Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper proposed a novel idea that generates imperceptible adversarial attacks for ASR by perturbing the phase information. Proof that phase perturbations reduce the magnitude of the spectrogram is provided. White-box-threat-model-based experimental results showed the proposed method can generate effective adversarial examples for an academic Transformer-based ASR system with better efficiency than the state-of-the-art counterpart methods. 
main_review: The main strength of the paper is the novelty of the energy dissipation.

Main weaknesses include:
1. As pointed out by reviewer rkdE, the claim that serves as the motivation "Since phase is not relevant for speech recognition, the existing audio adversarial attacks neglect the influence of phase spectrogram." is not true. It is not shown in the paper what this claim is based on. I guess perhaps the authors thought traditional filterbank acoustic features for monaural ASR only keep magnitudes, which is certainly true. However, phase information is certainly important for ASR not only with binaural or microphone array data but also for monaural -- this is possibly why ASR systems with raw-waveform features can outperform those with filterbank features in many recent studies. 
2. The type of ASR input features used is missing in the paper (perhaps log-mel spectrograms from Fig. 1?). I traced into the paper that provides the ASR model architecture (Winata et al., 2020a), but did not find any clear evidence for the feature type. This is critical here since filterbank-related features (including MFCCs) do not have explicit phase information. Perturbing phase information can reduce the magnitude of the spectrogram is certainly good evidence, but doesn't this contradict with the claim "Since phase is not relevant for speech recognition, the existing audio adversarial attacks neglect the influence of phase spectrogram."?
3. The ASR method used in this paper is not common. The effectiveness of such adversarial attacks is certainly related to the detailed model architecture and how it was trained. I would expect the method may not work for NN-HMMs, CTC, and stateless RNN-T. 
4. It is also difficult for me to understand how to use such white-box adversarial attack techniques for ASR in practice. Industrial ASR systems are often trained on an enormously large dataset with many data augmentation techniques applied, which should be a lot more robust against energy dissipation. I understand the authors rely on (Chen et al., 2020) to convert a white-box model to a black-box model. However, the methods proposed in (Chen et al., 2020) are not convincible enough to me, since most of the industrial ASR systems studied in that paper are possibly NN-HMMs and CTC, which should be robust against adversarial attacks. 
5. Although the adversarial attack is mostly a machine learning research topic, the novelty and the required knowledge are mostly signal processing. Perhaps ICASSP would be a more suitable place to publish this work than ICLR. 
6. Contains many mistakes and typos, for instance:

(a) "Denote the ASR classification model as f : {X} → Y , with X ∈ [0, 1]t×c being the audio space."
 
I guess c is the number of bits related to the floating number precision, but it is not defined at all.

(b) The reference (Winata et al., 2020a) and (Winata et al., 2020b) are the same paper.

(c) In the equation, L_{net} means n, e, t are three variables. Should be L_{\text{net}} instead.

...
 
summary_of_the_review: In conclusion, the paper presents a novel idea to perform adversarial attacks for audio-based systems, but the experiment setup and results need improvement. The amount of work required is perhaps more than what could be finished based on the time constraint.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper proposes a phase-oriented algorithm PhaseFool to efficiently construct imperceptible audio adversarial attacks with energy dissipation.  The authors leverage the spectrogram consistency of STFT to adversarially transfer phase perturbations to the adjacent frames and dissipate the energy that is crucial for ASR systems. Empirical evaluations show that the attack effectiveness of the proposed attack is high.
main_review: This paper provides an interesting perspective to generate stealthy adversarial audios. The paper is easy to follow and the proposed method is well-motivated.
However, the evaluation of the proposed attack in the paper is a bit weak. For instance, the paper didn't evaluate the proposed attack against different adversarial audio defenses to evaluate the resiliency of the attack. 
It would be helpful if the authors can test the generated adversarial audios against different ASR systems.
Further, it would be important and interesting to test the adversarial transferability and other properties of the generated adversarial audios. 
summary_of_the_review: Overall the paper is well-organized and the proposed method is interesting.
If the authors can add necessary evaluation, such as the attack effectiveness comparison with other attacks against the state of the art defenses; the adversarial transferability analysis, and the adversarial evaluation against different ASR systems, I would like the increase my score.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper introduces a new way of constructing adversarial examples for automatic speech recognition using the phase of the short-time Fourier transformation. The authors conduct experiments and subjective evaluations to show how their adversarial examples compare to previous state-of-the-art algorithms. The experimental results show that the proposed phase-oriented audio adversarial samples can be produced in reduced time as well as they are less perceivable by humans.
main_review: Overall, I believe that the paper has great potential since the idea of energy dissipation is quite interesting but there are several concerns that need to be addressed. If the following concerns are addressed, I will consider to increase my score. Please see below my concerns and questions to the authors in descending order of importance (0 is the most important):

