# Evading Logits-Based Detections to Audio Adversarial Examples by Logits-Traction Attack
## 3 Proposed Method
### Logits-Traction Adversarial Example Generation
#### 3.3.3 Logits-Traction Loss Function  
In both image and audio, generating adversarial examples against a white-box model can be considered as updating \(\delta\) via gradient descent [34; 35] on a predefined loss function:  
\[\mathcal{L}(x,\delta,t)=\updownarrow_{model}(f(x+\delta),t)+c\cdot\updownarrow _{metric}(x,x+\delta) \tag{2}\]  
where \(\updownarrow_{model}\) denotes the loss function of the target model and \(\updownarrow_{metric}\) denotes the distortion measure function. Parameter \(c\) weighs the relative importance of achieving adversarial attacks and reducing adversarial perturbations.  
Due to the interframe interaction and the additional decoding steps in ASR, it is not easy to construct a loss that corresponds to the optimization objective.  
Since the improvement of the loss does not need to consider the interaction between frames and additional decoding steps, the literature designs a loss function term, that improves the attack efficiency and the robustness of adversarial examples. Our method draws on this and aims to construct adversarial examples with new features. In our method, the optimization objective is extended as follows:  
\[\mathcal{L}(x,\delta,t)=\updownarrow_{model}(f(x+\delta),t)+c_{1}\updownarrow_{ logit\_gap}\Big{(}f_{logits}(x+\delta)\Big{)}+c_{2}\updownarrow_{metric}(\delta) \tag{3}\]  
In the process of backpropagation, this loss function generates \(\Delta\delta\) that achieves target transcription while producing a minimal \(\updownarrow_{logit\_gap}\). The formal description of \(\updownarrow_{logit\_gap}\) will be elaborated below.  
Our optimization objective is composed of the following three components:  
1. \(\updownarrow_{model}\) denotes the original loss function used in the ASR model. The loss of sparse logits is CTC-Loss, and the loss of dense logits is cross-entropy loss function. Using the same loss function as the original model to generate adversarial examples is based on the following observation: \[\updownarrow_{model}(f(x+\delta),t)\leq 0\Rightarrow f(xt)=t\] (4)
2. \(\updownarrow_{logit\_gap}\) measures the logits value gap of the original output, calculates the difference between the maximum value and the second-highest value in all categories for each frame, and then adds these values together. The specific calculation method is shown in Algorithm 1.  
```
Input:\(f_{logits}(x+\delta)\) \(\big{(}logits\ \in\mathbb{R}^{(b,n,m)}\big{)}\), the original output of the adversarial example \(x+\delta\) passing through the ASR model during each iteration. Output:\(gap\_sum\), a vector describing the intra-frame difference of logits.
1. initialize\(gap\_sum\)
2. for\(i=0:b\)
3. initialize\(gap\)
4. for\(j=0:n\)
5. \(fst\_class=max\big{(}logits^{(i,j_{:})}\big{)}\)
6. set\(argmax\big{(}logits^{(i,j_{:})}\big{)}=0\)
7. \(scd\_class=max\big{(}logits^{(i,j_{:})}\big{)}\)
8. \(gap+=scd\_class-fst\_class\)
9. \(gap\_sum[i]=gap\)
10. return\(gap\_sum\)
```  
**Algorithm 1**\(logit\_gap\) Measurement Method  
where \(b\) denotes batch_size, \(n\) denotes frames, and \(m\) denotes classes; \"0:\(b\)\" means traversing over values from 0 to \(b\), and \":\" means it traverses all the values of the dimension in symbol resides (_ie._ 0 to \(b\)). A smaller \(\updownarrow_{logit\_gap}\) means that the neural network has higher confidence in the current transcription result.  
3. \(\updownarrow_{metric}\) measures adversarial perturbations, and it is defined as: \[\updownarrow_{metric}(\delta)=\sum_{i=0}^{n}\delta_{i}^{2}\] (5)  
This paper adds the term \(\updownarrow_{logit\_gap}\) to filter the C&W adversarial examples further. This may make the adversarial perturbations satisfy both constraints, resulting in speech distortion. Therefore, \(\updownarrow_{metric}\) is added to limit the disturbance by penalizing adversarial perturbations with large absolute values.