Adversarial attacks on spectrograms can fool audio classifiers trained on waveforms.
problem Susceptibility of audio classifiers to adversarial attacks on spectrograms.
method Applying adversarial attacks to spectrograms and reconstructing audio waveforms.
result Perturbed spectrograms can fool 2D CNNs and 1D CNNs trained on audio waveforms.
Detects audio adversarial examples using anomalous pattern detection.
problem Identifies adversarial audio attacks in deep neural networks.
method Applies anomalous pattern detection in activation space of audio models.
result Can detect adversarial examples with up to 0.98 AUC, no degradation on benign samples.
Adversarial audio attacks can be considered as a small perturbation unperceptive to human ears that is intentionally added to the audio signal and causes a machine learning model to make mistakes. This poses a security concern about the safety of machine learning models since the adversarial attacks can fool such model…
We propose a method to generate audio adversarial examples that can attack a state-of-the-art speech recognition model in the physical world. Previous work assumes that generated adversarial examples are directly fed to the recognition model, and is not able to perform such a physical attack because of reverberation an…
Recent studies have highlighted adversarial examples as a ubiquitous threat to different neural network models and many downstream applications. Nonetheless, as unique data properties have inspired distinct and powerful learning principles, this paper aims to explore their potentials towards mitigating adversarial inpu…
Adversarial training improves audio classifier robustness.
problem Improving robustness of audio classifiers against adversarial attacks.
method Adversarial training of deep neural networks on audio data.
result Adversarially trained models can resist higher perturbations and fooling rates.
Study shows adversarial attacks can fool speech-to-text models, and PCA is ineffective as a defense.
problem Adversarial attacks can mislead speech-to-text neural networks.
method Crafted adversarial waveforms, used PCA for defense, tested under black-box setting.
result PCA is ineffective as a defense mechanism against adversarial attacks in audio domain.
This research tackles backdoor attacks on audio data using a stochastic investment approach.
problem The threat of backdoor attacks on audio data, especially in voice-activated systems.
method A Stochastic investment-based backdoor attack (MarketBack) approach.
result MarketBack can achieve an average attack success rate close to 100% with less than 1% of poisoned data.
The application of deep recurrent networks to audio transcription has led to impressive gains in automatic speech recognition (ASR) systems. Many have demonstrated that small adversarial perturbations can fool deep neural networks into incorrectly predicting a specified target with high confidence. Current work on fool…
Defense against ASR attacks using dropout uncertainty.
problem Adversarial attacks on ASR systems.
method Dropout uncertainty in neural networks.
result High detection accuracy across various ASR systems and datasets.
Recently, Convolutional Neural Networks (CNNs) demonstrate a considerable vulnerability to adversarial attacks, which can be easily misled by adversarial perturbations. With more aggressive methods proposed, adversarial attacks can be also applied to the physical world, causing practical issues to various CNN powered a…
We demonstrate the existence of universal adversarial perturbations, which can fool a family of audio classification architectures, for both targeted and untargeted attack scenarios. We propose two methods for finding such perturbations. The first method is based on an iterative, greedy approach that is well-known in c…
Robust ASR model removes fast-changing features to resist attacks.
problem Vulnerability of ASR systems to adversarial attacks.
method Removing fast-changing features using slow feature analysis or low-pass filtering.
result Hybrid ASR models are more than four times more robust against targeted attacks.
Study shows current metrics for audio adversarial examples are unreliable for human perception.
problem The reliability of metrics for evaluating audio adversarial examples.
method Analytical framework and human evaluation experiment.
result Current metrics for audio adversarial examples are not reliable for human perception.
Computational paralinguistic analysis is increasingly being used in a wide range of cyber applications, including security-sensitive applications such as speaker verification, deceptive speech detection, and medical diagnostics. While state-of-the-art machine learning techniques, such as deep neural networks, can provi…
This paper extends adversarial attacks to produce desired class probability distributions.
problem Easily fooling deep learning models with imperceptible perturbations.
method Probabilistic framework to generate desired class probability distributions.
result The ability to closely approximate any probability distribution for classes while maintaining high fooling rates and preventing detection.
Paper detects adversarial speech inputs with high accuracy.
problem Adversarial attacks on ASR systems.
method Uncertainty quantification using neural networks.
result Detection accuracy of adversarial inputs over 0.99.
