Dompteur：驯服音频对抗示例
Dompteur: Taming Audio Adversarial Examples
摘要：
对抗性的例子似乎是不可避免的。这些特制的输入允许攻击者任意操纵机器学习系统。更糟糕的是，它们对人类观察者来说似乎是无害的。在我们的数字社会中，这是一个巨大的威胁。例如，自动语音识别（ASR）系统，其作为许多种类的系统的免提接口，可以用人类听众无法理解的输入来攻击。研究界尝试了几种方法来解决这个问题，但都没有成功。在本文中，我们提出了一个不同的观点：我们接受针对ASR系统的对抗性示例的存在，但我们要求它们能够被人类听众感知。通过应用心理声学的原理，我们可以从ASR输入中去除语义上不相关的信息，并训练更接近人类感知的模型。我们实现了我们的想法，在一个名为DOMPTEUR的工具，并证明我们的增强系统，与未修改的基线相比，成功地专注于输入信号的可感知范围。这一变化迫使对抗性示例进入可听范围，同时使用最小的计算开销并保持良好的性能。为了评估我们的方法，我们构建了一个自适应攻击者，该攻击者积极尝试避免我们的增强，并证明来自该攻击者的对抗性示例仍然清晰可见。最后，我们通过对众包的人类听众进行听力测试来证实我们的说法。
英文摘要：
Adversarial examples seem to be inevitable. These specifically crafted inputs allow attackers to arbitrarily manipulate machine learning systems. Even worse, they often seem harmless to human observers. In our digital society, this poses a significant threat. For example, Automatic Speech Recognition (ASR) systems, which serve as hands-free interfaces to many kinds of systems, can be attacked with inputs incomprehensible for human listeners. The research community has unsuccessfully tried several approaches to tackle this problem. In this paper we propose a different perspective: We accept the presence of adversarial examples against ASR systems, but we require them to be perceivable by human listeners. By applying the principles of psychoacoustics, we can remove semantically irrelevant information from the ASR input and train a model that resembles human perception more closely. We implement our idea in a tool named DOMPTEUR and demonstrate that our augmented system, in contrast to an unmodified baseline, successfully focuses on perceptible ranges of the input signal. This change forces adversarial examples into the audible range, while using minimal computational overhead and preserving benign performance. To evaluate our approach, we construct an adaptive attacker that actively tries to avoid our augmentations and demonstrate that adversarial examples from this attacker remain clearly perceivable. Finally, we substantiate our claims by performing a hearing test with crowd-sourced human listeners.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
