Generating Robust Audio Adversarial Examples using Iterative Proportional Clipping
Authors: Hongting Zhang
Qiben Yan
Pan Zhou
Venue:  (2020)
Keywords: audio adversarial examples
attack
machine learning

Abstract: Audio adversarial examples, imperceptible to humans, have been constructed to attack automatic speech recognition (ASR) systems. However, the adversarial examples generated by existing approaches usually involve notable noise, especially during the periods of silence and pauses, which may lead to the detection of such attacks. This paper proposes a new approach to generate adversarial audios using Iterative Proportional Clipping (IPC), which exploits temporal dependency in original audios to significantly limit human-perceptible noise. Specifically, in every iteration of optimization, we use a backpropagation model to learn the raw perturbation on the original audio to construct our clipping. We then impose a constraint on the perturbation at the positions with lower sound intensity across the time domain to eliminate the perceptible noise during the silent periods or pauses. IPC preserves the linear proportionality between the original audio and the perturbed one to maintain the temporal dependency. We show that the proposed approach can successfully attack the latest state-of-the-art ASR model Wav2letter+, and only requires a few minutes to generate an audio adversarial example. Experimental results also demonstrate that our approach succeeds in preserving temporal dependency and can bypass temporal dependency based defense mechanisms.

Under review as a conference paper at ICLR 2020
GENERATING ROBUST AUDIO ADVERSARIAL EXAM- PLES USING ITERATIVE PROPORTIONAL CLIPPING
Anonymous authors Paper under double-blind review
ABSTRACT
Audio adversarial examples, imperceptible to humans, have been constructed attack automatic speech recognition (ASR) systems. However, the adversarial ex- amples generated by existing approaches usually involve notable noise, especially during the periods of silence and pauses, which may lead to the detection of such attacks. This paper proposes a new approach to generate adversarial audios. which uses Iterative Proportional Clipping (IPC) to significantly limit noise and simultaneously exploits the temporal dependency to resist the defenses based on temporal structure. Specifically, in every iteration of optimization, we use a backpropagation model learn the raw perturbation on the original audio waveform to construct our clipping. We then impose constraint on the perturba- tion at the positions with lower sound intensity across the time domain to eliminate the perceptible noise during the silent periods or pauses. IPC preserves the tem- poral closeness and trend in the original audio waveform to maintain the temporal dependency. We show that the proposed approach can successfully attack the lat- est state-of of-t----rttttt ASR model Wav2letter+, and only requires few minutes to generate an audio adversarial example. Experimental results also demonstrate that our approach succeeds in preserving temporal dependency and can bypass tempo- ral dependency based defense mechanisms.
INTRODUCTION
Due to the recent advancement in machine learning, automatic speech recognition (ASR) systems have been integrated into numerous commercial products. However, researchers have designed ad- versarial examples to launch targeted attacks towards ASR systems (Vaidya et al. (2015); Carlini et al. (2016)) Under adversarial attacks, ASR systems will recognize the audio inputs as intelligi- ble voice commands, while humans perceive the audio inputs differently. Such attack has proven effective towards ASR systems using Gaussian Mixture Model (GMM) and Hidden Markov Model (HMM) (Lamere et al. (2003), while recently, ASR systems based on deep neural networks can also be targeted by adversarial examples that slightly perturb the original inputs (Carlini et al.] (2016). Since voice interfaces of ASR products are always listening and have been deployed in sensitive environment, there an urgent need study the security and privacy of ASR systems.
While existing research focuses on generating image adversarial examples (Szegedy et al. (2013):
Liu et al. (2016); Kos al. (2018); AAmab et al. (2018); Sharif al. (2016); Hu & Tan (0017) ).
these approaches cannot be directly applied to generate effective audio adversarial examples due to the difference in audio and image inputs. In general, we face two major challenges in generating effective audio adversarial examples: (C1) Human voices are often interleaved with silent periods due to the pauses in the speech. Inevitably. adversarial examples generated by existing optimization- based approaches (Carlini & Wagner (20gn)r((018)) could involve non-negligible perturbation on the silent and pause positions, which would affect the quality of adversarial examples and alert the users. (C2) When generating adversarial examples against ASR, existing approaches do not consider the inherent voice data property, which allows defense mechanisms (Yang et al.) (2018)) that exploit voice data properties to resist such attacks. One important data property that has been used in defense mechanisms is temporal dependency. If the adversarial examples distort temporal dependency of voice data, they can be easily detected.
In this paper, we propose a new approach called Iterative Proportional Clipping (IPC) to generate audio adversarial examples which are not only imperceptible to the humans but also more robust

