PhaseFool: Phase-oriented Audio Adversarial Examples via Energy Dissipation

1 INTRODUCTION . Adversarial examples are specifically designed instances that cause a machine-learning algorithm to produce a misclassification ( Szegedy et al. , 2013 ; Biggio et al. , 2013 ) . Since researchers have successfully created adversarial examples to make automatic speech recognition ( ASR ) system transcribe the audio as any different sentence ( Carlini & Wagner , 2018 ; Vaidya et al. , 2015 ; Carlini et al. , 2016 ) , audio adversarial attacks have become more and more popular . Those attack algorithms usually optimize perturbations added on the benign audio waveform with different constraints based on lp-norm ( Carlini & Wagner , 2018 ; Zhang et al. , 2020 ) . Although the perturbations introduced is small in magnitude , noises in the audio adversarial examples are usually perceptible . Later , algorithms based on psychoacoustic principle ( Qin et al. , 2019 ; Schönherr et al. , 2019 ) successfully generate effectively imperceptible adversarial examples by hiding the adversarial perturbations to regions of magnitude spectrogram where it will not be heard by a human . In current imperceptible targeted audio adversarial attacks , only waveform and magnitude spectrogram are taken into account leaving phase and its nature unexplored . Since the structure of natural speech is highly complicated , these two types of algorithms face several challenges : • Waveform-oriented attacks are usually not imperceptible enough . Although constraining perturbations with l2-norm or l∞-norm ( Carlini & Wagner , 2018 ; Liu et al. , 2020 ) , these attacks introduce audible noises to the adversarial examples . Later works focused on the temporal dependency ( Zhang et al. , 2020 ) successfully reduce human-perceptible noises 1Generated audio adversarial examples can be found at our demo website : https : //phasefooldemo.github.io/phasefool-demo/ . but their perturbations are still audible , due to the uncorrelated relationship between psychoacoustic perception and lp-norm metrics . • The optimization of attacks based on the psychoacoustic principles is highly timeconsuming and hard to converge . Due to the determining influence of magnitude spectrogram on human perception , the attack that leverages the psychoacoustic principle of auditory masking ( Qin et al. , 2019 ) successfully generates imperceptible audio adversarial examples . However , it needs two-stage optimization where the first stage of optimization focuses on finding a relatively small perturbation to fool the network ( as is done in prior work ( Carlini & Wagner , 2018 ) ) and the second stage makes the adversarial examples imperceptible . The search process of the optimal balance between hiding the adversarial perturbations in the inaudible regions and fooling the ASR systems is empirically difficult . Generating a single full-sentence adversarial example requires approximately 5000 iterations until it finally converges to an imperceptible solution . This research is motivated by a psychoacoustic principle that phase manipulation in one-channel audios imposes tiny effects on human perception ( Vary & Eurasip , 1985 ) . Besides , the inherent spectrogram consistency of short-time Fourier transform ( STFT ) reveals the fact that the adversarial perturbations in a frame of phase spectrogram will transfer to adjacent frames of magnitude spectrogram ( Griffin & Lim , 1984 ) and dissipate the energy patterns in the spectrogram . These observation motivates us to exploit phase spectrogram for generating audio adversarial examples . Considering the relationship between phase spectrogram and the spectrogram consistency of STFT , in this work , we propose a novel phase-oriented algorithm called PhaseFool that efficiently generates imperceptible audio adversarial examples via energy dissipation . We prove that the phase-oriented perturbations always reduce the magnitude of the spectrogram in the corresponding areas via spectrogram consistency , which is called energy dissipation . Leveraging such a phenomenon , we bring new directions for audio adversarial attacks and are able to construct imperceptible audio adversarial examples efficiently . To the best of our knowledge , we are the first to consider phase spectrogram in the audio adversarial attacks . Our contributions can be summarized as follows : • We leverage the spectrogram consistency of STFT to construct phase-oriented audio adversarial examples , which brings new directions for imperceptible audio adversarial attacks . • We investigate the relationship between phase perturbations and magnitude spectrogram , which is called energy dissipation . Instead of the common lp distance metrics or magnitude-oriented metrics based on the psychoacoustic principle , we propose a weighted loss function based on the phenomenon of energy dissipation to improve the imperceptibility of phase-oriented audio adversarial examples . • We further evaluate the robustness of PhaseFool by constructing adversarial examples that can remain effective even after applying realistic simulated environmental distortions and several state-of-the-art defenses . We conduct experiments on the LibriSpeech dataset ( Panayotov et al. , 2015 ) and implement successful attacks against a pretrained DeepSpeech 2 model ( Amodei et al. , 2016 ) and an end-to-end Transformer-based ASR system ( Winata et al. , 2020 ) . The results show that in terms of imperceptibility , PhaseFool greatly surpasses current state-of-the-art algorithms based on lp-norm metrics and shows comparable imperceptibility with the attacks based on the psychoacoustic principle of auditory masking ( verified by a human study ) . Besides , PhaseFool achieves a 6.64x generation speed-up over current state-of-the-art imperceptible counterparts . Furthermore , in the robustness evaluations , the adversarial examples constructed by PhaseFool remain effective even after applying realistic simulated environmental distortions and several state-of-the-art defenses . We attach the adversarial examples in the experiments and the implementation for reproducibility in the supplementary material . 