Adversarial sample generation method and related device for black box intelligent speech recognition system

Abstract

The present invention belongs to the field of deep learning and discloses a method for generating adversarial samples for a black-box intelligent speech recognition system and a related device. The method comprises: obtaining a speech adversarial sample based on speech adversarial perturbation; performing MFCC feature extraction on both a target command audio file and the speech adversarial sample to obtain a target speech feature matrix and an adversarial speech feature matrix; calculating the L2 distance between the target speech feature matrix and the adversarial speech feature matrix as the acoustic feature loss function value; calculating the L2 norm of the speech adversarial perturbation as the perturbation loss function value; constructing an adversarial perturbation optimization loss function based on the acoustic feature loss function value and the perturbation loss function value; updating the speech adversarial perturbation with the goal of simultaneously minimizing the acoustic feature loss function value and the perturbation loss function value; and obtaining the final speech adversarial sample by iterating the above steps. No prior knowledge of the target speech recognition system is required, and the attack success rate is high and the transferability is strong.

Description

Technical Field

[0001] The present invention belongs to the field of deep learning and relates to a method for generating adversarial samples for a black-box intelligent speech recognition system and related devices. Background Art

[0002] The goal of a speech recognition system is to convert speech signals input into a machine system into a corresponding character sequence, essentially extracting textual information from speech. Traditionally, users primarily interacted with devices such as computers, smartphones, and home appliances through mouse, keyboard, touchscreen, and remote control. These methods of providing commands to machines and devices are inefficient and can require a certain learning curve for users. The emergence of speech recognition technology has made human-computer interaction more natural, user-friendly, and user-friendly, garnering widespread research and attention. In recent years, the continued maturity of speech recognition systems has been attributed to the rapid development of machine learning, particularly deep learning. However, the vulnerability of machine learning models to adversarial examples, resulting in erroneous output, has also attracted increasing attention. Initially, research on adversarial attacks focused on image recognition systems; more recently, research on adversarial attacks against speech recognition systems has emerged. Attackers use a method to generate an audio sample that results in different recognition results between human auditory perception and automatic speech recognition systems. While the audio anomaly may be unnoticeable to ordinary users, it may be interpreted by automatic speech recognition systems as malicious commands, potentially posing a threat to user security in all aspects.

[0003] Adversarial attacks can be broadly categorized as white-box, gray-box, and black-box attacks, depending on the attacker's level of knowledge of the target system. In white-box scenarios, attackers have access to nearly complete information about the machine learning model, allowing them to design attack methods around the visible machine learning model. In gray-box scenarios, attackers have much less information than in white-box scenarios, typically only obtaining information such as the model's output probability distribution. In black-box scenarios, attackers have even less information, often only obtaining the final output corresponding to the input. Under such challenging conditions, black-box attacks are particularly difficult. Some research has explored the portability of adversarial examples between white-box and black-box systems, specifically whether adversarial examples generated on a white-box system can attack a specific black-box system. Clearly, the more detailed information an attacker possesses about a speech recognition system, the easier it is to attack it. Recently, a number of research works have proposed attack methods with extremely high success rates under white-box scenarios. However, mainstream commercial speech recognition systems on the market are often black-box systems, making it difficult for attackers to obtain sufficient information about the model and parameters. To uncover the security risks of these commercial speech recognition systems, further research is needed to explore black-box attacks against them.

[0004] Currently, almost all adversarial attacks target the underlying machine learning models of the systems. However, different speech recognition systems may utilize different machine learning models, making it difficult for adversarial audio generated by one system to successfully attack another. Existing white-box methods for speech adversarial attacks do not align with realistic threat models, while black-box attacks have low success rates or poor transferability. Summary of the Invention

[0005] The purpose of the present invention is to overcome the shortcomings of the above-mentioned prior art, that is, the white-box method in the existing speech adversarial attack does not conform to the actual threat model, and the black-box attack success rate is low or the attack transferability is poor, and to provide a black-box intelligent speech recognition system adversarial sample generation method and related devices.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] In a first aspect, the present invention provides a method for generating adversarial samples for a black-box intelligent speech recognition system, comprising:

[0008] S1: Obtain target command audio files that can be correctly recognized by the black box intelligent speech recognition system, as well as speech adversarial perturbations;

[0009] S2: Obtain speech adversarial samples based on speech adversarial perturbations;

[0010] S3: Perform MFCC feature extraction on both the target command audio file and the speech adversarial sample to obtain the target speech feature matrix and the adversarial speech feature matrix. Calculate the L2 distance between the target speech feature matrix and the adversarial speech feature matrix as the acoustic feature loss function value, and calculate the L2 norm of the speech adversarial perturbation as the perturbation loss function value.

