A method for measuring common characteristics of adversarial audio

Abstract

The present invention discloses a method for measuring common features of adversarial audio, and belongs to the field of speech recognition model security technology in intelligent speech systems. The method includes selecting acoustic features that characterize speech information, and designing statistical features that describe the overall and peak distribution of acoustic feature vectors on this basis, and combining the two to form acoustic statistical features; using a variety of different adversarial attack methods, generating adversarial noise and adversarial samples for a large number of different benign audios and attack target texts, collectively referred to as adversarial audio, and calculating the acoustic statistical features of adversarial audio, benign audio, and white noise; performing consistency checks on the acoustic statistical features, extracting adversarial audio features, that is, features that are widely present in adversarial noise or adversarial samples and do not exist in benign audio or white noise, and completing the measurement of common features of adversarial audio.

Description

Technical Field

[0001] The present invention belongs to the field of voice recognition model security technology in intelligent voice systems, and in particular relates to a method for measuring common features of adversarial audio. Background Art

[0002] A speech recognition system is an intelligent system that converts human speech into text. With the development of deep neural network technology, the accuracy of speech recognition systems has been greatly improved. At present, they have been widely used in smart phones, cars, industrial control terminals and other devices. However, the research community has found that speech recognition models are vulnerable to adversarial audio attacks. When implementing this attack, attackers maliciously construct a piece of adversarial noise and superimpose it with speech to form an adversarial sample. The adversarial sample sounds similar to normal speech. Adversarial noise and adversarial samples can be collectively referred to as adversarial audio. Adversarial audio seriously threatens the security of intelligent speech systems. The following is an example of a typical attack case.

[0003] In smart home scenarios, attackers can superimpose adversarial noise on the conversations in radio programs, so that radio programs that sound like normal conversations will be recognized by the voice recognition system as malicious commands such as "make a call", "buy goods", "download software", "turn on appliances", and "open the door". When users play radio programs, the voice recognition systems of smart speakers, mobile phones, smart door locks and other devices will recognize malicious commands and operate according to the commands, which may lead to the purchase of goods that users do not need, the download and installation of malicious software, the turning on of appliances when no one is in the house, and the opening of doors, etc., threatening the personal and property safety of users.

[0004] The core part of adversarial attack is to generate adversarial audio. Existing research generally solves adversarial audio generation as an optimization problem. In this optimization problem, the optimization goal is to minimize the weighted sum of text distance and audibility. The text distance refers to the distance between the audio recognition result and the target text in the model after adding adversarial noise, and audibility refers to the degree to which the disturbance is perceived by humans. At present, the research community has proposed a variety of indicators to measure distance and audibility, forming a variety of adversarial attack methods. The adversarial audio generated by these adversarial attacks is different, but they can achieve similar attack effects. Therefore, exploring the common characteristics of adversarial audio under different attacks will help discover the essential reasons for the implementation of adversarial attack results and help speech recognition systems identify and defend against adversarial attacks.

[0005] At present, some work has explored the characteristics of adversarial samples from the aspects of spectrum and model interpretability. Most of the research objects are adversarial attacks in the field of image recognition, and there are fewer studies on adversarial speech.

[0006] Dong Yin et al. published "A fourier perspective on model robustness in computer vision" in "Advances in Neural Information Processing Systems" in 2019, studying the difference in frequency domain distribution of adversarial perturbations generated for ordinary image recognition models and adversarially trained image recognition models. This study found that the adversarial perturbations of ordinary models are mainly high-frequency perturbations, while the adversarial perturbations of adversarially trained models have increased low- and medium-frequency components.

[0007] Sicong Han et al. published "Rethinking adversarial examples exploiting frequency-based analysis" in the 2021 "Proceedings of the International Conferencepf Information and Communications Security", studying the differences in the distribution frequency bands of adversarial perturbations under different adversarial attacks on image recognition models. This study found that the distribution frequency band of adversarial perturbations is not fixed, and it is related to the data set and method used in the attack.

[0008] Chuan Guo et al. published a paper titled "Low frequency adversarial perturbation" at the 2018 "Conference on Uncertainty in Artificial Intelligence", which studies the role of different frequency bands in adversarial perturbations in attacks. This study found that fixing the search direction in the low-frequency space during adversarial generation and generating adversarial perturbations containing only low-frequency noise can improve the efficiency of adversarial sample generation.

[0009] Yash Sharma et al. published "On the effectiveness of low frequency perturbations" at the 2019 International Joint Conference on Artificial Intelligence, studying the role of different frequency bands in adversarial perturbations in attacks. This study found that low-frequency adversarial perturbations have good attack effects on both ordinary models and adversarially trained models, while high-frequency adversarial perturbations have difficulty attacking adversarially trained models.

[0010] Verena Praher et al. published "On the Veracity of Local, Model-agnostic Explanations in Audio Classification: Targeted Investigations with Adversarial Examples" at the 2021 International Society for Music Information Retrieval Conference, studying the correlation between adversarial perturbation distribution and model interpretability results. This study found that the important sample fragments discovered by interpretability tools are independent of the distribution fragments of adversarial perturbations.

