Defense Against Adversarial Attacks on Speech
Systems

Ziqian Luo

Oracle America

ziqian.l.luo@oracle.com

Xueting Pan

Oracle America

xueting.pan@oracle.com

Abstract

Automatic speech recognition system, especially speech2text system, are vulner-
able to adversarial attacks. Imagine a real world scenario, an evil adversary can
produce a perturbed natural sounding audio that to human ear, sounds like the sen-
tence *without the dataset the article is useless*, but will cause an ASR system (like
Siri) to produce transcription *ok google browse to evil dot com*. The current state
of the art attack like hidden voice commands [2] can add perturbation to a natural
audio input, pass it through the attacked ASR system and have it transcribed to any
target phrase chosen by the adversary. It is not hard to image that vulnerability to
such attacks could result in grief consequences to users of ASR systems. In this
project we attempt to adapt a detector-reformer pattern: identify adversarial from
benign audio inputs by exploring the natural temporal dependency property of be-
nign audio data; and explore possibilities to reform identified adversarial example
using concepts from well-received deep learning work in signal processing: such
as stacked denoising auto-encoder (SDAE), and convolutional auto-encoder, etc.

1 Background

Despite recent infiltration of adversarial attacks on audio and speech systems, especially automatic speech recognition (ASR) system, there is a lack of studying in dedicated systems for defense against both white-box (where the adversary has complete knowledge of the victim learning model) and black-box (where the adversary has no access to these) adversarial attacks in this domain.

Currently, there are two main classes of defense methods against adversarial attacks of ASR system:
retraining with adversarial example and input transformation.

1.1 Retraining with adversarial examples

Adversarial training aims to train a robust model from scratch on a training set augmented with adversarially perturbed data. However adversarial training is more time consuming than training on clean audios only, because online adversarial example generation needs extra computation, and it takes more epochs to fit adversarial examples.

1.2 Input transformation

Preprocessing based training such as input transformation process inputs with certain transformation to remove the adversarial noise, and then send these inputs to the target model. Since preprocessing based defense does not require retraining the ASR model, it is a more flexible and applicable choice in the industry compared with adversarial training. [21] shows that applying simple signal processing transformations (quantization Quant-256, local smoothing Median-4 and downsampling) to audio inputs are fast and easy to implement; these methods could effectively reduce the adversarial
perturbation without affecting the original audio too much. But such input transformations cannot prevent the generation of adversarial audios by adaptive attack. In addition, Athalye et al.[1] has pointed out that models with input transformation can become fragile to adversarial examples when one adopts the attack consider gradient obfuscation.

This motivates us to propose using deep learning to create a preprocessing-based defense method that is robust to adaptive attack and at the same time is plug-and-play. The reason we consider this approach is that preprocessing based methods require no retraining of the ASR system, making it more suitable to adapt in large-scale production setting, where constantly retraining ASR systems with adversarial examples is both time and budget inefficient.

In the image domain, preprocessing based defense methods using denoising autoencoders as a defence have gained many applications: Gu et al. [10] first proposed the use of denoising auto-encoders as defense. Meng et al. [17] proposed a two-step defense model MagNet, which detects the adversarial input and then reforms it based on the difference between the manifolds of clean and adversarial examples using two autoencoders.

But there is yet an effective denoising autoencoder for the use of defense against adversarial attacks toward the ASR systems.

## 2 Related work

We hypothesize that the success gained by MagNet in the image domain [6] could be transferable to the audio domain to create an effective defense against adversarial attacks on ASR systems.

Thus, we propose to adopt the **detector** and **reformer** architecture in MagNet. For the detector, we get inspiration from recent paper that exploits audio data's temporal dependency to detect adversarial audios from benign ones. For the reformer, we plan to implement an autoencoder to remove adversarial noises by projecting the adversarial input distribution space into the benign distribution. The precise related work is listed in the following sections.

### 2.1 Temporal dependency

In [7], on the automatic speech recognition (ASR) tasks, by utilizing audio data's temporal dependent property, the paper proposed a classification strategy that can effectively detect audio adversarial examples while minimally affecting the recognition performance on normal examples. Given an audio sequence, a prefix of length *k* can be selected as input for ASR to obtain transcribed results as *S*<sub>*k*</sub>. The whole sequence can also be given as input for ASR and the prefix of length *k* of the transcribed result as *S*{*whole*, *k*}. Then the consistency between *S*<sub>*k*</sub> and *S*{*whole*, *k*} can be compared in terms of temporal dependency distance with the metric of word error rate (WER). For normal/benign audio instances, *S*<sub>*k*</sub> and *S*{*whole*, *k*} should be similar, however, for audio adversarial examples, it may fail to preserve the temporal information of the original sequence and thus *S*<sub>*k*</sub> and *S*{*whole*, *k*} in this case will not be able to produce consistent results.

