Are Deep Speech Denoising Models Robust to Adversarial Noise?
Authors: Will Schwarzer
Andrea Fanelli
Philip S. Thomas
Xiaoyu Liu
Venue: ICLR 2026 Poster (2026)
Keywords: Adversarial Robustness
Adversarial Perturbations
Security
Safety
Speech Enhancement
Speech Denoising
Noise Suppression
Deep Noise Suppression
Psychoacoustic Masking
Primary area: applications to computer vision, audio, language, and other modalities
TL;DR: Deep speech denoising models are unexpectedly vulnerable to imperceptible adversarial noise and can be induced to output unintelligible gibberish.

Abstract: Deep noise suppression (DNS) models enjoy widespread use throughout a variety of high-stakes speech applications. 
However, we show that four recent DNS models can each be reduced to outputting unintelligible gibberish through the addition of psychoacoustically hidden adversarial noise, even in low-background-noise and simulated over-the-air settings. For three of the models, a small transcription study with audio and multimedia experts confirms unintelligibility of the attacked audio; simultaneously, an ABX study shows that the adversarial noise is generally imperceptible, with some variance between participants and samples.
While we also establish several negative results around targeted attacks and model transfer, our results nevertheless highlight the need for practical countermeasures before open-source DNS systems can be used in safety-critical applications.

ARE DEEP SPEECH DENOISING MODELS ROBUST TO ADVERSARIAL NOISE?
Will Schwarzer* Philip S. Thomas', Andrea Fanelli', Xiaoyu Liut.3 University of Massachusetts, "Dolby Laboratories, "Meta
ABSTRACT
Deep noise suppression (DNS) models enjoy widespread use throughout variety of high-stakes speech upplications. However, we show that four recent DNS mod- els can each be reduced to outputting unintelligible gibberish through the addition of psychoacoustically hidden adversarial noise, even in now-background-nont simulated over-the-air settings. For three of the models, a small transcription study with audio and multimedia experts confirms unintelligibility of the attacked au- dio; simultaneouslyy, an ABX study shows that the adversarial noise is generally imperceptible, with some variance between participants and samples. While we also establish several negative results around targeted attacks and model transfer, our results nevertheless highlight the need for practical countermeasures before open-source DNS systems can be used in safety-critical applications.
and
INTRODUCTION
Deep neural networks (DNNs) have found widespread use in speech denoising tasks (herein consid- ered synonymous with speech enhancement and noise suppression). With existing usage in video- conferencing software (Cutler, 2022) and speech recognition systems (Milling et al., 2024), and potential future usage in hearing aids (Westhausen al., 2024), the robustness of such deep noise suppression (DNS) models is clearly of paramount concern.
However, it is well-documented that DNNs are often susceptible adversarial perturbations--sligh modifications to the input data that are subtle or imperceptible to humans, but which can lead to dramatically incorrect outputs from DNNs (Szegedy et al., 2014). This vulnerability has been ex- tensively studied in domains such as automatic speech recognition (ASR) (Carlini & Wagner, 2018; Schönherr et al., 2018 8; Qin et al., 2019) and speaker recognition (Gong & Poellabauer, 2017; Wang et al., 2020), where attacks induce the models to mistranscribe speech misclassify speakers.
Given their ubiquity and the vulnerability similar models, we posit that DNS models are ap- pealing targets for adversarial attacks. Beyond videoconferencing and hearing aids, neural speech enhancement is actively studied for mobile telephony (Tan al., 2021), emergency-responder com- munications (Brodersen al., 2019), and air-traffic-conter radio (Wu et al., 2024; Yu et al., 2024). Many of these systems rely on open-source models with publicly available weights, giving a poten- tial attacker full gradient access. Moreover, safety-critical voice channels often carry stereotyped, high-stakes phrases (evacuation orders, controller clearances, distress calls), so an attacker need only target& small set of known utterances to cause harm. Yet this threat might appear limited: DNS models are designed to remove noise, and prior attacks on speech enhancement models were perceptible, limited high-noise settings, and might not work over-the-air (Dong al., 2023).
To the contrary, we show that, across variety of settings, psychoacoustically hidden noise can cause four recent DNS models output unintelligible gibberish, thus raising urgent security concerns for such open-source DNS models (Defossez et al., 2020: Chen et al., 2022: Zhao et al., 2022; Lu et al., 2024). The success of our attacks varies little by setting, such as the presence and strength of reverb and normal background noise, and we demonstrate attacks in simulated over-the- air settings. While our attacks are white-box, and we find that naive model transfer fails, this is cold comfort: gradients are always available in open-source DNS models.
"Corresoondence to: wschwarzed @uma@uuuasss.... edu Work done while Dolby Laboratories.

---

We also identify some areas for optimism. First, attacks appear to work best when designed for only a single utterance from the speaker: similar to other audio tasks (Neekhara et al., 2019; Abdoli et al., 2019; Zhang et al., 2021: Sun et al., 2024), imperceptible universal perturbations (Moosavi- Dezfooli et al., 2017) are not yet possible in this domain. Second, we find that one of the models test, Full-SubNet+ (Chen al., 2022), enjoys limited protection from white-box attack due to exploding gradients, though previous research suggests this is easily circumvented (Athalye et al., 2018). Third, targeted attacks may succeed according to objective metries without subjectively producing the target utterance. Finally, simple Gaussian perturbation appears to be a moderately effective baseline defense; nevertheless, the prior success of adaptive attacks (Tramer et al., 2020) highlights that safety-critical DNS systems will need more sophisticated defenses.'
Contributions.
1. Systematic study of imperceptible adversarial attacks on speech denoising models. Contrary to prior image-denoising results, we show that four state-of-the-art DNS models can be driven to produce unintelligible outputs by psychoacoustically hidden perturbations, in speech settings ranging from nearly-clean (70 dB SNR, no reverb) to noisy and reverberant. We also show that auditory masking offsets allow easy tuning of power versus imperceptibility (Appendix D.3).
Human study, comprehensive computational measurement, and samples. We demon- strate the success of our core untargeted attacks using three complementary approaches: a) tran- scription and ABX studies with audio/multimedia experts; b) five distinct computational metrics; c) online samples to allow the reader to evaluate subjective imperceptibilityy and attack success.
Evidence:
3. Masking- and RIR-aware attack framework. We show that clipping to auditory masking thresh- olds in STFT space offers a ready-made projection operator for projected gradient descent (Madry et al., 2018). To ensure imperceptibilityy in simulated wver-the-air experiments where the perturba- tion itself is convolved with a non-in non-invertible room-im nom-impulse response, we evaluate a combination of Wiener deconvolution and gradient descent-based projection.
4. Mechanistic insights:
Gradient flow matters more than model size and input features. We show that, contrary to common wisdom (Madry et al., 2018), the size of the models we test matters little for robustness; instead, the only protection find comes from obfuscated gradients in Full-SubNet+ (Chen et al., 2022), protection which is known to be brittle (Athalye et al., 2018).
5. Practical threat analysis. Attacks are model- and interance-specifii and require gradient access, but successful over-the-air white-box attacks still preclude the deployment of open-source models in safety-critical applications such as hearing aids without additional defenses. We also quantify the partial protection offered by Gaussian perturbation baseline defense.
RELATED WORK
Adversarial perturbations for audio models. Adversarial perturbations originated in image classi- fication (Szegedy et al., 2014), and have since been studied in audio tasks. Like visual attacks, audio perturbations are most commonly studied in classification tasks such as speaker recognition (Gong & Poellabauer, 2017; Zhang et al., 2020; Wang et al., 2020; Chen et al., 2021; Jati et al., 2021; Xie al., 2021; Shamsabadi et al., 2021: Chen et al., 2023; Li al., 2020), speaker verification (Kreuk et al., 2018: Zhang et al., 2021), environmental sound classification (Abdoli et al., 2019; Xie et al., 2021; Ntalampiras, 2022), and speech command recognition (Zhang et al., 2017; Xie et al., 2021).
Successful attacks also target audio models with discrete outputs, like ASR systems (Cisse et al., 2017: Alzantot et al., 2018; Carlini & Wagner, 2018; Schönherr et al., 2018; Qin et al., 2019; Neekhara et al., 2019; Sun et al., 2024; Jin et al., 2024). This work includes demonstrating im- perceptible targeted attacks that force ASR systems to output attacker-chosen transcriptions.
The success of attacks on complex tasks like ASR raises questions about the vulnerability of models with continuous audio outputs. However, research on attacking generative audio models limited. Takahashi et al. (2021) and Trinh (2022) demonstrated vulnerability in speech separation models, though the required perturbation perceptibility remains unclear. Dong et al. (2023) first attacked speech-enhancemert networks, but their study left open questions regarding: (i) Imperceptibility.
'Samples and code are available online.
2

---

They used oc-norm- booumbbuundd,, audible perturbations; use strict psychoacoustic masking (with pre/post masking and a 12 to -16 dB offset) for imperceptible samples. (ii) Attack goals. Their attacks untargeted; analyze both intelligibilliyy destruction and targeted utterance injection. (iii) Real-world coverage. Their experiments covered limited conditions ([-8, 8] dB SNR, no re- verb, two models). We test four open-source DNS models in diverse conditions (near-clean noisy, with/without reverb, simulated over-the-air), and report on transferability, universal perturbations, and defenses. Our work thus generalizes and significantly extends the threat landscape they outlined.
Imperceptible audio perturbations. Prior work highlights the complexity of ensuring impercepti- ble audio perturbations. Standard image perturbations are constrained by p-norms (initially 2-norm (Szegedy et al., 2014; Fawzi et al., 2018), now often oc-norm (Goodfellow et al., 2015; Moosavi- Dezfooli et al., 2017)). User studies suggest these norm constraints yield imperceptible perturbations for classification tasks like speaker verification (Kreuk et al., 2018), and for weaker ASR attacks (e.g., untargeted, single-word attacks (Cisse et al., 2017; Alzantot et al., 2018)).
However, recent work indicates norm-constrained perturbations may lack capacity for stronger sentence-level targeted ASR attacks (Schönherr et al., 2018; Qin et al., 2019), prompting the use of psychoacoustic models for masking. Yet, even psychoacoustically masked perturbations can be shown perceptible in user studies, implying that difficult attacks still push perceptually solid con- straints to their limits. For our attacks, therefore enhance existing models ($4.2).
BACKGROUND
We study the existence of adversarial perturbations for DNS models. As background, we first re- view the standard behavior of DNS models and important characteristics of the models we study. We then formally state the definition of adversarial perturbations for DNS models, and review auditory masking, perceptibility constraint for audio attacks (Schönherr et al., 2018; Qin et al., 2019).
3.1 SPEECH DENOISING
The primary goal of speech denoising models is to remove background noise from speech signal (Defossez et al., 2020; Chen et al., 2022; Zhao et al., 2022; Lu et al., 2023; 2024). In some cases (Defossez et al., 2020), but not all (Chen et al., 2022; Zhao et al., 2022: Lu et al., 2023), the model also trained to dereverberate signals that have been distorted by the environment or microphone.
Concretely, this paper, speech denoising models are functions f R= + R" that map to and from the space of audio waveforms. We model the denoising model's 's input some clean speech y E IR", mixed additively with some (possibly zero) background noise d E R", and (optionally) convolved with some room impulse response (RIR) r E Rm,
(y + b). (Note that some work only convolves the speech with r (Zhao et al., 2022): in this paper, we convolve both speech and background noise.) Given this input, the model produces f(x) ÿ. where ý is as close either y or * as possible. For consistency with past benchmarks (Dubey et al., 2024), and because we do not attempt to evaluate healthy model behavior, we assume that the model attempts to infer y.
3.1.1 MODELS
We test the robustness of four recent open-source DNS models with publicly available checkpoints:
Demucs, published online as Denoiser (Defossez et al., 2020); Full-SubNet+ (Chen et al., 2022); FRCRN (Zhao et al., 2022); and MP-SENet (Lu et al., 2023; 2024). The models we study operate in either the time domain (waveforms) or the time-frequency (TF) domain (STFT spectrograms) (Lu et al., 2023); see Appendix D.I. Note that FSN+, FRCRN and MP-SENet do not attempt to dereverberate: they infer r y instead of y. For exact checkpoints and detailed architectural notes, see Appendix E.
3.2 ADVERSARIAL PERTURBATIONS
Given the definition of speech denoising given in $3.1, an adversarial perturbation for some input I = * (y + b) is any E g" such that x + + y/. where (a) y undesirable and (b) x + 8 sounds identical æ. To make these notions concrete, distinguish untargeted and targeted attacks.
3

