Universal Adversarial Audio Perturbations

TL;DR

This paper introduces universal adversarial audio perturbations capable of fooling multiple audio classifiers, proposing a novel penalty-based method that outperforms greedy approaches, especially with limited data, achieving over 85% attack success.

Contribution

The main contribution is a new penalty formulation for finding universal adversarial audio perturbations, with proven convergence and effectiveness in limited data scenarios.

Findings

Achieved over 85% success rate in targeted attacks.

Proposed penalty method outperforms greedy approach.

Effective even with only one sample available.

Abstract

We demonstrate the existence of universal adversarial perturbations, which can fool a family of audio classification architectures, for both targeted and untargeted attack scenarios. We propose two methods for finding such perturbations. The first method is based on an iterative, greedy approach that is well-known in computer vision: it aggregates small perturbations to the input so as to push it to the decision boundary. The second method, which is the main contribution of this work, is a novel penalty formulation, which finds targeted and untargeted universal adversarial perturbations. Differently from the greedy approach, the penalty method minimizes an appropriate objective function on a batch of samples. Therefore, it produces more successful attacks when the number of training samples is limited. Moreover, we provide a proof that the proposed penalty method theoretically converges to a solution that corresponds to universal adversarial perturbations. We also demonstrate that it is possible to provide successful attacks using the penalty method when only one sample from the target dataset is available for the attacker. Experimental results on attacking various 1D CNN architectures have shown attack success rates higher than 85.0% and 83.1% for targeted and untargeted attacks, respectively using the proposed penalty method.