### 2.2 Autoencoder for speech denoising and enhancement

In the image domain, denoising autoencoder has achieved good result as a defense against adversarial attacks: in Liao et al. [11], the authors proposed the denoising U-net that can reconstruct the clean image by subtracting the adversarial noise. Experimental results show that their model achieved the highest accuracy on the test set compared with the state-of-the-art denoising autoencoder model [18].

Additionally, there have been attempts at using Autoencoders for speech denoising and enhancement in signal processing domain. In [16], a stacked autoencoder structure is proposed to denoise the input data. In the training procedure, noisy-clean speech pairs are used and they expect the trained AЭ can eliminate the factory and car noise (which is also what they used in training) added to the speech. There are also uses of convolutional autoencoder structure for audio source separation from nonstationary background noise demonstrated in [9].
<figure><img src="image_1.png" /><figcaption>Figure 1: Temporal dependency detector structure taken directly from [15]</figcaption></figure>

<figure><img src="image_2.png" /><figcaption>Figure 2: Denoising Autoencoder taken directly from [12]</figcaption></figure>

We know that adversarial samples are generated by adding noise, though not random, to clean samples. If we can train an AE that can eliminate the noise in the data, then it might also be able to make the adversarial samples 'clean'. The problem is how do we train the AE if we don't have access to the adversarial samples. One idea is to add gaussian noise to clean data and use those samples to train our AE.

## 3 Objective

This motivates us to formulate the defense against adversarial attacks on speech systems as a combination of both detection and input transformation: we propose a system that exploits the unique temporal dependency quality of audio data for detection of adversarial examples and uses a deep denoising autoencoder for input transformation to transform slightly perturbed audio input closer to the ground truth audio.

Our end goal is to design a model that can identify whether the input is an adversarial example and improve the performance of ASR given adversarial examples while only slightly negatively impacting transcription accuracy of benign examples. In particular, the ASR system under consideration for project is DeepSpeech. It is a speech-to-text transcription network, which is a biRNN based model with beam search to decode text. We choose DeepSpeech as our targeted ASR system due to its popularity in the research community, so that reference of baseline on the same ASR system is available. In addition, it provides pretrained model and extensive documentation. We will use a pretrained DeepSpeech model on the Librispeech dataset for our evaluation.

## 4 Datasource

For the adversarial dataset to perform evaluation and finding temporal dependency threshold, we started with the state-of-the-art gradient-based method proposed in [3]. Instead of implementing this attack which is very time consuming as mentioned in [20], we will start with pre-generated adversarial example based on the Mozilla Common Voice dataset. As speech signals in the dataset have different lengths, the dataset is categorized in terms of speech signal length and target text length. Each sample in the data is a triplet of (normal original audio in wav format, generated adversarial audio in wav format, target text). The speech audio is categorized to three classes:

* **Short signals**: audios with length of 1-2 seconds

* **Medium signals**: audios with length of 3-4 seconds

* **Long signals**: audios with length of 6-7 seconds

The target text is categorized to three classes:

* **Short target**: "Open all doors"

* **Medium target**: "Switch off wifi connection"
<figure><img src="image_3.png" /><figcaption>Figure 3: Final model workflow</figcaption></figure>

*   **Long target:** "I need a reservation for sixteen people at the seafood restaurant down the street"

For the final testing, we sampled 100 × 3 × 3 of samples from the dataset described above to have a balanced representation from each category without repeating samples.

For denoising autoencoder training, we used a dataset of 2,500 sentences of audio data in wav format. Then we applied STFT to get the spectrum. The input of autoencoder is generated by adding small amounts of random noise $N \sim (0, \sigma^2)$, $\sigma^2 = 0.05$ to the normalized spectrum.

# 5 Model

As mentioned in the beginning of Section 2 related work, we hypothesize that the success gained by MagNet in the image domain could be transferable to the audio domain to create an effective defense against adversarial attacks on ASR systems. For our model, we adopt the two-part **detector** and **reformer** architecture in MagNet. In particular, the proposed model workflow is outlined in Figure 3. The detector still serves the functionality of differentiating adversarial audios from the benign ones, but instead of using an autoencoder as shown in MagNet, we will use the temporal dependency detector used in [22]. The second part would contain the reformer which is an autoencoder using techniques in audio denoising [19].

