Audio Adversarial Attack Detection via Dynamic Time Warping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing automatic speech recognition systems are vulnerable to audio adversarial attacks, which can mislead the systems into executing unintended tasks, and current detection methods are either ineffective or dependent on the machine learning architecture or require user authentication, leading to performance issues and increased computational costs.
Innovation Solution
A method that involves converting the input audio signal and its transcript into synthesized audio signals, extracting acoustic features, and calculating a dynamic time warping distance to detect adversarial attacks, independent of the machine learning architecture, allowing for efficient detection and rejection of hacked speech while maintaining recognition accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If machine learning-based automatic speech recognition systems are used, then speech recognition accuracy is improved, but vulnerability to audio adversarial attacks increases
Solution Approach 1:
The patent introduces an intermediary detection system that sits between the audio input and the speech recognition system. This intermediary extracts acoustic features, generates synthesized audio from the transcript, and compares the original and synthesized audio using dynamic time warping to detect adversarial attacks before they affect the recognition system.
Solution Approach 2:
The system performs preliminary detection by comparing the input audio with a synthesized version generated from the transcript before the speech recognition system processes the audio. This preliminary comparison identifies adversarial perturbations in advance, allowing the system to reject malicious inputs before they can be misinterpreted.
2Difficulty of detecting and measuring
If existing detection methods are used, then detection capability is improved, but dependency on machine learning architecture increases
Solution Approach 1:
The patent replaces machine learning-based detection mechanisms with traditional signal processing techniques. Instead of using another neural network to detect attacks, the system uses acoustic feature extraction, text-to-speech synthesis, and dynamic time warping - classical methods that are architecture-independent and more adaptable to different speech recognition systems.
3Reliability
If user authentication is required, then security is improved, but ease of operation deteriorates
Solution Approach 1:
The system performs self-service detection by automatically comparing the input audio with the synthesized audio generated from the transcript. This self-comparison mechanism detects adversarial attacks without requiring any additional user authentication steps, maintaining both security and ease of operation.
4Object-affected harmful factors
If transformations are applied to audio input data, then disruption of adversarial perturbations is improved, but performance on benign samples deteriorates
Solution Approach 1:
Instead of directly transforming the input audio, the patent uses an intermediary approach: it generates a synthesized audio signal from the transcript and compares this synthesis with the original input. This comparison reveals adversarial perturbations without applying disruptive transformations to the actual audio data, preserving benign sample performance.
Data Source
Figure 1
Figure 2
Figure 3~4c
AI summary
The disclosure relates to a method and device for detecting an audio adversarial attack with respect to a voice input (VI) processed by an automatic speech recognition system (ASR). The method includes: obtaining (11) an input audio signal (IAS) associated with the voice input; obtaining (12) a transcript (T) resulting from the processing, by the automatic speech recognition system, of the input audio signal; converting (13) the transcript (T) into a synthesized audio signal (SAS); extracting (15, 15'), at a sampling time interval, at least one acoustic feature of a same type, respectively from the input audio signal and from the synthesized audio signal, delivering a first sequence of features vectors (sFV1) associated with the input audio signal and a second sequence of features vectors (sFV2) associated with the synthesized audio signal; converting (16, 16') the acoustic features of the first sequence of features vectors and the acoustic features of the second sequence of features vectors to corresponding acoustic features associated with a target reference voice (RV), respectively delivering a first sequence of converted features vectors (sCFV1) and a second sequence of converted features vectors (sCFV2); computing (17) a dynamic time warping distance (D) between the first sequence of converted features vectors and the second sequence of converted features vectors; and delivering (18) a piece of data representative of a detection of an audio adversarial attack, as a function of a result of a comparison between the dynamic time warping distance and a predetermined threshold.