[0011] These works mainly answer questions such as the role of adversarial samples in different frequency bands on adversarial attacks, the difference in spectral distribution in adversarial samples generated for common models and adversarial training models, and the correlation between model interpretability results and adversarial samples. Such work only analyzes the characteristics of adversarial audio from a single aspect such as spectrum, and does not comprehensively characterize adversarial audio from the perspective of speech signals, does not consider the common characteristics of adversarial audio under multiple attacks, and does not compare adversarial audio with normal speech, making it difficult to discover the unique properties of adversarial audio. Summary of the invention

[0012] Aiming at the problem that the commonality of speech adversarial audio is unknown under different adversarial attacks, the present invention proposes a method for measuring the common features of adversarial audio. First, acoustic features for characterizing speech information are designed, and on this basis, statistical features are designed, and the two are combined to form a feature library of acoustic-statistical features. Then, using a variety of different adversarial attack methods, adversarial noise and adversarial samples are generated for a large number of different benign audios and adversarial target texts, collectively referred to as adversarial audio, and the acoustic-statistical features of adversarial audio, benign audio and white noise are calculated. The acoustic-statistical features are checked for consistency, and adversarial audio characteristics are extracted, that is, characteristics that are widely present in adversarial noise or adversarial samples and do not exist in benign audio or white noise, to complete the measurement of common features of adversarial audio.

[0013] The present invention is achieved through the following technical solutions:

[0014] A method for measuring common characteristics of adversarial audio comprises the following steps:

[0015] Step S01, determining a measurement implementation object, wherein the measurement implementation object includes adversarial noise, adversarial samples, white noise, and benign samples; the adversarial noise and adversarial samples are used as adversarial audio, and the white noise and benign samples are used as comparative audio;

[0016] Step S02, generating a large number of adversarial noises and adversarial samples based on different adversarial attack methods, wherein the adversarial attack methods use a distance index and an audibility index as generation optimization targets, and the adversarial samples are obtained by adding adversarial noise to benign samples;

[0017] Step S03, calculating the acoustic features of the adversarial noise, adversarial samples, white noise and benign samples to form an acoustic feature vector;

[0018] Step S04, calculating the statistical features of the acoustic feature vector to form an acoustic-statistical feature vector; the statistical features are used to describe the overall distribution and peak distribution of the acoustic feature vector, including continuity, regularity and distribution trend;

[0019] Step S05, calculate several statistics of the acoustic-statistical feature vectors of adversarial noise, adversarial samples, white noise and benign samples, perform a difference significance test based on the statistics corresponding to different adversarial attack methods, if the difference significance test passes, screen the statistic type with significant difference, and continue to perform the sign consistency test, if the adversarial audio and the comparison audio of all adversarial attack methods have the same difference sign under the statistic type with significant difference, then measure and obtain the common characteristics of the adversarial audio; if the difference significance test fails, then end the measurement process, and there is no common feature in the adversarial audio.

[0020] Furthermore, the step S02 includes:

[0021] (2.1) Generate adversarial noise using an adversarial attack method, add the adversarial noise to a benign sample, and generate an adversarial sample corresponding to the benign sample. The adversarial sample will be recognized by the speech recognition model as an attack target text, and the attack target text is different from the real text of the benign sample; the weighted sum of the distance index between the model recognition result of the adversarial sample and the attack target text and the audibility index of the adversarial noise is minimized;

[0022] (2.2) Changing the adversarial attack mode multiple times and repeating step (2.1) to generate adversarial noise and adversarial samples corresponding to different adversarial attack modes; the different adversarial attack modes all use the distance index and the audibility index as generation optimization targets, and can cover a variety of different speech recognition models.

[0023] Furthermore, the benign samples are randomly selected, and the benign samples correspond to different attack target texts.

[0024] Furthermore, the acoustic features include time domain features and frequency domain features. The time domain features include short-time power, sound pressure level, short-time autocorrelation rate, short-time average amplitude difference, short-time average zero-crossing rate, phoneme duration, and character interval time; the frequency domain features include spectrum centroid, fundamental frequency, energy entropy ratio, spectrogram, Mel-spectrogram, Mel-cephalogram coefficients, spectrum envelope, and linear predictive coding (LPC).

[0025] Furthermore, the step S04 includes:

[0026] (4.1) determining a statistical feature type, wherein the statistical feature type includes an overall distribution and a local distribution of an acoustic feature vector, wherein the local distribution refers to a data distribution around a peak value in the acoustic feature vector;

[0027] (4.2) Designing overall distribution statistical features from three aspects: continuity, regularity and distribution trend, wherein the overall distribution statistical features include difference, second-order difference, cosine distance, Euclidean distance, autocorrelation rate, period, zero-crossing rate, zero-crossing distance and normalized value of features;

[0028] (4.3) Designing local distribution statistical features from three aspects: continuity, regularity and distribution trend. The local distribution statistical features are for the peaks in the acoustic feature vector, including the distance between peaks, the autocorrelation rate of the peaks, the period of the peaks, the number of peaks, the position of the peaks, the width of the peaks, the height of the peaks, and the kurtosis of the peaks;

[0029] (4.4) Calculate the acoustic-statistical feature vector of the acoustic feature vector based on the overall distribution statistical features and the local distribution statistical features designed in step (4.2) and step (4.3).

[0030] Furthermore, the step S05 includes:

[0031] (5.1) defining an adversarial characteristic, wherein the adversarial characteristic refers to a significant difference between the statistics of the acoustic-statistical feature vector of the adversarial noise or adversarial sample and the statistics of the acoustic-statistical feature vector of the corresponding white noise or benign sample;

[0032] (5.2) Calculate several statistics of the acoustic-statistical feature vectors of adversarial noise, adversarial samples, white noise, and benign samples;

[0033] (5.3) Performing a difference significance test based on the statistics corresponding to different attack modes. The difference significance test is: using a hypothesis test to determine whether there is a significant difference in the statistics corresponding to the noise combination consisting of the adversarial noise and white noise generated under different attack modes, and / or using a hypothesis test to determine whether there is a significant difference in the statistics corresponding to the sample combination consisting of the adversarial samples and benign samples generated under different attack modes. When there is a significant difference between any combination of the noise combination and the sample combination, the difference significance test is passed; otherwise, it fails and the measurement process ends;

[0034] (5.4) If the difference significance test is passed, the statistical type with significant difference is screened, and a sign consistency test is performed: when the difference signs of the probability density functions of the adversarial audio and the comparison audio corresponding to all adversarial attack methods are the same under the j-th statistical type with significant difference in the acoustic-statistical feature m, then the acoustic-statistical feature m of the adversarial audio has a common characteristic under the j-th statistical type with significant difference, and a common feature is generated according to the positive or negative sign of the difference; traverse all acoustic-statistical features m and all statistical types with significant difference to generate all adversarial features of the adversarial audio.