2 BACKGROUNDS . In this section , we briefly overview the background of this work , including audio adversarial examples and phase-aware audio signal processing . Audio Adversarial Examples . After the early works ( Gong & Poellabauer , 2017 ; Cissé et al. , 2017 ) towards neural networks based ASR systems successfully generate untargeted adversarial examples that produce incorrect but arbitrary transcriptions . Recently , more and more efforts have been made in the audio domain ( Alzantot et al. , 2018 ; Carlini & Wagner , 2018 ) . Among them , one of the most outstanding studies is the iterative optimization-based attack ( Carlini & Wagner , 2018 ) , which introduces a two-stage attack and directly generates targeted adversarial examples using a gradient-descent minimization method . Nevertheless , the generated adversarial examples tend to include noticeable noise . Thus , two recent approaches ( Qin et al. , 2019 ; Schönherr et al. , 2019 ) introduce hearing thresholds for designing inaudible perturbations by curbing the signal variation below the threshold of human perception . However , these imperceptible attacks require two stages of optimization and suffer from slow convergence rates . Phase-aware Audio Signal Processing . The interest in utilizing phase information in the field of audio signal processing is constantly increasing ( Mowlaee et al. , 2016 ) . The STFT phase has been widely used in signal enhancement ( Miyahara & Sugiyama , 2014 ; Choi et al. , 2019 ; Hu et al. , 2020 ) and signal reconstruction ( Mowlaee & Kulmer , 2015 ) . The phase in the harmonic domain is used in the speech synthesis ( Degottex & Erro , 2014 ; Ai & Ling , 2020 ) and the phase in perceptual bands is used in speech watermarking ( Wang et al. , 2021 ) . The important information in the phase brings positive contributions to the above fields . Nevertheless , the existing audio adversarial attacks directly neglect the influence of phase spectrogram ( Schönherr et al. , 2019 ) . In this work , instead of introducing perturbations to the audio waveform like most of the previous works , we propose to leverage the spectrogram consistency and generate phase-oriented perturbations for constructing imperceptible audio adversarial examples . 3 PHASE-ORIENTED AUDIO ADVERSARIAL EXAMPLES VIA ENERGY DISSIPATION . In this section , we first define the preliminaries of the phase-oriented audio adversarial attack . Then we investigate the relation between phase spectrogram and magnitude spectrogram under spectrogram consistency and prove that phase perturbations always reduce the magnitude of the spectrogram in the corresponding areas under spectrogram consistency , which is called energy dissipation ( as is illustrated in Figure 1 ) . Finally , we design a novel phase-oriented loss function based on energy dissipation for constructing imperceptible audio adversarial examples . 3.1 PRELIMINARIES OF PHASE-ORIENTED AUDIO ADVERSARIAL ATTACK . 3.1.1 PROBLEM DEFINITION . Given an input audio waveform x and a transcription y corresponding to x. Denote the automatic speech recognition ( ASR ) system as f ( · ) that outputs a transcription . The objective of the targeted audio adversarial attack is to find a small perturbation δ that constructs an imperceptible and targeted example x′ = x + δ to fool the ASR system f ( · ) so that f ( x′ ) = yt , where yt is the targeted adversarial transcription . Denote Lnet ( f ( x′ ) , yt ) as the loss function for the ASR model that is minimized when f ( x′ ) = yt . Then the general formulation of targeted adversarial attack for ASR system can be defined as : argmin δ Lnet ( f ( x+ δ ) , yt ) + λ‖δ‖pp , s.t.‖δ‖∞ < , ( 1 ) where λ > 0 is the trade-off parameter between the imperceptibility and loss function Lnet ( f ( x + δ ) , yt ) ( in some formulations λ = 0 ) , control the maximum perturbation value , and p could be specified as different values , according to the attacker ’ s requirement ( e.g . p = 2 in C & W ’ s attack ( Carlini & Wagner , 2018 ) ) . Then we will describe how to generate phase-oriented and targeted audio adversarial examples in the next subsection . 3.1.2 PHASE-ORIENTED ADVERSARIAL EXAMPLE GENERATION . Denote φ ( · ) as the function of the STFT and φ−1 ( · ) as the function of the inverse STFT and X = φ ( x ) = |X| · eiθx , where |X| and θx = ∠X representing the spectral magnitude and the instantaneous phase spectrogram , respectively . Denote T ( X ) = φ ( φ−1 ( X ) ) . We assume that window function w , window length N and window shift R is fixed and a signal can be perfectly reconstructed from its STFT spectrogram through the inverse STFT in this setting . We propose to generate perturbations on the instantaneous phase spectrogram and reconstruct the audio adversarial examples with the inverse STFT as the following formulation : argmin δ Lnet ( f ( E ( φ−1 ( |X| · eiθx · ejδ ) ) ) , yt ) , s.t.− π ≤ δ ≤ π , ( 2 ) where E ( · ) is the feature extraction function for the ASR model and the φ−1 ( |X| · eiθx · ejδ ) is the generated audio adversarial example . As shown in Figure 2 , the spectrogram X ′ = |X| · eiθx · ejδ perturbed by P ( X ) is usually located outside the STFT spectrogram domain . Considering the phenomenon of spectrogram consistency ( Le Roux et al. , 2010 ) , it is easy to prove the following two conclusions : 1 ) |X ′| 6= |T ( X ′ ) | mathematically ; 2 ) φ−1 ( X ′ ) and φ−1 ( T ( X ′ ) ) represent the same time-domain audio signals . Since the STFT and iSTFT functions are differentiable , these conclusions enable us to adversarially manipulate the reconstructed magnitude spectrogram by introducing perturbations to the original phase spectrogram , which is called phase-oriented audio adversarial attack . Then we detail how the perturbations on a frame of phase spectrogram influence the adjacent frames of corresponding magnitude spectrogram and reveal the energy dissipation nature of the phase-oriented audio adversarial attack .

Summary: This paper proposed a novel idea that generates imperceptible adversarial attacks for ASR by perturbing the phase information. Proof that phase perturbations reduce the magnitude of the spectrogram is provided. White-box-threat-model-based experimental results showed the proposed method can generate effective adversarial examples for an academic Transformer-based ASR system with better efficiency than the state-of-the-art counterpart methods.