A speech adversarial sample detection method based on unnaturalness

Abstract

The present invention discloses a method for detecting speech adversarial samples based on unnaturalness, and belongs to the field of speech recognition model security technology in intelligent speech systems. Common features related to adversarial audio and unnaturalness are obtained, including discontinuous time domain signals, discontinuous frequency domain signals, and irregular time domain signals; for each common feature, the acoustic-statistical features related to unnaturalness of benign and adversarial audio samples are calculated; the acoustic-statistical features of benign and adversarial audio samples are used to train a random forest model as a preprocessing model for feature screening; a classifier is trained based on the acoustic-statistical features of benign audio samples and adversarial audio samples after feature screening; the acoustic-statistical features of the audio samples to be tested after feature screening are extracted, and recognition results are obtained based on the trained classifier. Based on the common features related to unnaturalness, the present invention uses a lightweight classifier to achieve speech adversarial sample detection based on naturalness evaluation.

Description

Technical Field

[0001] The present invention belongs to the field of speech recognition model security technology in intelligent speech systems, and specifically relates to a speech adversarial sample detection method based on unnaturalness. Background Art

[0002] Speech recognition technology can convert speech into text. It has been widely used in devices such as smartphones, cars, and industrial control terminals, and can realize functions such as voice control, voice transcription, and voice search. Existing research shows that speech recognition technology is threatened by adversarial attacks. In adversarial attacks, attackers superimpose maliciously constructed adversarial noise on human speech to form adversarial samples, inducing the speech recognition model to output incorrect text. In the voice control scenario, such attacks can cause malicious operations on devices such as smartphones, cameras, home appliances, and vehicles, threatening the safe operation of various speech recognition applications.

[0003] Existing research has proposed a variety of attack methods for generating adversarial samples. These attacks use different audibility indicators, such as decibel distortion, absolute hearing threshold, psychoacoustic hearing, etc. The perturbations generated under different audibility indicators have different shapes and different naturalness. Decibel distortion uses the intensity ratio between the perturbation and the original audio to represent the audibility of the perturbation. By fixing the signal-to-noise ratio between the original audio and the perturbation at a large value, it prevents the adversarial noise from being too strong to be detected by humans. When decibel distortion is used as an audibility indicator, the adversarial perturbation generated is similar to white noise in signal shape and auditory effect, which is quite different from normal human speech. This makes the generated adversarial samples less natural and easier to be distinguished by humans. In contrast, the psychoacoustic hearing masking scheme uses the theory of psychoacoustics, that is, for human hearing, high-energy sounds can mask low-energy sounds with similar frequencies and time points. The energy distribution of the perturbation generated by using this as the audibility index in the time-frequency domain is similar to that of the original audio, so the perturbation sounds like a human whisper. Therefore, this type of adversarial sample has good naturalness, good attack concealment, and is difficult to be discovered by humans, but it still retains some adversarial characteristics. In addition, the performance of adversarial samples generated under other audibility indicators such as absolute hearing threshold is between the above two.

[0004] Based on the differences in signal morphology between speech adversarial samples and benign speech, existing studies have proposed a variety of methods for detecting speech adversarial samples, which can be mainly divided into four categories according to the principle: (1) Based on perturbation sensitivity, this type of detection method takes advantage of the fact that adversarial audio is easily perturbed. By performing operations such as denoising, denoising, compression, feature transformation, reconstruction, and time domain segmentation on the audio, the recognition results of the audio before and after the operation are compared to distinguish normal audio from adversarial samples; (2) Based on model transferability, this type of detection method takes advantage of the fact that adversarial attacks have poor transferability between models. Multiple speech recognition models or fine-tuned models are used to recognize audio, and normal audio and adversarial samples are distinguished based on the similarity of recognition results of different models; (3) Based on model recognition mode, this type of detection method uses the difference in model recognition intermediate values ​​when identifying adversarial samples and benign samples to distinguish them; (4) Based on classifier classification, this type of detection method distinguishes normal audio from adversarial samples by directly training a binary classifier.

[0005] Related work on detecting speech adversarial samples based on perturbation sensitivity includes:

[0006] (1) Kwon H et al., "POSTER: Detecting audio adversarial example through audio modification" published in the Proceedings of the ACM SIGSAC conference on computer and communications security (ACM CCS) in 2019 and Tamurak et al., "Protection Method based on Multiple Sub-Detectors against Audio Adversarial Examples" published in the Proceedings of the IEEE International Workshop on Computational Intelligence and Applications (IWCIA) in 2021. They perform noise or denoising processing such as low-pass filtering, downsampling, audio silence removal, and adding new low-level distortion on the audio, and detect adversarial examples by comparing the similarity of the model recognition results before and after the processing;