[0035] Furthermore, the statistical quantity types of the acoustic-statistical feature vector include mean value, minimum value, first quartile, median, third quartile, and maximum value.

[0036] Furthermore, in the step (5.3), when performing a difference significance test for any combination, for the nth adversarial attack mode, each statistic S of the adversarial noise δ generated under the adversarial attack mode is i (m(δ)) and the corresponding white noise statistic S i (m(δ w )) Perform Kruskal-Wallis H test to obtain p value; where S i (m(δ)) represents the statistical result of the acoustic-statistical feature m of the adversarial audio δ under the i-th statistical type, S i (m(δ w )) indicates contrast audio delta w The statistical result of the acoustic-statistical feature m under the i-th statistical type;

[0037] Traverse all statistical types and retain the lowest p-value and the statistical type corresponding to the lowest p-value;

[0038] Traverse all the adversarial attack methods and get p min,1 ,p min,2 ,…,p min,N , where p min,Nrepresents the minimum p value corresponding to the Nth adversarial attack method, and N represents the number of all adversarial attack methods;

[0039] If p min,1 ,p min,2 ,…,p min,N No more than 0.05 / M, where M is the number of all statistical types, then p min,1 ,p min,2 ,…,p min,N The corresponding statistic type is the statistic type with significant differences.

[0040] Furthermore, the step (5.4) is specifically as follows:

[0041] Calculate the statistics s of the acoustic-statistical features of the adversarial audio and the comparison audio under each adversarial attack mode j (m(δ)), s j (m(δ w )) probability density function, where s j (m(δ)) represents the statistical result of the acoustic-statistical feature m of the adversarial audio δ under the jth statistical type with significant difference, s j (m(δ w )) indicates contrast audio delta w The acoustic-statistical feature m of is the statistical result under the jth statistical type with significant difference; s j (m(δ)), s j (m(δ w ))’s probability density function is subtracted and the sign of the difference is recorded;

[0042] Traverse all adversarial attack methods, compare adversarial noise and white noise as the first combination, and compare adversarial samples and benign samples as the second combination. When the positive and negative signs of the corresponding differences under all attack methods in any combination are the same, it means that the acoustic-statistical features m of the adversarial noise or adversarial samples in the combination have common characteristics under the jth statistical type with significant differences, and generate common features according to the difference signs;

[0043] Traverse all acoustic-statistical features and all statistical types with significant differences to obtain all common features of adversarial noise and adversarial samples.

[0044] Furthermore, the generating of common features according to the difference signs includes:

[0045] When the corresponding difference sign is positive, the common feature is recorded as s j (m(δ))>s j (m(δ w)), indicating that the statistical result of the acoustic-statistical feature m of the adversarial noise / adversarial sample under the jth statistical type with significant differences is greater than the statistical result of the acoustic-statistical feature m of the white noise / benign sample under the jth statistical type with significant differences;

[0046] When the corresponding difference sign is negative, the common feature is recorded as s j (m(δ))<s j (m(δ w )), indicating that the statistical result of the acoustic-statistical feature m of the adversarial noise / adversarial sample under the jth statistical type with significant differences is smaller than the statistical result of the acoustic-statistical feature m of the white noise / benign sample under the jth statistical type with significant differences.

[0047] The present invention has the following beneficial effects:

[0048] (1) The present invention proposes a method for measuring the common features of speech at the signal feature level under adversarial attacks, which makes up for the current shortcomings in the analysis of adversarial audio signals for speech recognition models and fills the gaps in the research of adversarial audio characteristics at multiple levels. The present invention first uses a variety of acoustic features to describe the audio, and then uses a variety of statistical features to describe the continuity, regularity and distribution trend of the acoustic feature vectors in the overall and peak parts in a fine-grained manner. Different from the existing methods that only analyze the characteristics of adversarial samples from the spectral distribution level, the present invention uses a variety of acoustic features to extract the characteristics of audio from multiple aspects such as intensity, rhythm, pitch, timbre, etc., and realizes a more complete exploration of adversarial audio characteristics.

[0049] (2) The present invention ensures that the common features of the measurements are caused by the adversarial attack by checking the differences between the adversarial audio and the comparative audio, thus filling the gaps in existing work on this type of research. The measurement object of the present invention is a large amount of adversarial audio under various adversarial attacks. After extracting the acoustic-statistical features of the audio, the features of the adversarial audio and the features of the comparative audio are checked for consistency, and it can be verified that the two have obvious differences in certain features. Comparing the adversarial noise with white noise can ensure that the adversarial characteristics found are not caused by simple noise addition, and comparing the adversarial sample with the original audio can ensure that the audio characteristics found are not possessed by the original speech itself. Therefore, the adversarial audio characteristics obtained by the present invention are caused by the adversarial attack superimposed on special noise, which can reflect the essential characteristics of the adversarial audio and can be used for the cause analysis and detection and protection of adversarial attacks.