[0011] S4: Construct an adversarial perturbation optimization loss function based on the acoustic feature loss function value and the perturbation loss function value, and update the speech adversarial perturbation with the goal of simultaneously minimizing the acoustic feature loss function value and the perturbation loss function value;

[0012] S5: Iterate S2 to S4 until the number of iterations reaches a preset value or the decrease value of the adversarial perturbation optimization loss function during the consecutive preset number of iterations is within a preset range, and obtain the final speech adversarial sample.

[0013] Optionally, the speech adversarial perturbation is initially a random noise vector that obeys a uniform distribution within (-1, 1).

[0014] Optionally, obtaining a speech adversarial sample according to the speech adversarial disturbance includes:

[0015] According to the speech adversarial perturbation, a hidden instruction attack is performed according to formula (1) or (2) to obtain the speech adversarial sample x′:

[0016] x′=y+α·δ0 (1)

[0017] x′=δ0 (2)

[0018] Where y is the target instruction audio file, α is the first perturbation parameter, and δ0 is the speech adversarial perturbation;

[0019] Alternatively, obtain the original carrier file and perform integrated instruction attack according to formula (3) to obtain the speech adversarial sample x′:

[0020] x′=x+β·δ0 (3)

[0021] Where x is the original carrier file and β is the second perturbation parameter.

[0022] Optionally, when the speech adversarial sample is obtained by a hidden instruction attack, the adversarial perturbation optimization loss function loss is loss=loss f -λ·loss p , where loss f is the acoustic feature loss function value, loss p is the perturbation loss function value, λ is the preset linear penalty term hyperparameter; when the speech adversarial sample is obtained by integrated instruction attack, the adversarial perturbation optimization loss function loss is loss=loss f + ·oss p .

[0023] Optionally, the preset adjustment coefficient is obtained by:

[0024] The first speech adversarial sample is used to conduct a preliminary attack on the black-box intelligent speech recognition system. During the preliminary attack, a binary search algorithm is used to automatically configure the preset linear penalty hyperparameters.

[0025] Optionally, when updating the speech adversarial perturbation with the goal of simultaneously minimizing the acoustic feature loss function value and the perturbation loss function value, an optimization algorithm based on gradient descent is used to iteratively update the speech adversarial perturbation.

[0026] Optionally, the gradient descent-based optimization algorithm is a gradient descent-based adaptive moment estimation optimizer.

[0027] A second aspect of the present invention provides an adversarial sample generation system for a black-box intelligent speech recognition system, comprising:

[0028] The data acquisition module is used to obtain target command audio files that can be correctly recognized by the black box intelligent speech recognition system, as well as speech adversarial perturbations;

[0029] The adversarial module is used to generate adversarial speech samples based on speech adversarial perturbations.

[0030] A data processing module is used to perform MFCC feature extraction on both the target command audio file and the speech adversarial sample to obtain the target speech feature matrix and the adversarial speech feature matrix, and calculate the L2 distance between the target speech feature matrix and the adversarial speech feature matrix as the acoustic feature loss function value, and calculate the L2 norm of the speech adversarial perturbation as the perturbation loss function value;

[0031] An optimization module is used to construct an adversarial perturbation optimization loss function based on the acoustic feature loss function value and the perturbation loss function value, and to update the speech adversarial perturbation with the goal of simultaneously minimizing the acoustic feature loss function value and the perturbation loss function value;

[0032] The iterative control module is used to iteratively trigger the adversarial module, data processing module and optimization module until the number of iterations reaches a preset value or the decrease value of the adversarial perturbation optimization loss function during the consecutive preset number of iterations is within a preset range, thereby obtaining the final speech adversarial sample.

[0033] In a third aspect of the present invention, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the above-mentioned method for generating adversarial samples for a black-box intelligent speech recognition system are implemented.

