A method and system for inaudible universal adversarial command attack

Abstract

The present invention relates to a method and system for inaudible general adversarial command attacks, which includes two stages; the first stage is the generation process of general adversarial commands UAC, using a data-independent method to construct general adversarial commands; the commands are characteristic commands with strong robustness, which can prevent interference from other commands, enabling the speech recognition model to only execute inaudible attack commands; the second stage is the generation process of inaudible general adversarial commands IUAC, modulating the general adversarial commands obtained in the first stage into inaudible general adversarial commands IUAC, that is, inaudible attack commands. The present invention has the advantages of data-independent construction and inaudibility, and can covertly counterattack and attack intelligent speech recognition systems.

Description

Technical Field

[0001] The present invention relates to a method and system for universal countermeasure command attacks based on inaudibility, belonging to the technical field of intelligent speech recognition. Background Art

[0002] With the development of deep learning in the intelligent era, intelligent voice systems have become widely used in IoT devices. Currently, many intelligent voice systems require voiceprint authentication. If an attacker can obtain the user's voiceprint information in advance, they can proactively activate the user's device. However, this assumption is strong. If the attacker cannot obtain the user's voiceprint in advance, existing attack methods become very difficult. Therefore, studying the security of intelligent voice systems is crucial. Can an attacker attack an intelligent voice system while it is active without first obtaining the user's voiceprint data? If so, the attacker can launch an attack and trick the intelligent voice system into executing the attacker's target command, even if the attacker has never seen the victim. In recent years, research on the security of intelligent voice systems has increased. These attacks can be divided into two categories: direct attacks using signals and indirect attacks using adversarial examples. Direct attacks using signals mainly fall into two types. One type is audible, such as replay attacks. However, these attacks are not sufficiently stealthy. The second type is inaudible and their attacks are covert; however, they require prior access to the user's voiceprint information. Indirect attacks using adversarial examples generally fail to detect the added adversarial perturbations. However, most common adversarial attacks rely on user data samples and are susceptible to interference from environmental noise. In an attack scenario, the attacker hopes to issue an inaudible, universal adversarial command while the user is using the intelligent voice system. Even if mixed with the user's command, the intelligent voice system can still execute the attacker's command. Typically, the attacker does not have the user's command data, so the attacker needs to design a data-independent method to construct a universal attack command. Since the attacker cannot obtain user commands in advance, ensuring that the attack command is effective against any user command is also a challenge. Furthermore, the attack must be sufficiently stealthy and robust to remain undetected and resistant to environmental noise.

[0003] Therefore, existing technologies cannot use data sample-independent methods to conduct inaudible adversarial attacks on intelligent speech recognition systems. Summary of the Invention

[0004] The technology of the present invention solves the problem: overcoming the deficiency of data dependence in the existing technology, providing a universal anti-command attack method and system based on inaudibility, which has the advantages of no data dependence structure and inaudibility, and can covertly counterattack intelligent speech recognition systems.

[0005] In the first aspect, the present invention provides a method for attacking based on inaudible general adversarial commands, which is implemented as follows: It includes two stages;

[0006] The first stage is the generation process of general adversarial commands UAC. A general adversarial command is constructed using a data-independent method; the command is a feature command with strong robustness, which can prevent interference from other commands, enabling the speech recognition model to only execute the attack command;

[0007] The second stage is the generation process of inaudible general adversarial commands IUAC. The general adversarial command obtained in the first stage is modulated into an inaudible general adversarial command IUAC, that is, an inaudible attack command;

[0008] The first stage is the generation process of general adversarial commands UAC, which is implemented as follows:

[0009] (11) Construct a training set using a data-independent method;

[0010] The specific implementation is as follows:

[0011] Use speech synthesis technology to synthesize data containing semantic information, and use the cyclic replacement method to process the data containing semantic information to generate a training set that meets anisotropic characteristics;

