Voice signal confrontation sample generation method under black box condition

Abstract

The invention discloses a voice signal confrontation sample generation method under a black box condition, and belongs to the field of voice information confrontation sample production methods. An existing confrontation sample generation algorithm under the black box condition has the problems that the attack efficiency is low, the algorithm is prone to falling into local optimum, and confrontation sample concealment is insufficient. The method comprises the following steps: carrying out feature extraction on a preprocessed voice signal; generating an adversarial sample by using a CMA-ES algorithm, randomly generating a group of solutions in a search space by the CMA-ES, and optimizing the group of solutions; optimizing by applying a gradient estimation method, estimating the gradient of an objective function relative to parameters by using the gradient estimation method for an initial adversarial sample generated by the CMA-ES, and updating the adversarial sample according to the estimated gradient information; a Deepspeech speech recognition system is used as a pre-trained acoustic model, and the output of the acoustic model is used as a constraint condition. The method improves the generation efficiency of the adversarial sample, introduces the acoustic model to improve the concealment of the adversarial sample, and can keep effective even on different target models.

Description

Technical Field

[0001] The present invention relates to a method for producing signal adversarial samples, and in particular to a method for producing speech signal adversarial samples under black box conditions. Background Art

[0002] Language is the cornerstone of human society and culture and plays an extremely important role. A short voice signal can carry a lot of information. In recent years, driven by artificial intelligence and deep learning technologies, human-computer interaction systems based on voice recognition have been realized and widely popularized. Voice command control systems such as smart phone voice wake-up and smart speakers, and the usage rate of voice intelligent interaction systems and devices are increasing year by year.

[0003] Automatic speech recognition (ASR) systems have been popularized in many fields. They can interpret the voice signals received on devices, allowing us to remotely control and interact with these devices. However, the security issues existing in artificial intelligence technology also seriously affect the field of voice interaction. Studies have shown that neural networks are vulnerable to adversarial samples. Since the adversarial samples were proposed, they have brought great security threats to the widely used neural network technology. Adversarial samples refer to samples generated by adding small perturbations to the original clean data, which can effectively fool the target model to give a wrong prediction output result with high confidence. In the field of voice interaction, voice applications such as speech recognition, speech classification, and speaker recognition are vulnerable to adversarial samples. For example, when a voice sample is input into a voice command classification model, a normal voice sample can be classified as Yes by the voice classifier, but by adding a small, inaudible adversarial perturbation to the original voice sample, the classification result of the voice classifier will become No.

[0004] Research on adversarial samples in the field of speech started relatively late, and some related research has been carried out in recent years. Researchers usually input the generated adversarial samples as test cases into intelligent speech recognition software to observe whether the adversarial samples will cause the software to make wrong judgments, so as to take defensive methods to improve the security and robustness of intelligent software. In the generation of adversarial samples, black-box intelligent speech software is more common in life and has practical research value. However, the existing generation methods have certain limitations. On the one hand, compared with the generation of adversarial samples in the field of computer vision, it is more difficult to design adversarial samples in the field of speech; on the other hand, the current research on adversarial samples in the field of speech is relatively weak. At present, the adversarial sample generation algorithm under black-box conditions in the field of speech is mainly designed based on genetic algorithms. This method often requires huge computing resources and time overhead, which seriously restricts the practicality of the current speech adversarial attack algorithm. In addition, it is easy to fall into the local optimal solution during the execution of the algorithm, resulting in the decline of the quality of the generated adversarial samples and unsatisfactory attack effects. At the same time, these methods usually add obvious noise to the original speech, making the adversarial samples easy to be detected. In-depth research on adversarial attack algorithms in the speech field will help address these deficiencies in the current speech recognition model design and promote the design of safer and more effective speech recognition models, which is of great significance for further ensuring the security of speech recognition models.

[0005] In summary, the current research on adversarial samples in the field of speech is not in-depth enough, and there are few existing algorithms. Algorithms for generating adversarial samples under black box conditions are even more scarce, and existing algorithms have defects such as low attack efficiency, algorithms are prone to falling into local optimality, and adversarial samples are not concealed enough. By studying adversarial sample generation, the vulnerability of speech recognition systems can be revealed, which helps to identify and fix potential security vulnerabilities. This is very important to ensure that speech recognition systems can be more robust and secure in the face of malicious attacks. Research on adversarial sample generation in the speech field is of great significance to improving the security, performance, and privacy protection of speech recognition systems, and helps to cope with evolving technical and security challenges. Summary of the invention

[0006] The purpose of the present invention is to solve the problems of low attack efficiency, easy falling into local optimum, insufficient concealment of adversarial samples, etc. in the existing adversarial sample generation algorithm under black box conditions, and to propose a method for generating adversarial samples of speech signals under black box conditions.