---

Under review as a conference paper at ICLR 2020
against existing defense mechanisms. Specifically, first compute the Connectionist Temporal Classification (CTC) loss (Graves et al. (2006) of the original audio and the target sentence. Then, derive the gradient the original audio through a backpropagation model to be used as the raw perturbation. Moreover, we proportionally clip the perturbation that will be added to the input data. By enforcing a stricter limit on the perturbation at those positions with lower sound intensity in the time domain, our method can introduce negligible noise at silent and pausal positions (addressing (CI)). In addition, we limit the perturbed audio waveform proportional to the original audio wave- form at all timestamps. By maintaining the trend of the original waveform, our audio adversarial examples succeed to preserve the temporal dependency (TD) in the original audio (addressing (C2)). To summarize, we force the perturbation to be within a certain proportion of the original audio wave- form at all positions based on iterative proportional clipping, to both restrict the perceptible noise and preserve the TD.
The main contributions of this paper are two fold. First, we launch a successful attack on the latest model of end-to-end ASR system Wav2letter= with differentiable Mel Frequency Cepstral Coef- ficient (MFCC) features extraction. Second, we provide a new perspective by considering temporal information in generating robust audio adversarial examples. To the best of our knowledge, are the first to take TD into account when launching targeted attacks towards ASR systems. Our method generates audio adversarial examples just in few minutes while prior methods (Carlini & Wagner 20188) take hours. Compare to Schönherr et al. (2018) which requires the domain-specific knowledge of psychoacoustic hiding, our approach is also more generic and casier to implement in practice.
2 RELATED WORK
In their seminal work, Biggio et al. (2013) and Goodfellow et al. (2014) have shown that neural networks are vulnerable adversarial examples. The followup work (Goodfellow et al.] (2014); Fawzi et al. (2016): Liu et al. (2016); Fawzi et al. (2018); [Shaham et al. (201 8)) further investigates the problem of enhancing the robustness of machine learning models in face of adversarial examples. A substantial amount of efforts have been spent improving the image recognition models (Kos)
cct al. (2018): Arnab et al. (2018); Sharif et al. (016);; Behzadan & Munir (017);; Huang et al.
(2017), ) which have a significant growth since the inception of deep neural networks (DNN).
Meanwhile, recent studies investigate the impact of adversarial examples over text classification (Jia
& Liang (017)) and malware classification (Grosse al. (2016); Hu & Tan (2017))
Although we have witnessed the impact of adversarial images on neural networks based systems in recent years, less efforts have been spent on studying the impact of audio adversarial examples towards neural networks based ASR systems. One type of attack approaches is to create an ad- versarial audio waveform that ASR systems recognize as intelligible voice commands but humans perceive as noise. |Vaidya et al. (2015) first explored adversarial examples against ASR systems, which were generated by inputting an audio command into an audio mangler while keeping most of MFCCs intact. The output audio was converted back to a waveform from lossy inversion of MFCCs, making the output audio unintelligible to human. Carlini et al. (2016) further extended the black-box approach and constructed white-box attacks via the hidden voice commands on CMU Sphinx speech recognition system (Lamere et al.) (2003)), in which they demonstrated HMM-only ASR systems were subject to targeted attack. While these methods
achieve targeted attacks on ASR systems, they cannot generate the adversarial audio waveforms in an end-to-end framework. Zhhng et al. (207)) proposed Dolphin in which they modulated the baseband audio signal onto ultrasound frequency to form inaudible voice commands. This approach requires an expensive attack equipment and highly relies on the software and hardware of the target device. Compared with these approaches, our IPC method is easy to implement with low cost and can achieve an end-to-end attack framework.
Another type of approaches is to fool neural networks by introducing minor perturbations on the input. Carlini Wagner (2018) used CTC loss as an objective function and generated adversarial examples using
descenttdddeeet-bbseeee minimization scheme (Carlini & Wagner (2017)). Yuan ett al. (2018) successfully embedded transcripts within a popular song. The latest approach con- sidered psychoacoustics to minimize human perception: [Schönherr et al. (2018) proposed to gen-

---

Under review as a conference paper at ICLR 2020
erate adversarial examples based psychoacoustic hiding. They used the hearing thresholds as a guideline to design appropriate manipulations on the imput signal by limiting them to be below the thresholds of human perception. [Abdullah et al. (2019) utilized domain-speciff knowledge of audio signal processing to achieve practical black-box attacks by leveraging the fact that humans interpret discontinuous signals noisy and hardly discern differences high frequency signals. These techniques require domain-specific knowledge and complex signal processing. By contrast, pplimization-basee methods (Opt) (Carlini & Wagner (2018) are easier implement, but the gener- ated adversarial examples tend to include widely distributed noise. In this paper, we propose a novel method which extends Opt but limits the total perturbation using iterative proportional clipping, to derive more imperceptible adversarial examples.
METHOD
In this section, we first introduce our attack workflow for Iterative Proportional Clipping (IPC) attack, and then elaborate on how IPC method generate our adversarial examples. We also explain the imperceptibility of the perturbation on the silent periods. Finally, we analyze the preservation of temporal dependency (TD) of our method.
target transcription
"THIS HINST COMMND"
ASR
1.seedoor posteriors
L(y.y)
perturbation clipper
MFCC
Wav2Letter
Clipper
AX
VL.
2 backoropagation
Figure 1: The workflow for generating our adversarial examples.
3.1 ATTACK WORKFLOW
The workflow for our adversarial audio generation is shown in Figure I which includes three major components: 1) the raw audio is fed into a common ASR system to get the pseudo-posteriors y, which is a matrix with each element representing the possibility of each alphabet label at each step. 2) We compute the objective loss L(y vy) in terms of the pseudo-posteriors and target sentence y' directly, with no need of forced alignment. Then, we compute the gradient V on the input as the raw perturbation through backpropagation model. 3) The perturbation is then clipped to an allowed range which is derived from the IPC method. Finally, the modified audio added with the clipped perturbation is then fed into the system in the next iteration. Note that the clipping the gradient in the third component can realize the preservation of TD.
3.2 ITERATIVE PROPORTIONAL CLIPPING METHOO
Fast gradient sign method (FGSM) (Goodfellow et al. 2014)) takes the sign of the gradient as the perturbation on the original audio, and the optimization
method (Opt) (Carlini Wagner (018)) uses the gradient itself to perturb the data. Here, introduce novel iterative method using the proportionally clipped gradient as the perturbation factor to modify the original audio. Figure 2 illustrates how construct our clipping in every iteration. Given a natural waveform x, first. calculate its Upper Sideline (USL. and Lower Sideline (LSL.) as follows:
DUSL (1 + B) -2, LLSL = (1 -1-18 B) -r,
(1)
where B is the intensity width of the perturbation in proportion to x, the value of which resides between 0 and 1. We use B to set the maximum thresholds to limit the perturbation. The tolerable perturbation of the original audio will increase with larger B value. For each iteration, based on USL and LSL, we update the modified input from the previous iteration by gradient descent to get the new disturbed waveform. Then, we clip the disturbed waveform at those positions where the
3