[0012] (12) Find an initial general adversarial command from the target domain to accelerate convergence;

[0013] (13) Based on the given neural network model, training set, and initial general adversarial command, use the loss function to find UAC. The loss function is designed as follows:

[0014]

[0015] Among them, L refers to CTC-Loss, f is the neural network model, t is the target phrase, τ t is an initial point in the target domain, α is a hyperparameter, τ is an independent variable, s ij is the training set, N is the audio length corresponding to the target phrase; n is the number of speech synthesis data;

[0016] Finally, by optimizing the loss function until convergence, the final general adversarial command UACδ = τ + τ t .

[0017] Furthermore, the CTC-Loss function is as follows:

[0018]

[0019] Among them, f(x) represents the probability of the output result obtained by inputting an x to a given neural network model f(.), t is the target phrase, y is an output result of the neural network model, and Pr() refers to the probability of obtaining this output result y;

[0020] reduce is a function for post-processing the output directly obtained by a speech recognition model to correct the output result. It satisfies the following two rules: (1) If two identical characters are connected together, only one needs to be retained; (2) If there is a special symbol "-" between two identical characters, the two identical characters cannot be merged. For example, if t = abb, then reduce(aaa-bb-bb) = abb, reduce(aa-bbb-bb) = abb, and both aaa-bb-bb and aa-bbb-bb are alignments of t.

[0021] Furthermore, in the step (12), in order to accelerate the convergence rate of training UAC, an initial point τ in the target domain is used t to accelerate the finding of UAC, satisfying:

[0022] τ t ∈Γ t ={x|C(f(x)) = t}

[0023] Γ t is the target domain, f(·) is the neural network model, and C(·) is the decoding process.

[0024] Furthermore, in the step (11), the processing method is to process by constructing a replacement matrix set;

[0025] Perform cyclic replacement on each data. Define M={m1,…m i} as the replacement matrix set, and the replacement matrix m i satisfies the following conditions:

[0026]

[0027] In the second aspect, the present invention provides an inaudible general adversarial command attack system, including a general adversarial command UAC generation module and an inaudible general adversarial command IUAC generation module;

[0028] The general adversarial command UAC generation module constructs a general adversarial command using a data-independent method; the command is a feature command with strong robustness, which can prevent interference from other commands, enabling the speech recognition model to only execute inaudible attack commands;

[0029] The inaudible Universal Adversarial Command IUAC generation module modulates the obtained universal adversarial command into an inaudible universal adversarial command IUAC, that is, an inaudible attack command;

[0030] The universal adversarial command UAC generation module is implemented as follows:

[0031] (11) Construct a training set using a data-independent method;

[0032] The specific implementation is as follows:

[0033] Use speech synthesis technology to synthesize data containing semantic information, and use the loop replacement method to process the data containing semantic information to generate a training set that satisfies anisotropic characteristics;

[0034] (12) Find an initial universal adversarial command from the target domain to accelerate convergence;

[0035] (13) Based on the given neural network model, training set, and initial universal adversarial command, use the loss function to find UAC. The loss function is designed as follows:

[0036]

[0037] Among them, L refers to CTC-Loss, t is the target phrase, τ t is an initial point in the target domain, α is a hyperparameter, τ is an independent variable, s ij is the training set, N is the audio length corresponding to the target phrase, and n is the number of speech synthesis data;

[0038] Finally, by optimizing the loss function until convergence, the final universal adversarial command UACδ = τ + τ t . δ represents the attack command.

