Certifying Neural Network Audio Classifiers

1 INTRODUCTION . Recent advances in deep learning have enabled replacement of traditional voice recognition systems with a single neural network trained from data ( Graves et al. , 2013 ; Hannun et al. , 2014 ; Amodei et al. , 2016 ) . Wide adoption of these networks in consumer devices poses a threat to their safety when exposed to a malicious adversary . Indeed , it was recently shown that an adversary can inject noise unrecognizable to a human and force the network to misclassify ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ; Zhang et al. , 2017 ; Carlini & Wagner , 2018 ; Carlini et al. , 2016 ; Qin et al. , 2019 ; Neekhara et al. , 2019 ; Yang et al. , 2019 ; Esmaeilpour et al. , 2019 ) , exposing a serious security flaw . Ideally , when deploying an automated speech recognition system we would like to guarantee that the system is robust against noise injected by an adversary . There has been substantial recent work on certifying robustness of computer vision models ( Katz et al. , 2017 ; Ehlers , 2017 ; Bunel et al. , 2018 ; Ruan et al. , 2018 ; Tjeng et al. , 2019 ; Anderson et al. , 2018 ; Wong et al. , 2018 ; Dvijotham et al. , 2018 ; Raghunathan et al. , 2018 ; Dvijotham et al. , 2019 ; Weng et al. , 2018 ; Zhang et al. , 2018 ; Salman et al. , 2019 ; Gehr et al. , 2018 ; Singh et al. , 2018 ; 2019a ; Wang et al. , 2018 ; Singh et al. , 2019b ) . However , the audio domain poses unique challenges not addressed by prior certification work for vision . Differences between audio and vision models Concretely , while an input to a vision model is a raw image , audio models typically come with a complex preprocessing stage ( that involves non-trivial non-linear operations such as logarithm ) which extracts relevant features from the signal . Additionally , audio systems typically use recurrent architectures ( Chiu et al. , 2017 ) which computer vision verifiers do not handle as they focus on fully-connected , convolutional and residual architectures . This work We address both of these challenges and propose an end-to-end verification method for neural network based audio classifiers and an implementation of this method in a system called DAC ( Deep Audio Certifier ) . Our threat model assumes an attacker can introduce a noise-based perturbation to the raw audio input signal . The goal then is to certify that , for any signal that the attacker can produce , the neural network classifies the signal to the correct label . We perform verification of this property using the framework of abstract interpretation ( Gehr et al. , 2018 ) . At a high level , the idea is to maintain an abstraction capturing all possible behaviors of both the audio processing stage and the neural network . The flow of DAC is shown in Fig . 1 where all abstractions are dark blue shapes . Here , all possible signals an attacker can obtain are captured using an abstraction s ( i ) ( a convex relaxation ) . This abstraction is then propagated through the audio processing stage ( shown in green boxes ) . The key components of this step are abstract transformers . For each audio processing operation ( e.g . FFT ) we create an abstract transformer which receives an abstraction representing an approximation of all possible inputs to the operation and outputs a new abstraction which approximates all possible outputs of the operation . The result of the audio processing stage is the abstraction x ( i ) . The shape x ( i ) is then used as input to the recurrent LSTM unit ( light blue ) which maintains an abstraction of a hidden state h ( i−1 ) . LSTM consists of multiple operations and we create a custom abstract transformer for each of those . The result of the transformers in LSTM is a new hidden state h ( i ) . If this was the last frame in the signal ( meaning i = T ) , then hidden state h ( T ) is passed through the fully connected layer of the neural network and , again using the abstract transformer , the final abstract shape a is obtained at the output ( at the right of Fig . 1 ) . Finally , to certify the property we check if each concrete output in the abstraction a classifies to the correct label ( this is typically easy ) . If this is true , the output of the network is correct for all inputs that the attacker can create . Related work on RNN certification The work of ( Ko et al. , 2019 ) proposes the POPQORN verifier for recurrent neural networks ( RNN ) . We note that POPQORN does not handle the audio preprocessing pipeline . Even though POPQORN can not directly verify audio classifiers , their approximations for LSTM non-linearities can be integrated in DAC . This results in ≈ 200× slowdown with small decrease in the volume of the approximation . The massive slowdown makes their approximations unsuitable for certifying audio classifiers . In contrast , using our custom abstract transformers for LSTM non-linearities , DAC can precisely certify end-to-end robustness of challenging audio classifiers in few minutes . Our main contributions are : 1 . A novel and efficient method to certify robustness of neural network audio classifiers to noise-based perturbations . The method is based on new abstract transformers which handle non-linear operations used in both audio processing and recurrent architectures . 2 . An implementation of both verification and provably robust training in a system called DAC . We evaluated DAC on common audio classification benchmarks , showing it scales to realistic networks and is far more precise ( 97 % to 2 % ) than the next best scalable method . 