Electronic music assassin: towards imperceptible physical adversarial attacks against black-box automatic speech recognitions

Abstract Speech recognition technology has brought revolutionary changes to our lives, but existing work has demonstrated the feasibility of using adversarial examples (AEs) to mislead speech recognition systems. Most existing adversarial attacks are designed for white-box or grey-box systems and they are ineffective against strict black-box scenarios where only the recognition results can be queried. The known black-box attack methods all add perturbations limited to the bounded $$L_{p}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msub> <mml:mi>L</mml:mi> <mml:mi>p</mml:mi> </mml:msub> </mml:math> neighborhood in the time domain and they neglected the relationship between the perturbations and the carrier audios. Therefore, although AEs they generated cannot be recognized by humans as the target attack commands, they sound very unnatural and unsmooth. The abnormal sense in auditory perception is easy to alarm the victim and can be used for defense. To address this limitation, we propose a novel adversarial attack against black-box systems. Unlike previous works adding perturbations in the time domain, we extract the effective adversarial feature in the frequency domain and modify the spectral energy distribution of the carrier electronic music in a smooth way to maintain the the carriers’ original timbre. Meanwhile, we dynamically adjust the insert position and duration of the adversarial feature according to the music’s rhythm. Our higher requirement for imperceptibility is that AEs should sound natural and smooth. We evaluated our method on eight commercial black-box speech recognition systems (including five digital and three physical systems). Our AEs can achieved the 100% attack success rate and have the outstanding imperceptibility compared to the state-of-the-art black-box attacks. Our AEs are on par with normal music in terms of auditory naturalness and smoothness in the digital world, which requires only about 500 queries. Compared to the existing works, only 7.9% think their AEs are normal, at least 52.1% could not distinguish between our AEs and normal music in the physical world. The demos and code are available at the open source repository https://github.com/Cybersecurity-Electronic-Music-Assassin/Electronic-Music-Assassin.git.