[0039] The advantages of the present invention compared with the prior art are as follows:

[0040] (1) The present invention proposes a data - independent method to generate Universal Adversarial Commands (UAC). The semantic filling and cyclic replacement methods are used to construct training data to replace the user's voice data. This method can construct feature data with anisotropic directions, and then a loss function with CTC - Loss is designed to constrain the UAC. Even when other commands interfere, the model can still recognize two superimposed commands as the target phrase. Here, it is equivalent to that the constructed anisotropic feature data forms a spherical surface centered on the UAC after being superimposed on the UAC. The loss function is to limit the entire spherical surface within the target decision space. The innovation of the method is to find the center point of the target decision space of a given model. In addition, to accelerate the convergence speed of training UAC, an initial point in the target domain can be used to accelerate the finding of UAC. This method can be extended to other deep models to find a strongly robust input (i.e., the center point of the target decision space, which is a concept first proposed by this method).

[0041] (2) The present invention can achieve a relatively high attack success rate, averaging over 96%. For the real - world dataset, the average Character Error Rate (CER) is 0.018. The UAC attack effect reaches 35.85 times that of the baseline and has stronger robustness.

[0042] (3) The IUAC algorithm converges more quickly. On the one hand, it can save training costs, and on the other hand, it can improve the attack accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a block diagram of the composition of the attack system of the present invention;

[0044] Figure 2 [[ID=1�]]It is a flowchart of the implementation of the method of the present invention;

[0045] Figure 3 It is an architecture diagram of a microphone;

[0046] Figure 4 It is a schematic diagram of data - independent UAC generation;

[0047] Figure 5 It is a schematic diagram of IUAC generation and passing through a microphone;

[0048] Figure 6 It is a comparison diagram of attack effects; for the left - hand figure, the abscissa overlap degree represents the overlap ratio between the user command and the attack command, and the ordinate is the error word rate; for the right - hand figure, the abscissa is the average signal - to - noise ratio, and the ordinate is the average error word rate;

[0049] Figure 7 It is a comparison table of the effects of different attack commands;

[0050] Figure 8This is a comparison chart of the convergence effect. Detailed implementation manners

[0051] The present invention will be described in detail below with reference to the accompanying drawings and embodiments.

[0052] As Figure 1 shown, it is a block diagram of the composition of the attack system of the present invention; the attacker first uses a data-independent method to generate a UAC, then modulates the generated UAC into an IUAC, and then when the user issues a command to the intelligent speech recognition system, the attacker issues a pre-constructed IUAC attack command. Through the microphone, the intelligent speech recognition system can receive overlapping commands, and the final recognition result is the attacker's command.

[0053] As Figure 2 , the first stage is a general adversarial command (UAC) generation module, and the function realized is to generate a strongly robust feature command, which can prevent the interference of other commands and enable the speech recognition model to only execute the attacker's command. What enters this module is an execution command desired by the attacker. After feature robustness processing, it is then sent to the IUAC generation module.

[0054] The second stage is an inaudible general adversarial command (IUAC) generation module, and the function realized is to transform the general adversarial command into an inaudible attack command. What enters this module is the general adversarial command, which is modulated by a high-frequency carrier wave to become an inaudible command.

[0055] The implementation process of the UAC generation module:

[0056] The attacked intelligent speech system uses DeepSpeech as the speech recognition model, which is a speech-to-text system. This model is an end-to-end rnn-based automatic speech recognition (ASR) model with CTC-Loss, which can flexibly calculate the loss and perform gradient descent. Define this speech recognition model as the function f(·), and D is the user command set (test set). Let Y = {a,..., z, space, -}. The audio input x i can be represented as multiple frames (i.e., x i = [r1,..., r di ). f(·) maps each frame of the input audio to the probability distribution of Y, that is where d i = |x i |, m = |Y|. C(·) is the decoding process, and C(f(x)) represents the final result of the speech recognition model recognizing the input audio x.