[0034] In a fourth aspect, the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the above-mentioned method for generating adversarial samples for a black-box intelligent speech recognition system.

[0035] Compared with the prior art, the present invention has the following beneficial effects:

[0036] The present invention's adversarial sample generation method for a black-box intelligent speech recognition system meets strict black-box requirements and requires no prior knowledge of the target speech recognition system, making it more realistic for attack scenarios. It uses the MFCC feature extraction method commonly used in speech recognition systems to achieve a misleading attack on the entire system, with a high attack success rate and strong attack transferability. A novel acoustic feature loss function and perturbation loss function are designed, and an adversarial perturbation optimization loss function is constructed based on the acoustic feature loss function and perturbation loss function values. The speech adversarial perturbation is updated with the goal of simultaneously minimizing the acoustic feature loss function and perturbation loss function values. The entire process is extremely lightweight, typically requiring only 30 seconds to converge to a successful speech adversarial sample output.

[0037] Furthermore, the attack framework integrates two forms: hidden command attacks for noise segments and integrated command attacks for music segments, supporting speech recognition systems in any language, not just Chinese and English.

[0038] Furthermore, a linear penalty term that can be automatically configured based on a binary search algorithm is used to balance the effectiveness and concealment of voice adversarial attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 This is a flow chart of the adversarial sample generation method for the black-box intelligent speech recognition system according to an embodiment of the present invention.

[0040] Figure 2 This is a schematic diagram of the principle of the adversarial sample generation method for the black-box intelligent speech recognition system according to an embodiment of the present invention.

[0041] Figure 3 This is a structural block diagram of the adversarial sample generation system of the black-box intelligent speech recognition system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0043] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0044] The present invention is described in further detail below with reference to the accompanying drawings:

[0045] See also Figure 1 and 2 In one embodiment of the present invention, a method for generating adversarial samples for a black-box intelligent speech recognition system is provided, comprising the following steps:

[0046] S1: Obtain target command audio files that can be correctly recognized by the black-box intelligent speech recognition system, as well as speech adversarial perturbations.

[0047] S2: Obtain speech adversarial samples based on speech adversarial perturbations.

[0048] S3: Perform MFCC feature extraction on both the target command audio file and the speech adversarial sample to obtain the target speech feature matrix and the adversarial speech feature matrix, and calculate the L2 distance between the target speech feature matrix and the adversarial speech feature matrix as the acoustic feature loss function value, and calculate the L2 norm of the speech adversarial perturbation as the perturbation loss function value.

[0049] S4: Construct an adversarial perturbation optimization loss function based on the acoustic feature loss function value and the perturbation loss function value, and update the speech adversarial perturbation with the goal of simultaneously minimizing the acoustic feature loss function value and the perturbation loss function value.

[0050] S5: Iterate S2 to S4 until the number of iterations reaches a preset value or the decrease value of the adversarial perturbation optimization loss function during the consecutive preset number of iterations is within a preset range, and obtain the final speech adversarial sample.

[0051] Specifically, in S1, a target command text set is first acquired. Then, using speech synthesis services provided by cloud computing vendors such as Google, the appropriate language, gender, voice, speaking speed, and intonation are selected to batch convert the text information into WAV lossless audio files. The synthesized audio files are then pre-tested on a black-box intelligent speech recognition system to ensure correct speech recognition results, i.e., target command audio files that can be correctly recognized by the black-box intelligent speech recognition system. Otherwise, the parameters of the speech synthesis service are readjusted until the conditions are met. The speech synthesis services provided by cloud computing vendors are high-performance, high-quality tools that can synthesize text information into human speech. They offer a wide range of configurations, such as language, voice, speaking speed, and intonation. Different configurations can produce speech output with different auditory effects. Pre-testing on the black-box intelligent speech recognition system can screen out the synthesized speech with higher quality.

[0052] In one possible implementation, the speech adversarial perturbation is initially a random noise vector that follows a uniform distribution within (-1, 1). Specifically, since audio files are stored in a computer as encoded data normalized to the interval (-1, 1), a random noise vector that follows a random uniform distribution within the interval U to (-1, 1) is generated as the initial speech adversarial perturbation δ0.

