Speech adversarial sample concealment generation method based on natural environment

Abstract

The application discloses a voice adversarial sample concealment generation method based on a natural environment, which comprises the following steps: obtaining a natural environment noise data set, input audio data, and generating an adversarial disturbance; generating an adversarial sample and misleading a voice recognition model to generate a corresponding adversarial sample transcription while setting a target adversarial transcription content; calculating a CTC-loss loss function of the adversarial sample and the target adversarial transcription; calculating a norm of the adversarial disturbance and the environmental noise; adding different weight parameters to the CTC-loss loss function and the norm of the adversarial disturbance and the environmental noise to form an adversarial sample generation loss function; and using a PGD gradient descent method to iteratively update the adversarial disturbance to obtain an optimal adversarial disturbance, thereby obtaining a voice adversarial sample. The method improves the masking property and human ear imperceptibility of the voice adversarial sample and improves the universality of the applicable scene; and can be migrated to a commonly used voice recognition model to achieve efficient attack.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of speech recognition, and particularly relates to a speech adversarial sample concealment generation method based on a natural environment. BACKGROUND

[0002] Speech recognition (Speech Recognition) technology, also known as automatic speech recognition (Automatic Speech Recognition, ASR) or speech to text recognition (Speech To Text, STT), converts input speech audio signals into corresponding text, symbols or classifications, and recognizes the content of the speech. However, in recent years, with the rapid improvement of the accuracy of speech recognition, the hardware cost required for storing speech data has been decreasing year by year, so more and more intelligent products choose speech as the interface for human-computer interaction, from the daily use of mobile device terminals, human-computer interaction of household vehicles, to Google Cloud, Apple Siri IVC, iFLYTEK and other commercial equipment scenarios, speech recognition systems are widely used. However, speech adversarial samples also come with them, by inserting subtle disturbances that are not easily detected by human ears, making the speech recognition model produce incorrect output and unable to infer the original audio information. In terms of acoustic features, speech adversarial samples have a little more noise than original audio, which is not sensitive to human ears, but it will cause the ASR system to transcribe errors and inadvertently pose a potential threat to life and property.

[0003] Existing technologies such as the Qin algorithm use the principle of auditory masking, that is, there is a "masking threshold" near each frequency in the audio domain, to simulate the physical environment for targeted white-box attacks; the CW algorithm adjusts the MFCC parameters and introduces a change matrix simulating the propagation of disturbances in the physical environment to perform physical targeted white-box attacks; the Commandersong algorithm adds popular songs and combines the PDF-ID algorithm to introduce adversarial samples, and achieves the process of migrating from white-box attacks to black-box attacks.

[0004] However, existing speech adversarial sample generation schemes usually add random adversarial disturbances, and limit the amplitude range of the disturbance or use relatively conspicuous songs, psychoacoustic masking methods to conceal the adversarial samples, so they are not suitable for real application scenarios. With the wider application scenarios and stronger practicality of speech recognition, existing technologies are easy to be discovered by human ears in real-life application scenarios, and have poor concealment, so they cannot achieve the goal of successful attacks; and with the increase of speech recognition platforms, the low migration of adversarial algorithms also cannot achieve high success rate attacks on all platforms.

[0005] Therefore, generating a speech adversarial sample that can combine the characteristics of the speech sample, and create a strong masking, strong migration, and strong attack is a problem that is concerned and worth studying. SUMMARY

[0006] In order to solve the above problems existing in the prior art, the application provides a natural environment-based speech adversarial sample hidden generation method. The technical problem to be solved by the application is realized by the following technical scheme:

[0007] A natural environment-based speech adversarial sample hidden generation method, comprising:

[0008] Step 1, obtaining a natural environment noise data set, input audio data, and generating an adversarial disturbance;

[0009] Step 2, generating an adversarial sample based on the adversarial disturbance and the input audio data, and misleading a speech recognition model to generate a corresponding adversarial sample transcription, while setting a target adversarial transcription content;

[0010] Step 3, calculating the CTC-loss loss function of the adversarial sample transcription and the target adversarial transcription;

[0011] Step 4, calculating the norm of the adversarial disturbance and the environmental noise based on the natural environment noise data set and the adversarial disturbance;

[0012] Step 5, adding different weight parameters to the CTC-loss loss function and the norm of the adversarial disturbance and the environmental noise to constitute an adversarial sample generation loss function;

[0013] Step 6, based on the adversarial sample generation loss function, the PGD gradient descent method is used to iteratively update the adversarial disturbance until the maximum iteration number is reached, to obtain the optimal adversarial disturbance, thereby obtaining a speech adversarial sample.

