Adversarial sample attack defense method and system for speech recognition

Abstract

The application discloses a kind of facing the method and system of attack defense of adversarial sample of speech recognition, the method includes: obtaining original sample, the original sample includes normal sample, adversarial sample, is high sampling rate audio;Original sample pre-processing, including denoising processing and extracting mel frequency cepstrum coefficient, respectively obtain to be recovered sample and mel frequency cepstrum coefficient;Construct audio reconstruction model, the audio reconstruction model uses the improved Wavenet residual network structure based on expansion convolution;Training audio reconstruction model, obtain the mapping relationship of low sampling rate audio to high sampling rate audio;Sample recovery, to be recovered sample and mel frequency cepstrum coefficient are input into the audio reconstruction model of well-trained, obtain normal sample.The application not only can effectively recover sample, improve adversarial sample attack defense capability, and simple and practical, processing efficiency is high.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, in particular to an adversarial sample attack defense method and system for speech recognition. BACKGROUND

[0002] Deep learning is to learn the internal laws and representation levels of sample data, and the information obtained in these learning processes is very helpful for the interpretation of data such as text, image and speech. Its ultimate goal is to enable machines to have analysis and learning ability like humans, and to be able to recognize text, image and speech data. In recent years, the related research of deep learning has experienced rapid development, and various applications based on deep learning have brought great convenience to people's life. In the application of deep learning, speech recognition is an important technology for communication between humans and machines. Speech recognition is essentially a pattern recognition system, which is a process of converting an input speech segment into corresponding text through a series of transformation processes. However, the emergence of adversarial samples has brought challenges to the security of speech recognition and its related applications: attackers only need to add carefully designed malicious noise to the speech, which can attack the speech recognition system without human perception of the difference, so that the speech recognition system will recognize it as false information or the recognition result set by the attacker.

[0003] This security challenge brought by adversarial samples puts higher requirements on the defense technology in the field of speech recognition. However, current defense research on adversarial samples mainly focuses on the image field, and there are still few defense researches in the field of speech recognition. Because there are significant differences in the attack and defense methods of adversarial samples between the image field and the speech recognition field, the attack and defense methods in the image field cannot be directly applied to speech recognition. SUMMARY

[0004] The purpose of the present application is to provide an adversarial sample attack defense method and system for speech recognition, so as to effectively improve the adversarial sample attack defense capability.

[0005] In order to achieve the above-mentioned purpose of the application, the embodiments of the present application provide the following technical solutions:

[0006] An adversarial sample attack defense method for speech recognition, comprising the following steps:

[0007] Step S1, obtaining an original sample, the original sample including a normal sample and an adversarial sample, being a high sampling rate audio;

[0008] Step S2, original sample preprocessing, including denoising processing and extracting mel frequency cepstral coefficients, to obtain a to-be-restored sample and mel frequency cepstral coefficients respectively;

[0009] Step S3: Construct an audio reconstruction model, which adopts an improved WaveNet residual network structure based on dilated convolution;

[0010] Step S4: Obtain normal samples for training the audio reconstruction model. The normal samples are high-sampling-rate audio. First, downsample the normal samples, and then transform their dimensions using bilinear interpolation upsampling to match the input dimensions required by the audio reconstruction model, resulting in low-sampling-rate audio. Combine the high-sampling-rate audio with the low-sampling-rate audio to obtain the dataset for training the audio reconstruction model. Divide the dataset into training, validation, and test sets, optimize the loss using the mean squared error (MSE) metric, and train the audio reconstruction model to obtain the mapping relationship from low-sampling-rate audio to high-sampling-rate audio.

[0011] Step S5: Input the sample to be restored and the Mel frequency cepstral coefficients into the trained audio reconstruction model to obtain normal samples.

