SirenAttack: Generating Adversarial Audio for End-to-End Acoustic Systems

TL;DR

SirenAttack introduces a versatile, effective, and stealthy method for generating adversarial audio that can deceive various end-to-end acoustic systems with high success rates, raising security concerns.

Contribution

It presents a novel attack method capable of fooling multiple acoustic systems in both white-box and black-box scenarios, with high success and stealthiness.

Findings

Achieves 99.45% success rate on IEMOCAP with ResNet18

Deceives multiple ASR platforms like Google Cloud and IBM

Stealthy audios indistinguishable from benign sounds

Abstract

Despite their immense popularity, deep learning-based acoustic systems are inherently vulnerable to adversarial attacks, wherein maliciously crafted audios trigger target systems to misbehave. In this paper, we present SirenAttack, a new class of attacks to generate adversarial audios. Compared with existing attacks, SirenAttack highlights with a set of significant features: (i) versatile -- it is able to deceive a range of end-to-end acoustic systems under both white-box and black-box settings; (ii) effective -- it is able to generate adversarial audios that can be recognized as specific phrases by target acoustic systems; and (iii) stealthy -- it is able to generate adversarial audios indistinguishable from their benign counterparts to human perception. We empirically evaluate SirenAttack on a set of state-of-the-art deep learning-based acoustic systems (including speech command recognition, speaker recognition and sound event classification), with results showing the versatility, effectiveness, and stealthiness of SirenAttack. For instance, it achieves 99.45% attack success rate on the IEMOCAP dataset against the ResNet18 model, while the generated adversarial audios are also misinterpreted by multiple popular ASR platforms, including Google Cloud Speech, Microsoft Bing Voice, and IBM Speech-to-Text. We further evaluate three potential defense methods to mitigate such attacks, including adversarial training, audio downsampling, and moving average filtering, which leads to promising directions for further research.