Adversarial Attack Detection in Speech Recognition via Dropout Stability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Automatic speech recognition systems are vulnerable to adversarial audio attacks, where small, inaudible noise manipulations can lead to malicious transcriptions, and existing defense mechanisms are not effectively applicable in the audio domain due to the complexity of audio signal processing.
Innovation Solution
A linguistic system utilizing a neural network with a dropout mechanism is implemented, which executes multiple times to produce varying transcriptions, and uses a metric calculation module to determine pairwise edit distances and features from these transcriptions to classify inputs as legitimate or illegitimate, employing a classifier module to make decisions based on these features.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a neural network is used for automatic speech recognition, then transcription capability is improved, but vulnerability to adversarial attacks increases
Solution Approach 1:
The patent applies dropout mechanism dynamically during inference by randomly deactivating neurons with probability p, creating multiple dynamic network configurations for the same input. This dynamic behavior causes legitimate inputs to produce consistent transcriptions across different dropout realizations, while adversarial inputs produce varying transcriptions, enabling detection through transcription stability measurement.
Solution Approach 2:
The patent changes the network configuration parameter by randomly setting neuron weights to zero with probability p during each dropout realization. This parameter change creates variability in network structure while maintaining the same trained weights, allowing the system to detect adversarial attacks through the stability of transcription outputs across multiple parameter configurations.
2Measurement precision
If dropout mechanism is applied to detect adversarial attacks, then detection accuracy is improved, but processing complexity increases
Solution Approach 1:
The patent segments the detection process into distinct modules: a dropout mechanism module that applies random neuron deactivation, a transcription module that generates multiple transcriptions, and a stability measurement module that calculates consistency metrics. This segmentation allows each module to perform its specific function efficiently, reducing overall processing complexity while maintaining high detection accuracy.
Solution Approach 2:
The patent creates multiple copies of the neural network through dropout realizations, where each copy processes the input independently. Instead of comparing complex internal network states, the system copies the input through multiple network configurations and compares only the final transcription outputs, significantly reducing computational complexity while preserving detection capability.
3Reliability
If multiple transcriptions are generated through dropout realizations, then adversarial detection capability is improved, but computational time increases
Solution Approach 1:
The patent applies partial dropout by deactivating only a portion of neurons with probability p rather than the entire network, and generates a limited number of dropout realizations (e.g., 5-10) rather than exhaustive sampling. This partial action provides sufficient transcription stability measurement for adversarial detection while keeping computational time acceptable for practical deployment.
Data Source
AI summary
A linguistic system for transcribing an input, where the linguistic system comprises a processor configured to execute a neural network multiple times while varying weights of at least some nodes of the neural network to produce multiple transcriptions of the input. Further, determine a distribution of pairwise distances of the multiple transcriptions; determine a legitimacy of the input based on the distribution; and transcribe the input using stored weights of the nodes of the neural network when the input is determined as legitimate to produce a final transcription of the input.