# Evading Logits-Based Detections to Audio Adversarial Examples by Logits-Traction Attack
## 3 Proposed Method
### Logits Type in the ASR Model  
Logits are a vector that represents the raw outputs [27] of the neural network. In the model performing the image classification task, logits are one-dimensional sequences followed by a SoftMax layer [28]. In the ASR task, the output of RNN is logits [29]. It is a two-dimensional vector, which is usually transcribed into a character vector or word vector using beam search decoding and then assembled into a complete sentence.  
In practice, the logits structure of the ASR model [13; 30] can be represented as [batch_size, frames, classes], where \"batch_size\" represents the number of speeches in each iteration. \"Frames\" represents the number of frames of each speech, and is dependent on the length of the speech sequence and the MFCC window size. \"Classes\" represents the categories into which each frame may be transcribed.  
In character-level transcription (Figure 1(a)), \"A-Z\", \"Space\", and \"Blank\" pseudo-characters (represented by \"-\") are included in the transcription classes. \"Blank\" means no characters and can only be used to separate two characters. For differentiation, this paper refers to the frames with the highest value in the \"Blank\" category as the \"blank frame\" (frame 4, 5, and the last frame on Figure 1(a)), and the remaining frames are called the \"decision frame\". In the process of generating adversarial examples, the conversion between \"blank frame\" and \"decision frame\" is more accessible than that between \"decision frame\" and \"decision frame\". Meanwhile, it tends to get a more significant intra-frame difference. This paper defines the logits structure of alternating \"blank frame\" and \"decision frame\" as sparse logits. ASR models using CTC loss functions, such as DeepSpeech [13], typically includes sparse logits. During the optimization of adversarial examples, the inter-frame interactions of the sparse logit are minimal, and the faults generally are exhibited as mis-transcribed characters in words.  
In word-level transcription (Figure 1(b)), the transcribed classes are related to specific models, including all labelled words and word roots from the training data. The transcription of succeeding frames requires the results of the previous frames, and the output of the last state in the RNN network contains the logits information of the whole speech sequence. In this logits type, the first \(d\) \"decision frames\" (\(d=4\) on the Figure 1(b)) determine the transcription result of the speech with a substantial intra-frame difference. In contrast, the subsequent \(frames-d\) frames are meaningless \"blank frames\" with a near-zero intra-frame difference. This paper defines such logits with distinct bounded frames as dense logits. Dense logits are included in ASR models such as Lingvo [30] that employ cross-entropy loss functions. Its incorrect transcription results can only originate from classes, and the mistakes are presented as successive words or root transcription errors.  
Therefore, the distribution of blank frames in dense and sparse logits is significantly different. The blank frame cannot effectively affect the transcription result compared to the character frame. More weight should be given to the character frame to improve the  
Figure 2: The schematic diagram of sparse logits (**a**) and dense logits (**b**).  
detection accuracy. Indeed, the logit distribution of original speech and adversarial example are more different in these frames.