## 5.1 Detector: Temporal Dependency Detector

The proposed temporal dependency detector, follows the design mentioned in section 2.1 Temporal Dependency [13], which exploits audio's domain-specific data property to gain discriminative power against audio adversarial examples [5], and is resistant to adaptive attacks demonstrated in their experiments. It works by obtaining and comparing two kinds of transcriptions for each sample. First, it takes an incoming audio sample, take the first k portion of the audio, pass the prefix audio through the pretrained DeepSpeech model, get the transcription, which we call it *transcriptionA*. For the same audio sample, pass the entire audio through the pretrained DeepSpeech model, get the transcription, split the transcription to obtain the first k portion of the transcription, which we call it *transcriptionB*. After *transcriptionA* and *transcriptionB* are obtained for each audio sample, they are compared using both word error rate and character error rate. For benign samples, it is expected that both errors would be low; while for adversarial samples, both error is expected to be high.

## 5.2 Reformer: Denoising Autoencoder

We experimented with multiple architectures for the autoencoder denoiser. The first kind under consideration were convolutional based autoencoders. It involved gradually increasing the filter number to capture more high level information with Conv2d layers using ReLU activation and then reducing the filter number back down with ConvTranspose2d layers. We attempted both
Conv2d and Conv1d models, with the input channel and final output channel for the Conv2d being 1 and being 161 for Conv1d, which is the spectrogram channel used in DeepSpeech. Between these two, Conv2d models performed better. Details for the Conv2d model can be found in Figure 4. Conv1d model had the exact same structure except for replacing the layers from Conv2d to Conv1d.

Another convolutional model, following the architecture in [14], had pooling layers in the encoder and upsampling layers in the decoder, which is shown in Figure 5. Following the first convolutional layer, there is a Maxpooling layer of (3,5) which means down-sampling the feature maps by 3 in the time-frame direction and by 5 in the frequency direction. Similar upsampling is done for the upsampling layers, where pixels are interpolated to scale back up. This approach was giving worse results than Conv2d models without downsampling.

Inspired by [8], we also experimented with both MLP as well as stacked-MLP based models. The best model we found for this task was a MLP based model with linear layers with 512, 256, and 128 nodes in the encoder and 128, 256 and 512 nodes in the decoder. Each layer is followed by a ReLU activation layer except for the output layer. 161 here is the number of channels the spectrogram has for the input into DeepSpeech. For the deep denoising autoencoder, we build a network with four hidden layers, each with 200 hidden units and is followed by a ReLU activation layer.

For all the models, we used the Adam optimizer with a learning rate of 1e-3.

<figure><img src="image_4.png" /><figcaption>Figure 4: Convolutional
based autoencoder</figcaption></figure>

<figure><img src="image_5.png" /><figcaption>Figure 5: Convolutional based
autoencoder with downsampling</figcaption></figure>

<figure><img src="image_6.png" /><figcaption>Figure 6: MLP based
autoencoder</figcaption></figure>

<figure><img src="image_7.png" /><figcaption>Figure 7: Stacked MLP
based autoencoder</figcaption></figure>

<caption>Figure 4-7: Denoising Autoencoders Architecture</caption>

We used noisy-clean pairs to train the autoencoder. The inputs are noisy samples and on the output side, we minimized the mean squared error between the output and the clean spectrum. From figures 8 to 10 we can see that the major features in the spectrum are well reconstructed and most of the noise is removed.
<figure><img src="image_8.png" /><figcaption>Figure 8: The spectrum of original audio</figcaption></figure>

<figure><img src="image_9.png" /><figcaption>Figure 9: The spectrum of audio with Gaussian noise</figcaption></figure>

<figure><img src="image_10.png" /><figcaption>Figure 10: The spectrum of reconstructed audio</figcaption></figure>

# 6 Evaluation

## 6.1 Metrics

The goal of this project is to create a defense method using autoencoder against adversarial attacks on automatic speech recognition systems (ASR), which aims to recover the ground truth (original audio instances) from adversarial instances. Thus we propose to use the commonly used word error rate (WER) and character error rate (CER) as the evaluation metrics to measure the error between the recovered text and the ground truth text on both the word and character level.

## 6.2 Results

The best TD ratio was 0.5 which is the ratio of the first k portion length compared to the total length. Any ratio smaller or larger would produce transcripts that are either too short or too similar to the original to differentiate between adversarial and benign.

We used 0.4 as the TD threshold. We would only pass the input into the reformer if the percentage character error rate between the transcript of the truncated input and the truncated transcript of the whole input is higher than this threshold. Otherwise we directly feed it into the ASR system.