[0053] In a possible implementation, obtaining a speech adversarial sample based on speech adversarial disturbance includes: performing a hidden instruction attack according to formula (1) or (2) based on the speech adversarial disturbance to obtain a speech adversarial sample x′:

[0054] x′=y+α·δ0 (1)

[0055] x′=δ0 (2)

[0056] Where y is the target instruction audio file, α is the first perturbation parameter, and δ0 is the speech adversarial perturbation.

[0057] Alternatively, obtain the original carrier file and perform integrated instruction attack according to formula (3) to obtain the speech adversarial sample x′:

[0058] x′=x+β·δ0 (3)

[0059] Where x is the original carrier file and β is the second perturbation parameter.

[0060] Specifically, the original carrier file refers to an audio file arbitrarily specified by the attacker and having the same length as the target command audio file, such as a WAV file of a pop music clip.

[0061] Specifically, for hidden command attacks, the speech adversarial perturbation δ0 can be directly used as the speech adversarial sample x′, i.e., x′=δ. The corresponding speech adversarial sample is then obtained by optimizing the speech adversarial perturbation. Optionally, to improve the convergence efficiency of the optimization algorithm, the target command audio file is embedded in the adversarial perturbation initialization phase so that the initial adversarial perturbation contains the necessary acoustic features, i.e., x′0=y+α·δ0, where α is typically 0.5. This ensures that the adversarial sample has a large time domain waveform distance from the target command at the initial stage.

[0062] For integrated instruction attacks, the speech adversarial sample is the original carrier file superimposed with speech adversarial perturbation, that is, x′=x+β·δ0. Then, the corresponding speech adversarial sample is iteratively synthesized by optimizing the speech adversarial perturbation. Optionally, in order to achieve the goal of attack concealment, adversarial perturbation with extremely small amplitude should be superimposed in the initial stage. Therefore, the typical value of β is usually on the order of 0.0001.

[0063] In one possible implementation, S3 specifically includes: inputting the artificially synthesized target instruction audio file y into the MFCC feature extraction device, and obtaining its output MFCC (y) as the target speech feature matrix; inputting the current speech adversarial sample x′ as a hidden instruction attack or an integrated instruction attack into the MFCC feature extraction device, and obtaining its output MFCC (x′) as the adversarial speech feature matrix of the current iteration.

[0064] Then, the L2 norm distance between the feature matrix of the speech adversarial sample and the target optimized feature matrix is ​​calculated as the acoustic feature loss function value, i.e., loss f =||MFCC(x′)-MFCC(y)||; calculate the L2 norm of the adversarial perturbation vector of the current iteration as the adversarial perturbation loss function value, i.e. loss p =||δ0||.

[0065] Mel-frequency cepstral coefficients (MFCCs) are primarily used for voice data feature extraction and dimensionality reduction. MFCC extraction typically involves several steps: pre-emphasis, framing, windowing, fast Fourier transform (FFT), Mel filter bank, and discrete cosine transform (DCT).

[0066] In one possible implementation, when the speech adversarial sample is obtained by a hidden instruction attack, the adversarial perturbation optimization loss function is loss = loss f -λ·loss p , where loss f is the acoustic feature loss function value, loss pis the perturbation loss function value, λ is the preset linear penalty term hyperparameter; when the speech adversarial sample is obtained by integrated instruction attack, the adversarial perturbation optimization loss function loss is loss = loss f +λ·loss p .

[0067] Optionally, the preset adjustment coefficient is obtained by: performing a preliminary attack on the black box intelligent speech recognition system using the speech adversarial sample obtained for the first time, and using a binary search algorithm to automatically configure the preset linear penalty term hyperparameters during the preliminary attack.

[0068] Specifically, for each iterative optimization solution for speech adversarial examples, the linear penalty hyperparameter λ is fixed. Preliminary attack experiments are conducted on a black-box intelligent speech recognition system. By setting different λ values, the attack success rate and attack stealth of the generated speech adversarial examples are observed. If the attack success rate is unsatisfactory, λ is reduced; if the attack stealth is unsatisfactory, λ is increased. A binary search algorithm continuously narrows the range of suitable λ values ​​until a suitable value is found. For the same black-box intelligent speech recognition system, optimizing batches of speech adversarial examples with a fixed λ value consistently yields ideal output.

