the present invention obtains speech training samples, performs spectrogram feature extraction on the speech training samples, obtains positive sample spectrograms and negative sample spectrograms, respectively, inputs the positive sample spectrograms and negative sample spectrograms into the preset neural network for training, and obtains the speech adversarial sample detection model, thereby forming an automated speech adversarial sample detection tool, which improves the efficiency of identifying fictitious speech while ensuring high judgment accuracy, provides front-end protection for the security of ASR, and prevents the adverse effects caused by adversarial samples that deliberately create tampering with semantics.

[0098] Figure 5 FIG. 1 is a schematic diagram showing the structure of a device for detecting speech adversarial samples provided by an embodiment of the present invention. Figure 5 As shown, the device 400 includes:

[0099] The second acquisition module 410 is used to acquire the voice data to be detected.

[0100] The conversion module 420 is used to convert the speech data to be detected into a spectrogram to be detected.

[0101] The detection module 430 is used to input the to-be-detected spectrogram into a speech adversarial sample detection model. The speech adversarial sample detection model is trained according to the training method of the speech adversarial sample detection model or the training device of the speech adversarial sample detection model.

[0102] The output module 440 is used to output the detection result of the voice data to be detected.

[0103] The specific working process of the speech adversarial sample detection device of the embodiment of the present invention is generally consistent with the steps of the speech adversarial sample detection method of the above-mentioned method embodiment, and will not be repeated here.

[0104] The embodiment of the present invention obtains speech training samples, performs spectrogram feature extraction on the speech training samples, obtains positive sample spectrograms and negative sample spectrograms, respectively, inputs the positive sample spectrograms and negative sample spectrograms into the preset neural network for training, and obtains the speech adversarial sample detection model, thereby forming an automated speech adversarial sample detection tool, which improves the efficiency of identifying fictitious speech while ensuring high judgment accuracy, provides front-end protection for the security of ASR, and prevents the adverse effects caused by adversarial samples that deliberately create tampering with semantics.

[0105] Figure 6 The schematic diagram of the structure of the computing device provided by the embodiment of the present invention is shown, and the specific embodiment of the present invention does not limit the specific implementation of the computing device. Figure 6As shown, the computing device may include: a processor (processor) 502 , a communications interface (Communications Interface) 504 , a memory (memory) 506 , and a communication bus 508 .

[0106] The processor 502, the communication interface 504, and the memory 506 communicate with each other via the communication bus 508. The communication interface 504 is used to communicate with other devices such as a client or other server network elements. The processor 502 is used to execute the program 510, which can specifically execute the relevant steps in the above-mentioned training method for speech adversarial sample detection model or speech adversarial sample detection method embodiment.

[0107] Specifically, the program 510 may include a program code, which includes computer executable instructions. The processor 502 may be a central processing unit CPU, or an application specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement an embodiment of the present invention. The one or more processors included in the computing device may be processors of the same type, such as one or more CPUs; or they may be processors of different types, such as one or more CPUs and one or more ASICs. The memory 506 is used to store the program 510. The memory 506 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage.

[0108] The program 510 may be specifically invoked by the processor 502 to cause the computing device to perform the following operations:

[0109] Acquire speech training samples, wherein the speech training samples include a plurality of normal speech samples and a plurality of adversarial speech samples; the adversarial speech samples are negative samples with tampered semantics;

[0110] Extracting spectrogram features from the speech training samples to obtain positive sample spectrograms and negative sample spectrograms;

[0111] Inputting the positive sample spectrogram and the negative sample spectrogram into a preset neural network for training respectively to obtain a speech adversarial sample detection model; or

[0112] The program 510 may be specifically invoked by the processor 502 to cause the computing device to perform the following operations:

[0113] Obtain the voice data to be detected;

[0114] Converting the speech data to be detected into a spectrogram to be detected;

[0115] Inputting the to-be-detected spectrogram into a speech adversarial sample detection model; the speech adversarial sample detection model is trained according to the above-mentioned training method;

[0116] Output the detection result of the voice data to be detected.

[0117] In an optional manner, the acquiring of speech training samples, wherein the speech training samples include normal speech samples and adversarial speech samples, includes: acquiring an original normal speech sample; generating an adversarial speech sample through an objective function according to the original normal speech sample;

[0118] The objective function is: min‖δ‖ 2 +l(x′+δ,t) stdb(δ)≤T

[0119] Where δ represents the adversarial perturbation, x′ is the original normal speech sample, t is the target sentence, l is the CTC loss, the distortion is expressed in decibels (·), which represents the relative loudness of the audio on a logarithmic scale, and T represents the threshold of the energy size of the adversarial perturbation.