---

Untargeted attacks. Here, assume that the attacker has loss function L R" RR" - R. and they wish to maximize the value C(y', y). They do so by selecting á from a set of perturbations which are imperceptible when added to a feasible set which we refer to as (x)). Thus, the adversary in an untargeted attack wishes to find 8* E arg maX)eD(x) C (f(x 6),
Targeted attacks. In this case, the attacker has a target output y that they wish to cause I to output. We model this as the attacker wishing to minimize the loss [( + 6), y'), i.e., the adversary wants 8* arg D()) & (f(z + 8).
Over-the-air attacks. In an over-the-air attack, the adversarial perturbation is distorted by the room's acoustic characteristics and received through microphone. As these distortions are assumed to be applied equally to all audio, this is generally simulated by applying the given RIR the perturbation 8 well speech y and background noise b (Qin al., 2019; Schönherr et al., 2020). For example, the untargeted attack becomes the problem of finding 8 arg m (x) (f (y + bb+ 8)). y) where D is all perturbations that are impercepti- ble after all audio, including the perturbation, is convolved with
3.3 AUDITORY MASKING
We use perceptibility constraint based on auditory masking, also known as psychoacoustic hiding (Lin & Abdulla, 2015; Schönherr et al., 2018: 8; Qin al., 2019): by varying the loudness constraint on the perturbation according to how loud the original signal is across different time segments and fre- quency bands, the perturbation can be effectively hidden the original signal. This is accomplished through the computation of masking thresholds Or., the power spectral density (PSD) matrix of the perturbation, such that any audio whose PSD is upper-bounded by these masking thresholds is, in principle, imperceptible by humans. Expanding the auditory masking algorithms used in this prior work, we apply several enhancements to the threshold calculation to maximize attack power and minimize perceptibility; see $4.2.
4 METHOD
Most of the perturbations we study can be characterized as instantiations of the attacks shown in $3.2, given varying settings of f. y, b, r, C, D, and y/. Here, we discuss C. D, and optimization.
4.1 OPTIMIZATION OBJECTIVE
In this work, we used Short-Time Objective Intelligibility (STOI) (Taal et al., 2011) the loss function L for both targeted and untargeted attacks. Concretely, the untargeted objective is
Cuntargeted (6) (T + 6), y),
which we maximize over ó E D(r) (see $3.2), driving the model output away from the clean speech y. STOI is open-source, differentiable, and closely aligned with our perceptions of intelligibility in untargeted experiments.
While squared error (MSE) is widely used in comparable image tasks and has been success- fully employed in prior attacks on generative audio models (Takahashi et al., 2021; Dong et al., 2023), it remains an unreliable metric for intelligibiliit. suffers from a lack of several detailed desiderata; for example, it is strongly phase-dependent, meaning that simply delaying the audio by a few milliseconds can cause very large MSE but almost no loss intelligibility. Nevertheless, the central issue with MSE is that it is simply not designed to be an intelligibility metric; in our experi- ments, attacks would often achieve a large (untargeted) MSE by simply inducing the DNS model to fail to remove noise, rather than rendering the speech unintelligible.
We could not use Perceptual Evaluation of Speech Quality (PESQ) (Rix et al., 2001). a notable intelligibility metric, as its license owners did not grant However, real adversaries would of course face no such ethical or legal concerns.
academic license for this project.
Finally, also considered DNN-based intelligibility metrics such DNSMOS (Reddy et al., 2022), NISQA (Mittag et al., 2021), and the word enror rate (WER) of Whisper (Radford et al., 2022). While such metrics were reasonably effective unoptimized metries for attack success,
4

---

found empirically that they work poorly objectives, the attack simply learns to induce the model to output adversarial noise against the metric network.
4.2 PERCEPTIBILITY CONSTRAINT ENHANCEMENTS
Our precise procedure for computing the masking thresholds is almost identical the MP3 psychoa- coustic model as described by Lin & Abdulla (2015) and used by Schönherr et al. (2018) and Qin al. (2019), with the following changes: (a) for simplicity. we calculate the PSD of the imput audio by normalizing to [-1, 1] and converting to dB SPL explicitly, rather than setting the maximum bin to equal 96; (b) we enhance the psychoacoustic model with temporal pre- and post-masking, as described by Lin & Abdulla (2015) (see Appendix A for details); (c) because prior studies have found even attacks generated according to these masking thresholds to still be detectable by humans (Schönherr et al., 2018; Qin et al., 2019), we restrict thresholds down by 12 dB. We combine thresholds from contemporaneous masking and pre- and post-mate masking by taking the maximum between each. See Appendices A and B for details.
attacks further by shifting all masking
4.3 OPTIMIZATION ALGORITHM
We use projected gradient descent (PGD; Madry et al. 2018) to find the perturbation 8*:
aC(f(= 5.),
8.+1 = (p((s)
6 + a 06,
(1)
where II is the projection operator. Fortunately, the projection step is straightforward when using auditory masking on unreverberated perturbations (see $4.4 for details on reverberated perturbation optimization). If ب, is the STFT spectrogram of frame T and frequency bin w. then we clip the magnitude of س, such that PSD()) T. S 0rw, while preserving its phase, See Appendix B for details. We also tested Lagrangian dual descent, variant of which used by Qin et al. (2019), and the fast gradient sign method (Goodfellow et al., 2015), but these did not perform as well.
4.4 ADDITIONAL EXPERIMENTAL METHODS
Optimization in Simulated Over-the-air Attacks. We simulate over-the-air attacks in a specific acoustic environment by applying the given RIR to the adversarial perturbation as well as to the clean speech and background noise (see $3.2). Doing so dramatically increases the difficulty of the optimization problem, as the projection step in (1) no longer has closed-form solution: rather than directly clipping we must instead solve for some such that PSD(r 6) S 07,w-
We explore three methods to find such a 5: Wiener deconvolution, manual projection through gradi- ent descent, and combination of both. See Appendix C for details.
Targeted Attacks. We test three types of targets for targeted attacks: speech samples from the same speaker, speech samples from different speakers, and artificial targets generated using voice cloning systems such MaskGGT (Wang et al., 2024a). For all target types, our attack objective is
Leargeted (8) = (f + 6), y') - STOI + 6), y).
which we maximize over E D(x). so that the model's output becomes more intelligible as the target y/ than as the original clean speech y.
Defenses. Prior work has investigated a wide range of defenses against adversarial audio pertur- bations, from pre-processing steps like randomized smoothing (Subramanian al., 2019: Olivier & Raj. 2021), purification (Wu et al., 2023), and adversarial example detection (Yang et al., 2019; Hussain et al., 2021), to more involved defenses like adversarial training (Sallo et al., 2021). In this paper, evaluate the simplest of these defenses: Gaussian noise applied to the attacked audio, normalized to various SNRs.
Universal Adversarial Perturbations. While most of our experiments focus on attacking single known input, we also explore the existence of universal adversarial perturbations (UAPs): individual multiple inputs MMoosvvi-Dzzfoo 2017: Abdoli et al., 2019; Neekhara et al., 2019; Xie et al., 2021; Zhang et al., 2021; Sun et al., 2024). We design UAPs for DNS models under the assumption that the background noise b and RIR
perturbations that lead one or more models to misbehave
et al.,
5

---

remain the same for varying clean speech samples Yn: this represents a best case for the attacker, since the perturbation can hide in shared background noise and the masking thresholds need not accommodate dramatically different acoustic scenes. We calculate Dy Nn D(r * (vn, + +)) (i.e., take the minimum of the different masking thresholds). To train the attack, we iteratively execute one step of PGD sequentially each input r (Un + b).
EXPERIMENTS
In our computational experiments, we focused on answering the following questions: a) Are DNS models susceptible to adversarial noise, or do they denoise that successfully as well? b) In which use cases (amount of noise, reverb, etc.) are the models we study vulnerable to adversarial attacks? <) How does adversarial robustness vary by model, and which model characteristics seem to cor- relate with robustness? d) Can attackers induce the model output a target utterance, as in the case of ASR transcriptions, or are they limited to untargeted attacks? e) Do imperceptible univer- sal adversarial perturbations exist, or does the attacker need to know what the speaker will say? D) Do attackers need to have access to model gradients in order to successfully attack these models? g) Are sophisticated defenses (c.g., adversarial training) necessary, or is Gaussian perturbation good enough? h) Are real, over-the-air attacks possible in principle, is this setting too difficult? i) How does our perceptibility constraint trade off against attack success as we tighten it (Appendix D.3y?
5.1 EXPERIMENTAL DETAILS
Datasets. All audio caapples-speeee noise, and RIRs were taken from the main track of the ICASSP 2022 DNS Challenge 4 (Dubey et al., 2022). Ten-second clean speech samples were se- lected randomly from English read speech (as noted by Dubey et al. (2022), collated from Lib- riVox.org) and VCTK Corpus (Yamagishi et al., 2019). Audio was clipped to five seconds for MP-SENet due to insufficient VRAM. We filtered speech to contain at least 15 words according to Whisper. See Appendix E for more details.
Metries. In addition to STOI, we evaluated attacked audio and the model outputs using ViSQOL (Hines et al., 2015), an intrusive (binary with ground-truth) and unlearned metric; two non-intrusive deep metrics, NISQA (Mittag et al., 2021) and DNSMOS (Reddy et al., 2022); and word accuracy (de Oliveira et al., 2023) using the ASR model Whisper (Radford al., 2022). See Figure 2.
Attacks. All combinations of environment setting (background SNR and reverb/no reverb) and model choice were run for 20 shared seeds (each corresponding to a distinct speech utterance). The attack lasted for a different number of iterations for each model, chosen to ensure that the entire attack (including metric computation) lasted for about one hour on an Nvidia L40S GPU; in particular, this allowed 20,000 iterations for Demucs and FSN+, 10,000 iterations for MP-SENet, and 5,000 iterations for FRCRN. We standardized compute time rather than iteration count because we view attackability as inclusive of the time cost of mounting an attack: granting slower model proportionally more optimization steps would obscure the practical advantage that computational expense confers. We verify in Appendix D.6 that fixing iterations preserves robustness rankings.
5.2 RESULTS AND DISCUSSION
Summary of findings. We briefly answer each experimental question before elaborating in the sections that follow. a) Susceptibility. Yes: all four models can be driven to output unintelligible audio by imperceptible perturbations, though FSN+ is partially protected by exploding gradients (Figure 1). b) Settings. Attacks succeed across virtually all SNR and reverb settings, including near- clean conditions with dB SNR and no reverb. c) Robustness. FSN+ is the most resilient, but due to gradient instability rather than architecture or model size (Appendix D.1); the other three models are comparably susceptible. d) Targeted. Mixed: objective metrics suggest success, but subjective listening reveals the target utterance is barely audible in the output (Appendix D.2). e) UAPs. No: imperceptible UAPs produce only minor degradation (Appendix D.2). f) Transfer. Currently yes: naive cross- cross- architecture transfer fails (Table 2 in Appendix D.2.2), and leave-one-out transfer across
Demues checkpoints is far weaker than white- box attack (Figure 3). g) Defenses. Gaussian noise offers partial protection, but only at SNRs that also degrade normal performance, and an adaptive attacker would likely cireumvent it (Figure 4). h) OTA. Yes: simulated OTA attacks succeed for all

---

No Reverb
Reverb
STOJ Enhancoment Model
0.2
0.0
Condition
Inttal
Allacked
-0.6
Models
-0.8
-1.0
FRCEN
MP-SENet
FSN+
1.4
30
-10
30
10
Background SNR
Background SNR
Figure 1: Untargeted intelligibility degradation. Dashed curves show the DNS models' baseline STOI improvement ATOI = STOI(clean, output) - (Toan, imput); solid curves show the same quantity after adding imperceptible perturbation. Values flip from > < upon addition of adversarial noise across environmental settings, meaning the attack pushes speech from "cleaner than input" to "less intelligible than the noisy input." Error bars: + standard error over 20 seeds.
models except FSN+ (Figure 5), confirmed with real recorded RIRs (Figure 14 in Appendix D.5). i) Tradeoff. Tighter masking reduces attack success primarily in low-noise settings; all constraint levels still allow substantial degradation on average (Appendix D.3).
Figure/ demonstrates our fundamental result: all DNS models tested could be induced to output far worse-quality audio than the input through the addition of imperceptible adversarial noise, and indeed, all models could be reliably (or often, in the case of FSN+) reduced outputting gibberish. Furthermore, the success of the attack was relatively invariant with respect to setting: all models could be successfully attacked all settings, including setting which has almost attack vector: 70 dB SNR noise with no reverb. Thus, we can answer question b): three out of four tested models were completely susceptible in all settings, while FSN+ was fairly susceptible in most settings.
5.2. MODEL RESULTS
Figures I and 7 (Appendix D.2.1) suggest that FSN+ by far the most resilient, FRCRN and De- mues have comparable resilience, and MP-SENet is slightly more susceptible. Surprisingly, though, the resilience of FSN+ is not due high-level architecture differences such domain or parameter count (see Appendix D.I). Instead, the large difference between FSN+'s susceptibility and others was due to the pseudo-robustness the attack on FSN+, the gradient of the STOI loss with respect to the adversarial waveform would of- ten grow to have a norm of 10 or greater, causing numerical instability even with gradient clipping. Therefore, FSN+ might be more vulnerable black-box attacks (Athalye et al., 2018).
exploding gradients (Athalye et al., 2018): during the course of
5.2.2 SIMULATED OVER-THE-AIR THE-AIR ATTACKS
While the pseudo-protection of FSN+'s exploding gradients was amplified in our simulated over-the- air experiments, we discovered that all other models are highly vulnerable to untargeted reverberated perturbations, despite the additional optimization challenges in developing them (see Figure 5). However, the increased challenge of this attack did require that we slightly loosen our perceptibility constraint, reducing the masking thresholds by only dB rather than 12 dB. While this loosening still implies tighter constraint than prior work, it did cause slight crackling to be audible in the speech, though would be difficult to distinguish from minor distortion in real settings.
5.2.3 DEFENSES
We discovered that simple Gaussian perturbation offers reasonable protection against adversarial perturbations, though only when applied at a low enough SNR to damage model performance (Fig- 4; note that STOI enhancement of 0 is slightly lower than the unattacked average of ~ 0.044).