[0050] (3) The measurement object of the present invention needs to be generated in different ways, including different adversarial attack methods, different speech recognition models, different original benign speech samples, and different attack target texts. The common features measured on this basis are universal and are not related to specific attacks, recognition models or audio samples. Therefore, the common features of adversarial audio obtained by the present invention are applicable to a variety of attacks and have high credibility and application value. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 A flowchart of a method for measuring common characteristics of adversarial audio proposed by the present invention;

[0052] Figure 2 This is a flow chart of speech recognition counterattack in the present invention. DETAILED DESCRIPTION

[0053] The following are specific embodiments of the present invention and the accompanying drawings to further describe the technical solution of the present invention, but the present invention is not limited to these embodiments.

[0054] The accompanying drawings are merely schematic illustrations of the present invention. Some of the block diagrams shown in the accompanying drawings are functional entities, which do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in the form of software, or in one or more hardware modules or integrated circuits, or in different networks and / or processor systems and / or microcontroller systems.

[0055] like Figure 1 The present invention proposes a method for measuring common characteristics of adversarial audio, comprising:

[0056] Step S01, determine the measurement implementation object. By analyzing the attack implementation plan of the adversarial audio, four types of audio, namely adversarial noise, adversarial samples, white noise, and benign samples, are used as measurement implementation objects. The purpose of measuring adversarial noise and adversarial samples is to discover the common characteristics of adversarial audio, while the purpose of measuring white noise and benign samples is to compare with adversarial audio. By comparing, it can be ensured that the adversarial characteristics discovered are generated by maliciously constructed noise, rather than random noise or derived from the original audio.

[0057] Step S02, generating a large amount of adversarial audio. The adversarial audio includes adversarial noise and adversarial samples. To ensure that the analyzed adversarial audio is representative and the adversarial characteristics found are independent of specific attacks and speech recognition models, adversarial audio is generated by different adversarial attack methods using attack components such as distance indicators and audibility indicators, and the benign samples and attack target texts corresponding to different adversarial audio should be different.

[0058] In a specific implementation of the present invention, step S02 specifically includes:

[0059] Step S21, analysis of the principle of speech recognition system. The speech recognition system converts human speech audio into text, which mainly includes three steps: preprocessing, feature extraction and model-based encoding and decoding. First, the speech recognition system divides the input audio into millisecond-level audio segments, also called frames, and then filters and window each frame to convert the one-dimensional time series vector into a two-dimensional time series matrix. Next, the acoustic features are extracted from the audio frame. Commonly used acoustic features include spectrograms, Mel-spectrograms (Filter Bank, Fbank), Mel-Frequency Cepstral Coefficients (Mel-Frequency Cepstral Coefficients, MFCC), etc. Finally, the acoustic features are input into the encoding and decoding model, which consists of an acoustic model and a language model. The acoustic model converts the acoustic features into the encoding of basic language units, such as characters or phonemes, and the language model further converts the basic language unit encoding into complete words or sentences.

[0060] Step S22, analysis of the principle of adversarial audio generation. The main goal of adversarial attacks on speech recognition systems is to construct a malicious disturbance. The audio plus the disturbance will be recognized by the speech recognition model as the target text. The content of the target text is different from human perception. At the same time, the disturbance has low audibility and is not easy to be discovered by humans. Figure 2 As shown. Adversarial audio generation can be converted into an optimization problem to solve. In this optimization problem, the optimization goal is to minimize the weighted sum of the distance index and the audibility index. The distance index measures the distance between the model recognition result of the adversarial sample generated after adding the adversarial noise perturbation and the attack target text, and the audibility index measures the degree to which the perturbation is perceived by humans. The selection of the distance index and the audibility index determines the specific method of the adversarial attack.

[0061] Step S23, adversarial attack selection. In this embodiment, three representative attack methods are selected. These attack methods use different distance indicators and audibility indicators in the optimization target, and these indicators are widely used in various adversarial attacks currently studied. In addition, these three attacks are launched against speech recognition models of different architectures. Specifically, the attack methods include: Psy attack, C&W attack, and Imp attack. The Psy attack uses the distance of the probability density distribution as the distance indicator and the absolute hearing threshold as the audibility indicator. It attacks the traditional model Kaldi DNN-HMM. The Kaldi DNN-HMM model uses the DNN architecture as an encoder and the HMM as a calibrator. In addition, a language model is used to optimize the output text. The C&W attack uses the CTC loss function value as the distance indicator and the decibel distortion as the audibility indicator. It attacks the DeepSpeech model based on the CTC loss function. The DeepSpeech model uses the CNN and LSTM architectures as encoders and the CTC loss function as a calibrator. In addition, a language model is used to optimize the output text. The Imp attack uses the cross-entropy loss function value as the distance indicator and psychoacoustic auditory masking as the audibility indicator. It attacks the LAS model based on the attention mechanism. The LAS model uses the pyramid BLSTM and LSTM architecture to unify the acoustic model and language model. It includes three parts: encoder, calibrator and decoder, and directly outputs text.

[0062] Step S24, adversarial noise and adversarial sample generation. This embodiment randomly selects 300 benign samples from the speech data set VCTK. The duration of these benign samples is between 1 and 4 seconds, and the speech content is different. Based on these benign samples, for example, for 300 different common phrases such as "Turn off the Light", 300 adversarial samples and 300 adversarial noises are generated for each attack method. During the generation process, the signal-to-noise ratio (SNR) of the adversarial noise is limited to 20-40dB, and the audibility of the adversarial noise is reduced while ensuring the success of the attack, which complies with the principle of adversarial attack. By perturbing the benign samples with adversarial noise, adversarial samples can be generated. In addition, this embodiment also needs to construct a comparison data set, including 300 randomly generated white noises and 300 benign samples, and the signal-to-noise ratio of the white noise is also between 20-40dB.