[0057] As an attacker, it is difficult to obtain the user's command data in practice. Therefore, a general adversarial command needs to be constructed using a data-independent method If the general adversarial command can be heard, it needs to be converted into an inaudible general adversarial command. In an attack scenario, it is difficult to obtain the content and exact issuance time of the user's command . Therefore, it is necessary to consider the overlapping length and position, and define O(x i , δ, l i ) to represent it. O(x i , δ, l i ) represents the overlap between the user command x i and the attack command δ, and the starting point of the overlap is, l i . The first problem to be solved is to design a general adversarial command δ that satisfies the following equation:

[0058]

[0059] This is equivalent to finding an attack command δ such that for any l i and x i , refers to the set of user commands, and there is O(x i , δ, l i ) ∈ Γ t = {x|C(f(x)) = t}, Γ t is the target domain of the target phrase t. C(f(x)) is used to decode the vector f(x) into a phrase. The decoding methods mainly include greedy decoding and beam search decoding. For greedy decoding search, there is:

[0060]

[0061] Among them, reduce satisfies the following two rules: (1) If two identical characters are concatenated, only one needs to be retained, and two identical characters cannot be merged; (2) If there is a special symbol "-" between them. For example, if t = abb, then reduce(aaa - bb - bb) = abb, reduce(aa - bbb - bb) = abb, so aaa - bb - bb and aa - bbb - bb are both alignments of t. In addition, the probability of obtaining a model output result y is:

[0062] In practical applications, it is assumed that the set of user commands D cannot be obtained. Therefore, it is necessary to design a data - free method to generate the general adversarial command δ. Since the decision space is a complex high - dimensional space, for the sake of easy understanding, here only a two - dimensional space is taken as an example. Define S = {s1, s2, s3, s4} as the synthetic audio data. s1, s2, s3, and s4 are audio with different direction and length characteristics in the decision space. Figure 4Shows the main idea of finding a universal adversarial command.

[0063] As Figure 4 shown, a schematic diagram is generated for data-independent UAC; the initial attack command is moved to the decision center point; finally, a universal adversarial command δ is found. With it as the center, a sphere with radius R is contained within the target domain, such that the recognition results of the mixed instructions are all within the target domain. Define r as the length of the longest feature in set D, and R as the length of the smallest feature in set S in the decision space. It is required that R > r, so that the universal adversarial command generated by S can still remain within the target domain when overlapping with the commands in D. The empirical assumption is that r is controllable, so only R needs to be controlled to be large enough. However, if R is too large, it is difficult to converge. Therefore, in the experiment, R can be regarded as a variable parameter. Generating δ is achieved by reducing the loss, where τ t ∈Γ t , τ is the independent variable for optimization, L is CTC-Loss, and CTC-Loss is the loss function for training sequence-to-sequence neural networks. Given an input audio and its target phrase t, where is the frame domain, and d represents the frame length of the audio. Define y = (y1,..., y d ), y i ∈Y is the alignment of t to f(x), that is, reduce(y) = t.

[0064] Define CTC-Loss as follows:

[0065]

[0066] Finally, a universal adversarial command δ is found. With it as the center, a sphere with radius R is contained within the target domain, such that the speech recognition results of the mixed instructions are all within the target domain. So there is the following objective:

[0067]

[0068] where, ε → 0.

[0069] The anisotropic feature set S can be found by satisfying the following two conditions:

[0070] 1) The audio data needs to contain semantic information.

[0071] 2) The semantics of two pairs of synthetic speech data should be as different as possible.

[0072] First, use speech synthesis technology to synthesize data containing different semantic information. Each data itself should contain as many different characters as possible. For example, s1 = abcd, s2 = efgh, s3 = ijkl, s4 = mnop. Now obtain the data set Then, perform cyclic substitution on each data, and define M = {m1, …, m i} as the circular substitution matrix set, where m i satisfies the following conditions:

[0073]

[0074]

[0075] Therefore, optimize the following objective:

[0076]

[0077] Among them, s ij = s i * m j . Finally, obtain UAC: δ = τ + τ t .

[0078] Next, it is necessary to use the IUAC generation module to make the general adversarial command δ inaudible.