[0007] The above purpose is achieved through the following technical solutions:

[0008] A method for generating adversarial samples of speech signals under black box conditions, the method is implemented by the following steps:

[0009] Step 1: Collect voice signals and perform preprocessing;

[0010] The LibriSpeech speech dataset is used to generate adversarial samples; the DeepSpeech speech recognition system is selected as the test target; the signal preprocessing method steps are adjusted according to the model response, and the original signal is preprocessed including feature representation, normalization, and dimensionality reduction;

[0011] Step 2: Extract features from the preprocessed speech signal, and use the extracted features for the acoustic model and optimization algorithm;

[0012] Step 3: Use the CMA-ES algorithm to generate the initial adversarial samples. CMA-ES randomly generates a set of solutions in the search space and optimizes this set of solutions by continuously adjusting the search path and covariance matrix.

[0013] Step 4: Apply the gradient estimation method for optimization. For the initial adversarial sample generated by CMA-ES, use the gradient estimation method to estimate the gradient of the objective function relative to the parameter, and update the adversarial sample based on the estimated gradient information. The number of iterations is selected as multiple times, and the gradient estimation method is used to further adjust the adversarial sample in each iteration.

[0014] Step 5: Use the Deepspeech speech recognition system as a pre-trained acoustic model, constrain the generation of adversarial samples, design the objective function, and use the output of the acoustic model as a constraint.

[0015] Furthermore, in step 3, the initial adversarial sample is generated using the CMA-ES algorithm. CMA-ES randomly generates a set of solutions in the search space, and optimizes the set of solutions by continuously adjusting the search path and the covariance matrix. Specifically, the steps include:

[0016] Generate new individuals:

[0017] CMA-ES changes from Generate λ individuals;

[0018] x i =m t +σ t y i ,y i ~N(0,C t )

[0019] Where: y i ∈R n is the search direction; y is solved by eigenvalue decomposition of the covariance matrix C: t =BD 2 B T , and obtained through the standard normal distribution:

[0020] y i =BDz i,z i ~N(0,I)

[0021] Afterwards, calculate the fitness:

[0022] Calculate the fitness f(x) of each new individual and sort them by fitness;

[0023] f(x 1:λ )≤f(x 2:λ )≤......≤f(x λ:λ )

[0024] According to the fitness ranking, the first μ individuals are intercepted for parameter update, using μ = [λ / 2], or other interception methods;

[0025] Afterwards, update the parameters:

[0026] Use the selected individuals to update the distribution parameters m t ,C t and σ t ; First update the mean:

[0027]

[0028]

[0029] Among them: m is the mean, the following table t represents algebra, m t is the weighted average of individual x;

[0030] Afterwards, update the covariance matrix:

[0031] In CMA-ES, the update of the covariance matrix includes rank-1 and rank-μ, where rank-1 uses historical search information, namely the evolution path, and the evolution path and covariance matrix update formula are expressed as follows:

[0032]

[0033]

[0034] Among them, c1 and c μ is the learning rate;

[0035] Afterwards, the CMA-ES algorithm is used to generate adversarial samples:

[0036] First, define the problem of adversarial sample generation, including the target model of the attack, the target category of the generated adversarial samples, etc., and determine the optimization goal of CMA-ES; then, define the parameters in CMA-ES, including population size, number of iterations, and initial parameter distribution; if there are additional constraints, ensure that they are met in the optimization, that is, additionally meet the constraints of the acoustic model; sample the original signal to generate the initial population of CMA-ES, start iterative optimization, and apply the generated parameter vector to the original signal to generate adversarial samples; finally, determine whether it converges to a suitable solution.