[0063] Step S03, calculating acoustic features. According to existing research results in phonetics, 15 commonly used acoustic features in phonetics such as short-time power, sound pressure level, and short-time autocorrelation rate are selected. These acoustic features can describe audio from aspects such as intensity, rhythm, pitch, and timbre. The acoustic features of the above four types of audio, namely, adversarial noise, adversarial samples, white noise, and benign samples, are calculated to form an acoustic feature vector.

[0064] In a specific implementation of the present invention, step S03 specifically includes:

[0065] Step S31, time domain features in acoustic features. This embodiment uses 7 time domain features, whose names and physical meanings are as follows: (1) Short-time power: the power of each frame of audio, reflecting the intensity of the sound; (2) Sound pressure level: the logarithm of the ratio of the effective value of the sound pressure to the reference value, reflecting the intensity of the sound; (3) Short-time autocorrelation rate: the correlation between a frame and adjacent frames, reflecting the periodicity of the sound; (4) Short-time average amplitude difference: the correlation between a frame and adjacent frames, reflecting the periodicity of the sound; (5) Short-time average zero-crossing rate: the frequency of the zero-crossing point of the audio signal, which can be used to distinguish between unvoiced and voiced sounds; (6) Phoneme duration: the duration of the phoneme in the recognition result of the speech recognition model; (7) Character interval time: the interval time between characters in the recognition result of the speech recognition model.

[0066] Step S32, frequency domain features in acoustic features. This embodiment uses 8 frequency domain features, whose names and physical meanings are as follows: (8) Spectral centroid: the frequency point where energy is concentrated in the frequency domain; (9) Fundamental frequency: the frequency of glottis opening and closing; (10) Energy entropy ratio: the ratio of energy to uncertainty, distinguishing between voiced and silent parts; (11) Spectrum graph: the signal strength of audio in different frequency bands; (12) Fbank: the signal strength of audio in different Mel spectrum bands; (13) MFCC: the cepstral coefficients of audio in Mel spectrum; (14) Spectrum envelope: the envelope of the peak in the spectrum graph, that is, the changing trend of signal strength; (15) LPC: linear predictive coding, that is, the denominator polynomial coefficients of the filter in the vocal tract model.

[0067] Step S04, calculate the statistical features. Since the acoustic feature vector has hundreds of thousands of dimensions, it is difficult to directly extract the characteristics of the adversarial audio from it. Therefore, on the basis of the acoustic features, a statistical feature such as difference, second-order difference, cosine distance, etc. is designed to describe the acoustic features to reduce the redundant information contained in the data. The 17 statistical features respectively describe the overall distribution and peak distribution of the features, mainly involving three aspects: continuity, regularity and distribution trend. Calculate the statistical features of the above-mentioned acoustic feature vectors to form an acoustic-statistical feature vector. This embodiment designs 15 acoustic features and 17 statistical features, which are combined to form a feature library containing 255 acoustic-statistical features.

[0068] In a specific implementation of the present invention, step S04 specifically includes:

[0069] Step S41, select the statistical feature type. This embodiment mainly focuses on the overall distribution and local distribution of the acoustic feature vector, where the local distribution refers to the data distribution around the peak value in the acoustic feature vector. Special attention is paid to the peak value because sounds with different semantics are generated by vocal channels of different shapes and different excitation sources, and the resonance of the excitation source in the vocal channel is reflected in the audio as the peak value of the signal. Therefore, it can be inferred that the tampering of the speech content by the adversarial sample is related to the change of the peak area signal. In the overall distribution or peak value, this embodiment mainly focuses on the continuity, regularity and distribution trend of the signal. These three aspects are selected because the speech emitted by humans can be regarded as a short-term stable signal, that is, the shorter fragments in the signal (generally 10-50ms) can be approximated as periodic signals. The reason why human speech is short-term stable is that the human vocal channel changes slowly and cannot produce significant changes in a short time. The adversarial audio is generated by a machine and is not subject to this restriction, so it can be assumed that the adversarial audio does not have the characteristics of short-term stability. Focusing on the continuity, regularity and distribution trend of the adversarial audio can verify the above assumptions.

[0070] Step S42, overall distribution statistical features. This embodiment uses 9 statistical features related to the overall distribution, and their names and meanings are as follows: (1) Difference: the difference between adjacent values ​​in a vector or matrix; (2) Second-order difference: the difference between adjacent values ​​in a vector or matrix; (3) Cosine distance: the cosine distance between adjacent vectors; (4) Euclidean distance: the Euclidean distance between adjacent vectors. The above four items are used to evaluate the continuity of the audio signal. (5) Autocorrelation rate: the correlation between adjacent segments in a vector or matrix; (6) Period: the length of the period; (7) Zero crossing rate: the frequency of occurrence of zero crossings in a vector or matrix; (8) Zero crossing distance: the distance between adjacent zero crossings. The above four items are used to evaluate the regularity of the audio signal. (9) The normalized value of the feature, the normalized vector or matrix, reflects the data distribution characteristics, and this statistical feature is used to describe the distribution trend of the feature.

[0071] Step S43, peak statistical features. This embodiment uses 8 statistical features related to peaks, and their names and meanings are as follows: (10) Peak distance, the distance between adjacent peaks in a vector or matrix, this statistical feature is used to evaluate the continuity of the peak. (11) Peak autocorrelation rate: the correlation between adjacent peaks; (12) Peak period: the length of the peak occurrence period. The above two items are used to evaluate the regularity of the peak. (13) The number of peaks: the number of peaks per unit time; (14) The position of the peak: the position of the peak in the vector or matrix; (15) The width of the peak: the number of data points contained in the vector or matrix; (16) The height of the peak: the local maximum in the vector or matrix; (17) The kurtosis of the peak: the ratio of the height and width of the peak, reflecting the steepness of the peak. The above five items are used to evaluate the distribution trend of the peak.