0. The main problem of this paper stems from the limited experimental setup that the authors have chosen to show the significance of their contributions. Specifically, the authors have only tested their algorithm for generating sequences with 100% WER and with a white-box ASR which was trained by the authors. It would be interesting to see if those adversarial examples are valid for pre-trained black box models even with not 100% WER. Moreoever, the 100% WER might be misleading since it would make much more sense to have a small change in a few words that would change the meaning than completely altering the whole target sentence. Furthermore, it might be the case that the other algorithms could alter a couple of words fairly easily but not all of them.

1. The authors provide only a very limited amount of adversarial examples in their supplementary material (which the authors also do not provide details if they are random or cherry-picked). Even from those limited examples I would admit that there are evident artifacts in PhaseFool’s adversarial examples. To the best of my hearing ability I would also say that the adversarial examples coming from the “Imperceptable” sound less artifact-y. I do not consider that the difference is so significant but I would like to hear more random examples to conclude.

2. There are several premises and claims in this paper which are at least ill-posed and sometimes wrong. For example, “Since phase is not relevant for speech recognition, the existing audio adversarial attacks neglect the influence of phase spectrogram.” is not true in cases where there are several speakers and a model (or even a human) uses the phase (aka inter-aural time-difference) between the two sources to better isolate and understand the words spoken by a speaker from a specific location. Another example, “Till now, we reveal the bi-directional essence of phase-oriented audio adversarial attack: it dissipates the critical energy for the classification model and constructs the adversarial perturbations in the meantime.” How is the latter statement shown? To the best of my knowledge, there is no “known” frequency region critical energy for classification for all ASR models. 

3. I think that calling the inference/convergence times “efficiency (s)” is rather misleading. Moreover, the authors should report the number of trainable parameters, as well as the actual memory requirements in order to conclude that their algorithm is indeed more efficient and also discuss ways if their algorithm could be somehow more efficiently parallelized.

4. I am not fully convinced that an ASR model which does not use an STFT or a log-mel representation would also be vulnerable to an attack such as the one proposed in this paper. Specifically, with a small and simple adaptive front-end, one could possibly learn some real over-complete basis to be more robust against attacks like  PhaseFool. Real-basis have been successfully applied towards separation and enhancement problems but also show that can effectively represent speech with even a single layer [1, 2, 3, 4]. Could the authors provide ablation studies by replacing the fixed STFT layers with adaptive convolutions and still show that their findings still hold?

5. Based on the aforementioned point, the vulnerability of ASR models to phase perturbations or echoes is known for many years now [5] which partly explains the efficiency of PhaseFool that can easily drive the ASR model towards a mis-prediction while also not altering the structure of the sound significantly. Can PhaseFool be applied in reverberant scenarios where there are also other phase artifacts and still cannot be perceived by the human ear? Optionally, it would be wise to assume that there is at least some naive Wiener or minimum variance distortionless response (MVDR) filter and see how and if PhaseFool can trick those front-ends as well. There are other more sophisticated defences that the authors could also try, such as [6], to show that the proposed adversarial examples are not easily detectable by automated systems.

6. Table 1. should be WER 100% and the arrow next to WER should be facing up since  all of them are adversarial algorithms.

7. Could the authors specify what are the exact time-lengths of the input audio that the ~30seconds inference time corresponds to?