[0069] Specifically, we set λ to 10 and 100, representing the initial minimum and maximum values, respectively. These values ​​are then substituted into the adversarial perturbation optimization loss function. A complete iterative process is performed, outputting a speech adversarial sample. This sample is then fed into the black-box intelligent speech recognition system to obtain a transcribed output. The signal-to-noise ratio (SNR) of the speech adversarial sample is also calculated. If the recognition result is not the target instruction, the λ value is reduced. If the SNR is poor, the λ value is increased, and the complete loss function calculation, optimization, and speech feature sample synthesis process are repeated until an appropriate λ value is found.

[0070] In one possible implementation, when updating the speech adversarial perturbation with the goal of simultaneously minimizing the acoustic feature loss function value and the perturbation loss function value, an optimization algorithm based on gradient descent is used to iteratively update the speech adversarial perturbation. In this implementation, the optimization algorithm based on gradient descent is an adaptive moment estimation optimization method based on gradient descent.

[0071] Specifically, iterate S2 to S4 until the number of iterations reaches a preset value or the value of the adversarial perturbation optimization loss function decreases within a preset range over a consecutive preset number of iterations, thereby obtaining a final speech adversarial sample. If the value of the adversarial perturbation optimization loss function decreases within a preset range over a consecutive preset number of iterations, it indicates that the adversarial perturbation optimization loss function no longer has a significant downward trend over multiple consecutive iterations. At this point, the iterative optimization is considered complete, and the speech adversarial sample at this point is used as the final speech adversarial sample.

[0072] In summary, the method for generating adversarial samples for a black-box intelligent speech recognition system of the present invention does not require any prior knowledge about the target speech recognition system, and implements a strict black-box attack threat model. A misleading attack on the entire system is achieved through the extraction of MFCC features that are common to a speech recognition system. The basic idea is that two completely different speech segments may have similar speech feature matrices, and audio signals with similar speech feature matrices are found as speech adversarial samples based on optimization modeling. At the same time, the attack framework integrates two forms: hidden command attacks for noise segments and integrated command attacks for music segments, supporting speech recognition systems of any language, not just Chinese and English. A novel acoustic feature loss function and perturbation loss function are designed, and a linear penalty term that can be automatically configured based on a binary search algorithm is used to balance the effectiveness and concealment of speech adversarial attacks. The advanced Adam optimization algorithm is used to iteratively optimize the adversarial perturbation and the corresponding synthesized speech adversarial perturbation. The entire process is extremely lightweight, and it usually takes only 30 seconds to converge to a successful speech adversarial sample output.

[0073] After experimental verification, the adversarial sample generation method of the black-box intelligent speech recognition system can attack open source speech recognition systems including DeepSpeech and Kaldi, as well as cloud speech recognition services such as Google, Microsoft, Amazon, Alibaba and Tencent in the digital domain with a high success rate of 100%. It can also be further applied to various voice assistants and smart home voice control devices in the real physical world, including Apple Siri, Google Assistant and Amazon Alexa.

[0074] The following are device embodiments of the present invention, which can be used to perform the method embodiments of the present invention. For details not disclosed in the device embodiments, please refer to the method embodiments of the present invention.

[0075] See also Figure 3 In another embodiment of the present invention, a black-box intelligent speech recognition system adversarial sample generation system is provided, which can be used to implement the above-mentioned black-box intelligent speech recognition system adversarial sample generation method. Specifically, the black-box intelligent speech recognition system adversarial sample generation system includes a data acquisition module, an adversarial module, a data processing module, an optimization module and an iterative control module.

[0076] Among them, the data acquisition module is used to obtain the target instruction audio file and speech adversarial disturbance that can be correctly recognized on the black box intelligent speech recognition system; the adversarial module is used to obtain the speech adversarial sample based on the speech adversarial disturbance; the data processing module is used to perform MFCC feature extraction on both the target instruction audio file and the speech adversarial sample to obtain the target speech feature matrix and the adversarial speech feature matrix, and calculate the L2 distance between the target speech feature matrix and the adversarial speech feature matrix as the acoustic feature loss function value, and calculate the L2 norm of the speech adversarial disturbance as the disturbance loss function value; the optimization module is used to construct the adversarial disturbance optimization loss function according to the acoustic feature loss function value and the disturbance loss function value, and update the speech adversarial disturbance with the goal of simultaneously minimizing the acoustic feature loss function value and the disturbance loss function value; the iterative control module is used to iteratively trigger the adversarial module, the data processing module and the optimization module, and obtain the final speech adversarial sample when the number of iterations reaches a preset value or the decrease value of the adversarial disturbance optimization loss function value during the continuous preset number of iterations is within a preset range.