---

Initial
0.10
Attacked
STO1 Eabancommenn by Model (F)
Output
0.05
Normalizee Metric (Mean SED
0.8
0.6
-0.15
-0.20
-0.25
0.2
Background SNR
0.0
STOI
VIS0OL
NISOA DNSMOS ASR Acc.
Altacked
DNSM
Normalized values of the five speech intelligibility and quality metries test, averaged across all models and set- tings of Figure 1 and 20 seeds, with standard error bars. "Output" refers model out- put given the attacked input. ASR accuracy computed as min( (WER, 1). Ranges used for normalization were: STOL: []. ViSQOL: 5]. NISQA: [0. DNSMOS: [0, 5]. ASR accuracy: [0, 1]. ASR ground- truth is Whisper applied to clean speech.
Figure 2:
Figure 3: Leave-one-out transfer across Demucs checkpoints (dns48, dns64, and master64, labeled 'Demucs') in re- verb conditions, using the masking thresh- old of Qin et (2019). Transfer tacks produce minor degradation that grows with background noise, but remain far weaker than white-box attacks (ef. Fig- ure 1). See Figure for full results including no-reverb conditions. Curves show ASTOI (TOI(, input); error bars: + standard error over 10 seeds.
STOT(clean, output)
T-
Undafesded Attuck WND befanded
STOT Enbenseeeent by Model
0.0
S7O1 Eahurrement by Moddl (13
-0.2
0.2
-0.6
-0.8
-1.9
-1.2
Background SNR
-1.
Condition Instal Attacked
Models
MP-SENet
FRCEN
PSN+
Figure 4: White-noise defense. Adding moderate Gaussian ("white") noise to the attacked input partially smooths out ad- versarial perturbations, raising STOI but not restoring clean performance. Curves show ASTOI = STOI(clean, output) (TOT(elean, input); error bars: + standard emrr over 20 seeds.
Figure 5: Simulated over-the-air at- tack. Perturbations trained and evalu- ated under a mix of simulated and real recorded RIRs (OpenSLRR2/288) still crip- ple every model except FSN+. See Fig- ure for results with real RIRs only. Curves show ASToI (TOI( input); error bars: standard error over 20 seeds.
STOI output)
8

---

However, do not assume adaptation by the attacker; knowledge of the defense might allow them to train more
perturbations, emphasizing a need for more sophisticated defenses.
5.2.4 ABLATION: ATTACK PIPELINE COMPONENTS
A natural question is which components of our attack pipeline are necessary for imperceptible, successful attacks. To isolate this, we compare five constraint strategies in a single representative setting d30 SNR with reverb): (1-2) naive PGD with &x and E bounds in the STFT domain, (3) frequency masking without temporal masking at a calibrated offset, (4) the original masking thresholds of Qin et al. (2019) (frequency masking only, no offset), and (5) our full method ($4.2). For methods 1-3, we calibrate the constraint so that the same ASTOI is achieved as our full method, isolating the perceptibility cost: simpler methods must allow louder, more audible perturbations to reach the same attack success. We provide details and links to samples in Appendix D.4.
6 HUMAN STUDY
Participants & ethics. We recruited 15 adult audio/multimedia researchers from an industrial search lah. Participation was voluntary and conducted during paid working hours; no additional compensation was provided. Under the host institution's 's policy for minimal-risk studies, our study did not require formal IRB/ethics review. All participants provided informed consent and could withdraw any time, and no personally identifying information or audio recordings were collected; we stored only anonymized task responses and timestamps.
Tasks and protocol. ABX discrimination. Participants could take as long as they wished, though tasks were designed to be completed in less than 25 minutes. Once a participant advanced from transcription to ABX, they could not return to transcription. Participants typically use high-quality headphones in their day-to- day work; we recommended (but did not enforce) headphone use. Participants were instructed to leave transcription boxes blank if no intelligible speech was detected.
Each participant completed two tasks a fixed order: (1) transcription and (2)
Stimuli and conditions. All stimuli were 5 clips cropped from the same datasets as in the com- putational study (pilot feedback indicated 10s was too long to transcribe or compare reliably). We filtered candidate clips to contain at least 10 words and to use only the 2,000 most common English words to reduce ESL burden, again thanks to pilot feedback. We used two background conditions designed to mimic common listening scenarios: 30 dB and dB SNR with reverberation. We eval- uated Demucs, FRCRN, and MP-SENet in the human study; Full-SubNet+ was excluded here as to focus our human-evaluatie budget on the most vulnerable models.
Attacks. Attacks were conducted as in the computational study, here using the tighter psychoa- coustic masking constraint (Appendix D.3).
Measures and analysis. For transcription report word accuracy (WAcc; 1 1 WER), calculated without any equivalencies besides upperease-lowercase. For ABX we report accuracy versus the 50% chance bascline. For confidence intervals, we use 95% two-way ("pigeonhole") bootstrap CIs (Owen, 2007), a model-free alternative to generalized linear mixed models (GLMMs) for data with crossed effects. Note that, because samples were shared between participants, naive bootstrap and the Student's r-test would not be appropriate statistical tests, as they would underestimate variance.
Results. Transcription WAec (Figure 6a) shows that the Attacked Output had near-zero intelligi- bility. while both the Attacked Input and Clean Output were reasonably intelligible. In particular, an intersection-union test indicates that the attacked output was significantly less intelligible than both the attacked input and clean output (95% upper bounds on the mean differences of -0.464 and -0.458, respectively; see Appendix for details).
ABX accuracy (Figure 6b) had a mean of 59%, marginally above chance, but with substantial vari- ance between participants and samples. The mean was not significantly different from 50% accord- ing to one-sided 95% pigeonhole bootstrap test (lower bound: 0.478). While other less conserva- tive statistical tests (c.g.. a Wald test with a GLMM) might conclude significance, the present results offer preliminary support for the subjective imperceptibility of our attacks.

---

1.0
1.0
Word Accuracy (WAcc)
0.8
0.8
Accuracy
0.6
0.6
0.4
0.4
0.2
0.0
0.0
Primary Samples
Attention Checks
Attacked Input
Clean Output
Attacked Output
(a) Transcription study
(b) ABX study
Figure 6: Human study. We ran transcription and ABX studies with 15 audio/multimedia searchers using high-quality audio setups. The transcription task consisted of random 5-second samples (sampled once for all participants), including attacked imputs, model outputs given clean inputs, and 6 model outputs given attacked inputs. Word accuracy (WAce) results show that the attacked input and clean output were reasonably intelligible, while the attacked output unintel- ligible. The ABX task consisted of 12 pairs of 5-second samples (also common across participants), each consisting of an unattacked sample and its attacked counterpart, well as attention checks each consisting of a pair of clean and aggressively attacked audio. For both plots, we show 95% two-way bootstrap Cls (Owen, 2007); for the ABX study, we plot participant-wise marginal accu- racies (i.e., averaged across samples). ABX results show that the average participant's 's accuracy is insignificantly above the random chance baseline of 50% with substantial variance.
7 CONCLUSION
We show that DNS models are vulnerable to imperceptible adversarial attacks across simulated settings: by adding adversarial noise hidden in the original input signal, all models we study can be induced to output audio with almost no resemblance to clean or noisy speech. Our attacks generalize across settings, including simulated over-the-air attacks and cases with no background noise or reverb, and suggest that better optimization targets may enable subjectively effective targeted attacks (Appendix D.2). Finally, our human study validates that our attacks are generally imperceptible, and the outputs generally unintelligible, even to audio experts.
Our results have several important limitations. First, FSN+ is protected from gradient-bar based at- tacks due exploding gradients, though this pseudo-defense is easily overcome (Athalye et al., 2018). Second, our strongest attacks rely on gradient access; naive transfer is ineffective under strict masking. Third, we only attack fully differentiable DNS models; token-based DNS models (Wang et al., 2024b) will require new techniques. More broadly, our attacks are offline and per-utterance: streaming attacker would need universal perturbations (ineffective here), a lookahead buffer, or advance knowledge of the speech to attack. Our over-the-air experiments model linear propagation via RIRs (real recorded RIRs subsume speaker/miicopphoee frequency responses). but real playback chains also introduce nonlinearities, gain control, and codec compression (Sadasivan et al., 2025), any of which could attenuate the perturbation. Weak transfer suggests defense: inference-time ensembling randomized architecture switching could raise the bar for attacker, white-box access to each individual model.
with
Nevertheless, hope to convince the research community that open-source DNS models are both an appealing and feasible target for attack, with the potential to incapacitate live audio streams, speech recognition systems, hearing aid users, and more. With simple defenses such white noise only offering limited protection, we urge researchers to evaluate further models in more lifelike settings and develop and apply better defenses before attackers exploit these critical weaknesses.
10

---

ACKNOWLEDGEMENTS
We are deeply grateful to Neel Chaudhari (Dolby Laboratories) for his invaluable work design- ing, implementing, and deploying the perceptual listening-test platform used in our human-subjects evaluation.
Funding for this project generously provided by Dolby Laboratories. This project also used computational resources from Unity, collaborative, multi-institutional high-performance comput- ing cluster managed by UMass Amherst Research Computing and Data.
ETHICS STATEMENT
Dual-use adversarial robustness research. This paper demonstrates research into the adversar- ial robustness DNS models, including methodological advancements adversarial perturbation generation. However, we believe the security utility of our present work outweighs any utility it could provide real-world adversaries. First, the focus of the study on precisely characterizing long-standing vulnerabilities so as to spur future research rather than providing methods for over- coming existing defenses. Second, we indeed document that there are several further steps required for attacker before successfully applying the present methods to real-world scenario, including extending the simulated over-the-air attacks shown here to real over-the-air scenarios. Finally, we show that simple, easily implemented defenses such Gaussian perturbation effective against naive attacks, thus leaving the immediate advantage with a well-informed defender.
Human subjects. The present paper also describes small human study with 15 industry searchers. Participation was purely voluntary during business hours, with compensation only in the form of their existing salary; explicit consent collected before each participant began the study; the study consisted purely of audio tasks containing no offensive speech; each participant was free to withdraw at any time without penalty; and no personal information collected or stored at any time. While the host institution of the study does not require IRB approval for low-risk studies, we believe the risks subjects posed by our study design are minimal.
Licensing and credit. We carefully track the licenses of all artifacts we use other than standard PyPI libraries (Appendix G). particular, we did not use the proprietary speech quality metric PESQ, as it is not licensed for research use by default and the maintainers did not respond to our request.
LLM DISCLOSURE
LLMs provided assistance throughout this project except for ideation of the central research ques- tions. LLMs from the GPT, Claude, and Gemini families were used for methodological ideation, writing, and coding assistance. The authors attest to the correctness of all present claims and results.
REPRODUCIBILITY STATEMENT
We have specified all details needed reproduce our experiments the best of our abil- ity both in the main body and in all appendices. Our code is publicly available at http://gihhbh.oooo/liliiiwaaaeaa
REFERENCES
Sajadd Abdoli, Luiz G. Hafemann, Jerome Rony, Ismail Ben Ayed, Patrick Cardinal, and Alessan- dro L. Koerich. Universal adversarial audio perturbations, 2019. URL https:://aaxatt. or / 001.988..3......
Moustafa Alzantot, Bharathan Balaji, and Mani Srivastava. Did you hear that? Adversarial examples against automatic speech recognition, 2018. URL httttts///axxiii wwtp:/ivv.r./////w/a///oee/ 005 54.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Circumventing defenses to adversarial examples. In Jennifer Dy and Andreas Krause