[0120] In an optional manner, the speech training samples are subjected to spectrogram feature extraction to obtain positive sample spectrograms and negative sample spectrograms, respectively, including: dividing each of the speech training samples into a plurality of small speech segments; loading the plurality of small speech segments with a truncation window function to obtain a plurality of windowed small speech segments; and performing short-time Fourier transform on the plurality of windowed small speech segments to obtain a plurality of spectrograms corresponding to each of the speech training samples.

[0121] In an optional manner, the truncated window function is a Hanning window function; the step of loading the multiple speech segments with the truncated window function to obtain multiple windowed speech segments includes: loading the multiple speech segments with the Hanning window function to obtain multiple windowed speech segments.

[0122] In an optional manner, the positive sample spectrogram and the negative sample spectrogram are respectively input into the preset neural network for training to obtain the speech adversarial sample detection model, including: inputting the positive sample spectrogram and the negative sample spectrogram into the preset neural network for training to obtain a prediction result; calculating an energy loss function according to the label of the positive sample spectrogram, the label of the negative sample spectrogram and the prediction result; adjusting the parameters of the preset neural network according to the energy loss function, and re-inputting the positive sample spectrogram and the negative sample spectrogram into the preset neural network, calculating the energy loss function, and adjusting the parameters of the preset neural network until the energy loss function converges or reaches a preset threshold, thereby obtaining the speech adversarial sample detection model.

[0123] In an optional manner, the energy loss function is:

[0124]

[0125] Among them, E θ (Y,x)=-Y·F θ (x); θ is the parameter of the preset neural network, Y is the label of the speech training sample; x is the speech training sample; β is a normal number.

[0126] The specific working process of the computing device in the embodiment of the present invention is generally consistent with the method steps of the above method embodiment, and will not be repeated here.

[0127] The embodiment of the present invention obtains speech training samples, performs spectrogram feature extraction on the speech training samples, obtains positive sample spectrograms and negative sample spectrograms, respectively, inputs the positive sample spectrograms and negative sample spectrograms into the preset neural network for training, and obtains the speech adversarial sample detection model, thereby forming an automated speech adversarial sample detection tool, which improves the efficiency of identifying fictitious speech while ensuring high judgment accuracy, provides front-end protection for the security of ASR, and prevents the adverse effects caused by adversarial samples that deliberately create tampering with semantics.

[0128] An embodiment of the present invention provides a computer-readable storage medium, which stores at least one executable instruction. When the executable instruction is executed on a computing device, the computing device executes the training method of the speech adversarial sample detection model or the detection method of the speech adversarial sample in any of the above-mentioned method embodiments.

[0129] The executable instructions may be used to cause the computing device to perform the following operations:

[0130] Acquire speech training samples, wherein the speech training samples include a plurality of normal speech samples and a plurality of adversarial speech samples; the adversarial speech samples are negative samples with tampered semantics;

[0131] Extracting spectrogram features from the speech training samples to obtain positive sample spectrograms and negative sample spectrograms;

[0132] Inputting the positive sample spectrogram and the negative sample spectrogram into a preset neural network for training respectively to obtain a speech adversarial sample detection model; or

[0133] The executable instructions may also be used to cause the computing device to perform the following operations:

[0134] Obtain the voice data to be detected;

[0135] Converting the speech data to be detected into a spectrogram to be detected;

[0136] Inputting the to-be-detected spectrogram into a speech adversarial sample detection model; the speech adversarial sample detection model is trained according to the above-mentioned training method;

[0137] Output the detection result of the voice data to be detected.

[0138] In an optional manner, the acquiring of speech training samples, wherein the speech training samples include normal speech samples and adversarial speech samples, includes: acquiring an original normal speech sample; generating an adversarial speech sample through an objective function according to the original normal speech sample;

[0139] The objective function is: min‖δ‖ 2 +l(x′+δ,t) stdb(δ)≤T

[0140] Where δ represents the adversarial perturbation, x′ is the original normal speech sample, t is the target sentence, l is the CTC loss, the distortion is expressed in decibels (·), which represents the relative loudness of the audio on a logarithmic scale, and T represents the threshold of the energy size of the adversarial perturbation.

[0141] In an optional manner, the speech training samples are subjected to spectrogram feature extraction to obtain positive sample spectrograms and negative sample spectrograms, respectively, including: dividing each of the speech training samples into a plurality of small speech segments; loading the plurality of small speech segments with a truncation window function to obtain a plurality of windowed small speech segments; and performing short-time Fourier transform on the plurality of windowed small speech segments to obtain a plurality of spectrograms corresponding to each of the speech training samples.

[0142] In an optional manner, the truncated window function is a Hanning window function; the step of loading the multiple speech segments with the truncated window function to obtain multiple windowed speech segments includes: loading the multiple speech segments with the Hanning window function to obtain multiple windowed speech segments.