[0014] In an embodiment of the application, after step 6, further comprising:

[0015] Step 7, verifying the attack effect of the generated speech adversarial sample; if the verification is passed, the generated speech adversarial sample is saved; otherwise, the adversarial disturbance state is saved, the maximum iteration number is updated, and step 6 is returned.

[0016] In an embodiment of the application, step 3 comprises:

[0017] Deepspeech is introduced as a target attack model, and the CTC-loss of the adversarial sample transcription and the target adversarial transcription is calculated according to the model, and the calculation formula is:

[0018] minimizel net(f(x'), t');

[0019] wherein, l net is a CTC-loss loss function, f(x') represents a speech recognition process on the adversarial sample x', and the result is an adversarial sample transcription, x' = x + δ, x is input audio data, δ is an adversarial perturbation, and t' is a target adversarial transcription.

[0020] In an embodiment of the present application, step 4 comprises:

[0021] The collected natural environment noise data set is saved as a WAV format audio with a sampling rate of 16000 Hz, single channel, and uncompressed waveform, denoted as n.

[0022] Introducing l, l2, l ∞ norm, calculating the ‖δ-n‖ norm, and selecting the best norm form;

[0023] wherein, δ is an adversarial perturbation.

[0024] In an embodiment of the present application, in step 5, the expression of the adversarial sample generation loss function is:

[0025] l = α1l net (f(x'), t') + α2‖δ-n‖;

[0026] wherein, α1, α2 are weight parameters, and n is a natural environment noise data set.

[0027] In an embodiment of the present application, the weight parameters α1, α2 can be adjusted according to different use scenarios; the use scenarios include scenario 1, scenario 2, and scenario 3; wherein,

[0028] Scenario 1 is the case without environmental background noise; scenario 2 is the case with moderate background noise; and scenario 3 is the case with large background noise.

[0029] In an embodiment of the present application, in step 6, the specific process of iteratively updating the adversarial perturbation by using the PGD gradient descent method is:

[0030]

[0031] δ = clip ∈ (δ);

[0032] wherein, δ is an adversarial perturbation, β is the number of iteration steps, sign is a sign function, denotes a gradient operator, l is an adversarial sample generation loss function, clip is to limit δ within the range of (-ε, ε), and ε is the maximum limit of the perturbation amplitude.

[0033] In one embodiment of the present application, step 7 comprises:

[0034] The generated speech adversarial sample is input into the speech recognition model to obtain the corresponding transcription text;

[0035] Based on the obtained transcription text, the word error rate, the attack success rate and the signal-to-noise ratio are calculated respectively, and the calculation results are compared with the preset values to verify the generated speech adversarial sample.

[0036] The beneficial effects of the present application are:

[0037] 1. The natural environment-based speech adversarial sample hidden generation method provided by the present application uses natural environment noise, approximates the adversarial disturbance to the natural environment noise, improves the masking property and human ear imperceptibility of the speech adversarial sample, and improves the universality of the applicable scene; and can be migrated to a commonly used speech recognition model to achieve efficient attack.

[0038] 2. The target transcription of the adversarial sample generated by the present application can be a complete sentence, the adversarial disturbance can be inserted into real-time streaming audio, and immediate attack can be achieved regardless of the style of the input audio sample, thereby reducing the consumption cost of the generated adversarial sample and improving the efficiency of the adversarial sample generation.

[0039] 3. The natural environment-based speech adversarial sample hidden generation method provided by the present application processes the collected natural environment noise in a format and organizes it into a data set, thereby increasing the diversity of the data set.

[0040] The present application will be further described in detail below in combination with the drawings and embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0041] Figure 1 is a natural environment-based speech adversarial sample hidden generation method provided by an embodiment of the present application;

[0042] Figure 2 is a speech recognition diagram provided by an embodiment of the present application;

[0043] Figure 3 is a natural environment-based adversarial sample attack diagram provided by an embodiment of the present application. DETAILED DESCRIPTION

[0044] The present application will be further described in detail below in combination with the drawings and embodiments.

[0045] Embodiment One

[0046] Please refer to Figure 1 , Figure 1It is a natural environment-based speech adversarial sample concealment generation method schematic diagram provided by the embodiment of the present application, which comprises:

[0047] Step 1, obtain a natural environment noise data set, input audio data, and generate an adversarial disturbance.