[0007] (2) "Commander Song: A Systematic Approach for Practical Adversarial Voice Recognition" published by YUAN X et al. in "Proceedings of the USENIX security symposium" in 2018 and "Acoustic-decoy: Detection of adversarial examples through audio modification on speech recognition system" published by KWON H et al. in "Neurocomputing" in 2020 compressed the audio by MP3 compression, 8-bit compression, etc., and detected adversarial examples by comparing the similarity of the model recognition results before and after the processing;

[0008] (3) "Mel frequency spectral domain defenses against adversarial attacks on speech recognition systems" published by MEHLMAN N et al. in "JASA Express Letters" in 2023 and "WaveGuard: Understanding and Mitigating Audio Adversarial Examples" published by HUSSAIN S et al. in "Proceedings of the USENIX Security Symposium" in 2021 perform feature change processing such as quantization-dequantization, downsampling-upsampling, Mel spectrum extraction-inverse transformation on audio, and detect adversarial samples by comparing the similarity of model recognition results before and after processing;

[0009] (4) "Defending against Adversarial Audio via Diffusion Model" by Wu S et al., published in 2023, "Research on Speech Recognition Adversarial Sample Defense Based on BiLSTM-DNN" by Liang Jiaye et al., published in Science and Technology Innovation in 2023, and "Voiceprint Adversarial Sample Defense Method Based on Noise Destruction and Waveform Reconstruction" by Wei Chunyu et al., published in Journal of Information Security in 2024, extract features from audio and use tools such as WaveGAN vocoder and linear prediction coding to regenerate audio, and detect adversarial samples by comparing the similarity of model recognition results before and after processing;

[0010] (5) In addition, "Characterizing audio adversarial examples using temporal dependency" published by Yang Z et al. in 2018, "MultiPAD: A multivariant partition-based method for audio adversarial examples detection" published by Guo Q et al. in 2020 in "IEEE Access", and "Protection Method based on Multiple Sub-Detectors against Audio Adversarial Examples" published by Tamura K et al. in 2021 in "Proceedings of the IEEE International Workshop on Computational Intelligence and Applications (IWCIA)" divide the audio into segments and detect adversarial samples by comparing the similarity between the recognition results of the entire speech and the recognition results of the separate speech segments.

[0011] Related work on detecting speech adversarial samples based on model transferability includes "A multiversion programming inspired approach to detecting audio adversarial examples" by Zeng Q et al., published in the 2019 "Proceedings of the annual IEEE / IFIP international conference on dependable systems and networks (DSN)", "Detecting audio attacks on ASR systems with dropout uncertainty" by Jayashankar T et al., published in the 2020 "Proceedings of the INTERSPEECH", "Exploring Diverse Feature Extractions for Adversarial Audio Detection" by Choi Y et al., published in the 2023 "IEEE Access", and "Analyzing uncertainties in speech recognition using deep learning" by Vyasa et al., published in the 2019 "Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)". dropout", they used speech recognition models with different architectures, different types, and randomly dropped different neurons to identify adversarial samples, and detected adversarial samples by comparing the similarities of recognition results of different speech recognition models.

[0012] Related work on detecting speech adversarial samples based on model recognition patterns includes "Identifying audio adversarial examples via anomalous pattern detection" published by AKINWANDE V et al. in 2020, which detects adversarial samples by using different neurons activated when the model recognizes adversarial samples and normal samples; "Detecting Adversarial Examples for Speech Recognition via Uncertainty Quantification" published by S et al. in "Proceedings of the INTERSPEECH" in 2020 detects adversarial samples by calculating the prediction uncertainty of the model; "Detecting Audio Adversarial Examples in Automatic Speech Recognition Systems Using Decision Boundary Patterns" published by ZONG W et al. in "Journal of Imaging" in 2022 detects adversarial samples by the difference in decision boundaries when the model identifies adversarial samples and normal samples; "Audio adversarial detection through classification score on speech recognition systems" published by KWON H et al. in "Computers & Security" in 2023 detects adversarial samples by the difference in softmax score distribution when the model identifies adversarial samples and normal samples.

[0013] Related work on classifier-based detection of speech adversarial samples includes "Adversarial example detection by classification for deep speech recognition" published by Samizade S et al. in the "Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)" in 2020, "Hidden voice commands" published by Carlini N et al. in the "Proceedings of the USENIX security symposium" in 2016, and "Audio adversarial sample detection method based on multi-spectral features" published by Ma Jian et al. in the "Journal of Dongguan University of Technology" in 2022. They used certain known adversarial attacks to generate adversarial samples, and used these samples and the original speech in the corpus to train binary classifiers to detect adversarial samples.

