PhantomSound：通过分秒级音素注入实现黑盒、查询高效的音频对抗攻击
PhantomSound: Black-Box, Query-Efficient Audio Adversarial Attack via Split-Second Phoneme Injection
AI总结：
本文提出PhantomSound，一种针对语音助手的查询高效黑盒音频对抗攻击方法，通过基于决策的攻击和优化梯度估计生成对抗样本，显著减少了查询次数，在真实场景中成功攻击多种商用设备并绕过活体检测。
摘要：
在本文中，我们提出了PhantomSound，一种针对语音助手的查询高效黑盒攻击。针对语音助手的现有黑盒对抗攻击要么应用替代模型，要么利用模型的中间输出来估计梯度以生成对抗音频样本。然而，这些攻击方法需要大量查询且训练阶段漫长。PhantomSound利用基于决策的攻击生成有效的对抗音频，并通过优化梯度估计来减少查询次数。在实验中，我们在3种真实场景下对4种不同的语音转文本API发起攻击，以展示其实时攻击影响。结果表明，PhantomSound在空中攻击5种流行商用语音控制设备时实用且稳健，并能以>95%的成功率绕过3种活体检测机制。基准结果表明，PhantomSound能在几分钟内生成对抗样本并发起攻击。与最先进的黑盒攻击相比，我们显著提升了查询效率，分别仅使用约300次查询（约5分钟）和约1,500次查询（约25分钟），将成功的无目标和有目标对抗攻击成本降低了93.1%和65.5%。
英文摘要：
In this paper, we propose PhantomSound, a query-efficient black-box attack toward voice assistants. Existing black-box adversarial attacks on voice assistants either apply substitution models or leverage the intermediate model output to estimate the gradients for crafting adversarial audio samples. However, these attack approaches require a significant amount of queries with a lengthy training stage. PhantomSound leverages the decision-based attack to produce effective adversarial audios, and reduces the number of queries by optimizing the gradient estimation. In the experiments, we perform our attack against 4 different speech-to-text APIs under 3 real-world scenarios to demonstrate the real-time attack impact. The results show that PhantomSound is practical and robust in attacking 5 popular commercial voice controllable devices over the air, and is able to bypass 3 liveness detection mechanisms with >95% success rate. The benchmark result shows that PhantomSound can generate adversarial examples and launch the attack in a few minutes. We significantly enhance the query efficiency and reduce the cost of a successful untargeted and targeted adversarial attack by 93.1% and 65.5% compared with the state-of-the-art black-box attacks, using merely ~300 queries (~5 minutes) and ~1,500 queries (~25 minutes), respectively.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