We were able to beat the baseline autoencoder result in [4] with our model shown in Figure 3. Specifically the clean data results were much better. However, it was not able to beat the result using input transformation with quantization.

<table><caption>Figure 11: Our result using TD ratio of 0.5 and threshold of 0.4</caption><thead><tr><th></th><th>Clean WER</th><th>Clean CER</th><th>Adv WER</th><th>Adv CER</th></tr></thead><tbody><tr><td>Original</td><td>2.87</td><td>6.09</td><td>7.26</td><td>22.28</td></tr><tr><td>Our system</td><td>3.11</td><td>7.05</td><td>7.1</td><td>20.93</td></tr></tbody></table>

<table><caption>Figure 12: Result in Baseline Paper, Yang [21]</caption><thead><tr><th></th><th>Clean WER</th><th>Clean CER</th><th>Adv WER</th><th>Adv CER</th></tr></thead><tbody><tr><td>Original</td><td>3.05</td><td>1.46</td><td>102.8</td><td>86.5</td></tr><tr><td>Autoencoder in [2]</td><td>30</td><td>15.1</td><td>99.4</td><td>58.1</td></tr><tr><td>Quan-256 in [2]</td><td>3.5</td><td>1.7</td><td>29.1</td><td>15.4</td></tr></tbody></table>
<table><caption>Figure 13: Threshold tuning</caption><thead><tr><th>Threshold(CER%)</th><th>adversarial,defense WER</th><th>adversarial,defense CER</th><th>clean,defense WER</th><th>clean,defense CER</th></tr></thead><tbody><tr><td>0</td><td>6.93</td><td>20.41</td><td>4.94</td><td>13.53</td></tr><tr><td>0.1</td><td>6.94</td><td>20.43</td><td>4.49</td><td>12</td></tr><tr><td>0.2</td><td>6.97</td><td>20.52</td><td>3.7</td><td>9.35</td></tr><tr><td>0.3</td><td>7.06</td><td>20.86</td><td>3.35</td><td>7.89</td></tr><tr><td>0.4</td><td>7.1</td><td>20.93</td><td>3.11</td><td>7.05</td></tr><tr><td>0.5</td><td>7.23</td><td>21.89</td><td>3.05</td><td>6.6</td></tr><tr><td>0.6</td><td>7.26</td><td>22.43</td><td>2.94</td><td>6.32</td></tr><tr><td>0.7</td><td>7.25</td><td>22.38</td><td>2.9</td><td>6.18</td></tr><tr><td>0.8</td><td>7.26</td><td>22.27</td><td>2.9</td><td>6.18</td></tr><tr><td>0.9</td><td>7.26</td><td>22.21</td><td>2.9</td><td>6.18</td></tr><tr><td></td><td>adversarial,original WER</td><td>adversarial,original CER</td><td>clean,original WER</td><td>clean,original CER</td></tr><tr><td></td><td>7.26</td><td>22.28</td><td>2.87</td><td>6.09</td></tr></tbody></table>

<figure><img src="image_11.png" /><figcaption>Figure 14: The spectrum of original audio</figcaption></figure>

<figure><img src="image_12.png" /><figcaption>Figure 15: The spectrum of adversarial</figcaption></figure>

## 6.3 Conclusion

In this project, we were able to produce an architecture that beats the baseline autoencoder result shown in Yang's paper [21]. However, comparing our result with other defense strategy: input transformation is still more successful than the autoencoder. While mentioned in the section 1.2 Background, models with input transformation can become fragile to gradient obfuscation attack methods, while our detector-reformer approach using temporal dependency and autoencoder is resistant to such adaptive attack, at the same time, it is plug-and-play, meaning it requires no retraining of the ASR.

Our approach was producing mixed results. Especially with short input sequences to long target sequences, we are seeing much lower WER and CER, which might be caused by the reduced length of our transcript compared to the un-reformed adversarial transcript. Additionally, we would increase the error rate of clean examples. To address these mixed results, we have some hypotheses. First of all is that it is possible the autoencoder's notion of "noise" is different from the adversarial audio's "noise". We assumed the noise of the adversarial audio to be based on the Gaussian distribution but it turns out to not be a reliable assumption. Additionally, as shown in the spectrogram pictures of original audio in Figure 14 vs adversarial in Figure 15, in addition to noise, there are some portions missing in the adversarial audio. Our approach which only focused on denoising, did not help with adding back missing information.

## References

[1] Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In *International conference on machine learning*, pages 274–283. PMLR, 2018.
[2] Nicholas Carlini, Pratyush Mishra, Tavish Vaidya, Yuankai Zhang, Micah Sherr, Clay Shields, David Wagner, and Wenchao Zhou. Hidden voice commands. In *25th USENIX security symposium (USENIX security 16)*, pages 513–530, 2016.