[0014] The above work distinguishes adversarial samples from benign speech from multiple perspectives, but the proposed methods do not take into account the essential characteristic of the unnaturalness of speech adversarial samples, and the detection effects have certain limitations. For example, the detection methods using perturbation sensitivity and model transferability are only effective in detecting adversarial samples with poor robustness. Classifiers trained directly using adversarial samples are difficult to detect untrained adversarial attacks. Summary of the invention

[0015] In response to the above-mentioned problems, the present invention proposes a speech adversarial sample detection method based on unnaturalness for adversarial attacks on speech recognition models. First, four types of common features related to unnaturalness of adversarial samples suitable for machine learning are proposed, and for each common feature related to unnaturalness, several acoustic-statistical features are proposed to describe such unnaturalness. Finally, a lightweight speech adversarial sample detector is designed to realize speech adversarial sample detection based on naturalness evaluation.

[0016] The present invention is achieved through the following technical solutions:

[0017] A method for detecting unnatural speech adversarial samples comprises the following steps:

[0018] (1) obtaining common features related to unnaturalness of the adversarial audio, wherein the common features related to unnaturalness include four types, namely, discontinuity of time domain signals, discontinuity of frequency domain signals, irregularity of time domain signals, and irregularity of frequency domain signals;

[0019] (2) For each category of unnaturalness-related common features, calculate the unnaturalness-related acoustic-statistical features of benign audio samples and adversarial audio samples;

[0020] (3) using the unnaturalness-related acoustic-statistical features of the benign audio samples and the adversarial audio samples to train a random forest model as a preprocessing model, wherein the preprocessing model is used to perform feature screening on the unnaturalness-related acoustic-statistical features;

[0021] (4) training a classifier based on the acoustic-statistical features related to the unnaturalness of the benign audio samples and the adversarial audio samples after feature screening;

[0022] (5) Extracting the unnaturalness-related acoustic-statistical features of the audio sample to be tested after feature screening, and obtaining the recognition result based on the trained classifier.

[0023] Furthermore, the unnaturalness-related acoustic-statistical features corresponding to the discontinuity of the time domain signal include the difference of peaks in the spectrum graph, the difference of resonance peaks in the spectrum envelope, the cosine distance of linear prediction coding, and the Euclidean distance of linear prediction coding.

[0024] Furthermore, the unnaturalness-related acoustic-statistical features corresponding to the discontinuity of the frequency domain signal include the height of the peak in the spectrum graph, the width of the peak in the spectrum graph, the kurtosis of the peak in the spectrum graph, the height of the resonance peak in the spectrum envelope, the width of the resonance peak in the spectrum envelope, the kurtosis of the resonance peak in the spectrum envelope, and the number of resonance peaks in the spectrum envelope.

[0025] Furthermore, the unnaturalness-related acoustic-statistical features corresponding to the irregularity of the time domain signal include the length of the linear prediction code, the autocorrelation of the linear prediction code, the zero-crossing rate of the linear prediction code, the period of the linear prediction code, and the zero-crossing distance of the linear prediction code.

[0026] Furthermore, the unnaturalness-related acoustic-statistical features corresponding to the irregularity of the frequency domain signal include the autocorrelation rate of the peaks in the spectrum graph, the autocorrelation rate of the spectrum amplitude in the spectrum graph, the zero-crossing rate of the spectrum amplitude in the spectrum graph, the period of the peaks in the spectrum graph, the period of the spectrum amplitude in the spectrum graph, and the zero-crossing distance of the spectrum amplitude in the spectrum graph.

[0027] Furthermore, the feature screening process includes:

[0028] (3.1) Calculate the acoustic-statistical characteristics related to the unnaturalness of the audio;

[0029] (3.2) For each unnaturalness-related acoustic-statistical feature, its probability cumulative distribution function is calculated, and N uniformly distributed eigenvalues ​​are selected from the probability cumulative distribution function as the eigenvector of the unnaturalness-related acoustic-statistical feature, expressed as:

[0030] X in ={x|0.01k=f cdf (x), k = 1, 2, ..., N}

[0031]

[0032] Among them, x represents the feature point, f cdf represents the probability cumulative distribution function corresponding to a certain unnatural acoustic-statistical feature of the audio, k represents a natural number, X in represents a set of feature points, x i represents the i-th eigenvalue in the eigenvector, represents the feature vector;

[0033] (3.3) A random forest model is trained on the M×N dimensional input features as a preprocessing model to implement feature screening. First, M' acoustic-statistical features with high weights are selected from the M×N dimensional input features through feature sorting, and then N' feature values ​​with high weights are selected from the M'×N dimensional input features through feature sorting. The M'×N' dimensional features are output as the result after feature screening.