---

(eds.), Proceedings of the 35th International Conference Machine Learning, volume 80 of Proceedings of Machine Learning Research, pp. 27..274283, PMLR, 10-15 2018. URL https: / /pproceedings mlr. htt.:ss.wm.............e..e www.ppresss..... http:///aaaaaaala.aaaaaa htmm..
Michael Brodersen, Achim Volmer, and Gerhard Schmidt. Signal enhancement for communication systems used by fire fighters. EURASIP Journal on Audio, Speech, and Music Processing, 2019 (21), 2019. doi: 10.11866133666-19-00666
Nicholas Carlini and David Wagner. Audio adversarial examples: Targeted attacks on speech-to- text. In 2018 IEEE Security and Privacy Workshops (SPW), pp. 1-7, 2018. doi: 10.1109/SPW.20 18.00009.
Guangke Chen, Sen Chenb, Lingling Fan, Xiaoning Du, Zhe Zhao, Fu Song, and Yang Liu. Who is real Bob? Adversarial attacks speaker recognition systems. In 2021 I IEEE Symposium on Security and Privacy (SP), pp. 694-711, 2021.
doi: 10. 109/SP40001 1.0004..
Guangke Chen, Zhe Zhao, Fu Song, Sen Chen, Lingling Fan, Feng Wang, and Jiashui Wang. To- wards understanding and mitigating audio adversarial examples for speaker recognition. IEEE Trans. Dependable Secur. Comput., 20(5):3970- 3987, September 2023. ISSN 1545-5971. doi: 10. N0.1109/TDSC.222..22000 673.
URL https: /tt.:dii..ror../
110111111111 TDSC. 2022.3222
Jun Chen, Zilin Wang, Deyi Tuo, Zhiyong Wu, Shiyin Kang, and Helen Meng. Fullsubnet+: Channel attention fullsubnet with complex spectrograms for speech enhancement. In ICASSP 2022 2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 7857- 7861, 2022. doi: 10.1 00.1099CASSP43322220...11.
Moustapha Cisse, Yossi Adi, Natalia Neverova, and Joseph Keshet. Houdini: Fooling deep struc- tured visual and speech recognition models with adversarial examples. Proceedings of the 3 International Conference on Neural Information Processing Systems, NIPS' 17, pp. 6980-6990, Red Hook, NY, USA, 2017. Curran Associates Inc. ISBN 97815 10860994
Ross Cutler. Developing machine learning based speech enhancement models for Teams and Skype. Conference presentation video, RTC @ Scale 2022 (virtual), February 2022. URL https: //at scaleconferrncee cwm com/videos wwweeoeing wwwpeiinnnmmchhinnoo learning- spe ech-enhancement- modee - wawer--ttaas-ad-ss---eee----- ross- Accessed: 2025-01-28.
Danilo de Oliveira, Julius Richter, Jean-Marie Lemercier, Tal Peer, and Timo Gerkmann. On the behavior of intrusive and non-intrusive speech enhancement metrics in predictive and generative settings, 2023. URL https::///// http:://axivvvi//e abs /006. 03014. 4.
Alexandre Defossez, Gabriel Synnaeve, and Yossi Adi. Real time speech enhancement in the wave- form domain, 2020. URL https://arxiv org./ abs 2006. 12847.
Mingyu Dong, Diqun Yan, and Rangding Wang. Adversarial examples protect your privacy on speech enhancement system. Computer Systems Science and Engineering, 46(1):1-12, 2023. doi: 10.32604/csse 2023.034255 URL http: http://wwwwwetccceeeee.e techscience.... com http//sseevvaaee 6 /51333
Harishchandra Dubey, Vishak Gopal, Ross Cutler, Ashkan Aazami, Sergiy Matusevych, Sebastian Braun, Sefik Emre Eskimez, Manthan Thakker, Takuya Yoshioka, Hannes Gamper, and Robert Aichner. ICASSP 2022 deep noise suppression challenge. In ICASSP 2022 2022 IEEE Interna- tional Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 9271-9275, 2022. doi: 1A.109//CASS9449222222..99
Harishchandra Dubey, Ashkan Aazami, Vishak Gopal, Babak Naderi, Sehastian Braun, Ross Cutler, Alex Ju, Mehdi Zohourian, Min Tang, Mehrsa Golestaneh, and Robert Aichner. ICASSP 2023 deep noise suppression challenge. IEEE Open Journal of Signal Processing, 5:725-737, 2024. doi: 00.1109/01SP.2224.3377
Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Analysis of classifiers' robustness adversarial perturbations. Mach. Learn., (07(3):481-500 March 2018. ISSN 0885-6125. doi: 10.1007/s109 94-017-5663-3. URL https: //o.i.o....//////////// orrg/ -
12

---

Yuan Gong and Christian Poellabauer. Crafting adversarial examples for speech paralinguisties applications, 2017. URL https://axxivv.rgg/ abtpg///bs//11111 03280.
lan Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples, 2015. URL htttttsss//aaxttt org /141..112...... 6572.
Feng Guo, Zheng Sun, Yuxuan Chen, and Lei Ju. Towards the transferable audio adversarial attack via ensemble methods. Cyhersecurity; 6(44), 2023. doi: 10.11886/424000033-000777 URL https: http://bebbbrrrr.y..... wtw.:cccwttt....pinneeereeoeee com httppp/e...eeeeeeeeeeeeeee/.//// 23 00175-8. 8.
Andrew Hines, Jan Skoglund, Anil C. Kokaram, and Naomi Harte. ViSQOL: An objective speech quality model. EURASIP Journal on Audio, Speech, and Music Processing, 2015(1):13, 2015. ISSN 1687-4722. doi: s s13636- 01 5 0054-9.
URL https: http:/ooi...ooo httpp////oo..rggo.11111000
Shehzeen Hussain, Paarth Neekhara, Shlomo Dubnov, Julian McAuley, and Farinaz Koushanfar. WaveGuard: Understanding and mitigating audio adversarial examples. 30th USENIX Security Symposium (USENIX Security 21), pp. 2273-2290. USENIX Association, August 2021. ISBN 978-1-939133-24-3 URL hwtps:ttpt..... /www. usenix wogg//oofeeenne/ueeeeeee hyyl/presentatiion//usss
Arindam Jati, Chin-Cheng Hsu, Monisankha Pal, Raghuveer Peri, Wael AbdAlmageed, and Shrikanth Narayanan. Adversarial attack and defense strategies for deep speaker recognition systems. Computer Speech & Language, 68:101199, 2021. ISSN 0885-2308. doi: https:
htt..org/1..111/.cs...zozo V/doi.org/1i ww.110066..sll.... 2021. URL https://p/// /ww.wwwwammmmmmmm sc encedi rect. com c
ience/articles / 000061.
Weifei Jin, Yuxin Cao, Junjie Su, Qi Shen, Kai Ye, Derui Wang, Jie Hao, and Ziyao Liu. To- wards evaluating the robustness of automatic speech recognition systems via audio style transfer. In Proceedings of the 2nd ACM Workshop on Secure and Trustworthy Deep Learning Systems, SecTL '24 pp. 47-55, New York, NY, USA, 2024. Association for Computing Machinery. ISBN 9798400706912. doi: 10.1145/366541 33655332. URL https: /oii org/10 1145/36 65451. 3665532.
Tom Ko, Vijayaditya Peddinti, Daniel Povey, Michael Seltzer, and Sanjeev Khudanpur. study on data augmentation of reverberant speech for robust speech recognition. In 2017 IEEE Interna- tional Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 5220-5224, 2017. doi: 10.1109/ICASSPP2211..9999
Felix Kreuk, Yossi Adi, Moustapha Cisse, and Joseph Keshet. Fooling end-to-end speaker verifica- tion with adversarial examples. In 2018 JEEE International Conference on Acoustics. Speech and Signal Processing (ICASSP), pp.
2018. doi: 10.1109/ICASSP 2018 8.868866.93.
Xu Li, Jinghua Zhong, Xixin Wu, Jianwei Yu, Xunying Liu, and Helen Meng. Adversarial attacks on GMM i-vector based speaker verification systems. In ICASSP 2020 2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 6579-6588 2020. doi: 10. /TA.:///AAAS5477222000005.0
Yiqing Lin and Waleed H. Abdulla. Principles Psychoacousties, pp. 15-49. Springer International Publishing, Cham, 2015. ISBN 978-3-319-07977 doi: 10. 10.1007/978-33319-779444 URL https: //d::///do.../ wwtg////// . 1007 /978 000--119-7999 -
Ye-Xin Lu, Yang Ai, and Zhen-Hua Ling. Mp-senet: A speech enhancement model with parallel denoising of magnitude and phase spectra. In Interspeech 2023, pp. 3834-3838, 2023. doi:
10.21437//nterspeechhho 2023-1441.
Ye- Xin Lu, Yang Ai, and Zhen-Hua Ling. Explicit estimation of magnitude and phase spectra in parallel for high-quality speech enhancement. 2024. URL https: /ttxivivvv.///////////aa/////avv org/ abs/ / 08. 08926.
13

---

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018. URL http:///pweeeeeeeeooooooooaaeaee
net/ /orummid==mmmII
ZAb.
Manuel Milling, Shuo Liu, Andreas Triantafyllopoulos, Ilhan Aslan, and Björn W. Schuller. Audio enhancement for computer audition-an iterative training paradigm using sample importance.
Journal of Computer Science and Technology, 39(4):895-911, 2024. ISSN 1860-4749, doi: 10 1390-024-29944 URL https: /doii wwg/10.0000 10t.:/....1000...... 100000//s111110000
Gabriel Mittag, Babak Naderi, Assmaa Chehadi, and Sebastian Möller. NISQA: A deep CNN-self- attention model for multidimenssonal speech quality prediction with crowdsourced datasets. In Interspeech 2021, pp. 2127-2131, 2021. doi: (0.21457/meerrpeecch.2011/ 2021:s/
Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In 2017 IEEE Conference Computer Vision and Pattern Recognition (CVPR), pp. 86 86-94, 2017. doi: 10. 20.1109/VVP..201...0
Paarth Neekhara, Shehzeen Hussain, Prakhar Pandey, Shlomo Dubnov, Julian McAuley, and Farinaz Koushanfar. Universal adversarial perturbations for speech recognition systems. In Interspeech 2019, pp. 481-485, 2019. doi: 111444//mterspecch2019111-0
Stavros Ntalampiras. Adversarial attacks against audio surveillance systems. In 2022 30th European Signal Processing Conference (EUSIPCO), pp. 284-288, 2022, doi: 9022.990
Raphael Olivier and Bhiksha Raj. Sequential randomized smoothing for adversarially robust speech recognition. In Marie-Francine Moens, Xuanjing Huang. Lucia Specia, and Scott Wen-tau Yih (eds.), Proceedings of the 2021 Conference Empirical Methods in Natural Language Pro- cessing, pp. 6372-6386, Online and Punta Cana, Dominican Republic, November 2021. As- sociation for Computational Linguistics. doi: 10.18653/v http://221..emmmmmmmmem main.514. URL org.oogg////2 pettps:/aacantthee wtwp://.............mm..aa...... 514/.
emnlp-main
Art B. Owen. The pigeonhole bootstrap. The Annals of Applied Statistics, 1(2), December 2007. ISSN 1932-6157. doi: 10. 10.1214/07-a0as222 URL http: //tp:://dx..e doi. org.org///// http://..111///... 1214/07-A OAS122.
Yao Qin, Nicholas Carlini, Garrison W. Cottrell, Ian J. Goodfellow, and Colin Raffel. Impercep- tible, robust, and targeted adversarial examples for automatic speech recognition. In Kama- lika Chaudhuri and Ruslan Salakhutdinov (eds.), Proceedings of the 36th International Confer- ence on Machine Learning. ICML 2019, 9-15 June 2019, Long Beach, California. USA, vol- ume 97 of Proceedings of Machine Learning Research, pp. 5231-5240. PMLR, 2019, URL http: / /ptpp/eeeooenggsso/e/eeeeee mmlr.press/vel
9a html.
Alec Radford, Jong Wook Kim, Tao Xu, Greg Brockman, Christine McLeavey, and Ilya Sutskever. Robust speech recognition via large-scale weak supervision. https://opentti com/ index /whisper/ /, 2022. OpenAl Report
Chandan K A Reddy, Vishak Gopal, and Ross Cutler. Dnsmos p.835: A non-intrusive perceptual objective speech quality metric evaluate noise suppressors, 2022. URL hittps://azxx 2210.110.. 017 63.
W. Rix, J.G. Beerends, M.P. Hollier, and A.P. Hekstra. Perceptual evaluation of speech quality (PESQ)-a new method for speech quality assessment of telephone networks and codecs. In 2001 IEEE International Conference on Acoustics, Speech, and Signal Processing. Proceedings (Cat.
No.0ICH37221), volume 2, pp. 749-752 vol.2, 2001. doi: 10.1109/ICASSP.. 2001 2001.99023....
Vinu Sankar Sadasivan, Soheil Feizi, Rajiv Mathews, and Lun Wang. Attacker's 's noise can manipu- late your audio-based LLM in the real world. arXiv preprint arXiv:2507.06256 2025.
Raymel Alfonso Sallo, Mohammad Esmaeilpour. and Patrick Cardinal. Adversarially training for audio classifiers. In 2020 25th International Conference on Pattern Recognition (ICPR), pp- 9569-9577 2021.
doi: 10.1 109//CCR44800620021.9000 9413222.....
14