---

Under review as a conference paper at ICLR 2020
waveform segment recognized "but then the picture gone quickly
M
lal
(b)
waveform green) aptimized based mothod: waveform (in red) after our proportional clipping
Ma
border meintained waveform recognized "transfer ten dollars"
Illustration of the proportional clipping process. Two boundary lines in yellow in (b) which we name Upper Sideline (USL) and Lower Sideline (LSL) respectively, are calculated from the original waveform (a). The line green in (c) the disturbed waveform with the perturbation based on Opt. We clip the disturbed waveform in green in (c) at those positions where the sound intensity exceeds the USL or LSL, as shown in (d). The modified waveform in current iteration after our proportional clipping is displayed in red in (e).
Figure 2:
sound intensity exceeds the USL or LSL, after which we obtain the modified input for the next iteration. After number of iterations, can derive our adversarial examples.
One major advantage of the IPC method is that limits the perturbation on the silent periods. Since the threshold of each position the disturbed waveform is proportional to the original waveform, the perturbation on the silent position is constrained and thus more likely to be imperceptible to humans. Existing methods, on the other hand, tend derive adversarial examples with random noise applied across all positions of the audio.
In addition, our method also preserves the TD of the original waveform through iterative propor- tional clipping. Existing approaches such as FGSM and Opt-based ones become ineffective against TD based defense mechanisms (Yang et al.) (2018)) However, we construct proportional clipping which aims to preserve the temporal properties including temporal closeness and trend in the orig- inal audio. The signal intensity at one timestamp is affected by recent timestamps. Our adversarial audio is more likely to have low signal intensity between two timestamps when both of them have extremely low signal intensities. Besides, the trend an audio waveform refers to the increase or decrease in signal intensity. Because limit the intensity variance in small range each times- tamp, our adversarial audio can preserve the trend the original audio. To formalize the temporal dependency in our adversarial examples, we compute the cross-correlation coefficient between the original audio sequence and our adversarial example, the result of which exceeds 0.99. Experimen- tal verification on the preservation of the two temporal properties is presented in Section 4. In the end, IPC method provides mechanism to better control the trend in the output audio waveforms for the purpose of preserving TD.
Objective loss function. Similar to Carlini & Wagner (0018). we formulate the problem of constructing an adversarial example as an optimization problem. Given natural example x (I1, T2, .NN) and any target phrase y', we solve the formulation as follows:
minimize
((x + 06,') + 1812
(2)
B, VISiSN,
42
where E(-) represents the CTC loss. We use the intensity width B to maintain the proportionality between the perturbation å and the original waveform æ. The parameters C1 O2 trade off the relative importance of being adversarial and remaining similar to the original audio. Note that we set the restriction on the perturbation in every iteration to produce effective final perturbation results.
EXPERIMENTAL RESULTS
The presentation flows of the experimental results are summarized as follows. In Section 4.1, we introduce the dataset and adversary model that are used in all of the experiments. In Section 4.2, introduce experimental setup IPC attacks. In Section 4.3, evaluate the performance of the proposed IPC method from different aspects: first, we perform targeted attacks towards sen- tences with different lengths to show that IPC method can transform the original audio into arbitrary
4

---

Under review as a conference paper at ICLR 2020
target transcription; second, we further provide a visualized comparison between the waveform gen- erated by our approach and other approaches in both time and frequency domains to demonstrate the preservation of the temporal property in the original audio; third, we balance the noise distortion and time cost to develop the optimal attack scheme. In Section 4.4, we describe the experimental setup TD defense against our adversarial examples. In Section 4.5, evaluate the preservation of TD in our method, and the results show that our IPC can bypass TD defense effectively.
4.1 DATASET AND ADVERSARY MODEL.
Dataset. LibriSpeech ( (Panayotov et al. 2015) is a corpus of approximately 1,000 hours of 16Khz English speech derived from audiobooks from the Libri Vox project. It comes with its own training, validation sets, test-clean and test-other sets. We used all available samples to train and validate our ASR system. We generate adversarial examples only using its test-clean set, which contains 2,620 waves with the average duration of 4.294s.
Adversary model. Wav2letter (Collobert et al. (2016) a simple and efficient end-to-end auto- matic speech recognition system open sourced by the Facebook Al research team. It combines a standard ID convolutional neural network, a sequence criterion of typical AutoSegCriterion (ASG) and simple beam-search decoder. Based on the architecture in Collobert et al. (2016) Liptchinn sky et al. 2017). NVIDIA proposes Wav2letter- which consists of 17 ID-Convolutional Layers and 2 Fully Connected Layers. It extracts log-mel filterbank energies the input features to the model and uses CTC loss to train the model. In this paper, we implement wav2letter+ in Pytorch as our adversarial model and use beam-search decoder for decoding. Different from the wave2letter+ spec- ification, we use a differentiate MFCC features extraction in front of the ASR model. The output of our model is sequence of letters corresponding to the speech input. The vocabulary consists of all alphahets (a-z), space, and the apostrophe symbol, a total of 29 symbols including the blank symbol used by the CTC loss.
4.2 IPC ATTACK SETUP
We implement the attack using Pytorch. We randomly select one audio file from the test-clean set as the original audio, and the sentence corresponding to another audio file as the target transcription. To make sure the target is arbitrary, we also designate other random sentences as targets. To generate a massive amount of effective adversarial examples quickly and systematically, we conduct attacks in two stages: for the generation of each adversarial example, we first generate a weak adversarial example under the train mode of the ASR system, which is an approximation of the true adversarial example; and then, in the second stage we fine tune to get the desired adversarial example under the eval mode of the ASR system.
As for parameter settings, we set e and C2 100 to represent the case when CTC loss has a larger magnitude. Besides, we set Ir 1e-5 in the first stage and Ir 5 in the second stage. In order to avoid gradient exploding, we also have a gradient clipping with gradmez = 100 and gradmas = 10 respectively in two stages. All experiments are carried out an Ubuntu Server (16.04 LTS) with an Intel(R) Core(R) i5-6500@ 3.20GHz x 4, 16G Memory and GTX 1080 GPU.
Type
Transcribed results
Original
but then the picture was gone as quickly as it came
Adversarial (short)
open alipay
Adversarial (medium)
transfer to bob ten dollars
Adversarial (long)
please delete the last transaction record
Table I: Examples of the IPC attacks
4.3 EVALUATION OF IPC METHOD
Prior works (Vaidya et al. 2015 Carlini al. (016)). Carlini & Wagner (2018) have demonstrated that the transfer from a short sentence to a longer one is not a difficult task. The reason is that, differ-