[0034] Furthermore, the acoustic-statistical features included in the features after feature screening are: the difference of peaks in the spectrum graph, the cosine distance of linear prediction coding, the Euclidean distance of linear prediction coding, the height of the peak in the spectrum graph, the width of the peak in the spectrum graph, the kurtosis of the peak in the spectrum graph, the height of the resonance peak in the spectrum envelope, the width of the resonance peak in the spectrum envelope, the kurtosis of the resonance peak in the spectrum envelope, the number of resonance peaks in the spectrum envelope, the length of the linear prediction coding, the zero-crossing rate of the linear prediction coding, the zero-crossing distance of the linear prediction coding, the autocorrelation rate of the peaks in the spectrum graph, the autocorrelation rate of the spectrum amplitude in the spectrum graph, and the period of the spectrum amplitude in the spectrum graph.

[0035] Furthermore, the classifier consists of a Z-Score normalization layer and a support vector machine with a linear kernel.

[0036] Furthermore, adversarial audio samples used to train the classifier are generated based on different adversarial attack methods, including white-box attack, black-box attack, generative attack, and general perturbation attack, and different adversarial attack methods cover a variety of different speech recognition models.

[0037] Furthermore, a cross-validation method is used to train the classifier.

[0038] The present invention has the following beneficial effects:

[0039] (1) This invention measures the common features of adversarial audio under multiple attacks, and proposes features related to the unnaturalness of adversarial samples and suitable for machine learning based on the causes of these common features and their connection with the principles of adversarial attacks. These features are summarized into four categories: discontinuous time domain signals, discontinuous frequency domain signals, irregular time domain signals, and irregular frequency domain signals. Through the inherent properties of adversarial samples that exist under multiple attacks, this method makes up for the lack of existing research in exploring the essential characteristics of speech adversarial samples, and helps detect and defend against adversarial samples.

[0040] (2) The present invention designs acoustic-statistical features for describing the unnaturalness of speech, and designs a lightweight adversarial sample detector based on the acoustic-statistical features, which can detect a variety of adversarial attacks. Specifically, the present invention first extracts a number of feature vectors based on the acoustic-statistical features of speech. Then, the random forest model is trained as a preprocessing model to reduce the dimension and optimize the input feature vector to complete feature screening. A binary classifier is designed based on the input features after feature screening to detect adversarial samples. The adversarial sample detector proposed in the present invention has low input data dimension and few model parameters. It is a lightweight and easy-to-deploy detection method. When a small number of existing adversarial attack adversarial samples are used to train the classifier, it can detect a variety of adversarial attack samples and has high application value. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A flowchart of a method for detecting unnatural speech adversarial samples proposed by the present invention;

[0042] Figure 2 Schematic diagram of the adversarial sample detector in the present invention. DETAILED DESCRIPTION

[0043] The following are specific embodiments of the present invention and the accompanying drawings to further describe the technical solution of the present invention, but the present invention is not limited to these embodiments.

[0044] The accompanying drawings are merely schematic illustrations of the present invention. Some of the block diagrams shown in the accompanying drawings are functional entities, which do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in the form of software, or in one or more hardware modules or integrated circuits, or in different networks and / or processor systems and / or microcontroller systems.

[0045] like Figure 1 The present invention proposes a method for detecting speech adversarial samples based on unnaturalness, comprising:

[0046] Step S01, determining common features related to the unnaturalness of adversarial samples.

[0047] By measuring the common features of adversarial audio, we obtain the common features that are unique and ubiquitous in adversarial samples under various attacks. According to the causes of the common features and their connection with the principles of adversarial attacks, we extract features related to the unnaturalness of adversarial samples from the common features, and screen out features suitable for machine learning, which are summarized into four categories: discontinuous time domain signals, discontinuous frequency domain signals, irregular time domain signals, and irregular frequency domain signals.

[0048] In a specific implementation of the present invention, step S01 specifically includes:

[0049] Step S11, the time domain signal is discontinuous. Through the time domain continuity measurement experiment, it can be found that the continuity of the adversarial sample signal in the time domain is poor, that is, the signal changes drastically within tens of milliseconds, which is significantly different from human speech. Time domain continuity can be measured by the difference between the acoustic features of adjacent frames. The greater the difference, the worse the continuity. In this embodiment, the spectrum graph is used as an example to measure the continuity of the signal in the time domain. The acoustic feature of each frame in the spectrum graph is the spectrum amplitude of each frame signal. Based on the spectrum graph, the energy distribution difference between adjacent frames in the frequency domain can be calculated. By measuring the spectrum graph, it can be found that the difference in the spectrum amplitude of adjacent frames in the adversarial sample is large, while the difference in the spectrum amplitude of adjacent frames in the benign audio is small.