---

Lea Schönherr, Thorsten Eisenhofer, Steffen Zeiler, Thorsten Holz, and Dorothea Kolossa. Imperio: Robust over-the-air adversarial examples for automatic speech recognition systems. Proceed- ings of the 36th Anmual Computer Security Applications Conference. ACSAC '20, pp. 843-855, New York, NY, USA, 2020. Association for Computing Machinery. ISBN 9781 1503388580 doi: 10.1145/3427228.447777
URL https::tpp/..oc...... //t////oiii./ 11te///111111/422222221 3427276.
Lea Schönherr, Katharina Kohls, Steffèn Zeiler, Thorsten Holz, and Dorothea Kolossa. Adversarial attacks against automatic speech recognition systems via psychoacoustic hiding, 2018. URL
https: /ttpvvaaxvvvv//vv///vv//.../...v abs////b//// 05665.
Ali Shahin Shamsabadi, Francisco Sepúlveda Teixeira, Alberto Abad, Bhiksha Raj. Andrea Caval- laro, and Isabel Trancoso. Foolhd: Fooling speaker identification by highly imperceptible adver- sarial disturbances. In ICASSP 2021 2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 6159- 6163, 2021. doi: 10.1000CCASSP3377222200000
3760.
Vinod Subramanian, Emmanouil Benetos, and Mark B. Sandler. Robustness of adversarial attacks in sound event classification. In Proceedings of the Detection and Classification of Acoustic Scenes and Events 2019 Workshop (DCASE2019), pp. 239 243, New York University, New York, NY, USA, October 2019. doi: 10.33622/s99m-4K06
Zheng Sun, Jinxiao Zhao, Feng Guo, Yuxuan Chen, and Lei Ju. CommanderUAP: A practical and transferable universal adversarial attacks speech recognition models. Cybersecurity, (1):38, June 2024. ISSN 2523-3246. doi: 10. 0066//42400002-0022211 //dpi. 1186/1181110 0424000024-00211--
URL https:
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks, 2014. URL https: /ttpsss//axvvv.o/ g/ s//bs//i /0os/11 0////111.611 6199.
Cees H. Taal, Richard C. Hendriks, Richard Heusdens, and Jesper Jensen. algorrith for intelligi- bility prediction of time time-frequency weighted noisy speech. IEEE Transactions on Audio, Speech, and Language Processing, 19(7):2125-2134 2011. doi: 10. 20010//TTS..11..211111
Naoya Takahashi, Shota Inoue, and Yuki Mitsufuji. Adversarial attacks audio source separa- tion. In ICASSP 2021 2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 521-525, 2021. doi: 10. 1119//CAASPP99922200199991138
Ke Tan, Xueliang Zhang, and DeLiang Wang. Deep learning based real-time speech enhancement for dual-microphone mobile phones. IEEE/ACM Transactions on Audio, Speech, and Language Processing, 29:1853-1863, 2021.
doi: 10. 10.1099TASSLP20013002331
Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and Lin (eds.), Advances in Neural Information Processing Systems, volume 33, pp. 1633-1645, Curran Associates, Inc., 2020. URL http:////o/t////ooeeeeeeeeeeee/. h0tp////00.111113311111033333330
files/p
Kendrick Trinh. Adversarial attacks on speech separation systems. Master's project,, San Jose State University, 2022. URL https::/p/// schol arworks jjsu..euue..u www.euuuu.... pttpetteepeessss////e/oooseessss Paper 1089.
Qing Wang, Pengcheng Guo, and Lei Xie. Inaudible adversarial perturbations for targeted attack in speaker recognition. In Interspeech 2020, pp. 4228 4232, 2020. doi: 10.21457//nterspeech.00 011955.
Yuancheng Wang. Haoyue Zhan, Liwei Liu, Ruihong Zeng. Haotian Guo, Jiachen Zheng, Qiang Zhang, Xueyao Zhang, Shunsi Zhang, and Zhizheng Wu. Maskget: Zero-shot text-to-speech with masked generative codec transformer, 2024a. URL https: www.iiwwgg/aa...a...o.o..o.ooore abs/g//bb///0 9409. 007 50.
15

---

Ziqian Wang, Xinfa Zhu, Zihan Zhang, YuanJun Lv, Ning Jiang. Guoqing Zhao, and Lei Xie. Selm: Speech enhancement using discrete tokens and language models. In ICASSP 2024-2024 IEEE In- ternational Conference Acoustics, Speech and Signal Processing (ICASSP), pp. 1.p..1155 11561-11565. IEEE, 2024b.
Nils L. Westhausen, Hendrik Kayser, Theresa Jansen, and Bernd T. Meyer. Real-time multi- channel deep speech enhancement in hearing aids: Comparing monaural and binaural process- ing in complex acoustic scenarios. IEEE/ACM Trans. Audio, Speech and Lang. Proc., 32: 4596-4606, October 2024. ISSN 2329-9290. doi: 10. L100TTASLPP URL
https: http///di.../ /rgg/0..... 1110/TAALL .ww.AASLPP.20...... 2024. 3473315.
Donald S. Williamson, Yuxuan Wang, and DeLiang Wang. Complex ratio masking for monaural speech separation. JEEE/ACM Transactions on Audio, Speech, and Language Processing, 24(3): 483-492, 2016. doi: 10. 00.1109/ASLLP220555522
Shutong Wu, Jiongxiao Wang, Wei Ping, Weili Nie, and Chaowei Xiao. Defending against adver- sarial audio via diffusion model. In The Eleventh International Conference on Learning Repre- sentations, 2023. URL https: http:////.pppaoooooooo./e/////ta
Yuezhou Wu, Pengfei Li, and Siling Zhang. Air traffic control speech enhancement method based on improved DNN-IRM. Aerospace, 11(7):581, 2024. doi: 10.3390/aerospace 1070581.
Yi Xie, Zhuohang Li, Cong Shi, Jian Liu, Yingying Chen, and Bo Yuan. Enabling fast and universal audio adversarial attack using generative model. Proceedings the AAAI Conference on Artificial Intelligence, //ojs. www.aaii..ooinaaaa www.innwwwppppppppppp.oppppppppe AAAI
May 2021. doi: 00.1609/aaii.v355 v35i16. 17663. URL https:
Junichi Yamagishi, Christophe Veaux, and Kirsten MacDonald. CSTR VCTK Corpus: English Multi-speaker Corpus for CSTR Voice Cloning Toolkit (version 0.92). sttps://doi.on 10. 74..448BDS/22 2645, 2019, Data available 2019-11-13.
Zhuolin Yang. Bo Li, Pin-Yu Chen, and Dawn Song. Characterizing audio adversarial examples using temporal dependency. In International Conference on Learning Representations, 2019. URL httphttt//// http:////peeeeeeeeeeee net/ wwt.:neee/oofttmeeeeeo wow.mmiddrrgee3e0
Xineheng Yu, Dongyue Guo, Jianwei Zhang, and Yi Lin. Rose: A recognition- speech enhancement framework in air traffic control using multi-objective learning, 2024. Accepted by IEEE/ACM Transactions on Audio, Speech, and Language Processing.
Guoming Zhang, Chen Yan, Xiaoyu Ji, Tianchen Zhang, Taimin Zhang, and Wenyuan Xu. Dol- phinattack: Inaudible voice commands. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS '17, pp. 103-117, New York, NY, USA, 2017. Association for Computing Machinery. ISBN 9781450049948. doi: 10.1145/3133955.3134022. URL https:ttp///cmm /ooi. org /tgg100.00 1145 /13355333335666 htt.//3133555...330533 3134052.
Hanyi Zhang, Longbiao Wang, Yunchun Zhang, Meng Liu, Kong Aik Lee, and Jianguo Wei. Adver- sarial separation network for speaker recognition. In Interspeech 2020, pp. 951-955, 2020. doi: 10.21437/Intesspeechh. 2020- 1966.
Weiyi Zhang, Shuning Zhao, Le Liu, Jianmin Li, Xingliang Cheng, Thomas Fang Zheng, and Xi- aolin Hu. Attack on practical speaker verification system using universal adversarial perturba- tions. In ICASSP 2021 2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 2575-2579, 2021. doi: 10. 10.1109//CSSP39722 2012222..21.9. 2021.9413467.
Shengkui Zhao, Bin Ma, Karn N. Watcharasupat, and Woon-Seng Gan. FRCRN: Boosting feature representation using frequency recurrence for monaural speech enhancement. In ICASSP 2022 2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp- 2281-9285, 2022. doi: 10.1 10.1000CCASSP443222200.....
16

---

A AUDITORY MASKING
Temporal Masking. Let 0 T, be the masking threshold in frame T and frequency bin w. computed by the default approach (Lin & Abdulla, 2015; Qin et al., 2019). This computation already involves consideration of the effect of sound in one frame and frequency bin on the masking thresholds the same frame, т, but adjacent frequency bins, w'. For example, the model already accounts for the fact that a kHz sine tone would mask 990 Hz tone as well.
However, well known (Lin & Abdulla, 2015) that masking also occurs between frames, along the same frequency bin; this is known pre-masking and post-masking. Combining results shown by Lin & Abdulla (2015) with our own experimentation, we model this by first computing contem- poraneous masking thresholds as before, then for each or computing the post-masking threshold it causes on later frames 7' using exponential decay of 0.02 mss-. clipping to zero at gap of 100 ms. Pre-masking, where r' < т, is modeled similarly but much more sharply, with a decay of 0.16 ms clipping zero after gap of 20 ms.
Finally, each frame and frequency bin now has one contemporaneous masking threshold. a small number of masking thresholds due pre-masking by future sounds, and a larger number of masking thresholds due to post-masking by previous sounds. To combine all of these thresholds, we set the final threshold to be their maximum, as we find this to empirically produce the best perceptibility constraint.
B PROJECTED GRADIENT DESCENT WITH MASKING
Given the TF masking thresholds 0r.. calculated for the normalized input x, seek an impercep- tible perturbation whose reverberation free STFT magnitude does not exceed 0r,.- Let
8 = STFT())
For the purposes of illustration, let
.., 10log10 (1ō, P))
(In reality, there are subtleties around Hann window energy and length correction which we elide here; the full process is discussed by Lin & Abdulla (2015) and Qin et al. (2019).)
To enforce PSD(0) S Or... we use a projection operator Il each iteration of projected
gradient descent (PGD). Specifically, after each gradient step, we adjust 8rw to satisfy
PSD()) S Orw
by scaling its magnitude if necessary:
8 8 x min 1, 10
PSD(8)
This enforces time-frequency masking constraints bin-by-bin while preserving the phase 8
Note that this is not necessarily projection operator in the strict sense of mapping to the nearest point in D(z), particularly when parameterized the time domain, but it does ensure a feasible 8 after each projection step.
C AVER-THE-AIR ATTACK OPTIMIZATION
Given knowledge of an RIR r and clipped, imperceptible reverberated perturbation = r 6, Wiener deconvolution is the following process: if & is the full frequency spectrogram of in bin w, and similar for T.,, approximate
8 ~
17