---

Under review as a conference paper at ICLR 2020
sayall morsk)
4gpo
4.53
zine
2020 34.04
2010
20140
3050
3010
Eir 13/30200
Figure 3: The perturbation at the positions with low sound intensity (left), medium sound intensity (middle) and high sound intensity (right) in time domain.
ent from humans who comprehend each phoneme generally by a dozen frames or so, the machines perceive audios by recognizing each phoneme in least three HMM states. To show the translated results in different lengths from a general audio waveform, we provide a group of adversarial ex- amples that have been maliciously transcribed in Table [ We can see different alterations of ASR output toward short, medium, and long utterances, which illustrates that our method can achieve arbitrary targeted attacks from general audio waveform. More examples are shown in Appendix A.
To explore the impact our IPC method on the waveform segments with different sound intensities compared to Opt, we show the specific perturbation at different positions in magnified view in Figure For the low sound intensity part in the audio, we can see that our IPC based signal follows the original one closely while the Opt based signal fluctuates significantly. Therefore, the temporal closeness in audio is preserved. Consistent with such phenomenon, our IPC based adversarial ex- amples sound more clear at the silent the low sound intensity periods. For the middle and high sound intensity parts, IPC and Opt both look similar to the original one, but the former always has smaller perturbation. We infer that IPC based signal avoids the perturbation of large amplitude at the expense of more frequent variation. Although it makes the audio periods with high intensities sound little fuzzy, our adversarial example is more acceptable compared Opt based adversarial examples that contain harsh noise at silent periods. Moreover, the result shows that our signal also maintains the trend of the original audio in the time domain.
We further provide a visualization of the above audio in frequency domain in Figure 4 We first select the signals of 2-5 kHz since the human ear more sensitive to this band. It shows that Opt produces more noise than IPC, and the Opt signal is more likely to be perceptible to humans. However, our IPC signal is almost the same as the original one. We also visualize the audio in higher frequency bands, where Opt produces obvious noise, which implies that IPC attacks perform better than Opt attacks, and are more robust against defenses which defend against adversarial examples based on high frequency filtering. See Appendix A.2 for more visualizations of the adversarial examples in time and frequency domain.
To investigate the performance with different intensity widths B in Eq. we conduct a series of experiments with different intensity widths while generating adversarial examples. We mainly
0.0007
DFT magnitude (abs)
0.004
DFT magnitude [abss)
0. 0.0004
0.000
2.0044
0/001
3.003
2.5
3.5
4.5
frequency (KH2)
frequency (4H2)
Figure 4: The perturbation at the positions with human sensitive frequency band (left) and high frequency band (right).

---

Under review as a conference paper at ICLR 2020
12 devetor
19000
WTR. Crih
-
tpost
WER
WER
30300
23000
30000
22
23
3/4
5/5
bantaccts
cut ratio
(a) Trends of L2 distortion and epoch
(b) Error rate
Figure 5: (a) Trends of L2 Distortion and epoch as the intensity width gets narrower. (b) Word Error Rate and Character Error Rate of audio examples.
explore the trend of two key metrics with narrower intensity width, which is shown in Figure 5(a). One metric is the L2 distortion, which is chosen for quantifying the distortion introduced by the perturbation; the other one is the number of epochs required to alter original transcription to the target. We can find that the 1.2 distortion descends slowly from 2.4 to 1.6 while the number of requisite epochs grows the intensity width narrows down from 0.5 to 0.1. Specifically, the number of requisite epochs explodes to be more than 5,000 when the intensity width drops to 0.1. To strike a balance between epochs and distortion, we the intensity width to 0.2 in all the following experiments to generate adversarial examples with a high quality while reducing runtime cost. As the classical paper Carlini & Wagner (2018) has demonstrated, generating single adversarial example requires upproximately one hour of computation time on commodity hardware (a single NVIDIA 1080Ti). In Schöönherr al. (2018), the proposed method requires to compute a matrix which contains the difference with the hearing thresholds at each iteration. They claim it took less than two minutes to calculate the adversarial perturbations with 500 backpropagation steps, but do not specifyy the exact time for a successful attack. In contrast, to accomplish successful attack, our time consumption is minute-level, usually in 3-15 minutes on commodity hardware (a single NVIDIA 1080), without any complex computation. We encourage the reader to listen to our adversarial examples to hear how similar they are to the original audic
4.4 TD DEFENSE SETUP
Due to the preservation of TD, our adversarial examples are more robust than the state-of-the-art adversarial examples (Carlini & Wagner (2018). To validate their robustness, we implement at- tacks using our adversarial examples to target ASR systems equipped with TD defense (Yang et al. 2 TD defense gains discriminate power against adversarial examples by utilizing the incon- sistency between the prefix of length I of the transcribed results and the transcribed portion of the same length I. The audio portion of length 1 is obtained by cutting the tested audio with different cut ratios k. With k = 0.5, for example, TD defense will compare the transcription the first half of audio and the corresponding prefix of the original transcription. Common adversarial examples often involve some unwished losses of temporal information. Our proposed method circumvents the loss of temporal information and therefore can effectively bypass TD defense. We follow the same experimental procedures as Yang et al. (2018), and adopt their evaluation metries: the area under curve (AUC) of word error rate (WER), AUC of character error rate (CER), and AUC of longest common prefix (L.CP).
4.5 EVALUATION OF IPC METHOD AGAINST TD DEFENSE
Generally, as TD defense exploits the broken TD in audio data to identify adversarial examples, common Opt based adversarial examples can be detected owing the inconsistent transcription of the same k portion. To illustrate that the effectiveness of our adversarial examples is not impacted by TD defense, we list some examples of translated results for benign and adversarial audios with the cut ratio k- = 0.5 in Table 2
We can see that segments of our adversarial examples can be equally