[0072] Step S05: consistency check.

[0073] Six statistics, including the mean, minimum, and median of the acoustic-statistical feature values ​​of each audio in the comparison audio (including white noise and benign samples) and the adversarial audio (including adversarial noise and adversarial samples) generated under each attack mode, are calculated. A hypothesis test is used to determine whether the difference between the adversarial audio and the comparison audio features is significant. If not, it means that there is no common feature. If significant, then test whether the difference between the adversarial audio and the comparison audio under different attack modes has the same sign. If the sign of the difference under a certain attack is the same, it is considered that the adversarial noise or adversarial sample has a common feature in this acoustic-statistical feature, which is the common feature of the adversarial audio.

[0074] In a specific implementation of the present invention, step S05 specifically includes:

[0075] Step S51, defining the adversarial characteristic. First, this embodiment gives a definition of the adversarial characteristic. The adversarial characteristic refers to a special distribution of acoustic-statistical feature values, that is, there is a significant difference between the distribution of the statistics (such as the average value) of the adversarial audio feature value and the comparison audio (i.e., benign sample or white noise).

[0076] Step S52, determining a comparison object. In this embodiment, adversarial noise and adversarial samples are used to measure adversarial characteristics. When performing consistency check, adversarial noise is compared with white noise, and adversarial samples are compared with benign samples.

[0077] Step S53, calculating statistics.

[0078] The statistics in the adversarial characteristic definition include six types: mean, minimum, first quartile, median, third quartile and maximum. The reason why the acoustic-statistical feature is not used directly here but its statistics is that a single acoustic-statistical feature of a single audio is not a single value but an array. Therefore, a single acoustic-statistical feature of a group of audio will be a group of arrays, and its distribution cannot be calculated. This embodiment uses six additional statistics to reduce the dimension of the acoustic-statistical feature to 1 to calculate the distribution of the feature over a large number of samples.

[0079] Taking a certain acoustic-statistical feature m of a certain adversarial noise as an example, we need to calculate m(δ) for the adversarial noise δ and for the white noise δ w Calculate m(δ w ), and calculate m(δ) and m(δ w ), denoted by S.

[0080] Step S54: test for significance of difference.

[0081] This embodiment uses hypothesis testing to determine whether the difference between features is significant. Specifically, the Kruskal-Wallis H test is used on the feature distribution of adversarial audio and contrast audio. The null hypothesis used in this hypothesis test is that the features of adversarial audio and benign audio follow the same distribution. The reason for choosing this hypothesis testing method is that it is a non-parametric test, which is suitable for situations where the overall distribution of data is unknown, and is suitable for analyzing whether two groups of independent samples have the same distribution under the influence of a single factor. The rejection region critical value used in this embodiment is 0.003. If p≤0.003 in the hypothesis test, the null hypothesis is rejected, indicating that there are significant differences between the two types of audio features. 0.003 is selected as the critical value of the p value here because the hypothesis test is repeated six times for each null hypothesis in the experiment, that is, the hypothesis test is performed on the six statistics of an acoustic-statistical feature. This hypothesis testing method belongs to multiple hypothesis testing. Generally, the original rejection region critical value needs to be divided by the number of hypothesis tests as the new critical value. The original critical value selected here is 0.05, so the critical value finally used is 0.003.

[0082] In a specific implementation of the present invention, a comparison is first performed between the adversarial noise and the white noise. For the nth attack mode, each statistic S of the adversarial noise δ generated under the attack mode is i (m(δ)) and the corresponding white noise statistic S i (m(δ w )) Perform a Kruskal-Wallis H test to obtain a p-value; perform a Kruskal-Wallis H test on each statistic, obtain a total of six p-values, and retain the lowest p-value p min , and p min The corresponding statistic S k For N attack methods, repeat the above N times to get p min,1 ,p min,2 ,…,p min,N and its corresponding statistic S k,1 ,S k,2 ,…,S k,N The subscript k indicates the kth statistic, n indicates the nth attack method; the statistic S k,1 ,S k,2 ,…,S k,N The types of statistics appearing in are denoted as s1, s2, …, s L , where L≤N and L≤6.

[0083] If all p min,1 ,p min,2 ,…,p min,NIf the values ​​are all less than the critical value of 0.003, it is considered that there is a significant difference between the adversarial noise generated by different attack methods and the white noise, and step S55 can be directly executed; otherwise, it is considered that there is no significant difference between the adversarial noise generated by different attack methods and the white noise, and a comparison between the adversarial samples and the benign samples is required. The comparison method is the same as above and will not be repeated here. If there is no significant difference between the adversarial samples generated by different attack methods and the benign samples, it means that the adversarial audio does not have common features in this acoustic-statistical feature; if there is a significant difference between the adversarial samples generated by different attack methods and the benign samples, step S55 is executed.

[0084] In this step, the adversarial sample and the benign sample can be compared first. If there is a significant difference, step S55 can be directly executed, otherwise the adversarial noise and the white noise can be compared. The comparison order of the two groups of audio can be customized. When there is a significant difference after comparing any group of audio, the symbol consistency check is further performed.

[0085] Step S55: symbol consistency check: The symbol consistency check is used to check whether the adversarial audios under different attack modes have the same difference symbols.

