# Evading Logits-Based Detections to Audio Adversarial Examples by Logits-Traction Attack
## 3 Proposed Method
### Logits Value of Adversarial Examples  
To visually show the difference in logits between the original speech and adversarial examples, this paper plots a three-dimensional representation of the logits of the original speech and adversarial examples derived from it. As shown below, the frame axis in the figure represents the MFCC frame of the speech vector. The number of coordinate points on this axis is proportional to the length of the speech audio. The class axis represents probability distribution, where the model decodes each frame into all characters, and that probability is unnormalized. The value axis represents the specific value of the above possibility. The class that has the maximum value in each frame is transcribed characters. So the transcription task can also be considered a frame-by-frame classification task. Below (a) are the logits of the original speech whose transcription result is \"and you know\", and (b) are the logits of the C&W adversarial example generated based on the above original speech and whose transcription result is \"This is a test\". The logits were output by the DeepSpeech model. This paper connects these points as surfaces to better show their changing process.  
Figure 3a depicts the logits value of the original speech sequence, and Figure 3c depicts the raw signal of the original speech. In it, frames 0 to 35 represent silence. The \"blank\" characters (denoted by \"-\", the last column in 3.a class axis) score significantly higher than other classes, indicating that DeepSpeech is highly confident that these frames are transcripted to \"blank\". Frames 35 to 80 are the stages of human vocalization. In these stages, each frame column has a better value on only one category, with logit values that are much lower and less changeable for other classes. In the original speech, the confidence of \"blank frame\" and \"decision frame\" is generally higher. The Figure 3b represents the adversarial example, except for the \"blank\" class in the \"blank frame\", which has a more significant logit value. All other logit values are minor. In the \"decision frame\", each frame column has multiple large values, and DeepSpeech only recognizes them as the target transcription with weak confidence.  
Figure 3: Logits of the original speech (a), adversarial example (b) and raw speech signal (c).  
To quantify this difference numerically, [PERSON] et al. proposed a detection method based on the \"distribution of the difference between the maximum value of logit and the second largest value\" by adding Gaussian noise to the logits. Their method assumes that frames with a minor difference are more susceptible to maximum bit reversal when the noise follows the same distribution, leading to altered transcription results. As shown in Figure 3, the speech with more altered transcriptional effects after adding noise is more likely to be an adversarial example. After calculating the number of erroneous characters caused by adding noise to the logit, the error threshold can be determined at a statistical level, and speech adversarial example detection independent of the network structure is implemented.  
This paper defines the degree of disparity between the values of the classes in the \"decision frame\" of logits as the logit dispersion. In dense logits, it is sufficient to calculate by the values of \"decision frames\" that have the potential to affect the final transcription result. However, in sparse logits, the values of the \"blank\" pseudo-characters class in all \"decision frames\" must be removed.