ALIF：利用语言特征对黑盒语音平台发起低成本对抗性音频攻击
ALIF: Low-Cost Adversarial Audio Attacks on Black-Box Speech Platforms using Linguistic Features
AI总结：
针对黑盒 ASR 攻击查询成本高且易受模型更新影响的问题，本文提出 ALIF，在语言嵌入空间沿决策边界生成扰动，并以 OTL/OTA 方案实现高效、鲁棒的数字与物理攻击。
摘要：
大量研究表明，对抗样本（AE）对语音控制的智能设备构成重大威胁。近期研究提出了仅需自动语音识别（ASR）系统最终转写结果的黑盒对抗攻击。然而，这些攻击通常需要向 ASR 发起大量查询，导致高昂成本。此外，基于 AE 的对抗音频样本容易受到 ASR 更新的影响。本文中，我们找出了这些局限性的根本原因，即无法直接围绕深度学习（DL）模型的决策边界构造 AE 攻击样本。基于这一观察，我们提出 ALIF，这是首个基于黑盒对抗语言特征的攻击流程。我们利用文本转语音（TTS）与 ASR 模型的互逆过程，在决策边界所在的语言嵌入空间中生成扰动。基于 ALIF 流程，我们提出 ALIF-OTL 和 ALIF-OTA 方案，用于在数字域和物理播放环境中对四个商用 ASR 及语音助手发起攻击。大量评估表明，ALIF-OTL 和 ALIF-OTA 分别将查询效率显著提升 97.7% 和 73.3%，同时取得与现有方法相比具有竞争力的性能。值得注意的是，ALIF-OTL 仅需一次查询即可生成攻击样本。此外，我们的时间检验实验验证了该方法对 ASR 更新的鲁棒性。
英文摘要：
Extensive research has revealed that adversarial examples (AE) pose a significant threat to voice-controllable smart devices. Recent studies have proposed black-box adversarial attacks that require only the final transcription from an automatic speech recognition (ASR) system. However, these attacks typically involve many queries to the ASR, resulting in substantial costs. Moreover, AE-based adversarial audio samples are susceptible to ASR updates. In this paper, we identify the root cause of these limitations, namely the inability to construct AE attack samples directly around the decision boundary of deep learning (DL) models. Building on this observation, we propose ALIF, the first black-box adversarial linguistic feature-based attack pipeline. We leverage the reciprocal process of text-to-speech (TTS) and ASR models to generate perturbations in the linguistic embedding space where the decision boundary resides. Based on the ALIF pipeline, we present the ALIF-OTL and ALIF-OTA schemes for launching attacks in both the digital domain and the physical playback environment on four commercial ASRs and voice assistants. Extensive evaluations demonstrate that ALIF-OTL and -OTA significantly improve query efficiency by 97.7% and 73.3%, respectively, while achieving competitive performance compared to existing methods. Notably, ALIF-OTL can generate an attack sample with only one query. Furthermore, our test-of-time experiment validates the robustness of our approach against ASR updates.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