---

Under review as a conference paper at ICLR 2020
Type Original
Transcribed results
but then the picture was gone as quickly as it came but then the picture was to
the first half of Original
Adversarial (short)
open alipay open
First half of Adversarial
Adversarial (medium)
transfer to bob ten dollars transfer to bob please delete the last transaction record please delete the last
First half of Adversarial Adversarial (long)
First half of Adversarial
Table 2: Examples of the TD based detection on IPC method
IPC (Opt)
k
WER
CER
LCP
1/2
0,524 (0.930)
0,507 (0.933)
0.609 (0.806)
2/3
0.770 (0.930)
0.700 (0.948)
0,885 (0.826)
3/4
0.573 (0.933)
0.510 (0.938)
0.835 (0.839)
4/5
0.575 (0.955)
0.553 (0.969)
0.772 (0.880)
5/6
0.755 (0.941)
0.680 (0.962)
0.766 (0.858)
Table 3: AUC scores of different on IPC and Opt adversarial examples
transcribed with the corresponding transcription of the whole adversarial examples. More results on our adversarial examples against TDD defense are shown in Appendix A..4 Moreover, we explore the average WER and CER with different cut ratios under TD defense in Figure(5tb) to verify if the IPC based adversarial examples preserve TD. Compared with Opt, IPC based adversarial examples have lower WER and CER. The error of IPC is caused by the wrongly transcription of the last word. These experimental results demonstrate the IPC method can preserve the temporal information of the original audio. This is because the added perturbation in the audio is nearly proportional to the original audio across different positions, and thus does not change the trend of the audio.
To further investigate the effectiveness on the preservation of TD, Table the AUC scores of three basic metrics under different cut ratios on the IPC based adversarial examples. The AUC scores on IPC mostly distributed between 0.5 and 0.7, which means the classifier with TD de- fense has poor performance on our adversarial examples. Moreover, TD defense with metrics of WER and CER performs worse than that with LCP. We observe that the AUC scores based on WER and CER of IPC are relatively low and can reach slightly above 0.5. And the AUC score based on LCP reaches above 0.8 under the cut of 2/3 and 3/4 due the unbalanced proportion of longer and shorter transcribed targets. It is clear that our AUC scores are lower than the scores of Opt method under different ratios, which demonstrates the robustness of our method against TD defense due to the preservation of temporal information.
5 CONCLUSION
In this paper, we propose a new method based on IPC to achieve targeted attacks on ASR system, which, for the first time, considers the preservation of temporal dependency to generate robust audio adversarial examples. By iteratively performing proportional clipping on the perturbation which we compute from the gradient through backpropagation model, we force the modified audio waveform to maintain the trend in the original audio. Our experiments show that IPC based adversarial exam- ples can not only fool the state-of-the-art Wav2letter+ model but also bypass the latest temporal dependency based defense. Experimental results also demonstrate that IPC significantly outper- forms other voice attack methods, and the added noise on the original audio becomes imperceptible to humans.
8