[1] Venkataramani S, Casebeer J, Smaragdis P. End-to-end source separation with adaptive front-ends. In2018 52nd Asilomar Conference on Signals, Systems, and Computers 2018 Oct 28 (pp. 684-688). IEEE.

[2] Luo, Y. and Mesgarani, N., 2019. Conv-tasnet: Surpassing ideal time–frequency magnitude masking for speech separation. IEEE/ACM transactions on audio, speech, and language processing, 27(8), pp.1256-1266.

[3] Tzinis, E., Venkataramani, S., Wang, Z., Subakan, C. and Smaragdis, P., 2020, May. Two-step sound source separation: Training on learned latent targets. In ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) (pp. 31-35). IEEE.

[4] Mimilakis, S.I., Drossos, K. and Schuller, G., 2021, January. Unsupervised interpretable representation learning for singing voice separation. In 2020 28th European Signal Processing Conference (EUSIPCO) (pp. 1412-1416). IEEE.

[5] Xiong, F., Meyer, B.T., Moritz, N., Rehr, R., Anemüller, J., Gerkmann, T., Doclo, S. and Goetze, S., 2015. Front-end technologies for robust ASR in reverberant environments—spectral enhancement-based dereverberation and auditory modulation filterbank features. EURASIP Journal on Advances in Signal Processing, 2015(1), pp.1-18.

[6] Jayashankar, T., Roux, J.L., Moulin, P. (2020) Detecting Audio Attacks on ASR Systems with Dropout Uncertainty. Proc. Interspeech 2020, 4671-4675, doi: 10.21437/Interspeech.2020-1846.

===== POST - REBUTTAL =========
The authors have addressed some of my concerns, thus, I increase my score from 3 -> 5.
summary_of_the_review: Although the idea proposed in the paper is interesting and could have a great potential in the way that adversarial examples are generated for ASR systems. However, the current version of the paper displays only a limited experimental setup of the proposed algorithm that does not help to show the significance of the algorithm. I am willing to increase my score if my above concerns are addressed.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: This paper proposes a novel adversarial attack method that attacks ASR network.
The idea is that the attack is likely to be imperceptible when phase information is perturbed because phase information is known to give releatively small perceptible difference than magnitude information.
The perturbation on phase information influences the magnitude information which is known as energy dissipation.
Experiment results show that it reaches almost state-of-the-art results in terms of imperceptibility. The advantage of the proposed method is that it can generate the imperceptible perturbation using fewer steps than the previous state-of-the-art method.
They also qualitatively show that it is usually the harmonic parts of speech where the energy dissipates.

main_review: Strengths:
1. The idea of phase-based adversarial attack makes sense in that the phase information is usually known as less perceptible than magnitude information.
2. The authors theoretically show that the phase-based perturbation leads to energy dissipation.
3. The experiment results are good, and is even better than the magnitude-based method.

Weakness:
1. It could have been nicer if the authors had experimented with the raw-waveform-based ASR networks.
2. It could have been nicer if the authors had experimented the method on more diverse audio NNs.
summary_of_the_review: The idea is solid.
Experiment results are good.
Writing is straightforward and easy to follow.
All in all, I recommend to accept the paper.
review_title: null

Meta-review: This paper proposed a novel phase-oriented algorithm to efficiently construct imperceptible audio adversarial attacks. It leverages the spectrogram consistency of STFT to adversarially transfer phase perturbations to the adjacent frames and dissipate the energy that is crucial for ASR systems. Empirical evaluations show that the attack effectiveness of the proposed attack is high.

As agreed by the reviewers the method is very interesting, but the experimental justification is limited, lacking strong SOTA baseline ASR systems, different ASR model architectures, the adversarial transferability analysis etc. The author did add DeepSpeech 2 results to the initial version's Low-rank Transformer only results, which is still not convincing enough. The author also commented that they will "add more comprehensive experiments with different systems and …architectures in our next version of the paper" which is not in the current paper yet. Hence, resubmission with more experimental evaluations is recommended. 

The decision is mainly due to the weak experimental justification.
Decision: Reject