[0050] Step S12, the frequency domain signal is discontinuous. Through the frequency domain continuity measurement experiment, it can be found that the continuity of the adversarial sample signal in the frequency domain is poor, that is, the signal has a large change between adjacent frequency points, which is significantly different from human speech. Frequency domain continuity can be measured by the difference between acoustic features at adjacent frequency points. The acoustic features of discontinuous signals at adjacent frequency points are greatly different, that is, there are a large number of peaks in the feature vector along the spectrum direction. In this embodiment, the spectrum envelope is used as an example to measure the discontinuity of the signal in the frequency domain. The discontinuous signal is manifested in the spectrum envelope as a large number of narrow resonance peaks. By measuring the spectrum envelope, it can be found that compared with benign audio, the number of resonance peaks in the adversarial sample is large, the width is narrow, and the peak value is low, which is consistent with the characteristics of the signal being discontinuous in the frequency domain.

[0051] Step S13, the time domain signal is irregular. Through the time domain regularity measurement experiment, it can be found that the regularity of the adversarial sample signal in the time domain is poor, that is, the signal has poor periodicity in time series, which is significantly different from human speech. Time domain regularity can be measured by the stability of the time series related period over time. The more stable the period, the better the regularity. This embodiment takes the range of LPC period as an example to demonstrate the irregularity of the signal in the time domain. By measuring LPC, it can be found that in benign audio, as the LPC order increases, the LPC eigenvalue changes periodically and gradually approaches 0, and the period length of LPC is relatively stable, which shows that the time series of benign audio has the characteristics of periodic oscillation; however, in the adversarial sample, LPC does not have a fixed period length, which is consistent with the characteristics of irregular signals in the time domain.

[0052] Step S14, the frequency domain signal is irregular. Through the frequency domain regularity measurement experiment, it can be found that the regularity of the adversarial sample signal in the frequency domain is poor, that is, the signal has no obvious harmonics in the spectrum, which is significantly different from human speech. Frequency domain regularity can be measured by whether there are harmonics, because benign audio contains the fundamental and harmonic waves generated by human voice, which appear as periodic peaks in the spectrum. Therefore, it can be considered that benign audio has regularity in the frequency domain. This method takes the range of peak periods in the spectrum as an example to demonstrate the irregularity of signals in the frequency domain. By measuring the frequency difference between peaks in the spectrum, it can be found that benign audio has a stable period length in the spectrum diagram, while adversarial samples do not have a fixed period, which is consistent with the characteristics of irregular signals in the frequency domain.

[0053] Analysis of the causes of the above four types of discontinuity and irregularity. Through the above four steps, it can be found that the adversarial samples are discontinuous and irregular in the time domain and frequency domain, which is essentially different from benign speech. This is because the signals of the adversarial samples are not constrained by the physiological conditions of the human vocal organs. Specifically, in past studies, it was found that because the human vocal tract cannot change quickly, speech can only produce a small amount of changes within a time range of milliseconds, so it has continuity in the time domain. In addition, the frequency distribution of speech is limited by the frequency response of the vocal tract, and the energy gap between adjacent frequency points will not be too large, so speech is also continuous in the frequency domain. The periodicity in speech comes from the periodicity of the excitation signal. When humans make voiced sounds, the glottis will generate an excitation sound wave with a nearly periodic waveform, which makes the speech have a time correlation of fundamental waves, harmonics and near periods. In English, vowels and most consonants are voiced sounds, so it can be considered that there are periodic excitation sound waves most of the time when humans speak, which makes most human speech show regularity. However, adversarial samples are generated by machines, are not restricted by the glottis and vocal tract, and do not need to comply with the above constraints. In addition, since the data input into the speech recognition model is discretized audio, each discrete value is generated by a short-term narrow-band audio segment. It can be inferred that the continuity and regularity of the audio have limited effect on model recognition. Therefore, adversarial samples can also tamper with speech content without continuity and regularity. The above four adversarial features can reflect the unnaturalness of adversarial samples.

[0054] Step S02, designing acoustic-statistical features related to the unnaturalness of the adversarial sample.

[0055] For each unnaturalness of adversarial samples, acoustic features are designed to describe this unnaturalness, and statistical features are further used to characterize the overall distribution and peak distribution of acoustic feature vectors. The acoustic features are combined with statistical features to form acoustic-statistical features.

[0056] In a specific implementation of the present invention, step S02 specifically includes:

[0057] Step S21, acoustic-statistical features for discontinuous time domain signals. In order to quantify the unnaturalness of the discontinuous time domain signals against audio, this embodiment designs four acoustic-statistical features: the difference of peaks in the spectrum graph, the difference of resonance peaks in the spectrum envelope, the cosine distance of linear predictive coding (LPC), and the Euclidean distance of LPC. Among them, the difference of peaks in the spectrum graph refers to the distance between peaks in adjacent frames of the spectrum, and the distance of the peaks is the frequency difference between the peaks. This feature can reflect the continuity of the signal in the time domain from the spectrum; the difference of resonance peaks in the spectrum envelope refers to the difference in the resonance peak frequencies of adjacent frames in the spectrum envelope; the cosine distance of LPC refers to the cosine distance between adjacent frame LPCs. LPC is the coefficient of the denominator polynomial when the vocal tract model is expressed by a polynomial fraction, so this feature can measure the difference between adjacent frames from the vocal tract model; the Euclidean distance of LPC refers to the Euclidean distance between adjacent frame LPCs.