[0012] The adversarial sample attack defense method for speech recognition further includes, in step S2:

[0013] Step S21, the denoising process, firstly adds random Gaussian white noise to the original sample, which can destroy some malicious perturbations; then uses spectral subtraction denoising, which can further eliminate malicious perturbations; finally, transforms its dimension through bilinear interpolation upsampling method to be consistent with the input dimension required by the audio reconstruction model.

[0014] Step S22, the extraction of Mel frequency cepstral coefficients is achieved by processing the original samples through pre-emphasis, framing, windowing, fast Fourier transform, Mel filter bank, discrete cosine transform, etc., to obtain the Mel frequency cepstral coefficients.

[0015] The adversarial sample attack defense method for speech recognition further includes, in step S3:

[0016] Step S31: The improved Wavenet residual network structure based on dilated convolution has 30 residual layers. The kernel size of the dilated convolution is 3*1, containing 128 kernels. The stride of the dilated convolution is repeated three times from 1 to 512. The last two kernels of the model are 3*1, and the output uses a 1*1 kernel.

[0017] On the other hand, embodiments of the present invention also provide an adversarial sample attack defense system for speech recognition, comprising:

[0018] The sample acquisition module is used to acquire raw samples, which include normal samples and adversarial samples, and are high-sampling-rate audio.

[0019] The preprocessing module is used to preprocess the original sample, including noise reduction and extraction of Mel frequency cepstral coefficients, to obtain the sample to be restored and the Mel frequency cepstral coefficients, respectively.

[0020] The sample recovery module constructs an audio reconstruction model, which adopts an improved WaveNet residual network structure based on dilated convolution. The sample to be recovered and the Mel frequency cepstral coefficients are input into the trained audio reconstruction model to obtain normal samples.

[0021] The model training module obtains normal samples for training the audio reconstruction model. These normal samples are high-sampling-rate audio. First, the normal samples are downsampled, and then their dimensions are transformed using a bilinear interpolation upsampling method to match the input dimension required by the audio reconstruction model, resulting in low-sampling-rate audio. The high-sampling-rate audio and low-sampling-rate audio are paired to obtain the dataset for training the audio reconstruction model. The dataset is divided into training, validation, and test sets. The mean squared error (MSE) metric is used to optimize the loss, and the audio reconstruction model is trained to obtain the mapping relationship from low-sampling-rate audio to high-sampling-rate audio.

[0022] The aforementioned adversarial sample attack defense system for speech recognition further includes a preprocessing module that includes:

[0023] The denoising process first adds random Gaussian white noise to the original sample, which can destroy some malicious perturbations; then, spectral subtraction is used to further eliminate malicious perturbations; finally, the dimensionality is transformed by bilinear interpolation upsampling to match the input dimension required by the audio reconstruction model.

[0024] The extraction of Mel frequency cepstral coefficients is achieved by processing the original samples through pre-emphasis, framing, windowing, fast Fourier transform, Mel filter bank, and discrete cosine transform.

[0025] The adversarial sample attack defense system for speech recognition further includes a sample recovery module:

[0026] The improved Wavenet residual network structure based on dilated convolution has 30 residual layers. The dilated convolution kernel size is 3*1, containing 128 kernels. The stride of the dilated convolution is repeated three times from 1 to 512. The last two kernels of the model are 3*1, and the output uses a 1*1 kernel.

[0027] In another aspect, embodiments of the present invention also provide a computer-readable storage medium including computer-readable instructions, which, when executed, cause a processor to perform the steps in the method described in any embodiment of the present invention.

[0028] In another aspect, embodiments of the present invention also provide an electronic device, including: a memory for storing program instructions; and a processor connected to the memory for executing the program instructions in the memory to implement the method described in any embodiment of the present invention.