2 BACKGROUND . We first define a threat model that we work with and then present all operations that are part of the verification procedure , including audio processing ( MFCC ) and LSTM updates . We also discuss the type of verification method we employ . Threat model We follow the same attacker threat model as Carlini & Wagner ( 2018 ) . The assumption is that the attacker can add noise δ to the original signal s so to obtain a perturbed signal s′ = s+ δ . The measure of signal distortion are decibels ( dB ) defined as : dB ( s ) = max i 20 · log10 ( |si| ) ; dBs ( δ ) = dB ( δ ) − dB ( s ) Note that the quieter the noise is , the smaller the decibel of perturbation dBs ( δ ) ( it is usually a negative value as it is quieter than the signal ) . We assume the attacker can generate noise δ such that dBs ( δ ) < where is a constant defined by the threat model . Our goal is to verify whether the neural network classifies s′ correctly for each small perturbation δ ( as constrained above ) . Mel-Frequency Cepstral Coefficients ( MFCC ) Though there have been number of works which operate directly on the raw signal ( Pascual et al. , 2017 ; Sainath et al. , 2015 ) , Mel-Frequency Cepstrum ( MFC ) is traditionally preferred for audio preprocessing in speech recognition systems e.g. , DeepSpeech ( Hannun et al. , 2014 ) . The idea of MFC is to model non-linear human acoustic perception as power spectrum filters based on certain frequencies , called Mel-frequencies . The final result of the transformation is a vector of coefficients whose elements contain log-scaled values of filtered spectra , one for every Mel-frequency . This resulting vector is a feature representation of the original signal and can now be used in a downstream task such as audio classification . Sahidullah & Saha ( 2012 ) presented an approach to represent MFCC computation using several matrix operations which we integrate with our verification framework . Given T frames of audio signals of the length N = 2k , represented as matrix S = [ s ( 1 ) · · · s ( T ) ] tr ∈ RT×N ( tr for transpose ) , audio preprocessing with MFCC is calculated using the following steps : 1 . Pre-emphasizing and Windowing : Y = S ( IN − cpeI+1N ) H Transform the signal with the pre-emphasizing and applying the Hamming window . Here , I+1N ∈ RN×N is the shifted diagonal identity matrix ( I +1 i , j = 1 if i+ 1 = j , otherwise 0 ) , H ∈ RT×N is the Hamming window , and cpe is the pre-emphasizing constant . 2 . Power Spectrum of Fast Fourier Transform ( FFT ) : Θ = ( YW ) ( YW ) Perform FFT on the windowed data and square it to get the real-value spectrum . We can denote FFT on discrete domain ( DFT ) with the multiplication of Y andW ∈ CN×N/2 . 3 . Filter Bank Log Energy : Ψ = log ( ΘΛ ) Apply the Mel frequency filter bank to the power spectrum and get the log value of them . Λ ∈ RN/2×p is the filter bank given the number of filters p , and log is applied entry-wise . 4 . DCT ( Discrete Cosine Transformation ) : X = ΨD Perform DCT on the previous result . Again , this can be formulated using matrix multiplication . We use the resultingX = [ x ( 1 ) · · · x ( T ) ] tr as the input for the neural network . Long-Short Term Memory ( LSTM ) LSTM architectures ( Hochreiter & Schmidhuber , 1997 ) are a key part in modern state-of-the-art speech recognition systems ( Hannun et al. , 2014 ; Amodei et al. , 2016 ) . In our work , we consider the following definitions of updates in the LSTM unit . f ( t ) 0 = [ x ( t ) , h ( t−1 ) ] Wf + bf i ( t ) 0 = [ x ( t ) , h ( t−1 ) ] Wi + bi c ( t ) = σ ( f ( t ) 0 ) c ( t−1 ) + σ ( i ( t ) 0 ) tanh ( c̃ ( t ) 0 ) o ( t ) 0 = [ x ( t ) , h ( t−1 ) ] Wo + bo c̃ ( t ) 0 = [ x ( t ) , h ( t−1 ) ] Wc̃ + bc̃ h ( t ) = σ ( o ( t ) 0 ) tanh ( c ( t ) ) where [ · , · ] is the horizontal concatenation two row vectors , W· and b· are kernel and bias of the cell , respectively . At timestep t , vectors f ( t ) 0 , i ( t ) 0 , o ( t ) 0 , c̃ ( t ) 0 represent pre-activations of the forget , input , and output gate , respectively , and the pre-calculation of cell state . Cell state c ( t ) and hidden state h ( t ) computed at timestep t are propagated to the LSTM unit at the next timestep , thus allowing it to maintain states . This recurrent architecture allows inputs with arbitrary length , making it especially suited for audio inputs . Robustness certification In this work , our goal will be to certify the robustness of an audio classification pipeline ( including the LSTM ) to noise perturbations of the input . To build such a verifier , we leverage the general method of abstract interpretation suggested by Cousot & Cousot ( 1977 ) , successfully employed by some of the most recent state-of-the-art verifiers of neural networks ( Gehr et al. , 2018 ; Singh et al. , 2019a ) . The basic idea here will be to propagate the possible perturbations ( captured by a convex region ) through the operations of the entire audio pipeline and to then use the final output region to certify the robustness property . The most challenging step of this approach is defining efficient yet precise approximations of the non-linear operations ( called abstract transformers ) used in the audio pipeline . In this work , we will introduce a number of such new abstract transformers that handle the non-linear operations used in audio processing . Specifically , our over-approximations will be expressed in the recent DEEPPOLY abstraction ( Singh et al. , 2019a ) ( a restricted form of convex polyhedra ) which aims to balance efficiency and precision . That is , the abstract transformer of a non-linear function will take as input a convex polyhedra element expressible in DEEPPOLY and output another polyhedra which over-approximates the behavior of the non-linear operation when invoked with any concrete point inside the original polyhedra .

Summary: In this work, the authors study the task of building neural network classifiers for audio tasks which can be certified as being resistant to an adversarial attack. One of the contributions of this work is the development of abstract transformers which can be used for the data processing frontend used in typical audio applications. The work also proposes an abstract transformers for LSTMs which is stated to be much faster to use in practice than previous work.