---

Targeted, No Reverb
Targeted Reverb
1.25
Relativo Intelliibiiit larget
1.00
Audio
Attacked Input
Outgul
0.00
Models
-0.25
FRCEN
-0.50
MP-SENet
-0.75
FSN+
30
-10
70
Background SNR
Background SNR
Figure 7: Intelligibility of injected target audio. We plot Aureat STOI(target, audio) STOI(clean, audio) for the attacked input (dashed) and the DNS output (solid). Positive solid values indicate that the model's output makes hidden target phrase clearer than the original clean speech, demonstrating a successful targeted attack under the STOI criterion. Targets are real utter- ances from the same speaker the clean audio. Error bars: + standard error over 20 seeds.
where is small stability term (10-4) and represents complex conjugation. Although mathe- matically principled inversion, Wiener deconvolution is approximate for our use case, as convolution by RIRs is generally non-invertible.
One could attempt to apply Wiener deconvolution iteratively to find an exact å such that (r 6) E D* However, simpler iterative approach is gradient descent: directly compute the total constraint violation g( as
g Σ max(PSD(r 6) - (0 d),
where small positive offset dB) to ensure that gradient descent finds an exact feasible solution; we then find (g(6)) over-the-air attacks, we parameterize 5 in STFT spectrogram space, as this representation produces smoother gradient descent behavior. Because these attacks are harder, we gradually decrease the masking thresholds from a high starting point over time, similar to iterative constraint tightening in other works (Qin et al., 2019).
28 using autodifferentiation and repeat until E (* i.e., g()) 0. For
Finally, we also test applying one step of Wiener deconvolution and then finishing the projection with gradient descent.
D ADDITIONAL EXPERIMENTS
D. MODEL ATTACK SUCCESS VERSUS ARCHITECTURAL DETAILS
Table 1: Effect of architecture on robustness to adversarial perturbations. FSN+ shows sub- stantially smaller STOI degradation than other models with similar domains parameter counts, coarse architectural statistics do not predict robustness.
Model
Domain
#Par. (M)
ASTOI
Demucs
Time
33.5
-1.08
FRCRN
TF
10.3
-0.99
FSN+
TF
8.7
-0.49
MPSE
TF
2.3
-1.25
D.2 NEGATIVE RESULTS
In this section, explore several of our research questions that presented mixed negative results.
18

---

Universal Adversarial Perturbations (UAPs). We found that UAPs were unable to cause more than slight decreases in the quality of the model output while remaining imperceptible (question e)); this is likely due to the difficulty of hiding relevant perturbations inside of background noise alone, rather than a single clean speech sample. This result is consistent with prior work showing that audio UAPs are generally perceptible (Sun al., 2024).
D.2.1 TARGETED ATTACKS
Figure 7 demonstrates our results for the strongest targeted attack, where targets are real samples from the same speaker. At first glance, it appears to suggest that the answer to question d) re- soundingly positive: DNS models are equally susceptible to targeted attacks as ASR models, and equally susceptible to adversarial perturbations in general. However, we found that, while STOI was excellent minimization objective (low STOI implies low intelligibility), it broke down when used as a metric for maximization (high STOI does not imply high intelligibility). This issue is audible in samples: 0.5 with respect to the target audio, a human listener can discern at most faint robotic hint of the target speech. Thus, while future attackers may find ways generate targeted attacks using more sophisticated objectives, the answer to question d) is currently both positive and negative.
in attacked model outputs that are judged to have STOIs of more than
Note that cross- pross-s targets and Al-synthesized targets were empirically ineffective, so we only report results using real speech from the same speaker.
D.2.2 MODEL TRANSFER
To answer question f), we evaluated the possibility of model transfer attacks, where an attack is trained for one model but applied another. Our results indicated that attacks generally do nor transfer between different architectures (e.g., from Demucs to FSN+); see Table 2. We also tested whether attacks between three different available Demucs checkpoints transfer to each other. Sur- prisingly, we found that they did not.
Our results stand in contrast to those of Dong et al. (2023), who found that perceptible adversarial examples can transfer between models. Thus, without more sophisticated transfer techniques (Guo al., 2023), our results suggest an affirmative answer to question f), as long as the attacker truly constrained to producing imperceptible attacks. However, further research is urgently required, particularly on pure black-box attacks (Chen et al., 2021).
Table 2: Psychoacoussically hidden attacks do not transfer between models. Off-diagonal entries in the attack-transfer matrix are close to 0 despite similar training data, indicating that gradient access is required for effective imperceptible attacks and that naive cross-architecture transfer is weak.
Evaluated on
Trained on
Demucs
FSN+
FRCRN
MPSE
Demucs
-1.08
0.04
0.06
0.08
FSN+
0.05
-0.49
0.05
0.08
FRCRN
0.06
0.04
-0.99
0.08
MPSE
0.03
0.03
0.05
-1.25
To give transfer the best possible chance, we additionally performed leave-one-out experiment across three Demucs checkpoints (dns48, dns64, and master64), training on two models and evalu- ating on the held-out model. We also raised the masking threshold back to the original level used in Qin et al. (2019) to further advantage the attacker. As shown in Figure 8, attacks trained on mul- tiple similar models have minor success against held-out mooels--correspondee of speech quality, but not to the point unintelligibilityy and dramatically less success than un- der white-box gradient access. However, attack success does increase with background noise level and reverb, suggesting that environmental masking partially compensates for the loss gradient information.
to a worsening
19

---

No Reverb
Reverb
STOI Enhancement by Model
0.1
Condition
Initial
Attacked
Models
Demucs
-0.2
DNS64
DNS48
50
30 10
70 50
-10
Background SNR
Background SNR
Figure 8: Leave-one-out transfer across Demucs checkpoints. Perturbations optimized on two of the three available Demucs checkpoints (dns48, dns64, master64) and evaluated on the held-out model, using the original masking threshold of Qin et al. (2019). Transfer attacks produce minor degradation that grows with background noise and reverb, but remain far weaker than white-bor box attacks (cf. Figure 1). Curves show ASTOr STOT(clean, outuutt STOT(elean, input); error bars: + standard error over 20 seeds.
D.3 ADJUSTING PERCEPTIBILITY CONSTRAINTS
Setup. In this section, we explore the effect on our objective metrics of adjusting the perceptibility constraint described the main text. We do this primarily by adjusting the masking offset, setting it to either -8 dB (looser), -22 dB (default same as experiments in main text), and -6 dB (tighter. For the 'tighter' setting, we also double the decay constant used post-masking (see Appendix A) to 0.04 ms-1 To simplify presentation, we show results for each constraint setting averaged across the four models. All other experimental details are the same in the main experiments.
Note that, as the experiment shown in the main text, simulated OTA attacks use an effectively looser masking constraint by about d at the end of optimization (via OTA-specific projection- violation tolerance and sasple selection), relative to the other experiments. Furthermore, one simulated over-the-air attack in Figure 13 failed to converge in reasonable amount of time (3 hours on an L40S); we therefore set its final STOI enhancement value to be that of the initial unperturbed input.
Results. We include samples from an attack on moderately noisy, no-reverb speech sample using each of the perceptibility constraints described here https://sites, ttnp:://stes.goolle.ooo woogle.com/view/adee dns/perceptibilltyy Subjective listening evaluation suggests that the looser constraint results in audi- ble crackling in the sample, which goes away completely as the constraints are tightened.
Overall, our objective results suggest that the specific setting of the perceptibility constraint matters much more in relatively low-degradation environments (no reverb and moderate-to-low SNR): see Figures 9 and 10. This is unsurprising, as high-degradation environments naturally offer more space hide the adversarial perturbation. When averaged across environments, though, the setting of the perceptibility constraint makes significant difference in success, though all constraints we test allow substantial success (Figure 1 I)), as measured by metrics other than NISQA and DNSMOS. Interestingly, most metrics (except NISQA) suggest that there is no statistically significant difference in audio quality between attacked inputs under the various constraints, implying that even the loosest constraint damages audio only very slightly.
Unsurprisingly, the white noise defense is proportionally roughly equally effective against attacks under all perceptibility constraints (Figure 12): implied by Figure 11, even the loosest constraint still only allows very slight perturbations, which are therefore largely smoothed out by 15 dB white noise. dB white noise smooths out the signal well, hence its worse performance.)
Finally, we found that the perceptibility constraint had less effect on simulated over-the-air attack success (Figure 13) than directly applied attacks (Figure 9), mostly due to loosening of the
20

---

No Reverb
Reverb
STOI Enhancement (Oulput Inpus)
0.0
-0.2
0.4
Condition (Averag ed]
Detauit (Attacked)
-0.6
Tightar (Attacked)
(Attacked) Initial
-0.8
1.0
Background SNR (dB)
Background SNR (dB)
Figure 9: Untargeted intelligibility degradation across perceptibility constraints. The dashed curve shows the DNS models' baseline STOI improvement ASTOr STOI(clean, output) STOI(clean, input); solid curves show the same quantity after adding an imperceptible pertur- bation. Values flip from to <0 upon addition of adversarial noise across environmental settings, meaning the attack pushes speech from "cleaner than input" to "less intelligible than the noisy input itself." Values are averaged across all four models. Error bars: + standard error over 20 seeds.
No Reverb
Reverb
STOI (Target: Clean) (1)
0.50
0.25
Condition (Averaged)
0.00
Output (Defnclt)
Input (Defash)
0.25
(Tlahter)
Input (ighter)
0.50
Output (Locser)
Ipput (Locser)
-0.75
1.00
Background SNR (dB)
Background SNR (dB)
Figure 10: Intelligibility of injected target audio across perceptibility constraints. We plot Aurget STOI audio) (TOI(,, audio) for the attacked input (dashed) and the DNS output (solid). Positive solid values indicate that the model's output makes a hidden target phrase clearer than the original clean speech, demonstrating successful targeted attack. Targets real utterances from the same speaker as the clean audio. Values are averaged across all four models. Error bars: + standard error over 20 seeds.
constraint not seeming to allow for significantly stronger attacks. We are not certain why this the case; while this phenomenon may be specific to the particular OTA attack optimization algorithm use, may also indicate more generally that convolution with an RIR-which can indeed be con- sidered form smoothing-mas represent defense against adversarial perturbations, including even those which are designed adaptively against that RIR.
D.4 ABLATION: ATTACK PIPELINE COMPONENTS
To isolate the contribution of each component in our perceptibility constraint pipeline, we compare our full method against several simpler alternatives. We fix the environment to 30 dB background SNR with reverb, using the Demucs (master64) model and the speech sample selected by our first seed, and optimize for 5,000 iterations.
21

---

1.0
Normalized Metric (Mean I SE)
0.8
Initial (Default
Attacked (Tighter)
0.6
Output (Tighter)
Attacked (Defaull)
WAV
Output (Default)
Attacked (Loeser)
0.4
Output (Lonser)
STOI
ViSQOL
NISQA
DNSMOS
ASR Acc.
Figure 11: Additional metrics across perceptibility constraints. Normalized values of various speech intelligibility and quality metrics, averaged across all models and environmental settings and 20 seeds, with standard eтror bars. "Output" refers to model output given the attacked input. ASR accuracy is computed as min(WER, 1). Ranges used for normalization were: STOI: [-1, 1]. ViSQOL: [1. NISQA: 50.5]. DNSMOS: [0, 5). ASR accuracy: [0, 1]. ASR ground truth is Whisper applied to clean speech.
WND Effectiveness by Attack Perceptibility
STOI Enhancement (Oulput- Input) (1)
0.0
0.2
-0.4
-0.6
-0.8
-1.0
-1.2
90
60
45
30
15
White Noise Defense SNR (dB)
Undefended (Default)
Undefended (Looser)
WND Defended (Tighter)
Undefended (Tighter)
WND Defended (Default)
WND Defended (Looser)
White noise defense performance by perceptibility constraint. Dashed lines show the DNS models' attacked STOI improvement Asror STOO(clean. output) STOI(clean, input); solid curves show the same quantity when the attacked audio is subjected to Gaussian perturbation, ie., addition of white noise of varying signal-to-noise ratios (SNRs).
Figure 12:
22