[0029] Compared with the prior art, the present invention has the following advantages:

[0030] (1) When training the audio reconstruction model, this invention only needs to use normal samples to establish the mapping relationship between low sampling rate audio and high sampling rate audio, without the need to specially produce a large number of adversarial sample datasets, which effectively reduces the cost and expense of model training. At the same time, after the audio reconstruction model is trained, it can effectively remove malicious perturbations in adversarial samples without affecting the quality of normal samples, thus effectively improving the attack defense effect;

[0031] (2) Since traditional convolutional neural network models cannot directly process sequence problems, leading to an explosion of input context information, this invention adopts an improved WaveNet residual network structure based on dilated convolution. By using dilated convolution to increase the receptive field, the convolutional kernel skips certain connections and can act on input sequences longer than itself, which is equivalent to expanding it into a larger filter. In this way, while increasing the receptive field and making full use of input context information, it can also effectively improve processing efficiency.

[0032] (3) In addition, since the Mel frequency is more sensitive to low frequency signals, it can effectively reduce noise interference. Therefore, the Mel frequency cepstral coefficients are introduced into the audio reconstruction model, which can help the model achieve better audio reconstruction results. Attached Figure Description

[0033] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is a flowchart of the adversarial sample attack defense method for speech recognition according to the present invention.

[0035] Figure 2 This is a schematic diagram of the improved Wavenet residual network structure based on dilated convolution according to the present invention.

[0036] Figure 3 This is a functional block diagram of the adversarial sample attack defense system for speech recognition according to the present invention. Detailed Implementation

[0037] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0038] like Figure 1 As shown, this embodiment provides a method for defending against adversarial example attacks on speech recognition, including the following steps:

[0039] Step S1: Obtain the original samples, which include normal samples and adversarial samples, and are high-sampling-rate audio.

[0040] In this embodiment, normal samples are derived from the Common Voice and LibriSpeech datasets. The Common Voice dataset contains nearly 1400 hours of recordings from over 42,000 individuals, while the LibriSpeech dataset contains over 1000 hours of English recordings. Adversarial samples are generated using methods such as C&W attacks, general adversarial perturbation attacks, weighted sampling audio attacks, acoustic masking attacks, and perception-based speech attacks. Each attack method generates 300 adversarial samples on both the Common Voice and LibriSpeech datasets, resulting in a total of 3000 adversarial samples generated by different attack methods. C&W attacks, weighted sampling audio attacks, acoustic masking attacks, and perception-based attacks are targeted attacks; in this embodiment, their target is set to a string different from the original recognition result. General adversarial perturbation attacks are non-targeted attacks; in this embodiment, samples with a character error rate (CER) greater than 0.5 are considered adversarial samples. In this embodiment, the DeepSpeech model is used as the attacked speech recognition model to generate adversarial samples.

[0041] Step S2, raw sample preprocessing, including denoising and extraction of Mel frequency cepstral coefficients (MFCC), to obtain the sample to be recovered and Mel frequency cepstral coefficients respectively;

[0042] The denoising process first adds random Gaussian white noise to the original samples, which can destroy malicious perturbations to some extent. Then, spectral subtraction denoising is used to further eliminate some of the malicious perturbations in the adversarial examples. Spectral subtraction denoising mainly involves downsampling the audio file, thereby eliminating the perturbations maliciously introduced by the adversarial examples by reducing its sampling rate. Since downsampling is a lossy compression process, some waveforms are discarded during downsampling, which affects the audio quality. Therefore, the low-sampling-rate audio after spectral subtraction denoising needs to be fed into the audio reconstruction model for restoration. Because the audio reconstruction model requires the input and output sequences to have the same dimension, bilinear interpolation upsampling is also used to convert the low-sampling-rate audio after spectral subtraction denoising to the dimension required by the model.

[0043] The extraction of Mel frequency cepstral coefficients is achieved by processing the original samples through pre-emphasis, framing, windowing, fast Fourier transform, Mel filter bank, discrete cosine transform, etc.