[0086] In a specific implementation of the present invention, firstly, a comparison is made between the adversarial noise and the white noise, and s under each attack mode is calculated. j (m(δ)) and s j (m(δ w ))’s probability density function (PDF), make the difference between the two, and record the difference sign (positive or negative). If the corresponding difference signs are the same under all attack modes, it means that the statistic s of the acoustic-statistical feature m of the anti-noise j is a common characteristic, and the common characteristic is denoted as s j (m(δ))>or<s j (m(δ w )), where “>or <” depends on the sign of the difference, s1(m(δ))>s1(m(δ w )) as an example, it means that the average value of the acoustic-statistical feature m of the anti-noise is greater than the average value of the acoustic-statistical feature m of the white noise. This feature is a common feature of the anti-noise. Traverse the acoustic-statistical feature m and the statistic s j , and obtain all the common characteristics for resisting noise.

[0087] Similarly, the adversarial samples are compared with the benign samples. The comparison method is the same as above, traversing the acoustic-statistical features m and statistics s j , and obtain all the common characteristics of adversarial samples.

[0088] Combining all the common characteristics of the above-mentioned adversarial noise and all the common characteristics of the adversarial samples, we get all the common characteristics of the adversarial audio.

[0089] The present invention proposes a method for measuring the common characteristics of adversarial audio. First, 15 acoustic features are used to describe the audio, and 17 statistical features are used to describe the continuity, regularity and distribution trend of the acoustic feature vector in the overall and peak parts in a fine-grained manner. Different from the existing methods that only analyze the characteristics of adversarial samples from the spectrum distribution level, the present invention uses multiple acoustic features to extract the characteristics of audio from multiple aspects such as intensity, rhythm, pitch, timbre, etc., and realizes a relatively complete exploration of adversarial audio characteristics; the present invention explores the unique properties of adversarial audio, and through the difference test between the contrast audio, ensures that the adversarial characteristics found are caused by adversarial attacks. The common characteristics measured by the present invention can reflect the essential properties of adversarial audio, and can be used for cause analysis and detection and protection of adversarial attacks; the present invention explores the common characteristics of adversarial audio under multiple adversarial attacks, which is universal, not related to specific attacks, recognition models or audio samples, and is applicable to multiple attacks, with high credibility and application value.

[0090] The above examples are only specific embodiments of the present invention. Obviously, the present invention is not limited to the above examples, and many variations are possible. All variations that can be directly derived or associated with the contents disclosed by a person skilled in the art should be considered as the protection scope of the present invention.

Claims

1. A method for measuring common characteristics of adversarial audio, characterized in that: The following steps are involved: Step S01, determining a measurement implementation object, wherein the measurement implementation object includes adversarial noise, adversarial samples, white noise, and benign samples; the adversarial noise and adversarial samples are used as adversarial audio, and the white noise and benign samples are used as comparative audio; Step S02, generating a large number of adversarial noises and adversarial samples based on different adversarial attack methods, wherein the adversarial attack methods use a distance index and an audibility index as generation optimization targets, and the adversarial samples are obtained by adding adversarial noise to benign samples; Step S03, calculating the acoustic features of the adversarial noise, adversarial samples, white noise and benign samples to form an acoustic feature vector; Step S04, calculating the statistical features of the acoustic feature vector to form an acoustic-statistical feature vector; the statistical features are used to describe the overall distribution and peak distribution of the acoustic feature vector, including continuity, regularity and distribution trend; Step S05, calculating several statistics of the acoustic-statistical feature vectors of the adversarial noise, adversarial samples, white noise and benign samples, performing a difference significance test based on the statistics corresponding to different adversarial attack methods, and if the difference significance test passes, screening the statistical type with significant difference, and continuing to perform the sign consistency test, if the difference signs of the adversarial audio and the comparison audio of all adversarial attack methods are the same under the statistical type with significant difference, then measuring and obtaining the common characteristics of the adversarial audio; If the difference significance test fails, the measurement process is terminated and the adversarial audio has no common features.

2. The method for measuring common characteristics of adversarial audio according to claim 1, characterized in that: The step S02 comprises: (2.1) Generate adversarial noise using an adversarial attack method, add the adversarial noise to a benign sample, and generate an adversarial sample corresponding to the benign sample. The adversarial sample will be recognized by the speech recognition model as an attack target text, and the attack target text is different from the real text of the benign sample; the weighted sum of the distance index between the model recognition result of the adversarial sample and the attack target text and the audibility index of the adversarial noise is minimized; (2.2) Changing the adversarial attack mode multiple times and repeating step (2.1) to generate adversarial noise and adversarial samples corresponding to different adversarial attack modes; the different adversarial attack modes all use the distance index and the audibility index as generation optimization targets, and can cover a variety of different speech recognition models.

3. The method for measuring common characteristics of adversarial audio according to claim 2, characterized in that: The white noise is randomly generated, the benign samples are randomly selected, and the benign samples correspond to different attack target texts.

4. The method for measuring common characteristics of adversarial audio according to claim 1, characterized in that: The acoustic features include time domain features and frequency domain features. The time domain features include short-time power, sound pressure level, short-time autocorrelation rate, short-time average amplitude difference, short-time average zero-crossing rate, phoneme duration, and character interval time; the frequency domain features include spectrum centroid, fundamental frequency, energy entropy ratio, spectrogram, Mel-spectrogram, Mel-cephalogram coefficients, spectrum envelope, and linear predictive coding.