[0048] First, collect sounds such as wind, rain, bird songs and the like in a natural environment to obtain a natural environment noise data set, while collecting input audio data x.

[0049] Then, randomly generate an adversarial disturbance delta.

[0050] Step 2, generate an adversarial sample based on the adversarial disturbance and the input audio data, and mislead the speech recognition model to generate a corresponding adversarial sample transcription, while setting a target adversarial transcription content.

[0051] Specifically, please refer to Figure 2 , Figure 2 It is a speech recognition diagram schematic diagram provided by the embodiment of the present application. Normally, an input audio sample is obtained, which is usually a 16000Kz, single-channel and uncompressed audio file, as the input of the ASR recognition model. Through the recognition of the deep learning ASR model, the text information corresponding to the input audio is transcribed. The generation of the speech adversarial sample focuses on two aspects: on the one hand, whether the adversarial disturbance added to the input audio is well masked and not easy to be perceived by the human ear; on the other hand, whether the generated adversarial sample is robust, that is, whether it can successfully attack the general ASR recognition model with high success rate and high migration, and cannot be hindered by defense means and cannot restore the information of the original audio.

[0052] In this embodiment, the speech model recognition process can be represented as: f(x) = y, wherein x is the input audio data, and y is the corresponding transcription text.

[0053] Let x' be an adversarial sample, and x' = x + delta.

[0054] Then the target algorithm for generating an adversarial sample transcription is f(x') = f(x + delta) = y', wherein y' is an adversarial sample transcription, and y' ≠ y. At the same time, set the target adversarial transcription content t'.

[0055] Step 3, calculate the CTC-loss loss function of the adversarial sample transcription and the target adversarial transcription.

[0056] In this embodiment, Deepspeech is introduced as a target attack model, and the CTC-loss of the adversarial sample transcription and the target adversarial transcription is calculated according to the model.

[0057] Specifically, the embodiment introduces Deepspeech as a target attack model, understands the model internal weight parameters and the CTC-loss loss function, to constitute a part of the adversarial sample generation loss function, that is:

[0058] minimizel net (f(x′),t′);

[0059] Wherein, l net is the CTC-loss loss function, f(x') represents the speech recognition process of the adversarial sample x', and f(x') = y', y' is the transcription of the adversarial sample.

[0060] The embodiment minimizes the loss function of the model transcription result and the target adversarial transcription after introducing the adversarial disturbance.

[0061] Step 4, calculate the norm of the adversarial disturbance and the environmental noise based on the natural environment noise data set and the adversarial disturbance.

[0062] First, save the collected natural environment noise data set as a WAV format audio with a sampling rate of 16000Hz, a single channel, and an uncompressed waveform, denoted as n.

[0063] The natural environment-based speech adversarial sample concealment generation method provided by the application processes the collected natural environment noise in a format, and organizes it into a data set, adding diversity to the data set.

[0064] Then, in order to make the adversarial disturbance and the natural environment noise similar, the embodiment introduces l, l2, l ∞ norm, and selects the best norm form, limits it to a certain range, to adapt to different natural scenes, and takes this as the second part of the adversarial sample generation loss function.

[0065] Step 5, add different weight parameters to the CTC-loss loss function and the norm of the adversarial disturbance and the environmental noise to constitute the adversarial sample generation loss function.

[0066] In the embodiment, the expression of the adversarial sample generation loss function is:

[0067] l=α1l net (f(x′),t′)+α2‖δ-n‖;

[0068] Wherein, alpha1, alpha2 are weight parameters, and n depends on the natural environment noise data set.

[0069] In the embodiment, the weight parameters alpha1, alpha2 can be adjusted according to different use scenarios.

[0070] Specifically, regarding the present embodiment, three application scenarios are set to adjust the specific values of the weight parameters a1, a2, as follows:

[0071] Scenario 1: No environmental background noise

[0072] For the application scenario of quiet, no environmental background noise, the maximum value of the norm of the adversarial perturbation and the natural environmental noise is required, so that the adversarial perturbation and the natural environmental noise are infinitely approximated to achieve the goal of not being easily detected by the human ear. For example, a1 = 1 x 10 5 , a2 = 5 x 10 -2 .