[0044] Since Mel frequencies are more sensitive to low-frequency signals and can effectively reduce noise interference, this embodiment introduces Mel frequency cepstral coefficients into the audio reconstruction model to help the model achieve better reconstruction results. When extracting the Mel frequency cepstral coefficients, it is necessary to optimize the hyperparameters of the relevant transformation function. In this embodiment, the number of Mel filters is set to 80. Simultaneously, to ensure that the values ​​of the Mel frequency cepstral coefficients are consistent with the dimension of the residual layer, they need to be normalized to the range of -1 to 1 using maximum absolute value normalization (i.e., the MaxAbsScaler function), so that the Mel frequency cepstral coefficients can be incorporated into the residual layer.

[0045] Step S3: Construct an audio reconstruction model, which adopts an improved WaveNet residual network structure based on dilated convolution;

[0046] like Figure 2As shown, traditional convolutional neural network models cannot directly process sequence problems, leading to an explosion of input contextual information. Therefore, this embodiment employs an improved WaveNet residual network structure based on dilated convolution. By using dilated convolution to increase the receptive field, the convolutional kernel skips certain connections and can act on input sequences longer than itself, effectively expanding it into a larger filter. This increases the receptive field, fully utilizes input contextual information, and also effectively improves processing efficiency. The improved WaveNet residual network structure based on dilated convolution has 30 residual layers. The dilated convolution kernel size is 3*1, containing 128 convolutional kernels, and the stride of the dilated convolution is repeated three times from 1 to 512. Compared to the traditional WaveNet residual network where the last two convolutional kernels are 1*1, this embodiment modifies their size to 3*1, effectively avoiding breakpoints in the output sequence. Furthermore, using 1*1 convolutional kernels at output instead of the traditional WaveNet residual network's Softmax function effectively accelerates model training. In addition, in this embodiment, to maintain the consistency of the dimensions of the input and output sequences, the audio reconstruction model does not use pooling layers, but instead uses zero-padding to ensure the consistency of the input and output dimensions. Let p be the number of zero-padding elements in a hidden layer, s be the size of the convolutional kernel, and d be the dilation coefficient (the number of connections skipped by the convolutional kernel is usually called the dilation coefficient; the dilation coefficient of a regular convolution is 1), then p = (s-1)*d. As the dilation coefficient gradually increases, the number of zero-padding elements also increases.

[0047] Step S4: Obtain normal samples for training the audio reconstruction model. The normal samples are high-sampling-rate audio. First, downsample the normal samples, and then transform their dimensions using bilinear interpolation upsampling to match the input dimensions required by the audio reconstruction model, resulting in low-sampling-rate audio. Combine the high-sampling-rate audio with the low-sampling-rate audio to obtain the dataset for training the audio reconstruction model. Divide the dataset into training, validation, and test sets, optimize the loss using the mean squared error (MSE) metric, and train the audio reconstruction model to obtain the mapping relationship from low-sampling-rate audio to high-sampling-rate audio.

[0048] Since the audio reconstruction model requires pre-training before deployment, this embodiment selects the Common Voice and LibriSpeech datasets for training. Both the Common Voice and LibriSpeech datasets have an audio sampling rate of 16kHz. To improve training efficiency and better simulate real-world scenarios, this embodiment downsamples the 16kHz audio to 8kHz, and then uses bilinear interpolation to upsample it back to 16kHz. It's important to note that this 16kHz audio is merely to ensure consistent sampling point dimensions between the input and output; it is essentially still low-sampling-rate audio. The original 16kHz audio is used as the high-sampling-rate audio, and this is combined with the upsampled 16kHz low-sampling-rate audio to form training sample pairs: (original 16kHz high-sampling-rate audio, 16kHz low-sampling-rate audio obtained by upsampling from 8kHz). This yields the dataset used to train the audio reconstruction model. The dataset is then divided into two parts: a training set (80%), a validation set (10%), and a test set (10% each).

