Sequential Randomized Smoothing for Adversarially Robust Speech Recognition

Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 6372–6386 November 7–11, 2021. c⃝2021 Association for Computational Linguistics 6372 Sequential Randomized Smoothing for Adversarially Robust Speech Recognition Raphael Olivier and Bhiksha Raj Carnegie Mellon University Language Technologies Institute 5000 Forbes Avenue, Pittsburgh PA 15213, USA rolivier@cs.cmu.edu, bhiksha@cs.cmu.edu Abstract While Automatic Speech Recognition has been shown to be vulnerable to adversarial at- tacks, defenses against these attacks are still lagging. Existing, naive defenses can be par- tially broken with an adaptive attack. In clas- sification tasks, the Randomized Smoothing paradigm has been shown to be effective at de- fending models. However, it is difficult to ap- ply this paradigm to ASR tasks, due to their complexity and the sequential nature of their outputs. Our paper overcomes some of these challenges by leveraging speech-specific tools like enhancement and ROVER voting to de- sign an ASR model that is robust to pertur- bations. We apply adaptive versions of state- of-the-art attacks, such as the Imperceptible ASR attack, to our model, and show that our strongest defense is robust to all attacks that use inaudible noise, and can only be broken with very high distortion. 1 Introduction1 1.1 The threat of adversarial attacks on ASR In recent years, Automatic Speech Recognition (ASR) has been transitioning from a topic of aca- demic research to a mature technology imple- mented in everyday devices. AI voice assistants are becoming increasingly popular, and ASR models are being implemented in cars, smart TVs, and var- ious devices within the Internet of Things. There- fore, challenges to the security of these models, as explored in several recent articles, are also tran- sitioning from academic curiosities to real-world threats. One of these major security threats is vulnera- bility to adversarial attacks (Szegedy et al., 2014): perturbations of inputs to any model that, while nearly imperceptible to human senses, have con- siderable effects on its outputs. Such attacks can 1For reproducibility purposes our code and models are available at https://github.com/RaphaelOlivier/smoothingASR enable a malicious party to discretely manipulate models’ behaviors and cause them to malfunction, while escaping human observation. For instance, when applied to voice assistants, adversarial attacks can potentially lead to privacy breaches by suc- cessfully soliciting arbitrary sensitive information. They could also fool an ASR system to believe an audio input contains hateful content, and have it automatically rejected from platforms or its author banned. For several years now, adversarial attacks have been an active research field that crosses nearly every application of Machine Learning. One of the main objectives of the field is to defend AI models against such attacks without impacting their performance (on regular data) heavily. 1.2 Limitations of current defenses This research has taken the form of an arms race, where the attacker has the upper hand: whenever a defense was proposed (Samangouei et al., 2018), a stronger or adaptive attack was developed to counter it (Athalye et al., 2018). Some recent works seem to have partially broken this trend by propos- ing …

Content truncated to 500 words