Adversarial examples are carefully constructed modifications to an input that completely change the output of a classifier but are imperceptible to humans. Despite these successful attacks for continuous data (such as image and audio samples), generating adversarial examples for discrete structures such as text has pro…
Paper presents a statistical method for detecting adversarial inputs.
problem Adversarial attacks on deep learning models.
method Statistical approach based on per-class feature distribution comparison.
result Approach achieves good adversarial detection performance on MNIST and CIFAR-10 datasets.
This paper generates natural-looking perturbations to fool classifiers.
problem Generating adversarial examples that mimic natural objects or signals.
method Employing generative adversarial networks and optimization algorithms.
result The approach can fool classification models in both image and audio domains.
Paper finds universal speech command perturbations that fool models.
problem Existence of universal adversarial examples in speech command classification.
method Proposed a novel analytical framework for evaluating universal perturbations and a detailed distortion measurement method.
result Universal perturbations can fool speech command classification models across different models.
Recent breakthroughs in the field of deep learning have led to advancements in a broad spectrum of tasks in computer vision, audio processing, natural language processing and other areas. In most instances where these tasks are deployed in real-world scenarios, the models used in them have been shown to be susceptible …
A new algorithm for optimizing huge-scale black-box problems with reduced memory usage.
problem Optimizing huge-scale black-box problems with limited vector operations.
method ZO-BCD algorithm for zeroth-order optimization with reduced memory footprint.
result ZO-BCD achieves state-of-the-art adversarial attack success rate of 97.9%.
Perceptual ad-blocking is a novel approach that detects online advertisements based on their visual content. Compared to traditional filter lists, the use of perceptual signals is believed to be less prone to an arms race with web publishers and ad networks. We demonstrate that this may not be the case. We describe att…
Automatic speaker verification, like every other biometric system, is vulnerable to spoofing attacks. Using only a few minutes of recorded voice of a genuine client of a speaker verification system, attackers can develop a variety of spoofing attacks that might trick such systems. Detecting these attacks using the audi…
Generative adversarial network improves audio inpainting for long gaps.
problem Generating missing audio content in long-range gaps using WGAN.
method Proposed WGAN architecture with short-range and long-range neighboring borders.
result The proposed model outperforms classical WGAN in reconstructing high-frequency content.
Time-frequency (TF) representations provide powerful and intuitive features for the analysis of time series such as audio. But still, generative modeling of audio in the TF domain is a subtle matter. Consequently, neural audio synthesis widely relies on directly modeling the waveform and previous attempts at unconditio…
GACELA fills long gaps in musical audio with a GAN and context conditioning.
problem Restoring long gaps in musical audio with varying complexity and duration.
method Generative adversarial network (GAN) with five parallel discriminators and context conditioning.
result Reduced artifacts in inpaintings from unacceptable to mildly disturbing.
Efficient audio synthesis is an inherently difficult machine learning task, as human perception is sensitive to both global structure and fine-scale waveform coherence. Autoregressive models, such as WaveNet, model local structure at the expense of global latent structure and slow iterative sampling, while Generative A…
Proposes GAAE for high-fidelity audio generation and representation learning.
problem Lack of usable representations and high-fidelity audio generation from unsupervised learning.
method Guided Adversarial Autoencoder (GAAE) leveraging a small percentage of labelled data.
result Generates high-fidelity audio with superior quality and learns powerful representations.
Most state-of-the-art machine learning (ML) classification systems are vulnerable to adversarial perturbations. As a consequence, adversarial robustness poses a significant challenge for the deployment of ML-based systems in safety- and security-critical environments like autonomous driving, disease detection or unmann…
This paper studies adversarial attacks on Gaussian process bandits.
problem Adversarial attacks on Gaussian process bandits to manipulate optimal function regions.
method Proposes various adversarial attack methods on GP bandits, including white-box and black-box attacks.
result Adversarial attacks can force GP bandits to optima in target regions even with low attack budgets.
New approach deflects adversarial attacks by causing them to resemble target classes.
problem Ongoing cycle of stronger defenses being broken by more advanced attacks.
method Combines three detection mechanisms in Capsule Networks to achieve state-of-the-art performance on both standard and defense-aware attacks. Uses human study to show attacks can no longer be called adversarial.
result Attack images can no longer be called adversarial because they are classified the same way as humans do.