---

RIR Untargeted Attack Performance
STOI Enhancement (Output Imput) (1)
0.0
0.2
Condition (Avg.)
Default (Attacked)
-0.4
Tighter (Attacked)
Looser (Attacked)
Initial
-0.6
-0.8
70
10
Background SNR (dB)
Figure 13: Simulated over-the-air attack success across perceptibility constraints. The dashed curve shows the DNS models' baseline STOI improvement ASTOr STOI[clean, output) STOI(clean, input); solid curves show the same quantity after adding an imperceptible perturba- tion, passed through the same room impulse response (RIR) as the original audio itself. Values flip from to <0 upon addition of adversarial noise across environmental settings, meaning the attack pushes speech from "cleaner than input" to "less intelligible than the noisy input itself." Values are averaged across all four models. Error bars: standard error over 20 seeds. Effective OTA masking constraints are about dB looser than in the other experiments.
Methods compared. We compare five constraint strategies:
1. loo -norm in STFT domain (s = 0.04): PGD with simple magnitude bound on the STFT of the perturbation, without any psychoacoustic modeling.
2. f--oorm in STFT domain (s 18): PGD with a global bound on the STFT magnitudes.
3. Frequency masking only (offset -84 dB): psychoacoustic frequency masking thresh- olds withoul temporal pre- and post-masking, with the masking offset calibrated to approx- imately match the attack success of our full method.
4. Frequency masking, no offset (offset 0 OBB) frequency masking without temporal masking and without shifting thresholds below the psychoacoustic model's raw output, corresponding exactly to the constraint used by Qin al. (2019).
5. Full method (offset 122 dB, temporal masking): our complete pipeline, including tem- poral pre- and post-masking ($4.2) and 12 dB threshold reduction.
Calibration procedure. Our full method (5) achieves ASTOr 2 -1.1 at 5,000 iterations. For methods 1-3, we swept over constraint parameters and selected the tightest setting that achieved at least this level of attack success; note that the resulting methods may slightly overshoot. Method 4 uses the original thresholds of Qin al. (2019) without calibration. All methods use the same PGD optimizer, learning rate schedule, and initialization.
Results. All five methods achieve substantial attack success, driving the model's STOI improvement well below zero. The key difference is in how audible the perturbation is. For methods 1-2, the p-norm constraints bear no relation to human perception, and the resulting perturbations- small in norm-contain energy at perceptually salient frequencies and time intervals. Method respects frequency masking thresholds but lacks temporal masking; because temporal pre- and post- masking raises the masking threshold near signal transients (where the ear is briefly less sensitive), omitting reduces the overall perturbation budget. To compensate, the masking offset must be relaxed to 8.4 dB (from - 11 12d to achieve comparable attack success. This 3.6 dB gap quantifies
23

---

the additional perturbation budget that temporal masking provides. Method 4, with threshold reduction at all, achieves the strongest attack (AsTor = -1.4) but produces the most perceptible artifacts. Our full method (5) achieves comparable attack success to the calibrated baselines while keeping the perturbation within the tightest constraint.
We encourage the reader to listen samples from each method https//sitee.ggooll..coo//vvv///
dns/ablation to judge the perceptual differences firsthand.
D.5 REAL RECORDED RIR ROBUSTNESS
To verify that simulated over-the-air results are not artifacts of synthetic RIRs, re-ran attacks using only real, recorded room impulse responses from the OpenSLR28 dataset (Ko et al., 2017), keeping perceptibility constraints identical the main experiments. As shown in Figure 14, the attacks remain effective under real RIRs: STOI is still dramatically damaged (> 0.4 decrease from input) at background SNRs of 30 dB noisier, confirming that the vulnerabilities generalize beyond simulation. Attack success does depend more strongly on the volume of back- ground noise than in the simulated case, likely reflecting the greater acoustic diversity present real recordings.
identify
STOI Enhancement Model (1)
Condition
-0.2
Initial
Attacked
0.4
Models
Demucs
FRCRN
MP Nett
50
10
-10
Background SNR
Figure 14: Over-the-air attack with real recorded RIRs. Same experimental setup as Figure 5, but using only real recorded RIRs from OpenSLR28 rather than mixture of simulated and recorded RIRs. Attacks remain effective, though success depends more on background noise level than the simulated case. Curves show ASToI STOI(clean, output) (cllaclean, input); );; error bars: d: standard error over 20 seeds.
D.6 FIXED-ITERATION SANITY CHECK
As noted in Section 5, our main experiments allocate a different number of PGD iterations to each model that total GPU time is approximately equal. To verify that this choice does not confound the robustness ranking, we rerun the attack with a fixed budget of 5,000 iterations for every model, using the same 20 seeds background SNR 30 dB with reverb. Table reports STOI enhancement (Asroi) before and after the attack.
Table 3: sxxed-iteration sanity check (5,000 iterations per model, SNR -30 dB, reverb). Values mean standard deviation of ASTOr = (TOI output) (TOI(c input) over 20 seeds. Higher (less negative) attacked enhancement indicates greater robustness.
Model
Initial ASToI
Attacked ASTOI
FSN+
+0.035 + 0.022
-0.338 +:: 0. 2.245
FRCRN
+0.057 + 0.024
-1.034 + 0.159
Demucs
+0.031 + 0.041
-1.082 0.183
MP-SENet
+0.036 + 0.040
-1.258 0.102
24

---

The ranking is consistent with the main results: FSN+ remains by far the most robust model, fol- lowed by FRCRN, Demucs, and MP-SENet. These results suggest that FRCRN's robustness relative to Demucs and MP-SENet is not due to slower attack generation.
E ADDITIONAL EXPERIMENTAL DETAILS
E.1 MODEL DETAILS
Demucs. The earliest of the models we study, Demucs-specificall,, the master64 Demucs checkpoint provided in the Denoiser library- is time-domain denoising model with 33.5M (train- able) parameters. Uniquely among the models we study, Demucs operates end-to-end on waveforms, rather than spectrograms: processes the input waveform using several convolutional layers, then encodes temporal dependencies with an LSTM, before decoding again with convolutional layers. Unlike the other models we study, Demucs designed to dereverberate as well as denoise audio.
Full-SubNet+. Full-SubNet+ (FSN+) is TF-domain denoising model with 8.67M parameters. Full-SubNet+ takes magnitude, real, and imaginary spectra as input, and passes them through a variety of modules, including attention, convolution, and LSTMs. Like all TF-domain models we study, Full-SubNett outputs a ratio mask, a complex-valuee spectrogram q such that ý equals the element-wise complex product of and q (Williamson et al., 2016).
FRCRN. FRCRN is TF-domain model with 10.3M parameters. Similar to FSN+, FRCRN uses a mixture of convolutional, attention and recurrent structures in its architecture.
the DNS checkpoint provided in the official GitHub repository- is TF-domain model with only 2.26M parameters. Similar to FSN+ and FRCRN, MP-SENet also uses convolution, attention and recurrence for temporal modeling.
MP-SENet. MP-SENet
Note that, mentioned in the main paper, MP-SENet used unusually large amount of memory in our experiments, forcing us to curtail its input audio to seconds. note was later added to the MP-SENet README explaining that this is due bug the behavior of the model with default arguments, and can be solved with alternative arguments; unfortunately, this note was added after ran our experiments, so our experiments still curtail MP-SENet's input audio.
E.2 OTHER EXPERIMENTAL DETAILS
Dataset. Noise was selected randomly from the dataset and repeated up to ten seconds. All audio was sampled single-channel at 16 bits and 16 kHz. All settings had five sources of background noise added to them, with their post-RIR sum being set to various SNRs with respect to the post-RiR clean speech. (While five is a large number of sources, note that dB SNR still represents an effectively zero-noise setting.)
Optimal perturbation selection. Within each trial, the final output was selected as the perturbation with the lowest final loss-i.c STOl(ou clean) for untargeted attacks, and STOI(output, clean) (Totuut target) for targeted attacks. For over-the-air attacks where not every attack iteration converged to the feasible set, we instead selected the final output, as earlier outputs might not satisfy the final masking threshold (see Appendix C).
STFT. We use short-time Fourier transforms with Hann windows, 512 FFT points, window length of 512, and a hop length of 256.
Optimization Details. In all experiments except the simulated over-the-air experiment, we parame- terize& 8 in the time domain. We use Adam for all optimization, using an initial learning rate of 0.01, and clip gradients to a 2-norm of 10. We decrease the learning rate by factor of 0.99 whenever the loss fails to decrease for 10 iterations in a row.
Hyperparameter selection. Our hyperparameters tive evaluation (by us) of attack perceptibility and attack success.
selected by hand through extensive subjec-
Computation resources. For all experiments, we used a GPU with at least 40 GB of VRAM (gen- erally an A40, A100, or L40S), 8 CPU cores, and 40 GB of RAM. Except where noted, experiments took less than 2 hours with this setup.
25

---

F HUMAN STUDY DETAILS
F.I DESIGN AND COUNTERBALANCING
Transcription comprised 18 clips per participant: for each {model} x {background> x (stimulus type) combination we included one clip, where stimulus types were (Attacked Input) noisy+reverberant speech with imperceptible perturbation, (Clean Output) model output for clean input, and (Attacked Output) model output for attacked input. To avoid leakage and learning effects, no clip was reused across stimulus types for the same participant. ABX comprised 12 pairs per participant constructed from the attacked-input and unattacked-input pools. We also included two ABX attention checks with clearly audible degradations: these followed the same design as the primary samples, except their attacks were generated with a positive masking threshold offset of 16.0 (other attacks in the human study used negative offset of -16.0.. Clip identities were fixed across participants to standardize difficulty and reduce computational burden.
The second seed (sample) out of 20 was manually omitted from the study due being nearly- unintelligible whispering. Otherwise, for simplicity, assignment of seeds to (model, stimulus type, background) configurations was done through iteration using that hierarchy: iterating from 0, 2. 3, .... 18, we changed background every seed, stimulus type every two seeds, and model every six seeds.
F.2 STATISTICS
Let p P index participants and I index items (clips). For the transcrip- tion task, let Ypi.c E [0 denote the word accuracy (WAce) for condition c E {Attacked Input (Al), Clean Output (CO), Attacked Output (AO)) on the (p, cell (observed when that participant transcribed that clip under that condition). Let pa. = E[yp be the population mean WAcc for condition
Two-way ("pigeonhole") bootstrap for crossed effects. To obtain CIs that respect crossed par- ticipant-item variance (Owen, 2007), we independently resample participants and items with placement. On each bootstrap replicate = 1,..., B, draw counts 0,60) for E P from (uttinomial(PP::1PPPP and vi(0) for i I analogously; form replicate weights w
T/ v,()) For any condition the replicate mean is
y=(1) E(PNED. W:(h) pi Ypi,e
E(p.)EDD ((()) pi
where De S I the set of observed cells under (missing cells receive weight 0 by construc- tion). Percentile one-sided (1 a) CIs use the empirical quantiles of {Y= (b)) LB Jb=1
Primary claim via intersection-union test (IUT). We test that the attacked output is simulta- neously less intelligible than both the attacked input and the clean output:
Ho (A 2 0) (A2 2 0) vs
H, : (Ai 0) and (A2 < 0),
where the mean differences are A = 14A - MAi and A₂ = Mww Pco- By the IUT, an overall level-a test rejects Ho iff each elementary one-sided test rejects at level a. Operationally, using the two-way bootstrap, compute the (1 a) upper percentile bounds
Up Quantile )mm)
Ax ---()) yo(0) k (1,2).
with (.) = AI for = and (.) = CO for k = 2. Reject Hy (and conclude AO is worse than both) iff U1 < 0 and U2 < 0. In our data, the 95% upper bounds were U1 -0.464 and U2 -0.458,
yielding rejection. Note that, by construction, the IUT does not need multiple-comparison cor- rection.
ABX discrimination. Let Zps E 1] indicate whether participant p correctly identified the attacked clip in pair i. We test Ho : MABX < 0.5 H1 Maax 0.5, where MABX E[Zp.]- Using the same two-way bootstrap on {Zpz), form the lower one-sided (1 - a) percentile bound for man and reject Hg iff L 0.5. Our lower 95% bound was L 0.478, we did not reject.
26

---

Table External assets (excludes standard Python libraries installed with pip, versioning for which is included in the code's requiremente txt).
Asset
Authorship/ / citation
License
Version commit
Special terms of
openai-
Radford et al. (2022);
MIT
v20240930 /
None heyond MIT
Whisper
90db0de
MP-SENet
Lu et al. (2023);
MIT
611cd89
None beyond MIT
Denoiser
Defossez et al. (2020);
MIT
8afd7c1
None beyond MIT
FRCRN
Zhao al. (2022)
Apache-2.0
6341004
None beyond Apache-
(ClearerVoice-
Studio)
MaskGCT
Wang al. (2024a)
MIT
f7cb4b4
None heyond MIT
(Amphion)
DNS-
Dubey et al. (2022);
CC-BY-4.0 (data), MIT (code)
4dfd2f6
Attribution required for datasct
Challenge (datasets code)
DNSMOS
Reddy et al. (2022); same repo/commit as above
CC-BY-4.0 (data), MIT (code)
4dfd2E6
Attribution required
P.835
FullSubNet-
Chen al. (2022);
Apache-2.0
0d11530
None beyond Apache-2.0
Plus
NISQA
Mittag et (2021);
MIT
fe84f0f
None beyond MIT
ViSQOL
Hines et al. (2015);
Apache-2.0
b2b2a64
None beyond Apache 2.0
ViSQOL
jonashaag/visqol, Docker Hub; https:://////t... //hub. do cker. www/o//////////oo jonasha ag/ ag/visqol
Not declared
'v3'
Used only for build con- venience; inherits up- stream license
Docker image
(container redistributes ViSQOL Apache-2.0)
G LICENSE DETAILS
See Table 4.
27