[0143] In an optional manner, the positive sample spectrogram and the negative sample spectrogram are respectively input into the preset neural network for training to obtain the speech adversarial sample detection model, including: inputting the positive sample spectrogram and the negative sample spectrogram into the preset neural network for training to obtain a prediction result; calculating an energy loss function according to the label of the positive sample spectrogram, the label of the negative sample spectrogram and the prediction result; adjusting the parameters of the preset neural network according to the energy loss function, and re-inputting the positive sample spectrogram and the negative sample spectrogram into the preset neural network, calculating the energy loss function, and adjusting the parameters of the preset neural network until the energy loss function converges or reaches a preset threshold, thereby obtaining the speech adversarial sample detection model.

[0144] In an optional manner, the energy loss function is:

[0145]

[0146] Among them, E θ (Y,x)=-Y·F θ (x); θ is the parameter of the preset neural network, Y is the label of the speech training sample; x is the speech training sample; β is a normal number.

[0147] The embodiment of the present invention obtains speech training samples, performs spectrogram feature extraction on the speech training samples, obtains positive sample spectrograms and negative sample spectrograms, respectively, inputs the positive sample spectrograms and negative sample spectrograms into the preset neural network for training, and obtains the speech adversarial sample detection model, thereby forming an automated speech adversarial sample detection tool, which improves the efficiency of identifying fictitious speech while ensuring high judgment accuracy, provides front-end protection for the security of ASR, and prevents the adverse effects caused by adversarial samples that deliberately create tampering with semantics.

[0148] An embodiment of the present invention provides a training device for a speech adversarial sample detection model, which is used to execute the above-mentioned training method for the speech adversarial sample detection model.

[0149] The embodiment of the present invention provides a detection device for speech adversarial samples, which is used to execute the above-mentioned detection method for speech adversarial samples.

[0150] An embodiment of the present invention provides a computer program, which can be called by a processor to enable a computing device to execute the training method of a speech adversarial sample detection model in any of the above method embodiments.

[0151] An embodiment of the present invention provides a computer program, which can be called by a processor to enable a computing device to execute the method for detecting speech adversarial samples in any of the above method embodiments.

[0152] An embodiment of the present invention provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are run on a computer, the computer executes the training method of the speech adversarial sample detection model in any of the above method embodiments.

[0153] An embodiment of the present invention provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are run on a computer, the computer executes the method for detecting speech adversarial samples in any of the above method embodiments.

[0154] The algorithm or display provided here is not inherently related to any specific computer, virtual system or other equipment. Various general systems can also be used together with the teaching based on this. According to the above description, it is obvious to construct the structure required for this type of system. In addition, the embodiment of the present invention is not directed to any specific programming language yet. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described here, and the description of the above specific language is for disclosing the best mode of the present invention.

[0155] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0156] Similarly, it should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the embodiments of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this method of disclosure should not be interpreted as reflecting an intention that the claimed invention requires more features than those expressly recited in each claim.

[0157] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0158] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc. does not indicate any order. These words may be interpreted as names. The steps in the above embodiments, unless otherwise specified, should not be understood as limitations on the order of execution.

Claims

1. A training method for a speech adversarial sample detection model, characterized in that: The method comprises: Acquire speech training samples, wherein the speech training samples include a plurality of normal speech samples and a plurality of adversarial speech samples; the adversarial speech samples are negative samples with tampered semantics; Dividing each of the speech training samples into a plurality of small speech segments; Loading the plurality of speech segments with a truncation window function to obtain a plurality of windowed speech segments; Performing short-time Fourier transform on each of the plurality of windowed speech segments to obtain a plurality of spectrograms corresponding to each of the speech training samples; Add labels to each positive sample spectrogram and negative sample spectrogram; The labeled positive sample spectrogram and negative sample spectrogram are respectively input into a preset neural network for training to obtain a speech adversarial sample detection model. After the training is completed, the speech adversarial sample detection model outputs the output result of whether the spectrogram of each speech fragment is a positive sample or a negative sample, and counts the total number of spectrograms that are positive samples and negative samples. If more of the multiple speech fragments corresponding to the speech sample to be tested are judged as positive samples, the speech sample is considered to be a normal speech sample. Otherwise, the speech sample is considered to be a speech adversarial sample.

2. The method according to claim 1, characterized in that The acquiring of speech training samples, wherein the speech training samples include normal speech samples and adversarial speech samples, includes: Obtaining original normal speech samples; According to the original normal speech sample, generating an adversarial speech sample through an objective function; The objective function is: min||δ|| 2 +l(x′+δ,t) stdb(δ)≤T Where δ represents the adversarial perturbation, x′ is the original normal speech sample, t is the target sentence, l is the CTC loss, the distortion is expressed in decibels (·), which represents the relative loudness of the audio on a logarithmic scale, and T represents the threshold of the energy size of the adversarial perturbation.