Proposes a new video attack method that multiplies perturbation to improve model robustness.
problem Challenges existing defense methods for video recognition models against additive adversarial attacks.
method Introduces Multiplicative Adversarial Videos (MultAV) to impose perturbation by multiplication.
result Model trained against additive attacks is less robust to MultAV.
Tricks adversarial attacks to target specific classes, improving classifier accuracy.
problem Recent adversarial defense approaches have failed to protect classifiers from untargeted attacks.
method Target Training defense tricks untargeted attacks into targeted attacks on designated classes, then derives the real class.
result 86.2% accuracy for CW-L2 (confidence=0) in CIFAR10, outperforming unsecured classifiers.
New attack method improves neural network security.
problem Vulnerability of deep neural networks to adversarial attacks.
method Ensemble adversarial attack with long-term gradient memory.
result Enhanced robustness against adversarial attacks.
Automated discovery of adaptive attacks improves adversarial defense evaluation.
problem Challenges in reliably evaluating adversarial defenses.
method Formalizes adaptive attacks as reusable building blocks in a search space for automatic discovery.
result Our tool discovers significantly stronger attacks than AutoAttack, improving adversarial defense evaluation.
GGAN improves audio representation learning with fewer labels.
problem Learning representations for specific tasks from unlabelled data.
method Guided Generative Adversarial Neural Network (GGAN).
result GGAN learns better representations with fewer labelled data.
CCAT improves model robustness to various adversarial attacks.
problem Robustness to adversarial attacks does not generalize to unseen threat models.
method CCAT biases models towards low confidence predictions on adversarial examples.
result CCAT increases robustness against multiple adversarial attack norms and types.
This work simplifies adversarial attacks using neural networks, reducing computation and improving training convergence.
problem Efficiently generating and training against ideal adversarial attacks with minimal computational overhead.
method Representing ideal adversarial attacks as smooth piece-wise functions and approximating them with neural networks. Using a mathematical game between an attack network and a defense network for adversarial training.
result Obtained convergence rates of adversarial loss in terms of sample size n for adversarial training. Study on detecting backdoor attacks using adversarial detection methods.
problem Mitigating backdoor attacks in deep neural networks.
method Comprehensive studies on adversarial and backdoor examples, revising adversarial defense methods.
result Adversarial defense methods can be effective in detecting backdoor attacks.
NP-Attack reduces query counts for black-box adversarial attacks.
problem Efficiency of black-box adversarial attacks is low.
method Uses Neural Process to characterize image structure and find adversarial examples.
result NP-Attack significantly decreases query counts.
We study the problem of defending deep neural network approaches for image classification from physically realizable attacks. First, we demonstrate that the two most scalable and effective methods for learning robust models, adversarial training with PGD attacks and randomized smoothing, exhibit very limited effectiven…
This paper analyzes adversarial attacks methods and their effectiveness.
problem Understanding the effectiveness and theoretical properties of adversarial attacks.
method Comparative and formal analysis of loss functions of three adversarial attack methods.
result The Iterative Fast Gradient Sign attack is the slowest in creating adversarial examples.
Mic2Mic reduces microphone variability for speech systems.
problem Microphone variability impacts speech system accuracy.
method Cycle-consistent GANs for learning microphone variability reduction.
result Mic2Mic recovers 66% to 89% of lost accuracy due to microphone variability.
Adversarial training was introduced as a way to improve the robustness of deep learning models to adversarial attacks. This training method improves robustness against adversarial attacks, but increases the models vulnerability to privacy attacks. In this work we demonstrate how model inversion attacks, extracting trai…
Paper proposes a new black-box adversarial attack using normalizing flows.
problem Adversarial vulnerability of deep neural networks.
method Proposes a novel black-box adversarial attack using normalizing flows.
result Demonstrates competitive performance against well-known black-box adversarial attack methods.
This paper discusses adversarial attacks on cyber security systems using machine learning.
problem Adversarial attacks limit the use of machine learning in cyber security.
method Characterizes adversarial attack methods and their applications in cyber security.
result Highlights unique challenges and future research directions for adversarial attacks in cyber security.