[0079] The implementation process of the IUAC generation module:

[0080] As Figure 5 shown, after obtaining UAC δ, modulate UAC δ into IUAC through high-frequency carrier modulation. When IUAC is received by the microphone of the intelligent voice system, it will become the command δ′≈δ, that is, it can be restored to UAC after passing through the microphone and input into the speech recognition model.

[0081]

[0082] Among them, f c is the carrier frequency, T is the time, and the present invention selects f c = 230,000 Hz, n1 = n2 = 1.

[0083] As Figure 3 shown, it is the architecture diagram of the microphone; the receiving microphone of the intelligent voice system has four components. First, the transducer converts the sound signal into an electrical signal, then the amplifier amplifies it, and then the low-pass filter filters the high-frequency sound signal; finally, the signal is resampled by the analog-to-digital converter (ADC). The amplifier should be constructed to be linear, but in the real world, it has non-linear phenomena. Assume that the input speech signal is S in , and the output speech signal is S out , then the relationship between S in and S out is expressed as:

[0084]

[0085] Using the non-linear characteristics of the microphone of the receiving device, the general adversarial command UAC can be modulated by a high-frequency carrier wave into an inaudible command. Among them, G i refers to the non-linear coefficient of the microphone.

[0086] Such as Figure 6 As shown, it is a comparison of attack effects; the word error rate in the figure represents CER, and the edit distance between two strings is the minimum number of processing times required to convert one string into another (by insertion, deletion, and replacement). Given two strings str1 and str2, the character error rate CER(str1, str2) is defined by the normalized edit distance between the strings str1 and str2, that is:

[0087]

[0088] Among them, length(str2) represents the length of the string str2.

[0089] The signal-to-noise ratio NSR is defined as follows: Given an audio signal signal1 and a noise signal signal2, the relative magnitude of the signal-to-noise ratio is quantified by NSR(signal1, signal2), and is defined as:

[0090]

[0091] p refers to the norm, and p = 2 is taken.

[0092] The abscissa of the left figure represents the overlap degree between the user command and the attack command, and the ordinate is the word error rate. The word error rate of the UAC attack is evenly concentrated at the bottom. The word error rate of the DolphinAttack directly attacking with the original command is positively correlated with the overlap degree. The attack effect of UAC is significantly better than that of the original command attack. The abscissa of the right figure is the average signal-to-noise ratio, and the ordinate is the average word error rate. It can be seen that as the attack signal increases, the attack effect of UAC is better than that of the original command.

[0093] Such as Figure 7 As shown, it is the result of comparing the effects of different attack commands; three UACs (UAC1, UAC2, UAC3) are constructed respectively according to three different target phrases. It can be seen that at the same signal-to-noise ratio, the attack success rate and average word error rate of the UAC of the present invention are better than the baselines (original command one C, original command two C2, original command three C3). And it can be seen that our method is general for different commands and is applicable to constructing any command.

[0094] Figure 8It is a comparison chart of convergence effects; the abscissa is the number of training rounds, and the ordinate is the training loss. Among them, comparison method 1 is the method proposed by Li et al. in CCS’20, which uses disguised natural sounds for adversarial attacks. Comparison method 2 represents the method of general adversarial perturbations, and comparison method 3 represents the method of general adversarial perturbations without constraints. It can be seen that the convergence speed of the method of the present invention is better than that of the existing methods and has a smaller loss, and can greatly improve the attack accuracy.

[0095] The above embodiments are provided only for the purpose of describing the present invention, and are not intended to limit the scope of the present invention. The scope of the present invention is defined by the appended claims. All equivalent substitutions and modifications made without departing from the spirit and principles of the present invention shall be covered within the scope of the present invention.