[3] Nicholas Carlini and David Wagner. Audio adversarial examples: Targeted attacks on speech-to-text. In *2018 IEEE security and privacy workshops (SPW)*, pages 1–7. IEEE, 2018.

[4] Feiyang Chen and Ziqian Luo. Learning robust heterogeneous signal features from parallel neural network for audio sentiment analysis. *arXiv preprint arXiv:1811.08065*, 2018.

[5] Feiyang Chen and Ziqian Luo. Sentiment analysis using deep robust complementary fusion of multi-features and multi-modalities. *CoRR*, 2019.

[6] Feiyang Chen, Ziqian Luo, Nan Chen, Hanyang Mao, Hanlin Hu, Ying Jiang, Xueting Pan, and Huitao Zhang. Assessing four neural networks on handwritten digit recognition dataset (mnist). *Journal of Computer Science Research*, 6(3):17–22, 2024.

[7] Feiyang Chen, Ziqian Luo, Yanyan Xu, and Dengfeng Ke. Complementary fusion of multi-features and multi-modalities in sentiment analysis. *arXiv preprint arXiv:1904.08138*, 2019.

[8] Feiyang Chen, Ziqian Luo, Lisang Zhou, Xueting Pan, and Ying Jiang. Comprehensive survey of model compression and speed up for vision transformers. *arXiv preprint arXiv:2404.10407*, 2024.

[9] Emad M Grais and Mark D Plumbley. Single channel audio source separation using convolutional denoising autoencoders. In *2017 IEEE global conference on signal and information processing (GlobalSIP)*, pages 1265–1269. IEEE, 2017.

[10] Shixiang Gu and Luca Rigazio. Towards deep neural network architectures robust to adversarial examples. *arXiv preprint arXiv:1412.5068*, 2014.

[11] Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu. Defense against adversarial attacks using high-level representation guided denoiser. In *Proceedings of the IEEE conference on computer vision and pattern recognition*, pages 1778–1787, 2018.

[12] Xugang Lu, Yu Tsao, Shigeki Matsuda, and Chiori Hori. Speech enhancement based on deep denoising autoencoder. In *Interspeech*, volume 2013, pages 436–440, 2013.

[13] Ziqian Luo. Knowledge-guided aspect-based summarization. In *2023 International Conference on Communications, Computing and Artificial Intelligence (CCCAI)*, pages 17–22. IEEE, 2023.

[14] Ziqian Luo, Hua Xu, and Feiyang Chen. Utterance-based audio sentiment analysis learned by a parallel combination of cnn and lstm. *arXiv preprint arXiv:1811.08065*, 2018.

[15] Ziqian Luo, Hua Xu, and Feiyang Chen. Audio sentiment analysis by heterogeneous signal features learned from utterance-based parallel neural network. In *AffCon@ AAAI*, pages 80–87, 2019.

[16] Ziqian Luo, Xiangrui Zeng, Zhipeng Bao, and Min Xu. Deep learning-based strategy for macromolecules classification with imbalanced data from cellular electron cryotomography. In *2019 International Joint Conference on Neural Networks (IJCNN)*, pages 1–8. IEEE, 2019.

[17] Dongyu Meng and Hao Chen. Magnet: a two-pronged defense against adversarial examples. In *Proceedings of the 2017 ACM SIGSAC conference on computer and communications security*, pages 135–147, 2017.

[18] Xueting Pan, Ziqian Luo, and Lisang Zhou. Comprehensive survey of state-of-the-art convolutional neural network architectures and their applications in image classification. *Innovations in Applied Engineering and Technology*, pages 1–16, 2022.

[19] Xueting Pan, Ziqian Luo, and Lisang Zhou. Navigating the landscape of distributed file systems: Architectures, implementations, and considerations. *arXiv preprint arXiv:2403.15701*, 2024.
[20] Saeid Samizade, Zheng-Hua Tan, Chao Shen, and Xiaohong Guan. Adversarial example detection by classification for deep speech recognition. In *ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)*, pages 3102–3106. IEEE, 2020.

[21] Zhuolin Yang, Bo Li, Pin-Yu Chen, and Dawn Song. Characterizing audio adversarial examples using temporal dependency. *arXiv preprint arXiv:1809.10875*, 2018.

[22] Lisang Zhou, Ziqian Luo, and Xueting Pan. Machine learning-based system reliability analysis with gaussian process regression. *arXiv preprint arXiv:2403.11125*, 2024.