[0077] In a possible implementation, the speech adversarial perturbation is initially a random noise vector that obeys a uniform distribution within (-1, 1).

[0078] In a possible implementation, obtaining a speech adversarial sample based on speech adversarial disturbance includes: performing a hidden instruction attack according to formula (1) or (2) based on the speech adversarial disturbance to obtain a speech adversarial sample x′:

[0079] x′=y+α·δ0 (1)

[0080] x′=δ0 (2)

[0081] Where y is the target instruction audio file, α is the first perturbation parameter, and δ0 is the speech adversarial perturbation.

[0082] Alternatively, obtain the original carrier file and integrate the command attack according to formula (3) to obtain the speech adversarial sample x′:

[0083] x′=x+β·δ0 (3)

[0084] Where x is the original carrier file and β is the second perturbation parameter.

[0085] In a possible implementation, when the speech adversarial sample is obtained by a hidden instruction attack, the adversarial perturbation optimization loss function loss is loss=loss f -λ·loss p , where loss f is the acoustic feature loss function value, loss pis the perturbation loss function value, λ is the preset linear penalty term hyperparameter; when the speech adversarial sample is obtained by integrated instruction attack, the adversarial perturbation optimization loss function loss is loss=loss f +λ·loss p .

[0086] In one possible implementation, the preset adjustment coefficient is obtained by performing a preliminary attack on the black-box intelligent speech recognition system using the speech adversarial sample obtained for the first time, and using a binary search algorithm to automatically configure the preset linear penalty term hyperparameters during the preliminary attack.

[0087] In a possible implementation, when updating the speech adversarial perturbation with the goal of simultaneously minimizing the acoustic feature loss function value and the perturbation loss function value, a gradient descent-based optimization algorithm is used to iteratively update the speech adversarial perturbation.

[0088] In a possible implementation, the gradient descent-based optimization algorithm is a gradient descent-based adaptive moment estimation optimizer.

[0089] All relevant contents of each step involved in the embodiment of the aforementioned black-box intelligent speech recognition system adversarial sample generation method can be referred to the functional description of the functional module corresponding to the black-box intelligent speech recognition system adversarial sample generation system in the embodiment of the present invention, and will not be repeated here.

[0090] The module division in the embodiments of the present invention is illustrative and represents only one logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional modules in various embodiments of the present invention may be integrated into a single processor, exist physically as separate modules, or two or more modules may be integrated into a single module. The integrated modules may be implemented in either hardware or software functional modules.

[0091] In another embodiment of the present invention, a computer device is provided, comprising a processor and a memory, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is used to execute the program instructions stored in the computer storage medium. The processor may be a central processing unit (CPU), or may be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions in the computer storage medium to implement the corresponding method flow or corresponding function; the processor described in the embodiment of the present invention can be used for the operation of the adversarial sample generation method of the black box intelligent speech recognition system.

[0092] In another embodiment of the present invention, the present invention further provides a storage medium, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device for storing programs and data. It is understandable that the computer-readable storage medium here can include both built-in storage media in the computer device and, of course, extended storage media supported by the computer device. The computer-readable storage medium provides a storage space that stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by the processor are also stored in the storage space. These instructions can be one or more computer programs (including program codes). It should be noted that the computer-readable storage medium here can be a high-speed RAM memory or a non-volatile memory, such as at least one disk storage. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the adversarial sample generation method for the black-box intelligent speech recognition system in the above embodiment.

[0093] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0094] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0095] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0096] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0097] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered by the scope of protection of the claims of the present invention.