[0058] Step S22, acoustic-statistical features for discontinuous frequency domain signals. In order to quantify the unnaturalness of the frequency domain signal discontinuity, this embodiment designs seven acoustic-statistical features: the height of the peak in the spectrum graph, the width of the peak in the spectrum graph, the kurtosis of the peak in the spectrum graph, the height of the resonance peak in the spectrum envelope, the width of the resonance peak in the spectrum envelope, the kurtosis of the resonance peak in the spectrum envelope, and the number of resonance peaks in the spectrum envelope. Among them, the height of the peak in the spectrum graph refers to the numerical value of the peak; the width of the peak in the spectrum graph refers to the size of the frequency band covered by the peak; the kurtosis of the peak in the spectrum graph refers to the ratio of the height to the width of the peak; the resonance peak in the spectrum envelope is the peak in the spectrum envelope, the resonance peak height refers to the numerical value of the spectrum envelope where the resonance peak is located, the resonance peak width refers to the size of the frequency band covered by the resonance peak, the resonance peak kurtosis refers to the ratio of the height to the width of the resonance peak, and the number of resonance peaks refers to the average number of resonance peaks per frame in the audio.

[0059] Step S23, for the acoustic-statistical features of irregular time domain signals. In order to quantify the irregularity of time domain signals to combat the unnaturalness of audio, this embodiment designs five acoustic-statistical features: LPC length, LPC autocorrelation, LPC zero crossing rate, LPC period, and LPC zero crossing distance. LPC is the coefficient of each state term when the vocal tract model is represented by a state equation. Specifically, the vocal tract model is represented by a state equation as follows:

[0060]

[0061] Among them, x(t) is the amplitude of the signal at the tth moment, a iis the i-th order LPC. Therefore, the k-order LPC represents the correlation between the signal sampling value at one moment and the signal sampling values ​​at the previous k moments. The size of the LPC value can evaluate the strength of the timing correlation at each moment to determine the timing length with strong correlation. Here, the timing length with strong correlation is called the length of LPC. The autocorrelation, zero-crossing rate, period, and zero-crossing distance of LPC refer to the autocorrelation, zero-crossing rate, period, and distance between adjacent zero-crossing points of the sequence composed of LPC values.

[0062] Step S24, for the acoustic-statistical features of the irregular frequency domain signal. In order to quantify the unnaturalness of the irregular frequency domain signal against the audio, this embodiment designs six acoustic-statistical features: the autocorrelation rate of the peak in the spectrum graph, the autocorrelation rate of the spectrum amplitude in the spectrum graph, the zero-crossing rate of the spectrum amplitude in the spectrum graph, the period of the peak in the spectrum graph, the period of the spectrum amplitude in the spectrum graph, and the zero-crossing point distance of the spectrum amplitude in the spectrum graph. Among them, the autocorrelation rate of the peak in the spectrum graph and the period of the peak in the spectrum graph refer to the autocorrelation and period length of the frequency point sequence of the peak in the spectrum graph; the autocorrelation rate of the spectrum amplitude in the spectrum graph, the zero-crossing rate of the spectrum amplitude in the spectrum graph, the period of the spectrum amplitude in the spectrum graph, and the zero-crossing point distance of the spectrum amplitude in the spectrum graph refer to the autocorrelation, zero-crossing rate, period length and distance between adjacent zero-crossing points of the spectrum amplitude sequence.

[0063] Step S03, designing an adversarial sample detector.

[0064] The detector architecture is shown in the figure Figure 2 As shown in the figure, first, it is necessary to extract the acoustic-statistical features of the input audio, calculate the probability density distribution of the above acoustic-statistical features, and select 100 uniformly distributed eigenvalues ​​from the function as the input feature vector. Next, the random forest model is trained as a preprocessing model to reduce the dimension and optimize the input feature vector to complete the feature screening. Then, a classifier is designed based on the input features optimized by the random forest model. The classifier consists of a Z-Score normalization layer and a support vector machine with a linear kernel to detect adversarial samples. Finally, the classifier is trained using benign audio and adversarial samples of existing adversarial attacks. It can detect multiple adversarial attack samples when only two adversarial samples are used for training.

[0065] In a specific implementation of the present invention, step S03 specifically includes:

[0066] Step S31, extracting input features.