[0049] Step S5: Input the sample to be restored and the Mel frequency cepstral coefficients into the trained audio reconstruction model to obtain normal samples;

[0050] In this embodiment, the signal-to-noise ratio (SNR) and logarithmic spectral distance (LSD) are used to evaluate the reconstruction effect of the audio reconstruction model. The LSD primarily measures the spectral distortion between audio segments, i.e., the distortion rate. To make the results convincing, this embodiment selects a U-net-based audio reconstruction model for comparative testing. The two models are similar in that they both perform calculations on the input audio in the time domain and employ bilinear interpolation upsampling during the upsampling process. The difference lies in that the U-net-based audio reconstruction model uses ordinary convolution and deconvolution to reconstruct the audio sequence, resulting in a smaller receptive field and an inability to utilize contextual information in the audio sequence. Furthermore, it does not introduce Mel-frequency cepstral coefficients. In this embodiment, under the same condition of inputting “8kHz low sampling rate audio”, two models were tested respectively, and the results are as follows: (1) When the audio comes from the Common Voice dataset, the LSD of the audio reconstruction model provided by this embodiment is 2.87 and the SNR is 25.66; the LSD of the audio reconstruction model based on U-net is 2.97 and the SNR is 21.71; (2) When the audio comes from the LibriSpeech dataset, the LSD of the audio reconstruction model provided by this embodiment is 2.57 and the SNR is 29.75; the LSD of the audio reconstruction model based on U-net is 3.01 and the SNR is 23.98. The above are only some of the test results of this embodiment, not all of the test results. In fact, this embodiment also carried out comparative tests with various audio reconstruction models under different conditions. The results show that the audio reconstruction model provided by this embodiment has better reconstruction effect, regardless of the distortion rate or the signal-to-noise ratio. Therefore, the model learns a more accurate mapping relationship from low sampling rate audio to high sampling rate audio, with a lower distortion rate, a higher signal-to-noise ratio, and stronger recovery ability.

[0051] Meanwhile, this embodiment uses word error rate (WER) to evaluate the effectiveness of defending against adversarial sample attacks, and the speech recognition system uses the DeepSpeech model. Word error rate refers to the number of words that need to be added, removed, or changed in order to keep the recognized word sequence consistent with the word sequence of the original sample when recognizing a speech. The word error rate is calculated by dividing the total number of words that need to be added, removed, or changed by the total number of word sequences in the original sample. (1) Evaluate the impact of the embodiment of the present invention on normal samples. First, normal samples from the Common Voice dataset are directly sent into the speech recognition system, and the WER is 15.93%. Then, the same samples are processed and restored by the embodiment of the present invention and sent into the speech recognition system, and the WER is 16.82%. Next, the same test is performed on the LibriSpeech dataset, and the WER results are 12.32% and 12.79%, respectively. It can be seen that the embodiment of the present invention has basically no impact on normal samples. (2) Evaluate the effectiveness of adversarial sample attacks without taking defensive measures. When adversarial samples generated by C&W attacks from the Common Voice dataset are directly fed into the speech recognition system, the WER (Warranty Error Rate) is as high as 56.19%. Similarly, when adversarial samples generated by C&W attacks from the LibriSpeech dataset are directly fed into the speech recognition system, the WER is also as high as 59.60%. This shows that adversarial samples generated by C&W attacks have a huge destructive power on speech recognition systems. (3) Evaluate the effectiveness of the embodiments of the present invention in defending against adversarial sample attacks. When adversarial samples generated by C&W attacks from the Common Voice dataset are processed and restored by the embodiments of the present invention before being fed into the speech recognition system, the WER is reduced to 19.37%. Similarly, when adversarial samples generated by C&W attacks from the LibriSpeech dataset are processed and restored by the embodiments of the present invention before being fed into the speech recognition system, the WER is reduced to 14.96%. This shows that the embodiments of the present invention can play a significant defensive role against C&W adversarial samples. The above are only some of the test results of this embodiment, not all of the test results. In fact, based on this, this embodiment also conducted tests on the defense effect against different attack methods and different datasets, such as general adversarial perturbation attacks, weighted sampling audio attacks, acoustic masking attacks, and perception-based speech attacks. The results show that the embodiments of the present invention can all achieve significant defense effects, among which the defense performance against weighted sampling audio attacks and perception-based speech attacks is the best. (4) In order to make the results more convincing, this embodiment also selected commonly used defense methods such as random smoothing defense and MP3 compression defense for comparative tests.Among them, random smoothing masks adversarial perturbations by adding random normally distributed noise; MP3 compression defense is a lossy compression method based on a psychoacoustic model. It reduces file size by discarding a portion of audio information (usually information below the hearing threshold). While discarding audio information, it also discards the adversarial perturbations, thus rendering the attack ineffective. Test results show that, against several common adversarial example attacks such as C&W, this embodiment of the invention has better defense performance compared to commonly used defense methods such as random smoothing defense and MP3 compression defense.