Claims

1. A method for generating adversarial samples for a black-box intelligent speech recognition system, characterized in that: include: S1: Obtain target command audio files that can be correctly recognized by the black box intelligent speech recognition system, as well as speech adversarial perturbations; S2: Obtain speech adversarial samples based on speech adversarial perturbations; S3: Perform MFCC feature extraction on both the target command audio file and the speech adversarial sample to obtain the target speech feature matrix and the adversarial speech feature matrix. Calculate the L2 distance between the target speech feature matrix and the adversarial speech feature matrix as the acoustic feature loss function value, and calculate the L2 norm of the speech adversarial perturbation as the perturbation loss function value. S4: Construct an adversarial perturbation optimization loss function based on the acoustic feature loss function value and the perturbation loss function value, and update the speech adversarial perturbation with the goal of simultaneously minimizing the acoustic feature loss function value and the perturbation loss function value; S5: Iterate S2 to S4 until the number of iterations reaches a preset value or the decrease value of the adversarial perturbation optimization loss function during the consecutive preset number of iterations is within a preset range, and obtain the final speech adversarial sample.

2. The method for generating adversarial samples for a black-box intelligent speech recognition system according to claim 1, characterized in that: The speech adversarial perturbation is initially a random noise vector that obeys a uniform distribution within (-1, 1).

3. The method for generating adversarial samples for a black-box intelligent speech recognition system according to claim 1, characterized in that: The step of obtaining a speech adversarial sample according to the speech adversarial disturbance comprises: According to the speech adversarial perturbation, a hidden instruction attack is performed according to formula (1) or (2) to obtain the speech adversarial sample x′: x′=y+α·δ0 (1) x′=δ0 (2) Where y is the target instruction audio file, α is the first perturbation parameter, and δ0 is the speech adversarial perturbation; Alternatively, obtain the original carrier file and perform integrated instruction attack according to formula (3) to obtain the speech adversarial sample x′: x′=x+β·δ0 (3) Where x is the original carrier file and β is the second perturbation parameter.

4. The method for generating adversarial samples for a black-box intelligent speech recognition system according to claim 3, characterized in that: When the speech adversarial sample is obtained by hidden instruction attack, the adversarial perturbation optimization loss function loss is loss=loss f -λ·loss p , where loss f is the acoustic feature loss function value, loss p is the perturbation loss function value, λ is the preset linear penalty term hyperparameter; when the speech adversarial sample is obtained by integrated instruction attack, the adversarial perturbation optimization loss function loss is loss=loss f +λ·loss p .

5. The method for generating adversarial samples for a black-box intelligent speech recognition system according to claim 4, characterized in that: The preset linear penalty term hyperparameters are obtained as follows: The first speech adversarial sample is used to conduct a preliminary attack on the black-box intelligent speech recognition system. During the preliminary attack, a binary search algorithm is used to automatically configure the preset linear penalty hyperparameters.

6. The method for generating adversarial samples for a black-box intelligent speech recognition system according to claim 4, characterized in that: When updating the speech adversarial perturbation with the goal of simultaneously minimizing the acoustic feature loss function value and the perturbation loss function value, an optimization algorithm based on gradient descent is used to iteratively update the speech adversarial perturbation.

7. The method for generating adversarial samples for a black-box intelligent speech recognition system according to claim 6, characterized in that: The gradient descent-based optimization algorithm is a gradient descent-based adaptive moment estimation optimizer.

8. A black box intelligent speech recognition system adversarial sample generation system, characterized by: include: The data acquisition module is used to obtain target command audio files that can be correctly recognized by the black box intelligent speech recognition system, as well as speech adversarial perturbations; The adversarial module is used to generate adversarial speech samples based on speech adversarial perturbations. A data processing module is used to perform MFCC feature extraction on both the target command audio file and the speech adversarial sample to obtain the target speech feature matrix and the adversarial speech feature matrix, and calculate the L2 distance between the target speech feature matrix and the adversarial speech feature matrix as the acoustic feature loss function value, and calculate the L2 norm of the speech adversarial perturbation as the perturbation loss function value; An optimization module is used to construct an adversarial perturbation optimization loss function based on the acoustic feature loss function value and the perturbation loss function value, and to update the speech adversarial perturbation with the goal of simultaneously minimizing the acoustic feature loss function value and the perturbation loss function value; The iterative control module is used to iteratively trigger the adversarial module, data processing module and optimization module until the number of iterations reaches a preset value or the decrease value of the adversarial perturbation optimization loss function during the consecutive preset number of iterations is within a preset range, thereby obtaining the final speech adversarial sample.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method for generating adversarial samples for a black-box intelligent speech recognition system as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method for generating adversarial samples for a black-box intelligent speech recognition system as described in any one of claims 1 to 7 are implemented.

Images