---

Under review as a conference paper at ICLR 2020
REFERENCES
Hadi Abdullah, Washington Garcia, Christian Peeters, Patrick Traynor, Kevin RB Butler, and Joseph Wilson. Practical hidden voice attacks against speech and speaker recognition systems. arXiv preprint arXiv:1904.0577 2019.
Anurag Arnab, Ondrej Miksik, and Philip HS Torr On the robustness of semantic segmentation models to adversarial attacks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 888-897, 2018.
Vahid Behzadan and Arslan Munir. Vulnerability of deep reinforcement learning to policy induction attacks. In International Conference on Machine Learning and Data Mining Pattern Recogni- tion, pp. 262-27522222 Springer, 2017.
Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Smdić, Pavel Laskov, Gior- gio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In Joint European conference on machine learning and knowledge discovery in databases, pp. 387-402. Springer, 2013.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017
IEEE Symposium Security and Privacy (SP), pp. 39-57. IEBE, 2017.
Nicholas Carlini and David Wagner. Audio adversarial examples: Targeted attacks speech-to- text. In 2018 IEEE Security and Privacy Workshops (SPW), pp. 1-7. IEEE, 2018.
Nicholas Carlini, Pratyush Mishra, Tavish Vaidya, Yuankai Zhang, Micah Sherr, Clay Shields, David Wagner, and Wenchao Zhou. Hidden voice commands. In 25th USENIX Security Symposium (USENIX Security 16), pp- 513-530, 2016.
Ronan Collobert, Christian Puhrsch, and Gabriel Synnaeve. Wav2letter: an end-to-end convnet- based speech recognition system. arXiv preprint arXiv:1609.03: 160900399.. 2016.
Alhussein Fawzi, Seyed-Mohsen Moosavi-Dezfooli, and Pascal Frossard. Robustness of classifiers: from adversarial to random noise. In Advances in Neural Information Processing Systems, pp- 1632-1640, 2016.
Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Analysis of classifiers' robustness adversarial perturbations. Machine Learning, 107(3):481-508, 2018.
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv: arXiv:1412.665 1412.5772 2014.
Alex Graves, Santiago Fernández, Faustino Gomez, and Jürgen Schmidhuber. Connectionist tem-
poral classification: labelling unsegmented sequence data with recurrent neural networks. In Pro- ceedings of the 23rd international conference on Machine learning, pp. 369-376. ACM, 2006.
Kathrin Grosse, Nicolas Papernot, Praveen Manoharan, Michael Backes, and Patrick McDaniel. Adversarial perturbations against deep neural networks for malware classification. arXiv preprint arXiv:1606.0e 04435, 2016.
Weiwei Hu and Ying Tan. Generating adversarial malware examples for black-box attacks based on gan. arXiv preprint arXiv: 1702.0587, 2017.
Sandy Huang, Nicolas Papernot, Ian Goodfellow, Yan Duan, and Pieter Abbeel. Adversarial attacks neural network policies. arXiv preprint arXiv: (00i:0/702.0220000 02284,, 2017.
Robin Jia and Percy Liang. Adversarial examples for evaluating reading comprehension systems. arXiv preprint arxiv: 1 1707.07328, 2017.
Jernej Kos, Ian Fischer, and Dawn Song. Adversarial examples for generative models. In 2018 IEEE Security and Privacy Workshops (SPW), pp. 36-42. IEFE, 2018
Paul Lamere, Philip Kwok, William Walker, Evandro Gouvea, Rita Singh, Bhiksha Raj, and Peter Wolf. Design the emu sphinx-4 decoder. In Eighth European Conference on Speech Commu- nication and Technology, 2003.

---

Under review as a conference paper at ICLR 2020
Vitaliy Liptchinsky, Gabriel Synnaeve, and Ronan Collobert. based speech recognition with gated convnets. arXiv preprint arXiv: 2017.
Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial exam- ples and black-box attacks, arXiv preprint arXiv:1611.0277 2016
Vassil Panayotov, Guoguo Chen, Daniel Povey, and Sanjeev Khudanpur. Librispeech: an asr corpus based on public domain audio books. In 2015 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 5206-52100 IEEE, 2015.
Lea Schönherr, Katharina Kohls, Steffen Zeiler, Thorsten Holz, and Dorothea Kolossa. Adversarial attacks against automatic speech recognition systems via psychoacoustic hiding. arXiv preprint 1808.v/800.0566 2018.
Uri Shaham, Yutaro Yamada, and Sahand Negahban. Understanding adversarial training: Increasing local stability of supervised models through robust optimization. Neurocomputing. 307:195-204, 2018.
Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter. Accessorize to crime: Real and stealthy attacks on state-of-the-art face recognition. Proceedings of the 2016 ACM SIGSAC Conference Computer and Communications Security, pp. 1528-1540 ACM, 2016.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint 1312,6199 2013.
Tavish Vaidya, Yuankai Zhang, Micah Sherr, and Clay Shields. Cocaine noodles: exploiting the gap between human and machine speech recognition. In 9th {USENIX) Workshop on Offensive Technologies (1 (WOOT} 15), 2015.
Zhuolin Yang, Bo Li, Pin- Yu Chen, and Dawn Song. Characterizing audio adversarial examples using temporal dependency. arXiv preprint arXiv: 10875 2018.
Xuejing Yuan, Yuxuan Chen, Yue Zhao, Yunhui Long, Xiaokang Liu, Kai Chen, Shengzhi Zhang, Heqing Huang, XiaoFeng Wang, and Carl A Gunter. Commandersong: A systematic approach for practical adversarial voice recognition. In 27th {USENIX} Security Symposium (!USENIX) Security 18), pp. 49-64, 2018
Guoming Zhang, Chen Yan, Xiaoyu Ji, Tianchen Zhang, Taimin Zhang, and Wenyuan Xu. Dolphi- nattack: Inaudible voice commands. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security pp. 103-117, ACM, 2017.
10

---

Under review as a conference paper at ICLR 2020
A APPENDIX
A. MORE RESULTS ON IPC ATTACK
Tables 4-6 provide the results of targeted attacks from different original waveforms. We show that they are converted into transcriptions of different lengths for each example.
Type Original
Transcribed results
but then the picture gone as quickly as it came
Adversarial (short)
what slang what was that you are acute don't t anticipate sunday august sixteenth why are we to be divided there clothes itself word masks in metaphor rags for some time after that i remembered nothing distinctly yes yes she hurried pulling her hand gently away from him
Adversarial (short)
Adversarial (short)
Adversarial (medium)
Adversarial (medium)
Adversarial (medium)
Adversarial (long)
Adversarial (long)
Adversarial (long)
Table 4: Examples of the IPC attacks from "but then the picture was gone as quickly as it came".
Type
Transcribed results
Original
surely we can submit with good grace
Adversarial (short)
know
Adversarial (short)
got it
Adversarial (short)
run away
Adversarial (medium)
you positive then
Adversarial (medium)
he nods his consen
Adversarial (medium)
we suffer stifling pains it will be no disappointment to me tea please matthews butler impassively it will not be safe for you to stay here now
Adversarial (long)
Adversarial (long)
Adversarial (long)
Table Examples the IPC attacks from "surely we can submit with good grace".
Type Original
Transcribed results
there it clothes itself in word masks in metaphor rags
Adversarial (short)
i'm happy you did
Adversarial (short)
Adversarial (short)
open the door there just in front anders face grew red now to bed boy tis fine for you to talk old man answered the lean aullen apprentice it will not be safe for you to stay here now back uncas and bring the size of the singer's foot
Adversarial (medium)
Adversarial (medium)
Adversarial (medium)
Adversarial (long)
Adversarial (long)
Adversarial (long)
Table 6: Examples of the IPC attacks from "there it clothes itself in word masks in metaphor rags".
11