[0052] like Figure 3 As shown, this embodiment also provides an adversarial sample attack defense system for speech recognition, including:

[0053] The sample acquisition module is used to acquire raw samples, which include normal samples and adversarial samples, and are high-sampling-rate audio.

[0054] The preprocessing module is used to preprocess the original sample, including noise reduction and extraction of Mel frequency cepstral coefficients, to obtain the sample to be restored and the Mel frequency cepstral coefficients, respectively.

[0055] The sample recovery module constructs an audio reconstruction model, which adopts an improved WaveNet residual network structure based on dilated convolution. The sample to be recovered and the Mel frequency cepstral coefficients are input into the trained audio reconstruction model to obtain normal samples.

[0056] The model training module obtains normal samples for training the audio reconstruction model. These normal samples are high-sampling-rate audio. First, the normal samples are downsampled, and then their dimensions are transformed using a bilinear interpolation upsampling method to match the input dimension required by the audio reconstruction model, resulting in low-sampling-rate audio. The high-sampling-rate audio and low-sampling-rate audio are paired to obtain the dataset for training the audio reconstruction model. The dataset is divided into training, validation, and test sets. The mean squared error (MSE) metric is used to optimize the loss, and the audio reconstruction model is trained to obtain the mapping relationship from low-sampling-rate audio to high-sampling-rate audio.

[0057] This system is based on Figure 1 The invention is based on the same inventive concept as the method shown. Therefore, for the specific processing operations of each module, please refer to the relevant descriptions in the preceding method embodiments.

[0058] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. Those skilled in the art can make various modifications to the above content without departing from the spirit and scope of the invention as defined in the claims. Therefore, the scope of the present invention is not limited to the above description, but is determined by the scope of the claims.

Claims

1. A method for defending against adversarial example attacks in speech recognition, characterized in that, include: Step S1: Obtain the original samples, which include normal samples and adversarial samples, and are high-sampling-rate audio. Step S2, raw sample preprocessing, including denoising and extraction of Mel frequency cepstral coefficients, to obtain the sample to be recovered and Mel frequency cepstral coefficients respectively; Step S3: Construct an audio reconstruction model, which adopts an improved WaveNet residual network structure based on dilated convolution; Step S4: Obtain normal samples for training the audio reconstruction model. The normal samples are high-sampling-rate audio. First, downsample the normal samples, and then transform their dimensions using bilinear interpolation upsampling to match the input dimensions required by the audio reconstruction model, resulting in low-sampling-rate audio. Combine the high-sampling-rate audio with the low-sampling-rate audio to obtain the dataset for training the audio reconstruction model. Divide the dataset into training, validation, and test sets, optimize the loss using the mean squared error (MSE) metric, train the audio reconstruction model, and obtain the mapping relationship from low-sampling-rate audio to high-sampling-rate audio. Step S5: Input the sample to be restored and the Mel frequency cepstral coefficients into the trained audio reconstruction model to obtain normal samples.