Reviews:
[{"review_id": "nfBOLGPGSq", "reviewer": "Reviewer_GHmU", "summary": "This paper examines the adversarial robustness of speech denoising models. To do so, the authors simulate adversarial attacks using the projected gradient descent method on otherwise clean speech recordings that have had environmental noise and reverberation synthetically added to them. The paper finds that very subtle adversarial perturbations can cause denoising models to not only fail to denoise the speech, but rather produce outputs that are significantly less intelligible than the noisy speech that was provided as input. To verify the subtlety of the adversarial attacks, the authors conducted a human study, in which they found that the intelligibility of the speech post-attack was not noticeably degraded, and humans could not usually discriminate the attacked speech from unattacked speech.", "questions": "1. Why was it important to assume that the background noise and reverb for UAP are the same across speech samples?", "limitations": "", "rating": 4, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "1. Mostly clear presentation\n2. Technically sound methodology. I appreciate the comprehensive measurement of intelligibility\n3. I appreciate the human study as it grounds the work in reality.\n4. Novel work and significant results. This paper fills the gap in the current literature regarding the robustness of speech denoising models and the results show that these models are indeed susceptible to attacks. The novelty and originality of the work are enhanced by the masking and RIR aware attack framework proposed by the authors, and the enhancements to the masking attack methodology of Qin, et. al 2019.", "weaknesses": "1. My primary concern with this paper is that the experiments are not rigorous and leave many important questions unanswered, without which limits the contribution and impact of the work.\n    1. Black-box attacks were not used which limits the reliability of the results for at least 1 out 4 models in the current paper. Without black-box attacks it is not possible to answer question (f) from section 5. I recommend including 1 black-box attack\n    1. UAP generated in the multi-model scenario. It is well documented that optimizing the adversarial perturbation over multiple models leads to increased transferability. I would suggest doing a leave-one-out study, in which the UAP is optimized over 3 models and is used to attack the 4th model.\n    1. Gaussian noise is posed as a defense but adaptive attacks are not used. As such, there is insufficient evidence to draw any conclusions from this experiment. I would suggest either trying adaptive attacks or removing this section.\n    1. Effective defenses like, adversarial training or randomized smoothing should have been evaluated to show the trade off between robustness and accuracy.\n    1. The proposed attack aware framework is a key contribution of this work, but it is not thoroughly evaluated in the paper. I would recommend adding ablation experiments that demonstrate the increased imperceptibility of the perturbation generated by the proposed method, and increased attack success as measured by change in STOI, when compared to the vanilla PGD attack, and the masking-based attack from Qin, et. al 2019.\n    1. Answer to question (c) is not found in the paper. The only relevant comment is the contributions listed in the introduction and I am not very convinced by it. It is obvious and well known that without gradient flow white-box attacks will not succeed, so this is not really a contribution. Authors claim that model size and input features do not matter, but I did not see any results in the main body to show this. \n1. Some experimental detail is missing and some settings are questionable:\n    1. It is not mentioned how many speech samples were used in the evaluations\n    1. The decision to determine the number of attack iterations based on the GPU time is unusual and unjustified. This introduces a confounding factor in the results. Keeping FSN+ aside, FRCRN appears to be the most robust model, but it is also the model that is evaluated against the least attack steps.\n1. Some presentation issues:\n    1. Figures need to be rearranged so that they appear _after_ they are referenced. Also, Figure 2 and Figure 3 and in the wrong order.\n    1. Answers to at least 4/9 are not present in the main body of the paper. If these questions are unimportant they shouldn't be included in the list, otherwise the should be treated in sufficient detail in the main body.\n    1. Figure 3 a and b should be separate figures\n    1. Add equation for the objective in section 4.4", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "hyC11pctcv", "reviewer": "Reviewer_zfRF", "summary": "The paper investigates whether modern DNS models are vulnerable to attack. The main finding is that they are highly vulnerable. The authors showed they could use psychoacoustically hidden noise to make the output of DNS gibberish. This noise is crafted to be imperceptible to the human ear, but it completely tricks the DNS models.", "questions": "- Can the over-the-air attack stand perturbations beyond RIR.\n- Can the attack be made to lead the DNS models to output meaningful sentence?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The paper is the first systematic study to show that DNS models are vulnerable to imperceptible adversarial attacks.\n- The paper considers over-the-air attack by incorporating RIR which makes the attack more practical.\n- The presentation of the paper is clear and easy to follow.\n- The authors use human raters to confirm the conclusion that the attacked audios are non-intelligible.", "weaknesses": "- The motivation example in the introduction section feels a little artificial to me. Attacks are expensive and mostly happens when highly incentivized. I am not seeing the incentive of attack in the given scenario.\n\n- The over-the-air attack design only considers RIR so the found adversarial noise might not be robust to other perturbations in real life like compression loss, background noise, etc. It'd be helpful to incorporate such consideration into the attack as well. Example can be found in [1].\n\n- The attack only leads the DNS models to output gibberish instead of a targeted meaningful sentence. This limits the severity of the attack.\n\n- The attack works best when the noise is designed for a given utterance which also limits the flexibility of the attack.\n\n[1] Attacker's Noise Can Manipulate Your Audio-based LLM in the Real World.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "dDzqPIEqrT", "reviewer": "Reviewer_s9Ds", "summary": "Summary: \n\nThis paper studies the impact of adversarial attacks on DNS systems, which can cause several safety concerns. 4 open-source DNS models are evaluated and 2 types of adverbial attacks are studied (i.e., additive and convolutional).Through extensive experiments, the authors have found out that all DNS systems are prone to adversarial attack. While this paper is the first to address the problem under a DNS setting, the results are quite trivial since most DNNs (to the best of my knowledge) are prone to adversarial attack.", "questions": "Questions, Strengths and Weaknesses: \n\n1. Extensive experiment setups and follows ethical guidelines. \n2. An psychoacoustic auditory masking approach is first proposed and applied as adversarial attack. This is a novel approach and hypothesises that DNN may follow basic psychoacoustic principles. However, the effect of the proposed method is not included in the main text, but only in Appendix D.3. What are the advantages of using auditory masking as compared to black-box attacks / simply adding gaussian noises? \n3. Real-world speech signals covers a wider range of scenarios (for instance UHF-transmitted speech: [1] DENT-DDSP, Guo et.al, Interspeech 2023). I would encourage the authors to include these more general cases in the introduction or at least limits the scope of the paper.", "limitations": "", "rating": 2, "confidence": 3, "soundness": 2, "presentation": 4, "contribution": 1, "strengths": "See Section Questions", "weaknesses": "See Section Questions", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "KclvgIBGPd", "reviewer": "Reviewer_Eoer", "summary": "This is an interesting work that delves into the impact of adversarial noise on current speech denoising models. The authors claim that adversarial perturbations can impact the perceptual quality and lexical content of speech, where multiple speech denoising models were considered.\n\nThe paper is well motivated and the clearly written. However, the motivation part can be elaborated a bit more to illustrate the broader impact of adversarial attacks on DNS models. While one of the application cited is hearing aids which is relevant and useful to be aware, but are there possible applications where the impact of adversarial attack can be overwhelming? \n\nThe analysis shared is clearly explained and the choice of the metrics used are also clearly detailed.", "questions": "(1) In page 6, the paper specifies: \"Audio was clipped to five second ...\" \n>> Would this time constraint assumption have an impact on the intelligibility of the data? How would this time constraint impact possibly the metrics used in this work.\nFor longer speech segments, would the observations made in this work still hold?\n\n(2) In page 7, the paper says: \"Figures 1 and 5 suggest that FSN+ ...\"\n>> Figure 5 is in appendix, perhaps that needs to be clearly specified.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "The paper provides a deeper analysis of the impact of adversarial attacks on deep noise suppression models. The steps used in the analysis are clearly explained and the results are well illustrated. The paper also clearly outlines the contribution of the work and cites prior work and explains how this work is different than the prior work.\n\nThe results presented are convincing, specifically having human evaluations with subjective metrics and comparing that with objective metrics makes the observations made in this paper more convincing.", "weaknesses": "The motivation of the paper can be improved beyond what is stated already. One of the example the paper cites is hearing aids, where the adversarial attack can have severe impact. Are there other applications, that are more widely used, that may suffer from such attacks? \n\nThe observations made in this work can also inform what type of evaluation needs to be considered in the future for researchers working in the area of DNS models, which again can be yet another motivation.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "pLYbQvB0hJ", "reviewer": "Reviewer_N6bJ", "summary": "This paper presents a systematic study showing that modern deep noise suppression (DNS) models can be driven to produce unintelligible outputs via psychoacoustically hidden adversarial perturbations, including experiments in simulated over-the-air settings and a small human study validating imperceptibility and output unintelligibility. The authors develop a masking-aware PGD attack (with STFT-space clipping and RIR-aware optimization via Wiener deconvolution / gradient projection), evaluate four open-source DNS models across a range of SNRs and reverberation conditions, examine targeted vs. untargeted attacks, explore (limited) universal perturbations and defenses (Gaussian noise), and provide mechanistic analysis about gradient behavior and transfer failure; code and audio examples are promised", "questions": "What concrete aspects of DNS architectures or objectives make attacking DNS fundamentally different from attacking ASR or speaker models, beyond changing the loss to STOI? Could the authors highlight DNS-specific failure modes exploited by the attack?\n\nHave the authors attempted any black-box strategies (surrogate ensemble, score-based queries, or transfer from ensembles) to assess attacker capabilities without gradient access? If not, can they comment on expected barriers and potential approaches?\n\nIn the simulated over-the-air experiments, which components of the capture chain are modeled beyond the RIR? Specifically, were speaker and microphone frequency responses, A/D front-end filtering, microphone directivity, or codec effects considered or varied? If not, how do the authors expect these factors to change attack success?\n\nDo the authors foresee a streaming/real-time attack implementation where the perturbation is produced or injected online with limited lookahead (e.g., frame-by-frame)? If so, what would the constraints be (latency, buffer size, computational cost), and if not, can the authors quantify how much offline optimization is needed per second of audio?\n\nGiven the observed weak transfer across architectures, can the authors recommend practical defenses (beyond Gaussian noise) that exploit that architectural brittleness—for example, randomized pre-processing, ensembling, or input augmentation at inference time?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Clear motivation and high practical relevance. The paper motivates DNS as a high-impact target (video conferencing, hearing aids, alert systems) and illustrates realistic safety concerns where small, imperceptible perturbations could deny access to critical audible information. This real-world framing is consistently maintained throughout the experiments and human study.\n\nMethodological thoroughness within scope. The attack pipeline is well specified: STOI is used as an optimization objective, psychoacoustic masking thresholds (with temporal pre/post masking and tightened offsets) define the imperceptibility constraint, and a combination of Wiener deconvolution and gradient-based projection is used for simulated over-the-air attacks. The optimization and perceptual-constraint details are carefully described in Methods and Appendices.\n\nComprehensive empirical evaluation and human validation. The authors attack four modern, publicly available DNS models, sweep SNR and reverberation conditions, run simulated OTA experiments, test perceptibility settings, and run a human transcription + ABX study to corroborate automatic metrics—providing a multi-pronged empirical case.", "weaknesses": "The paper does not clearly articulate what is uniquely challenging about attacking DNS models beyond choosing an intelligibility loss (STOI) and applying psychoacoustic masking; much of the pipeline (masked PGD, RIR modeling, use of STOI) repurposes known techniques from ASR / audio adversarial work, and the manuscript should more explicitly explain any DNS-specific obstacles or mechanisms that make these attacks nontrivial for this class of models.\n\nThe work only studies white-box attacks and reports that naive transfer between model checkpoints and architectures is weak; there is no developed black-box attack (e.g., surrogate-ensemble training, query-based gradient estimation, or adaptive transfer techniques), leaving open the practical threat model where attackers lack direct gradient access to the target DNS.\n\nThe over-the-air experiments use simulated RIRs and treat the RIR as known during optimization, but the paper omits discussion and evaluation of other physical observation chain factors that significantly affect real OTA success, most notably speaker and microphone frequency responses, microphone directivity, amplification/attenuation non-linearities, A/D front-end filtering, and typical codec/compression applied by capture devices. These unmodeled effects can substantially change received perturbation spectra and thus attack efficacy, yet they are not specified or empirically varied.\n\nThe paper focuses on per-utterance offline optimization (with many iterations per sample chosen to fill about an hour of GPU time per trial) and does not address real-time / streaming attack feasibility. DNS systems commonly operate frame-by-frame with low latency; the manuscript lacks analysis of whether a perturbation can be injected in a streaming fashion (per frame or with limited lookahead) and still achieve the same destructive effect.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)