5. The method for measuring common characteristics of adversarial audio according to claim 1, characterized in that: The step S04 comprises: (4.1) determining a statistical feature type, wherein the statistical feature type includes an overall distribution and a local distribution of an acoustic feature vector, wherein the local distribution refers to a data distribution around a peak value in the acoustic feature vector; (4.2) Designing overall distribution statistical features from three aspects: continuity, regularity and distribution trend, wherein the overall distribution statistical features include difference, second-order difference, cosine distance, Euclidean distance, autocorrelation rate, period, zero-crossing rate, zero-crossing distance and normalized value of features; (4.3) Designing local distribution statistical features from three aspects: continuity, regularity and distribution trend. The local distribution statistical features are for the peaks in the acoustic feature vector, including the distance between peaks, the autocorrelation rate of the peaks, the period of the peaks, the number of peaks, the position of the peaks, the width of the peaks, the height of the peaks, and the kurtosis of the peaks; (4.4) Calculate the acoustic-statistical feature vector of the acoustic feature vector based on the overall distribution statistical features and the local distribution statistical features designed in step (4.2) and step (4.3).

6. The method for measuring common characteristics of adversarial audio according to claim 1, characterized in that: The step S05 comprises: (5.1) defining an adversarial characteristic, wherein the adversarial characteristic refers to a significant difference between the statistics of the acoustic-statistical feature vector of the adversarial noise or adversarial sample and the statistics of the acoustic-statistical feature vector of the corresponding white noise or benign sample; (5.2) Calculate several statistics of the acoustic-statistical feature vectors of adversarial noise, adversarial samples, white noise, and benign samples; (5.3) Performing a difference significance test based on the statistics corresponding to different attack modes. The difference significance test is: using a hypothesis test to determine whether there is a significant difference in the statistics corresponding to the noise combination consisting of the adversarial noise and white noise generated under different attack modes, and / or using a hypothesis test to determine whether there is a significant difference in the statistics corresponding to the sample combination consisting of the adversarial samples and benign samples generated under different attack modes. When there is a significant difference between any combination of the noise combination and the sample combination, the difference significance test is passed; otherwise, it fails and the measurement process ends; (5.4) If the difference significance test is passed, the statistical type with significant difference is screened, and a sign consistency test is performed: when the difference signs of the probability density functions of the adversarial audio and the comparison audio corresponding to all adversarial attack methods are the same under the j-th statistical type with significant difference in the acoustic-statistical feature m, then the acoustic-statistical feature m of the adversarial audio has a common characteristic under the j-th statistical type with significant difference, and a common feature is generated according to the positive or negative sign of the difference; traverse all acoustic-statistical features m and all statistical types with significant difference to generate all adversarial features of the adversarial audio.

7. The method for measuring common characteristics of adversarial audio according to claim 6, characterized in that: The types of statistics of the acoustic-statistical feature vector include mean value, minimum value, first quartile, median, third quartile, and maximum value.

8. The method for measuring common characteristics of adversarial audio according to claim 6, characterized in that: In the step (5.3), when performing a difference significance test for any combination, for the nth adversarial attack method, each statistic S of the adversarial noise δ generated under the adversarial attack method is i (m(δ)) and the corresponding white noise statistic S i (m(δ w )) Perform Kruskal-Wallis H test to obtain p value; where S i (m(δ)) represents the statistical result of the acoustic-statistical feature m of the adversarial audio δ under the i-th statistical type, S i (m(δ w )) indicates contrast audio delta w The statistical result of the acoustic-statistical feature m under the i-th statistical type; Traverse all statistical types and retain the lowest p-value and the statistical type corresponding to the lowest p-value; Traverse all the adversarial attack methods and get p min，1 , p min，2 , ..., p min，N , where p min，N represents the minimum p value corresponding to the Nth adversarial attack method, and N represents the number of all adversarial attack methods; If p min，1 , p min，2 , ..., p min，N No more than 0.05 / M, where M is the number of all statistical types, then p min，1 , p min，2 , ..., p min，N The corresponding statistic type is the statistic type with significant differences.

9. The method for measuring common characteristics of adversarial audio according to claim 6, characterized in that: The step (5.4) is specifically: Calculate the statistics s of the acoustic-statistical features of the adversarial audio and the comparison audio under each adversarial attack mode j (m(δ)), s j (m(δ w )) probability density function, where s j (m(δ)) represents the statistical result of the acoustic-statistical feature m of the adversarial audio δ under the jth statistical type with significant difference, s j (m(δ w )) indicates contrast audio delta w The acoustic-statistical feature m of is the statistical result under the jth statistical type with significant difference; s j (m(δ)), s j (m(δ w ))’s probability density function is subtracted and the sign of the difference is recorded; Traverse all adversarial attack methods, compare adversarial noise and white noise as the first combination, and compare adversarial samples and benign samples as the second combination. When the positive and negative signs of the corresponding differences under all attack methods in any combination are the same, it means that the acoustic-statistical features m of the adversarial noise or adversarial samples in the combination have common characteristics under the jth statistical type with significant differences, and generate common features according to the difference signs; Traverse all acoustic-statistical features and all statistical types with significant differences to obtain all common features of adversarial noise and adversarial samples.

10. The method for measuring common characteristics of adversarial audio according to claim 9, characterized in that: The generating of common features according to the difference signs includes: When the corresponding difference sign is positive, the common feature is recorded as s j (m(δ))>s j (m(δ w )), indicating that the statistical result of the acoustic-statistical feature m of the adversarial noise / adversarial sample under the jth statistical type with significant differences is greater than the statistical result of the acoustic-statistical feature m of the white noise / benign sample under the jth statistical type with significant differences; When the corresponding difference sign is negative, the common feature is recorded as s j (m(δ))<s j (m(δ w )), indicating that the statistical result of the acoustic-statistical feature m of the adversarial noise / adversarial sample under the jth statistical type with significant differences is smaller than the statistical result of the acoustic-statistical feature m of the white noise / benign sample under the jth statistical type with significant differences.

Images