3. The method according to claim 1, characterized in that The truncated window function is a Hanning window function; the step of loading the multiple speech segments into the truncated window function to obtain multiple windowed speech segments includes: loading the multiple speech segments into the Hanning window function to obtain multiple windowed speech segments.

4. The method according to any one of claims 1 to 3, characterized in that: The step of inputting the labeled positive sample spectrogram and the negative sample spectrogram into the preset neural network for training to obtain the speech adversarial sample detection model comprises: Inputting the positive sample spectrogram and the negative sample spectrogram into the preset neural network for training respectively, and outputting the prediction result; Calculating an energy loss function according to the label of the positive sample spectrogram, the label of the negative sample spectrogram and the prediction result; The parameters of the preset neural network are adjusted according to the energy loss function, and the positive sample spectrogram and the negative sample spectrogram are re-input into the preset neural network respectively, the energy loss function is calculated, and the parameters of the preset neural network are adjusted until the energy loss function converges or reaches a preset threshold, thereby obtaining a speech adversarial sample detection model.

5. The method according to claim 4, characterized in that The energy loss function is: Among them, E θ (Y,x)=-Y·F θ (x), F θ (x) is the model output value after the speech training sample is input into the preset neural network; θ is the parameter of the preset neural network, Y is the label of the speech training sample; x is the speech training sample; β is a normal number.

6. A method for detecting speech adversarial samples, characterized in that: The method comprises: Obtain the voice data to be detected; Converting the speech data to be detected into a spectrogram to be detected; Inputting the to-be-detected spectrogram into a speech adversarial sample detection model; the speech adversarial sample detection model is trained according to the training method according to any one of claims 1 to 5; Outputting the detection result of whether the spectrogram of each speech segment corresponding to the speech data to be detected is a positive sample or a negative sample; The statistical spectrogram is the total number of positive samples and negative samples. If more small segments among the multiple small segments corresponding to the detected speech sample are judged as positive samples, the speech sample is considered to be a normal speech sample. Otherwise, the speech sample is considered to be a speech adversarial sample.

7. A training device for a speech adversarial sample detection model, characterized in that: The device comprises: A first acquisition module is used to acquire speech training samples, wherein the speech training samples include normal speech samples and adversarial speech samples; the adversarial speech samples are negative samples with tampered semantics; An extraction module is used to divide each of the speech training samples into a plurality of speech segments; load the plurality of speech segments with a truncation window function to obtain a plurality of windowed speech segments; perform short-time Fourier transform on the plurality of windowed speech segments respectively to obtain a plurality of spectrograms corresponding to each of the speech training samples; A label adding module is used to add labels to each positive sample spectrogram and negative sample spectrogram; A training module is used to input the labeled positive sample spectrogram and negative sample spectrogram into a preset neural network for training, respectively, to obtain the speech adversarial sample detection model, wherein after the training is completed, the speech adversarial sample detection model outputs the output result of whether the spectrogram of each speech fragment is a positive sample or a negative sample, and counts the total number of spectrograms that are positive samples and negative samples. If more of the multiple speech fragments corresponding to the speech sample to be tested are judged as positive samples, then the speech sample is considered to be a normal speech sample, otherwise, the speech sample is considered to be a speech adversarial sample.

8. A speech adversarial sample detection device, characterized in that: The device comprises: The second acquisition module is used to acquire the voice data to be detected; A conversion module, used for converting the speech data to be detected into a spectrogram to be detected; A detection module, used for inputting the to-be-detected spectrogram into a speech adversarial sample detection model; the speech adversarial sample detection model is trained according to the training method of the speech adversarial sample detection model according to any one of claims 1 to 5 or the training device of the speech adversarial sample detection model according to claim 7; The output module is used to output the detection result of whether the spectrogram of each speech fragment corresponding to the speech data to be detected is a positive sample or a negative sample, and to count the total number of spectrograms that are positive samples and negative samples. If more of the multiple speech fragments corresponding to the speech sample to be detected are judged to be positive samples, then the speech sample is considered to be a normal speech sample. Otherwise, the speech sample is considered to be a speech adversarial sample.

9. A computing device, characterized in that include: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute the training method of the speech adversarial sample detection model as described in any one of claims 1-5 or the operation of the speech adversarial sample detection method as described in claim 6.

10. A computer-readable storage medium, characterized in that: The storage medium stores at least one executable instruction. When the executable instruction is executed on a computing device, the computing device executes the training method of the speech adversarial sample detection model as described in any one of claims 1 to 5 or the operation of the speech adversarial sample detection method as described in claim 6.

Images