---

Under review as a conference paper at ICLR 2020
A.2 MORE VISUALIZATIONS OF THE ADVERSARIAL EXAMPLES IN THE TIME AND FREQUENCY DOMAIN
We show the IPC attack from "but then the picture was gone quickly it came" to "why to be divided in the time domain in Figure 6-7, and frequency domain in Figure 8.
53p0) Mondy
sapel Wonky
D.00000
Lane 1220000
time 121
Figure 6: The original audio(left), Opt based adversarial example (middle) and IPC based adversarial example (right) time domain.
1000 Hotrctt
Mo mom
1315000
time
Iima
Figure 7: The perturbation at the positions with low sound intensity (left), medium sound intensity (middle) and high sound intensity (right) in time domain.
Out
Origin
DFT magnitudo (abs)
magnitude
0.0 0.0002
00002
2.0
2.5
3.0
3.5
45
5.0
6.00
6.25
5.50
6.25
7.00
7.25
755
735
8.50
frequency (dHzz)
frequency (kHzz)
Figure 8: The perturbation at the positions with human sensitive frequency band (left) and high frequency band (right).
12

---

Under review as a conference paper at ICLR 2020
We show the IPC attack from "surely submit with good grace" "it will not be safe for you to stay here now" in the time domain in Figure 9-10, and frequency domain Figure 11.
sone (neety
lane 133000
Lano 1302000
tame 1303000
Figure 9: The original aleio(left), Opt based adversarial example (middle) and IPC based adversarial example (right) in time domain.
1/4
5XP0 interet
1250
22000
11200
2013
6000
Figure 10: The perturbation the positions with low sound intensity (left), medium sound intensity (middle) and high sound intensity (right) in time domain.
Oyt
ICC
5,0012
Opc
0/6150
DFT tha.gntude (abs)
000000
6.0006
DFT
000025
0.0000
0.0003
2.5
5.5
7.5
6.0
frequency (6H2)
fr frequency (KHzz)
Figure 11: The perturbation the positions with human sensitive frequency band (left) and high frequency band (right).
13

---

Under review as a conference paper at ICLR 2020
Original Audio
Attack
Opt Attack
Figure 12: This figure displays an STFT of an audio file, our perturbation of audio file, Opt's perturbation of the audio file. The red elliptical area shows less noise in silent periods than Opt.
Original Audio
Our Attack
Opt Attack
Figure 13: This figure displays an STFT of an audio file, our perturbation of the audio file, Opt's perturbation of the audio file. The red elliptical area shows different frequency components at certain timestamp.
From spectrograms in Figures 12-13, one hand, we time (reflected in color) is consistent with that in the original signal in a particular frequency band, which suggests the trend is maintained. On the other hand, there are minimal noise in the silent periods blue, which makes our adversarial audio perceptually more appealing than Opt based adversarial audio.
the variance in signal intensity
14

---

Under review as a conference paper at ICLR 2020
A.3 RESULTS ON OPT BASED ADVERSARIAL EXAMPLES AGAINST TD DEFENSE
To show the Opt method's failure in preserving the temporal dependency, Tables 7-9 provide some additional examples of translated results for benign and Opt based adversarial audios under TD detection. We can see the transcription of the first half of audio always contains different words with the corresponding prefix of the original transcription in all cases, which shows the inconsistency between the prefix of the transcribed results and the transcribed portion of the same length.
Type Original
Transcribed results but then the picture gone as quickly as it came but then the picture was to
the first half of Original
Adversarial (short)
what is slang why this no my little son she said my little son it will not be safe for you to stay here now it were no bus
First half of Adversarial
Adversarial (medium)
First half of Adversarial Adversarial (long)
First half of Adversarial
Table 7: Examples of the temporal dependency based detection Opt method
Type Original
Transcribed results
surely we can submit with good grace surely we can submit
the first half of Original
Adversarial (short)
i know i ki
First half Adversarial
Adversarial (medium)
to be divided why why are we do it will be disappointment will be conclude
First half Adversarial Adversarial (long)
First half of Adversarial
Table 8: Examples of the temporal dependency based detection on Opt method
Type
Transcribed results
Original
there it clothes itself in word masks in metaphor rags there it clothes itself in word
the first half of Original
Adversarial (short)
m happy more
First half of Adversarial
Adversarial (medium)
oh i know that's lorne brandon oh knew that lord golden fortune and happy life golden fortun and whiping
First half of Adversarial Adversarial (long)
First half of Adversarial
Table 9: Examples of the temporal dependency based detection on Opt method
15

---

Under review as a conference paper at ICLR 2020
A.4 MORE RESULTS ON IPC BASED ADVERSARIAL EXAMPLES AGAINST TD DEFENSE
Tables 10-12 provide some additional examples of translated results for benign and IPC based ad- versarial audios under TD detection. We can see the transcription of the first half of audio is almost identical to the corresponding prefix of the original transcription in all cases, which shows the consis- tency between the prefix of the transcribed results and the transcribed portion with the same length.
Type Original
Transcribed results
but then the picture was gone as quickly as came but then the picture was
the first half of Original
Adversarial (short)
what is slang what is ton't anticipate
First half of Adversarial
Adversarial (medium)
First half of Adversarial Adversarial (long)
don't 't any there it clothes itself in word masks metaphor rags there it clothes itself in word
First half of Adversarial
Table 10: Examples of the temporal dependency based detection on IPC method
Type Original
Transcribed results surely we can submit with good grace surely we can submit
the first half of Original
Adversarial (short)
know know
First half of Adversarial
Adversarial (medium)
you are positive then you are pose
First half of Adversarial Adversarial (long)
will be no disappointment to me it will be no disappoint
First half of Adversarial
Table 11: Examples of the temporal dependency based detection on IPC method
Type
Transcribed results
Original
there it clothes itself in word masks in metaphor rags there it clothes itself in word
the first half of Original
Adversarial (short)
m happy i' m happy there just in front there just tis fine for you to talk old man answered the lean sullen apprentice tis fine for you to talk old man
First half of Adversarial
Adversarial (medium)
First half of Adversarial Adversarial (long)
First half of Adversarial
Table 12: Examples of the temporal dependency based detection on IPC method
16


