针对ASR系统的快速有目标自适应对抗攻击  

Adaptive fast and targeted adversarial attack for speech recognition

作　　者：张树栋 高海昌 曹曦文 康帅 ZHANG Shudong;GAO Haichang;CAO Xiwen;KANG Shuai(School of Computer Science and Technology,Xidian University,Xi’an 710071,China)

机构地区：[1]西安电子科技大学计算机科学与技术学院,陕西西安710071

出　　处：《西安电子科技大学学报》2021年第1期168-175,共8页Journal of Xidian University

基　　金：国家自然科学基金(61972306)。

摘　　要：对抗样本是一种恶意输入,通过在输入中添加人眼无法察觉的微小扰动来误导深度学习模型产生错误的输出。近年来,随着对抗样本研究的发展,除了大量图像领域的对抗样本工作,在自动语音识别领域也开始有一些新进展。目前,针对自动语音识别系统的最先进的对抗攻击来自Carlini&Wagner,其方法是通过获得使模型被错误分类的最小扰动来生成成功的对抗样本。因为这种方法需要同时优化两个损失函数项,通常需要进行数千次迭代,效率低下,因此提出了A-FTA方法。该方法通过最大化自动语音识别模型关于对抗样本的预测和目标短语之间的相似度来快速生成对抗样本,并且在攻击过程中根据是否攻击成功自适应地调整扰动大小,从而生成较小扰动的对抗样本。实验结果表明,这种方法相比于目前最先进的方法,用更少的迭代次数取得了更好的攻击结果,在高效的同时依然能保证很高的攻击成功率。Adversarial examples are malicious inputs designed to induce deep learning models to produce erroneous outputs,which make humans imperceptible by adding small perturbations to the input.Most research on adversarial examples is in the domain of image.Recently,studies on adversarial examples have expanded into the automatic speech recognition domain.The state-of-art attack on the ASR system comes from C&W,which aims to obtain the minimum perturbation that causes the model to be misclassified.However,this method is inefficient since it requires the optimization of two terms of loss functions at the same time,and usually requires thousands of iterations.In this paper,we propose an efficient approach based on strategies that maximize the likelihood of adversarial examples and target categories.A large number of experiments show that our attack achieves better results with fewer iterations.

关 键 词：深度神经网络 对抗样本 语音识别 机器学习 对抗攻击 

分 类 号：TN912.34[电子电信—通信与信息系统] TP183[电子电信—信息与通信工程]