[0037] Furthermore, the gradient estimation method is applied for optimization in step 4. For the initial adversarial sample generated by CMA-ES, the gradient estimation method is used to estimate the gradient of the objective function relative to the parameter, and the steps of updating the adversarial sample according to the estimated gradient information are as follows:

[0038] In the gradient estimation method, the attacker needs to know the output probability distribution of the model, that is, for the user's input x, the model will give the probability matrix g(x) of various outputs; the attacker estimates the gradient distribution of the loss function for different input positions by querying the changes in the model output distribution after slight perturbations at different input positions; the gradient is estimated through g(x) using the following formula:

[0039]

[0040]

[0041] Among them, FD x (g(x), δ) is the gradient estimate of the model output probability distribution to the input, δ is the estimation accuracy, and d is the dimension of the input vector; when δ→0, FD x (g(x),δ) is equal to the gradient of g(x) with respect to x.

[0042] Furthermore, the process described in step 5 of using the Deepspeech speech recognition system as a pre-trained acoustic model, constraining the generation of adversarial samples, designing the objective function, and taking the output of the acoustic model as a constraint condition is specifically:

[0043] When generating adversarial samples, acoustic model constraints are introduced to make the generated adversarial samples more consistent with the natural distribution of speech and avoid generating overly abnormal or unnatural sounds. The acoustic model constraints introduced when generating adversarial samples include:

[0044] Select and train an acoustic model:

[0045] Use DeepSpeech as the constraint model and use the speech dataset preprocessed in step 1 to train the acoustic model;

[0046] Introducing acoustic model constraints:

[0047] Input the current adversarial sample into the acoustic model and obtain the output of the model. This step is called forward propagation, which obtains the model's prediction result for the adversarial sample. Define an acoustic model loss function to measure the difference between the adversarial sample and normal speech. This loss function includes spectral differences and vocal tract characteristics. Combine the loss of the acoustic model with the loss of the adversarial model. In each round of algorithm iteration, include the acoustic model loss to guide the generation direction of adversarial samples.

[0048] The beneficial effects of the present invention are:

[0049] This paper aims at the generation of speech signal adversarial samples under the currently immature black box condition. Combining the CMA-ES algorithm and the gradient estimation method, a new adversarial sample generation algorithm is proposed. At the same time, in order to solve the defect of poor concealment of speech signal adversarial samples, it is proposed to introduce acoustic model constraints into the optimization algorithm to constrain the generation of adversarial samples, so that the adversarial and natural nature of adversarial samples can be balanced. Specifically include:

[0050] The CMA-ES algorithm is used to replace the genetic algorithm to generate adversarial samples. The CMA-ES algorithm is applied to the speech field. CMA-ES is suitable for high-dimensional continuous problems. It is a global search algorithm that helps to find the global optimal solution in a complex parameter space by adaptively adjusting the covariance matrix. This is more effective when dealing with high-dimensional and complex speech signal generation problems. At the same time, compared with the genetic algorithm, the CMA-ES algorithm has a faster convergence speed, which can improve the efficiency of adversarial sample generation.

[0051] Combine the CMA-ES algorithm with the gradient estimation method. The gradient estimation method has good local search capabilities. After the CMA-ES algorithm finds the initial solution, it can fine-tune it to improve the quality of adversarial samples. At the same time, the combination of CMA-ES and the gradient estimation method provides algorithm flexibility. During the search process, it can decide when to use global search and when to use local optimization based on the real-time optimization state to balance the exploration and utilization of the algorithm.

[0052] To address the problem of poor concealment of adversarial samples of speech signals, we introduce constraints of acoustic models in the process of optimizing algorithms to generate adversarial samples. We train an acoustic model with normal speech to constrain the generation of adversarial samples, so that adversarial samples can have similar features to normal speech, thereby improving the concealment of adversarial samples. At the same time, because the similarity of acoustic features can be shared among multiple models, introducing constraints of acoustic models may improve the transferability of adversarial samples and remain effective even on different target models. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1is a flow chart of the method of the present invention;

[0054] Figure 2 This is a flowchart of the CMA-ES algorithm involved in the present invention for generating adversarial samples. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Specific implementation method one:

[0058] A method for generating adversarial samples of speech signals under black box conditions in this embodiment is as follows: Figure 1 As shown, the method is implemented by the following steps:

[0059] Step 1: Collect voice signals and perform preprocessing;

[0060] The LibriSpeech speech dataset is used to generate adversarial samples. The LibriSpeech speech dataset extracts and processes speech data from the audiobooks of the LibriVox project, and the LibriSpeech speech dataset has been segmented and pre-aligned, which will help evaluate the algorithm; and the DeepSpeech speech recognition system is selected as the test target to verify the effectiveness of the algorithm. When using an optimization algorithm to generate speech adversarial samples, preprocessing is a key step. Preprocessing affects the performance of the optimization algorithm and the quality of the generated adversarial samples; adjust the signal preprocessing method steps according to the model response, and preprocess the original signal including appropriate feature representation, normalization, dimensionality reduction, etc.;

[0061] Step 2: Extract features from the preprocessed speech signal, and use the extracted features for the acoustic model and optimization algorithm;

[0062] Step 3: Use the CMA-ES algorithm to generate the initial adversarial samples. CMA-ES randomly generates a set of solutions in the search space and optimizes this set of solutions by continuously adjusting the search path and covariance matrix.