Reviews:
[{"review_id": "rylW8yRptB", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposed a new method for generating adversarial examples for the task of automatic speech recognition. The authors suggest using their method called Iterative Proportional Clipping, which limits the amount of change we allow at every time-step. \n\nOverall this paper is an incremental research work. The paper is clearly written. The idea is intuitive and well presented.\n\nI have several questions to the authors: \n1) Can the authors provide more details regarding the attack setup? Why exactly did you run the attack in two stages? What makes the difference between the train and eval modes? Only on the batch-norm layers? \n\n2) All experiments were conducted in a white-box settings, did the authors try to explore gray/black box settings as well?\n\n3) It seems like there are phase mismatch issues in the generated adversarial examples. Did the authors try to generate adversarial examples using other approximations besides the MFCC to wav approximator? Maybe working at the spectrogram magnitude level? \n\n4) Regarding comment (3). the underlying assumption of adversarial examples is: \"it will not be distinguishable from human ears.\" However, the changes to the signal are highly noticeable. Did the authors try to analyze when is it more or less noticeable, under which settings? Does it depend on the target text? ", "extra_scores": {"experience_assessment": "I have published in this field for several years.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "N/A"}, "extra_text": {}}, {"review_id": "S1ls_R5pKr", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper introduces an adversarial attack mechanism, Iterative Proportional Clipping (IPC), based on a differentiable MFCC feature extractor. In contrast to other audio attacks, the authors claim that the perturbations are well masked and are much less audible. \nThey also claim to propose the first attack mechanism that takes temporal dependency into account, at least in some intuitive sense as described in Figure 2. Simulations show that state of the art speech recognizers can be attacked using the approach and certain type of defenses, based on temporal structure, can be circumvented. \tThe method relies on the idea of using ‘the proportionally clipped gradient’ as a direction estimate for original audio modification. The basic idea is quite sensible and seems to be effective as supported by computational experiments.\n\nThe dataset is LibriSpeech and the speech recognizer is based on wav2letter+ -- here the MFCC features are replaced with a differentiable version to allow gradient based adversarial attacks. The experimental section is detailed and the results illustrate the \n\nThe fundamental shortcoming with the paper is that while the method is described in detail, there is not much effort in explaining and formalizing what aspects of the proposed method make it perceptually more appealing -- as this seems to be the one of the main motivations of the paper. I would at least expect to see at least some effort to explain the proposed  clipping technique as maintaining the phase properties of the original signal. The authors claim about perceptual properties of the method seem to be somewhat anecdotal and, while I think the method is sensible, just showing the power spectrum is not very informative. Is the proposed method better just because it does good detection of the  silent periods?\n\nI also find the use of technical jargon somewhat ambiguous at occasions (such as the term ‘linear proportionality’)\n\nMinor:\n\naudios -> waveforms  (audio does not have a plural form ) \n\nFig 2 ‘frequency - signal frequency’ labels -- this is probably just an estimate of the power spectrum by DFT magnitude\n", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "N/A"}, "extra_text": {}}, {"review_id": "BkgGIDS5FS", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposes a technique to generate audio adversarial examples based on iterative proportional clipping. It is essentially an optimization approach via backprop but with a constraint on the magnitude of perturbation in the time domain.  The authors show the effectiveness of the proposed technique to successfully attack the wav2letter+ ASR model and claim to have superior temporal dependency than other existing approaches.  Overall, the work is interesting but I have the following concerns.\n\n1. In terms of analysis, I think it would be more helpful to show results in spectrogram rather than frequency as shown in Fig.4.   \n\n2.  The authors claim that the proposed technique is less time-consuming to generate in the abstract. However, there is no discussion and comparison in the experiments. \n\n3.  Since the proposed technique is claimed to be iterative, it would be helpful to demonstrate the \"iterative\" performance improvement.  How much does the iteration help?  How many iterations does it need to get a good adversarial audio?  How long does it take to accomplish that?  I couldn't find such information in the paper. \n\n4. By listening to the provided audio samples, I would say the quality of the audios are good in general. But in w4, one can actually perceive the distortion in the audio. But overall it is good. Thanks for the samples.  \n\n5  The wording and formulation need to get improved.  \n     --  I found the word \"bandwidth\" very confusing especially when it comes to the discussion about the time and frequency domain signal processing.  The word \"bandwidth\" has a well-established meaning in signal processing already.  \n     --  There is no definition of \"TD\" throughout the paper -> temporal dependency? \n     --  The formulation in Eq.2 is incorrect. $\\delta$ in the second term seems to be independent of the first term. shouldn't it be $l(x+\\delta, y')$ in the first term?  \n\nP.S.  rebuttal read.  I will stay with my score. ", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper proposes a method called iterative proportional clipping (IPC) for generating adversarial audio examples that are imperceptible to humans. The efficiency of the method is demonstrated by generating adversarial examples to attack the Wav2letter+ model. Overall, the reviewers found the work interesting, but somewhat incremental and analysis of the method and generated samples incomplete, and I’m thus recommending rejection.
Decision: Reject