2. The method for defending against adversarial sample attacks for speech recognition according to claim 1, characterized in that, Step S2 includes: Step S21, the denoising process, firstly adds random Gaussian white noise to the original sample, which can destroy some malicious perturbations; then uses spectral subtraction denoising, which can further eliminate malicious perturbations; finally, transforms its dimension through bilinear interpolation upsampling method to be consistent with the input dimension required by the audio reconstruction model. Step S22, the extraction of Mel frequency cepstral coefficients is achieved by processing the original samples through pre-emphasis, framing, windowing, fast Fourier transform, Mel filter bank, discrete cosine transform, etc., to obtain the Mel frequency cepstral coefficients.

3. The method for defending against adversarial sample attacks for speech recognition according to claim 1, characterized in that, Step S3 includes: Step S31: The improved Wavenet residual network structure based on dilated convolution has 30 residual layers. The kernel size of the dilated convolution is 3*1, containing 128 kernels. The stride of the dilated convolution is repeated three times from 1 to 512. The last two kernels of the model are 3*1, and the output uses a 1*1 kernel.

4. A defense system against adversarial sample attacks for speech recognition, characterized in that, include: The sample acquisition module is used to acquire raw samples, which include normal samples and adversarial samples, and are high-sampling-rate audio. The preprocessing module is used to preprocess the original sample, including noise reduction and extraction of Mel frequency cepstral coefficients, to obtain the sample to be restored and the Mel frequency cepstral coefficients, respectively. The sample recovery module constructs an audio reconstruction model, which adopts an improved WaveNet residual network structure based on dilated convolution. The sample to be recovered and the Mel frequency cepstral coefficients are input into the trained audio reconstruction model to obtain normal samples. The model training module obtains normal samples for training the audio reconstruction model. These normal samples are high-sampling-rate audio. First, the normal samples are downsampled, and then their dimensions are transformed using a bilinear interpolation upsampling method to match the input dimension required by the audio reconstruction model, resulting in low-sampling-rate audio. The high-sampling-rate audio and low-sampling-rate audio are paired to obtain the dataset for training the audio reconstruction model. The dataset is divided into training, validation, and test sets. The mean squared error (MSE) metric is used to optimize the loss, and the audio reconstruction model is trained to obtain the mapping relationship from low-sampling-rate audio to high-sampling-rate audio.

5. A defense system against adversarial sample attacks for speech recognition according to claim 4, characterized in that, The preprocessing module performs the following operations during denoising: First, random Gaussian white noise is added to the original sample to destroy some malicious perturbations; then, spectral subtraction is used for denoising to further eliminate malicious perturbations; finally, the dimension is transformed by bilinear interpolation upsampling to match the input dimension required by the audio reconstruction model.

6. The adversarial sample attack defense system for speech recognition according to claim 4, characterized in that, When extracting Mel frequency cepstral coefficients, the preprocessing module performs the following operations: pre-emphasis, framing, windowing, fast Fourier transform, Mel filter bank, discrete cosine transform, etc., on the original samples to obtain Mel frequency cepstral coefficients.

7. A defense system against adversarial sample attacks for speech recognition according to claim 4, characterized in that, When constructing the audio reconstruction model, the sample recovery module performs the following operations: based on the improved Wavenet residual network structure with dilated convolution, there are 30 residual layers, the kernel size of the dilated convolution is 3*1, containing 128 convolution kernels, the stride of the dilated convolution is repeated three times from 1 to 512, the last two convolution kernels of the model are 3*1, and the output uses a 1*1 convolution kernel.

8. A computer-readable storage medium comprising computer-readable instructions, characterized in that, When executed, the computer-readable instructions cause the processor to perform the steps of the method according to any one of claims 1-3.

9. An electronic device, characterized in that, include: Memory, which stores program instructions; A processor, connected to the memory, executes program instructions in the memory to implement the method described in any one of claims 1-3.

Images