[0067] Based on the above 22 acoustic-statistical features, the input features are extracted, and for each characteristic acoustic-statistical vector / matrix, its Cumulative Probability Distribution Function (CDF) is calculated. cdf , and select 100 uniformly distributed eigenvalues ​​from the function as the input eigenvector The formula is as follows:

[0068] X in ={x|0.01k=f cdf (x), k = 1, 2, ..., 99, 100}

[0069]

[0070] Step S32, feature screening.

[0071] Based on the 22×100-dimensional input features extracted in the previous step, a random forest model is trained as a preprocessing model to implement feature screening. The random forest model is a tree-based model, and the model parameters include the threshold used to judge positive and negative samples, the weight of each tree, etc. In the model of this embodiment, each feature value can be regarded as a tree. By training each feature, a threshold parameter for judging whether it is an adversarial sample and the weight of this feature will be obtained. The weight of the feature can be used as an evaluation parameter of the feature importance. The input features can be sorted based on the weight, and the dimensions with high importance can be selected from the feature vector.

[0072] In this embodiment, 16 acoustic-statistical features with the highest weights are first selected from the 22×100-dimensional input features by feature sorting, and 20 dimensions with the highest weights are selected from the 100 dimensions of the 16 acoustic-statistical features. Therefore, through feature screening, 16×20-dimensional features are selected from the 22×100-dimensional input features as the optimized input features. The acoustic-statistical features included in the optimized input features are the difference of the peaks in the spectrum graph, the cosine distance of LPC, the Euclidean distance of LPC, the height of the peaks in the spectrum graph, the width of the peaks in the spectrum graph, the kurtosis of the peaks in the spectrum graph, the height of the resonance peaks in the spectrum envelope, the width of the resonance peaks in the spectrum envelope, the kurtosis of the resonance peaks in the spectrum envelope, the number of resonance peaks in the spectrum envelope, the length of LPC, the zero crossing rate of LPC, the zero crossing distance of LPC, the autocorrelation rate of the peaks in the spectrum graph, the autocorrelation rate of the spectrum amplitude in the spectrum graph, and the period of the spectrum amplitude in the spectrum graph.

[0073] Step S33, design and training of classifier.

[0074] In this embodiment, a classifier is designed based on the optimized input features of 16×20 dimensions to identify adversarial samples. The classifier consists of a Z-Score normalization layer and a support vector machine (SVM) with a linear kernel. The training data of the model in this embodiment is 600 benign audios and 600 adversarial samples. The benign audios come from the LibriSpeech dataset and the VCTK dataset, and the adversarial samples come from the white-box attack Imp attack and a generative adversarial attack GA attack, each of which provides 300 adversarial samples for training. In order to make full use of the training data and prevent overfitting, 4-fold cross validation is also used in training, that is, the data is divided into four parts on average, and three parts of the data are used for training each time, and one part of the data is used for verification. The trained classifier can identify a variety of speech adversarial attack samples including Imp attacks and GA attacks, including white-box attacks, black-box attacks, generative attacks, general perturbation attacks, etc.

[0075] The present invention proposes a speech adversarial sample detection method based on unnaturalness. The present invention first explores the unnaturalness of speech adversarial samples, and finds four common features related to unnaturalness that are prevalent in speech adversarial samples and suitable for machine learning, which makes up for the lack of existing research on the exploration of the essential characteristics of speech adversarial samples and is helpful for the detection and defense of adversarial samples; then the present invention designs acoustic-statistical features for describing unnaturalness, and realizes the quantitative characterization of the inherent properties of speech adversarial samples. Finally, the present invention designs a lightweight and easy-to-deploy adversarial sample detector, which can realize the detection of multiple adversarial attack samples when a small number of existing adversarial attack adversarial samples are used to train classifiers, and has high application value.

[0076] The above examples are only specific embodiments of the present invention. Obviously, the present invention is not limited to the above examples, and many variations are possible. All variations that can be directly derived or associated with the contents disclosed by a person skilled in the art should be considered as the protection scope of the present invention.

Claims

1. A method for detecting speech adversarial samples based on unnaturalness, characterized in that: The following steps are involved: (1) obtaining common features related to unnaturalness of the adversarial audio, wherein the common features related to unnaturalness include four types, namely, discontinuity of time domain signals, discontinuity of frequency domain signals, irregularity of time domain signals, and irregularity of frequency domain signals; (2) For each category of unnaturalness-related common features, calculate the unnaturalness-related acoustic-statistical features of benign audio samples and adversarial audio samples; (3) using the unnaturalness-related acoustic-statistical features of the benign audio samples and the adversarial audio samples to train a random forest model as a preprocessing model, wherein the preprocessing model is used to perform feature screening on the unnaturalness-related acoustic-statistical features; (4) training a classifier based on the acoustic-statistical features related to the unnaturalness of the benign audio samples and the adversarial audio samples after feature screening; (5) Extracting the unnaturalness-related acoustic-statistical features of the audio sample to be tested after feature screening, and obtaining the recognition result based on the trained classifier.