[0063] Step 4: Apply the gradient estimation method for optimization. For the initial adversarial sample generated by CMA-ES, use the gradient estimation method to estimate the gradient of the objective function relative to the parameter, and update the adversarial sample based on the estimated gradient information. The number of iterations is selected as multiple times, and the gradient estimation method is used to further adjust the adversarial sample in each iteration. This iterative process can strike a balance between global search and local search, and gradually improve the performance of adversarial samples.

[0064] Step 5: Use the Deepspeech speech recognition system as a pre-trained acoustic model, constrain the generation of adversarial samples, design an objective function, and use the output of the acoustic model as a constraint. The objective function includes minimizing the difference in speech quality between the adversarial sample and the original sample, while making the output of the model for the generated sample as close as possible to the output of the original sample. Specific implementation method 2:

[0066] Different from the first specific implementation mode, in the method for generating adversarial samples of speech signals under black box conditions in this implementation mode, the initial adversarial samples are generated using the CMA-ES algorithm as described in step 3, and CMA-ES randomly generates a set of solutions in the search space, and optimizes the set of solutions by continuously adjusting the search path and the covariance matrix, specifically:

[0067] CMA-ES is a global optimization algorithm that is often used to solve complex, high-dimensional non-convex optimization problems. It combines the ideas of evolutionary strategies and adaptive covariance matrices, and has the ability to adaptively adjust the shape and scale of the search space, making it perform better in dealing with various problems. Compared with genetic algorithms, CMA-ES usually has a faster convergence speed. It searches the parameter space more efficiently by adaptively adjusting the covariance matrix in the search space. At the same time, CMA-ES can adaptively adjust the search step size in different directions, so the search on high-dimensional problems is more effective.

[0068] The CMA-ES algorithm structure is as follows:

[0069] Generate new individuals:

[0070] CMA-ES changes from Generate λ individuals;

[0071] x i =m t +σ t y i ,y i ~N(0,C t )

[0072] Where: y i ∈R nis the search direction; y is solved by eigenvalue decomposition of the covariance matrix C: t =BD 2 B T , and obtained through the standard normal distribution:

[0073] y i =BDz i ,z i ~N(0,I)

[0074] Afterwards, calculate the fitness:

[0075] Calculate the fitness f(x) of each new individual and sort them by fitness;

[0076] f(x 1:λ )≤f(x 2:λ )≤......≤f(x λ:λ )

[0077] According to the fitness ranking, the first μ individuals are intercepted for parameter update, using μ = [λ / 2], or other interception methods;

[0078] Afterwards, update the parameters:

[0079] Use the selected individuals to update the distribution parameters m t ,C t and σ t ; First update the mean:

[0080]

[0081]

[0082] Among them: m is the mean, the following table t represents algebra, m t is the weighted average of individual x;

[0083] Afterwards, update the covariance matrix:

[0084] In CMA-ES, the update of the covariance matrix includes rank-1 and rank-μ, where rank-1 uses historical search information, namely the evolution path, and the evolution path and covariance matrix update formula are expressed as follows:

[0085]

[0086]

[0087] Among them, c1 and c μ is the learning rate;

[0088] Afterwards, the CMA-ES algorithm is used to generate adversarial samples:

[0089] First, define the problem of adversarial sample generation, including the target model of the attack, the target category of the generated adversarial samples, etc., and determine the optimization goal of CMA-ES, such as minimizing the error of the target model to the adversarial samples; then, define the parameters in CMA-ES, including population size, number of iterations, and initial parameter distribution; if there are additional constraints, ensure that they are met in the optimization, that is, additionally meet the constraints of the acoustic model; sample the original signal to generate the initial population of CMA-ES, start iterative optimization, and apply the generated parameter vector to the original signal to generate adversarial samples; finally, determine whether it converges to a suitable solution. Figure 2 Flowchart for generating adversarial examples for the CMA-ES algorithm. Specific implementation method three:

[0091] Different from the second specific implementation mode, in the method for generating speech signal adversarial samples under black box conditions in this implementation mode, the gradient estimation method is applied for optimization in step 4. For the initial adversarial samples generated by CMA-ES, the gradient estimation method is used to estimate the gradient of the objective function relative to the parameter, and the steps of updating the adversarial samples according to the estimated gradient information are as follows:

[0092] In the gradient estimation method, the attacker needs to know the output probability distribution of the model, that is, for the user's input x, the model will give the probability matrix g(x) of various outputs; the attacker estimates the gradient distribution of the loss function for different input positions by querying the changes in the model output distribution after slight perturbations at different input positions; the gradient is estimated through g(x) using the following formula:

[0093]

[0094]

[0095] Among them, FD x (g(x), δ) is the gradient estimate of the model output probability distribution to the input, δ is the estimation accuracy, and d is the dimension of the input vector; when δ→0, FD x (g(x),δ) is equal to the gradient of g(x) with respect to x. Specific implementation method four:

[0097] Different from the third specific implementation, the method for generating adversarial samples of speech signals under black box conditions in this implementation is that the Deepspeech speech recognition system is used as a pre-trained acoustic model in step 5 to constrain the generation of adversarial samples, design the objective function, and use the output of the acoustic model as a constraint condition. Specifically, the process is:

[0098] The acoustic model is one of the most important parts of the speech recognition system. Most mainstream systems use the hidden Markov model for modeling. The input of the acoustic model is the features extracted by the feature extraction module. Generally speaking, these features are multi-dimensional vectors, and their values ​​can be discrete or continuous.

[0099] The purpose of introducing acoustic model constraints is to better maintain the naturalness and listening experience of speech when generating adversarial samples, thereby improving the concealment of adversarial samples and making them more difficult to detect. Acoustic models are usually used to capture the characteristics of speech signals, such as spectrum, vocal tract characteristics, etc. When generating adversarial samples, by introducing acoustic model constraints, the generated adversarial samples are more consistent with the natural distribution of speech and avoid generating overly abnormal or unnatural sounds. The acoustic model constraints introduced when generating adversarial samples include:

[0100] Select and train an acoustic model:

[0101] Select a suitable acoustic model, usually a model that can capture the characteristics of speech signals. Use DeepSpeech as the constraint model and train the acoustic model using the speech dataset preprocessed in step 1 to ensure that the model can better capture the characteristics of normal speech.

[0102] Generate initial adversarial examples:

[0103] Generate initial adversarial samples using algorithms such as CMA-ES. This stage does not consider acoustic model constraints, but only focuses on adversarial properties.

[0104] Introducing acoustic model constraints:

[0105] Input the current adversarial sample into the acoustic model and obtain the output of the model. This step is called forward propagation, which obtains the model's prediction result for the adversarial sample. Define an acoustic model loss function to measure the difference between the adversarial sample and normal speech. This loss function includes spectral differences, vocal tract characteristics, etc. Combine the loss of the acoustic model with the loss of the adversarial model. In each round of algorithm iteration, include the acoustic model loss to guide the generation direction of adversarial samples.

[0106] The embodiments of the present invention disclose preferred embodiments, but are not limited thereto. A person skilled in the art can easily understand the spirit of the present invention based on the above embodiments and make different extensions and changes. However, as long as they do not deviate from the spirit of the present invention, they are all within the protection scope of the present invention.

Claims

1. A method for generating adversarial samples of speech signals under black-box conditions, characterized by: The method is implemented by the following steps: Step 1: Collect voice signals and perform preprocessing; Use the LibriSpeech speech dataset to generate adversarial samples; The DeepSpeech speech recognition system is selected as the test target; the signal preprocessing method steps are adjusted according to the model response, and the original signal is preprocessed including feature representation, normalization, and dimensionality reduction; Step 2: Extract features from the preprocessed speech signal, and use the extracted features for the acoustic model and optimization algorithm; Step 3: Use the CMA-ES algorithm to generate the initial adversarial samples. CMA-ES randomly generates a set of solutions in the search space and optimizes this set of solutions by continuously adjusting the search path and covariance matrix. Step 4: Apply the gradient estimation method for optimization. For the initial adversarial sample generated by CMA-ES, use the gradient estimation method to estimate the gradient of the objective function relative to the parameter, and update the adversarial sample based on the estimated gradient information. The number of iterations is selected as multiple times, and the gradient estimation method is used to further adjust the adversarial sample in each iteration. Step 5: Use the Deepspeech speech recognition system as a pre-trained acoustic model, constrain the generation of adversarial samples, design the objective function, and use the output of the acoustic model as a constraint.

