论文标题
观看您的预期：针对性的，可转移的对抗性示例
Watch What You Pretrain For: Targeted, Transferable Adversarial Examples on Self-Supervised Speech Recognition models
论文作者
论文摘要
有针对性的对抗性攻击会产生音频样本，该音频样本可以迫使自动语音识别（ASR）系统输出攻击者选择的文本。为了利用现实世界中的ASR模型，Black-Box设置，对手可以利用转移性属性，即为代理ASR生产的对手样本也可以欺骗其他远程ASR。但是，最近的工作表明，针对大型ASR模型的可传输性非常困难。在这项工作中，我们表明，现代ASR体系结构，特别是基于自我监督的学习的体系结构实际上很容易受到可转移性的影响。我们通过评估Wav2Vec2，Hubert，Data2Vec和wavlm等最先进的自我保护的ASR模型来成功证明了这一现象。我们表明，通过低级加性噪声达到30dB信号噪声比，我们可以以高达80％的精度实现目标转移性。接下来，我们1）使用消融研究表明，自我监督的学习是这种现象的主要原因，2）我们为这种现象提供了解释。通过此，我们表明，现代ASR架构非常容易受到对抗安全威胁的影响。
A targeted adversarial attack produces audio samples that can force an Automatic Speech Recognition (ASR) system to output attacker-chosen text. To exploit ASR models in real-world, black-box settings, an adversary can leverage the transferability property, i.e. that an adversarial sample produced for a proxy ASR can also fool a different remote ASR. However recent work has shown that transferability against large ASR models is very difficult. In this work, we show that modern ASR architectures, specifically ones based on Self-Supervised Learning, are in fact vulnerable to transferability. We successfully demonstrate this phenomenon by evaluating state-of-the-art self-supervised ASR models like Wav2Vec2, HuBERT, Data2Vec and WavLM. We show that with low-level additive noise achieving a 30dB Signal-Noise Ratio, we can achieve target transferability with up to 80% accuracy. Next, we 1) use an ablation study to show that Self-Supervised learning is the main cause of that phenomenon, and 2) we provide an explanation for this phenomenon. Through this we show that modern ASR architectures are uniquely vulnerable to adversarial security threats.
