Towards Robust Speech-to-Text Adversarial Attack

TL;DR

This paper presents a new adversarial attack method for speech-to-text systems that produces more robust signals against over-the-air playback and noise, outperforming existing attacks in accuracy and resilience.

Contribution

The paper introduces a novel adversarial algorithm using the Cramér integral probability metric to generate more robust speech adversarial signals without costly transformations.

Findings

Outperforms existing attacks in word error rate and sentence accuracy

More resilient against multiple over-the-air playbacks and noise

Maintains high-quality adversarial signal generation

Abstract

This paper introduces a novel adversarial algorithm for attacking the state-of-the-art speech-to-text systems, namely DeepSpeech, Kaldi, and Lingvo. Our approach is based on developing an extension for the conventional distortion condition of the adversarial optimization formulation using the Cram\`er integral probability metric. Minimizing over this metric, which measures the discrepancies between original and adversarial samples' distributions, contributes to crafting signals very close to the subspace of legitimate speech recordings. This helps to yield more robust adversarial signals against playback over-the-air without employing neither costly expectation over transformation operations nor static room impulse response simulations. Our approach outperforms other targeted and non-targeted algorithms in terms of word error rate and sentence-level-accuracy with competitive performance on the crafted adversarial signals' quality. Compared to seven other strong white and black-box adversarial attacks, our proposed approach is considerably more resilient against multiple consecutive playbacks over-the-air, corroborating its higher robustness in noisy environments.