2. According to the method for generating adversarial samples of speech signals under black box conditions in claim 1, it is characterized by: In step 3, the CMA-ES algorithm is used to generate the initial adversarial sample. CMA-ES randomly generates a set of solutions in the search space and optimizes this set of solutions by continuously adjusting the search path and covariance matrix. Specifically, the steps include: Generate new individuals: CMA-ES changes from Generate λ individuals; x i =m t +σ t y i ,y i ~N(0,C t ) Where: y i ∈R n is the search direction; y is solved by eigenvalue decomposition of the covariance matrix C: t =BD 2 B T , and obtained through the standard normal distribution: yes i =BDz i ,z i ~N(0,I) Afterwards, calculate the fitness: Calculate the fitness f(x) of each new individual and sort them by fitness; f(x 1:λ )≤f(x 2:λ )≤......≤f(x λ:λ ) According to the fitness ranking, the first μ individuals are intercepted for parameter update, using μ = [λ / 2], or other interception methods; Afterwards, update the parameters: Use the selected individuals to update the distribution parameters m t ,C t and σ t ; First update the mean: Among them: m is the mean, the following table t represents algebra, m t is the weighted average of individual x; Afterwards, update the covariance matrix: In CMA-ES, the update of the covariance matrix includes rank-1 and rank-μ, where rank-1 uses historical search information, namely the evolution path, and the evolution path and covariance matrix update formula are expressed as follows: Among them, c1 and c μ is the learning rate; Afterwards, the CMA-ES algorithm is used to generate adversarial samples: First, define the problem of adversarial sample generation, including the target model of the attack, the target category of the generated adversarial samples, etc., and determine the optimization goal of CMA-ES; then, define the parameters in CMA-ES, including population size, number of iterations, and initial parameter distribution; if there are additional constraints, ensure that they are met in the optimization, that is, additionally meet the constraints of the acoustic model; sample the original signal to generate the initial population of CMA-ES, start iterative optimization, and apply the generated parameter vector to the original signal to generate adversarial samples; finally, determine whether it converges to a suitable solution.

3. The method for generating adversarial samples of speech signals under black box conditions according to claim 1 or 2, characterized in that: In step 4, the gradient estimation method is used for optimization. For the initial adversarial sample generated by CMA-ES, the gradient estimation method is used to estimate the gradient of the objective function relative to the parameter. The steps of updating the adversarial sample according to the estimated gradient information are as follows: In the gradient estimation method, the attacker needs to know the output probability distribution of the model, that is, for the user's input x, the model will give the probability matrix g(x) of various outputs; the attacker estimates the gradient distribution of the loss function for different input positions by querying the changes in the model output distribution after slight perturbations at different input positions; the gradient is estimated through g(x) using the following formula: Among them, FD x (g(x), δ) is the gradient estimate of the model output probability distribution to the input, δ is the estimation accuracy, and d is the dimension of the input vector; when δ→0, FD x (g(x),δ) is equal to the gradient of g(x) with respect to x.

4. The method for generating adversarial samples of speech signals under black box conditions according to claim 3, characterized in that: The process described in step 5 of using the Deepspeech speech recognition system as a pre-trained acoustic model, constraining the generation of adversarial samples, designing the objective function, and using the output of the acoustic model as a constraint condition is as follows: When generating adversarial samples, acoustic model constraints are introduced to make the generated adversarial samples more consistent with the natural distribution of speech and avoid generating overly abnormal or unnatural sounds. The acoustic model constraints introduced when generating adversarial samples include: Select and train an acoustic model: Use DeepSpeech as the constraint model and use the speech dataset preprocessed in step 1 to train the acoustic model; Introducing acoustic model constraints: Input the current adversarial sample into the acoustic model and obtain the output of the model. This step is called forward propagation, which obtains the model's prediction result for the adversarial sample. Define an acoustic model loss function to measure the difference between the adversarial sample and normal speech. This loss function includes spectral differences and vocal tract characteristics. Combine the loss of the acoustic model with the loss of the adversarial model. In each round of algorithm iteration, include the acoustic model loss to guide the generation direction of adversarial samples.

Images