Claims

1. A universal adversarial command attack method based on inaudibility, characterized in that: The implementation is as follows: It consists of two stages; The first stage is the generation of universal adversarial commands, or UACs, using a data-free approach to construct universal adversarial commands. These commands are robust, feature-rich commands that can prevent interference from other commands, ensuring that the speech recognition model only executes the attacking commands. The second stage is the inaudible universal adversarial command (IUAC) generation process, which modulates the universal adversarial command obtained in the first stage into an inaudible universal adversarial command (IUAC), i.e., an inaudible attack command. The UAC generation process in the first stage is implemented as follows: (11) Constructing training sets using data-free methods; The specific implementation is as follows: Use speech synthesis technology to synthesize data containing semantic information, use the cyclic replacement method to process the data containing semantic information, and generate a training set that meets anisotropic features; (12) Finding an initial universal adversarial command from the target domain to accelerate convergence; (13) Based on a given neural network model, training set, and initial universal adversarial command, a loss function is used to find the UAC. The loss function is designed as follows: Among them, L refers to CTC-Loss, is a neural network model, is the target phrase, is an initial point in the target domain, is a hyperparameter, is the independent variable, is the training set, i and j are subscripts representing different training data, N is the audio length corresponding to the target phrase, and n is the number of speech synthesis data; Finally, by optimizing the loss function until convergence, the final universal adversarial command UAC is obtained; The CTC-Loss function is as follows: in, Represents a given neural network model, t is the target phrase, y is an output result of the neural network model, and Pr() refers to the probability of obtaining this output result y; It is a function that post-processes the output of the speech recognition model to correct the output. It satisfies the following two rules: (1) If two identical characters are connected together, only one needs to be retained; (2) If there is a special symbol "-" between two identical characters, the two identical characters cannot be merged. In the step (11), the processing method adopts constructing a replacement matrix set for processing; Perform cyclic replacement on each data and define M = { ,… } is the replacement matrix set, the replacement matrix The following conditions are met: 。 2. The inaudible universal countermeasure command attack method according to claim 1, characterized in that: In step (12), in order to speed up the convergence of training UAC, an initial point in the target domain is used. Accelerate the search for UAC, satisfying: , For the decoding process.

3. A universal countermeasure command attack system based on inaudible attack, characterized by: Includes a universal adversarial command UAC generation module and an inaudible universal adversarial command IUAC generation module; A universal adversarial command (UAC) generation module uses a data-free method to construct universal adversarial commands. These commands are robust feature commands that can prevent interference from other commands, so that the speech recognition model only executes the attacking commands. An inaudible universal adversarial command (IUAC) generation module modulates the obtained universal adversarial command into an inaudible universal adversarial command (IUAC), i.e., an inaudible attack command. The general adversarial command UAC generation module is implemented as follows: (11) Constructing training sets using data-free methods; The specific implementation is as follows: Use speech synthesis technology to synthesize data containing semantic information, use the cyclic replacement method to process the data containing semantic information, and generate a training set that meets anisotropic features; (12) Finding an initial universal adversarial command from the target domain to accelerate convergence; (13) Based on a given neural network model, training set, and initial universal adversarial command, a loss function is used to find the UAC. The loss function is designed as follows: Among them, L refers to CTC-Loss, is a neural network model, is the target phrase, is an initial point in the target domain, is a hyperparameter, is the independent variable, is the training set, i and j are subscripts representing different training data, N is the audio length corresponding to the target phrase, and n is the number of speech synthesis data; Finally, by optimizing the loss function until convergence, the final universal adversarial command is obtained; The CTC-Loss function is as follows: in, Represents a given neural network model, t is the target phrase, y is an output result of the neural network model, and Pr() refers to the probability of obtaining this output result y; It is a function that post-processes the output of the speech recognition model to correct the output. It satisfies the following two rules: (1) If two identical characters are connected together, only one needs to be retained; (2) If there is a special symbol "-" between two identical characters, the two identical characters cannot be merged. In the step (11), the processing method adopts constructing a replacement matrix set for processing; Perform cyclic replacement on each data and define M = { ,… } is the replacement matrix set, the replacement matrix The following conditions are met: 。

Images