[0073] Scenario 2: Moderate background noise exists

[0074] For the application scenario of moderate background noise, the weight of a2 can be reduced to reduce the approximation degree of the adversarial perturbation and the natural environmental noise, and it can also be well integrated with the background noise. For example, a1 = 1 x 10 5 , a2 = 1 x 10 -4 .

[0075] Scenario 3: There is a large background noise.

[0076] For the application scenario of large background noise, the norm value of the adversarial perturbation and the natural environmental noise can be replaced by the limitation of the range of δ amplitude, and it is not necessary to approximate it to the environmental noise to achieve the purpose of masking the adversarial perturbation. At this time, the scenario background noise is introduced into the CTC-loss function to improve the attack robustness of the adversarial sample.

[0077] Step 6, based on the adversarial sample generation loss function, the PGD gradient descent method is used to iteratively update the adversarial perturbation until the maximum iteration number is reached to obtain the optimal adversarial perturbation, thereby obtaining the speech adversarial sample.

[0078] Specifically, the specific process of iteratively updating the adversarial perturbation by the PGD gradient descent method is as follows:

[0079]

[0080] δ = clip ∈ (δ);

[0081] where β is the iteration step, sign is the sign function, denotes the gradient operator, clip is to limit δ within the range of (-ε, ε), and ε is the maximum limit of the perturbation amplitude.

[0082] After multiple iterations, the optimal adversarial perturbation can be obtained, thereby obtaining the speech adversarial sample.

[0083] Further, please continue to see Figure 1 After step 6, it also includes:

[0084] Step 7, verify the attack effect of the generated voice adversarial sample; if the verification is passed, save the generated voice adversarial sample; otherwise, save the adversarial disturbance state, update the maximum number of iterations, and return to step 6.

[0085] Please see Figure 3 , Figure 3 The attack graph based on natural environment generated adversarial sample is provided by the embodiment of the application.

[0086] First, the generated voice adversarial sample is input into the speech recognition model to obtain the corresponding transcription text. Specifically, a normal and clean input audio sample x is obtained, and noise disturbance δ similar to the natural environment is added to the sample to generate a voice adversarial sample x', which is input into the ASR recognition model for identification work, and finally misleads the ASR to output a target transcription such as: "Open the door." Or "chang the password to 111." And other malicious texts.

[0087] Then, based on the obtained transcription text, the word error rate, attack success rate and signal-to-noise ratio are calculated respectively, and the calculation results are compared with the preset values to verify the generated voice adversarial sample.

[0088] The above verification indicators will be introduced respectively.

[0089] I. Word error rate

[0090] The word error rate, also known as the word error rate (Word Error Rate, WER), is a widely used measure for calculating the performance of an ASR system. The Levenshtein distance algorithm calculates the minimum edit distance between two strings, which is used to calculate WER. WER is defined as the minimum edit distance between the ASR output and the reference transcription, and its calculation method is as follows:

[0091]

[0092] Wherein, the number of substitutions, deletions and insertions between the reference (real data) and the actual (model output) transcription are S, D and I, respectively, and N W is the number of words in the reference transcription.

[0093] II. Attack success rate

[0094] The success rate of attack (SRoA) is defined as the ratio of adversarial samples that can successfully mislead a given ASR system. That is, it is the ratio of adversarial samples that are mis-transcribed by the target ASR system. An adversarial sample is considered to be mis-transcribed by a given ASR system if its ASR output returns a non-zero WER with respect to the original transcription y. It is calculated as follows:

[0095]

[0096] where N a is the number of audio adversarial examples tested, N m is the number of audio adversarial examples mis-transcribed by the ASR system. This metric is used in this embodiment to evaluate the effectiveness of the adversarial audio generation method.

[0097] III. Signal-to-noise ratio

[0098] The signal-to-noise ratio (SNR) quantifies the amount of noise delta added to the original signal x, measured in decibels (dB). It is calculated as follows:

[0099]

[0100] where P x and P δ are the power of the original signal and the perturbation. This means that the higher the SNR ratio, the less distortion caused by the perturbation.

[0101] The natural environment-based speech adversarial sample concealment generation method provided by the present application uses natural environmental noise, approximates the adversarial perturbation with the natural environmental noise, improves the concealment and inaudibility of the speech adversarial sample by the human ear, and improves the universality of the applicable scenarios; and can be migrated to a commonly used speech recognition model to achieve efficient attack.

