关于音频机器学习管道用于监视对抗性示例的可利用性
On the Exploitability of Audio Machine Learning Pipelines to Surreptitious Adversarial Examples
摘要：
众所周知，机器学习（ML）模型容易受到对抗性样本的攻击。ML在语音生物识别认证中的应用也不例外。然而，音频对抗示例对这些现实世界系统的影响仍然知之甚少，因为大多数研究针对的是只能收听音频样本的有限辩护者。将攻击的可检测性与人类的可感知性相结合，研究集中在旨在产生人类无法区分相应良性样本的不可感知对抗性样本的方法上。我们认为，这种观点是粗糙的原因有两个：1。不可感知性是不可能验证的;它需要一个实验过程，包括听众训练，设备，音量，耳朵灵敏度，背景噪音类型等的变化，以及2。它忽略了现实防御者利用的基于管道的检测线索。这导致了在有知识的维护者在场的情况下，对抗性的例子是无效的。因此，对手只需要音频样本对人类来说是可信的。因此，我们引入了秘密对抗的例子，这是一类逃避人类和管道控制的新攻击。在白盒设置中，我们用联合的多阶段优化攻击实例化这个类。使用Amazon Mechanical Turk用户研究，我们表明这种攻击产生的音频样本比以前的攻击更隐蔽，这些攻击的目标仅仅是不可感知性。最后，我们证明了在黑箱环境中开发秘密对抗性示例是具有挑战性的。
英文摘要：
Machine learning (ML) models are known to be vulnerable to adversarial examples. Applications of ML to voice biometrics authentication are no exception. Yet, the implications of audio adversarial examples on these real-world systems remain poorly understood given that most research targets limited defenders who can only listen to the audio samples. Conflating detectability of an attack with human perceptibility, research has focused on methods that aim to produce imperceptible adversarial examples which humans cannot distinguish from the corresponding benign samples. We argue that this perspective is coarse for two reasons: 1. Imperceptibility is impossible to verify; it would require an experimental process that encompasses variations in listener training, equipment, volume, ear sensitivity, types of background noise etc, and 2. It disregards pipeline-based detection clues that realistic defenders leverage. This results in adversarial examples that are ineffective in the presence of knowledgeable defenders. Thus, an adversary only needs an audio sample to be plausible to a human. We thus introduce surreptitious adversarial examples, a new class of attacks that evades both human and pipeline controls. In the white-box setting, we instantiate this class with a joint, multi-stage optimization attack. Using an Amazon Mechanical Turk user study, we show that this attack produces audio samples that are more surreptitious than previous attacks that aim solely for imperceptibility. Lastly we show that surreptitious adversarial examples are challenging to develop in the black-box setting.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