2. The method for detecting unnatural speech adversarial samples according to claim 1, characterized in that: The unnaturalness-related acoustic-statistical features corresponding to the discontinuity of the time domain signal include the difference of peaks in the spectrum diagram, the difference of resonance peaks in the spectrum envelope, the cosine distance of linear prediction coding, and the Euclidean distance of linear prediction coding.

3. The method for detecting unnatural speech adversarial samples according to claim 1, characterized in that: The unnaturalness-related acoustic-statistical features corresponding to the discontinuity of the frequency domain signal include the height of the peak in the spectrum graph, the width of the peak in the spectrum graph, the kurtosis of the peak in the spectrum graph, the height of the resonance peak in the spectrum envelope, the width of the resonance peak in the spectrum envelope, the kurtosis of the resonance peak in the spectrum envelope, and the number of resonance peaks in the spectrum envelope.

4. The method for detecting unnatural speech adversarial samples according to claim 1, characterized in that: The unnaturalness-related acoustic-statistical features corresponding to the irregularity of the time domain signal include the length of the linear prediction code, the autocorrelation of the linear prediction code, the zero-crossing rate of the linear prediction code, the period of the linear prediction code, and the zero-crossing distance of the linear prediction code.

5. The method for detecting unnatural speech adversarial samples according to claim 1, characterized in that: The unnaturalness-related acoustic-statistical features corresponding to the irregularity of the frequency domain signal include the autocorrelation rate of the peaks in the spectrum graph, the autocorrelation rate of the spectrum amplitude in the spectrum graph, the zero-crossing rate of the spectrum amplitude in the spectrum graph, the period of the peaks in the spectrum graph, the period of the spectrum amplitude in the spectrum graph, and the zero-crossing distance of the spectrum amplitude in the spectrum graph.

6. The method for detecting unnatural speech adversarial samples according to claim 1, characterized in that: The feature screening process includes: (3.1) Calculate the acoustic-statistical characteristics related to the unnaturalness of the audio; (3.2) For each unnaturalness-related acoustic-statistical feature, its probability cumulative distribution function is calculated, and N uniformly distributed eigenvalues ​​are selected from the probability cumulative distribution function as the eigenvector of the unnaturalness-related acoustic-statistical feature, expressed as: X in ={x|0.01k=f cdf (x),k=1,2,…,N} Among them, x represents the feature point, f cdf represents the probability cumulative distribution function corresponding to a certain unnatural acoustic-statistical feature of the audio, k represents a natural number, X in represents a set of feature points, x i represents the i-th eigenvalue in the eigenvector, represents the feature vector; (3.3) A random forest model is trained on the M×N dimensional input features as a preprocessing model to implement feature screening. First, M' acoustic-statistical features with high weights are selected from the M×N dimensional input features through feature sorting, and then N' feature values ​​with high weights are selected from the M'×N dimensional input features through feature sorting. The M'×N' dimensional features are output as the result after feature screening.

7. The method for detecting unnatural speech adversarial samples according to claim 1 or 6, characterized in that: The acoustic-statistical features included in the features after feature screening are: the difference of peaks in the spectrum graph, the cosine distance of linear prediction coding, the Euclidean distance of linear prediction coding, the height of the peak in the spectrum graph, the width of the peak in the spectrum graph, the kurtosis of the peak in the spectrum graph, the height of the resonance peak in the spectrum envelope, the width of the resonance peak in the spectrum envelope, the kurtosis of the resonance peak in the spectrum envelope, the number of resonance peaks in the spectrum envelope, the length of the linear prediction coding, the zero-crossing rate of the linear prediction coding, the zero-crossing distance of the linear prediction coding, the autocorrelation rate of the peak in the spectrum graph, the autocorrelation rate of the spectrum amplitude in the spectrum graph, and the period of the spectrum amplitude in the spectrum graph.

8. The method for detecting unnatural speech adversarial samples according to claim 1, characterized in that: The classifier consists of a Z-Score normalization layer and a support vector machine with a linear kernel.

9. The method for detecting unnatural speech adversarial samples according to claim 1, characterized in that: The adversarial audio samples used to train the classifier are generated based on different adversarial attack methods, including white-box attack, black-box attack, generative attack, and general perturbation attack, and different adversarial attack methods cover a variety of different speech recognition models.

10. The method for detecting unnatural speech adversarial samples according to claim 1, characterized in that: The classifier was trained using a cross-validation method.

Images