[0102] In addition, the target transcription of the adversarial sample generated by the present application can be a complete sentence, the adversarial perturbation can be inserted into real-time streaming audio, and immediate attack can be achieved regardless of the style of the input audio sample, thereby reducing the consumption cost of generating the adversarial sample and improving the efficiency of generating the adversarial sample.

[0103] The above is a further detailed description of the present application in combination with specific preferred embodiments, and the specific implementation of the present application cannot be limited to these descriptions. For ordinary skilled persons in the technical field to which the present application belongs, some simple deductions or substitutions can be made without departing from the concept of the present application, and all of them should be considered as falling within the protection scope of the present application.

Claims

1. A method for generating a speech adversarial sample based on a natural environment, characterized in that, The method comprises the following steps: Step 1, obtaining a natural environment noise dataset, inputting audio data, and generating an adversarial perturbation; Step 2, generating an adversarial sample based on the adversarial perturbation and the input audio data, and misleading a speech recognition model to generate a corresponding adversarial sample transcription while setting a target adversarial transcription content; Step 3, calculating the CTC-loss loss function of the adversarial sample transcription and the target adversarial transcription; Step 4, calculating the norm of the adversarial perturbation and the environmental noise based on the natural environment noise dataset and the adversarial perturbation; Step 5, adding different weight parameters to the CTC-loss loss function and the norm of the adversarial perturbation and the environmental noise to form an adversarial sample generation loss function; Step 6, based on the adversarial sample generation loss function, the adversarial perturbation is iteratively updated using the PGD gradient descent method until the maximum iteration number is reached to obtain the optimal adversarial perturbation, thereby obtaining a speech adversarial sample.

2. The natural environment-based speech adversarial sample concealment generation method according to claim 1, characterized in that, After step 6, it further comprises: Step 7, verifying the attack effect of the generated speech adversarial sample; if the verification is passed, the generated speech adversarial sample is saved; otherwise, the adversarial perturbation state is saved, the maximum iteration number is updated, and step 6 is returned.

3. The natural environment-based speech adversarial sample concealment generation method according to claim 1, characterized in that, Step 3 comprises: Deepspeech is introduced as a target attack model, and the CTC-loss of the adversarial sample transcription and the target adversarial transcription is calculated according to the model, and the calculation formula is: minimize l net (f(x′),t′) wherein l net is the CTC-loss loss function, f(x') represents the speech recognition process on the adversarial sample x', the result of which is the adversarial transcript, x' = x + δ, x is the input audio data, δ is the adversarial perturbation, and t' is the target adversarial transcript.

4. The natural environment-based speech adversarial sample concealment generation method according to claim 1, characterized in that, Step 4 comprises: The collected natural environment noise dataset is saved as a WAV format audio with a sampling rate of 16000Hz, a single channel, and an uncompressed waveform, denoted as n; Introducing l, l2, l ∞ Norm, calculate the ||delta-n|| norm, and select the best norm form; Where δ is the adversarial perturbation.

5. The natural environment-based speech adversarial sample concealment generation method according to claim 1, characterized in that, In step 5, the expression of the adversarial sample generation loss function is: l = al l net (f(x'), t') + a2‖δ-n‖; Where α1, α2 are weight parameters, and n is the natural environment noise dataset.

6. The natural environment-based speech adversarial sample concealment generation method according to claim 5, characterized in that, The weight parameters α1, α2 can be adjusted according to different use scenarios; the use scenarios include scenario 1, scenario 2 and scenario 3; wherein, Scenario 1 is the case without environmental background noise; scenario 2 is the case with moderate background noise; scenario 3 is the case with large background noise.

7. The natural environment-based speech adversarial sample concealment generation method according to claim 1, characterized in that, In step 6, the specific process of iteratively updating the adversarial perturbation using the PGD gradient descent method is: δ = clip ∈ (δ); where δ is the adversarial perturbation, β is the iteration step number, and sign is the sign function, denotes the gradient operator, l is the adversarial sample generation loss function, clip is to limit δ in the range of (-ε, ε), and ε is the maximum limit of the perturbation amplitude.

8. The natural environment-based speech adversarial sample concealment generation method according to claim 2, characterized in that, Step 7 comprises: The generated speech adversarial sample is input into the speech recognition model to obtain the corresponding transcription text; Based on the obtained transcription text, the word error rate, the attack success rate and the signal-to-noise ratio are calculated respectively, and the calculation results are compared with the preset values to verify the generated speech adversarial sample.

Images