Patent Description:
This disclosure generally relates to automated speech processing.

The reality of a speech-enabled home or other environment - that is, one in which a user need only speak a query or command out loud and a computer-based system will field and answer the query and/or cause the command to be performed - is upon us. A speech-enabled environment (e.g., home, workplace, school, etc.) can be implemented using a network of connected microphone devices distributed throughout the various rooms or areas of the environment. Through such a network of microphones, a user has the power to orally query the system from essentially anywhere in the environment without the need to have a computer or other device in front of him/her or even nearby. For example, while cooking in the kitchen, a user might ask the system "how many milliliters in three cups?" and, in response, receive an answer from the system, e.g., in the form of synthesized voice output. Alternatively, a user might ask the system questions such as "when does my nearest gas station close," or, upon preparing to leave the house, "should I wear a coat today?".

Further, a user may ask a query of the system, and/or issue a command, that relates to the user's personal information. For example, a user might ask the system "when is my meeting with John?" or command the system "remind me to call John when I get back home.

For a speech-enabled system, the users' manner of interacting with the system is designed to be primarily, if not exclusively, by means of voice input. Consequently, the system, which potentially picks up all utterances made in the surrounding environment including those not directed to the system, must have some way of discerning when any given utterance is directed at the system as opposed, e.g., to being directed at an individual present in the environment. One way to accomplish this is to use a "hotword", which by agreement among the users in the environment, is reserved as a predetermined word or words that is spoken to invoke the attention of the system. In an example environment, the hotword used to invoke the system's attention are the words "OK computer. " Consequently, each time the words "OK computer" are spoken, it is picked up by a microphone, conveyed to the system, which may perform speech recognition techniques or use audio features and neural networks to determine whether the hotword was spoken and, if so, awaits an ensuing command or query. Accordingly, utterances directed at the system take the general form [HOTWORD] [QUERY], where "HOTWORD" in this example is "OK computer" and "QUERY" can be any question, command, declaration, or other request that can be speech recognized, parsed and acted on by the system, either alone or in conjunction with the server via the network.

This disclosure discusses an audio watermarking based approach to distinguish rerecorded speech, e.g. broadcasted speech or text-to-speech audio, from live speech. This distinction enables detection of false hotwords triggers in an input comprising rerecorded speech, and allows the false hotword trigger(s) to be suppressed. Live speech input from a user will not, however be watermarked, and hotwords in a speech input that is determined not to be watermarked may be not suppressed. The watermark detection mechanisms are robust to noisy and reverberant environments and may use a convolutional neural network based detector which is designed to satisfy the goals of small footprint, both memory and computation, and low latency. The scalability advantages of this approach are highlighted in preventing simultaneous hotword triggers on millions of devices during large viewership television events. An example of an approach for preventing the accidental wake up of a voice interface using a captured hotword is provided in <CIT>.

Hotword based triggering may be a mechanism for activating virtual assistants. Distinguishing hotwords in live speech from those in recorded speech, e.g., advertisements, may be a problem as false hotword triggers lead to unintentional activation of the virtual assistant. Moreover, where a user has virtual assistants installed on multiple devices it is even possible for speech output from one virtual assistant to contain a hotword that unintentionally triggers another virtual assistant. Unintentional activation of a virtual assistant may generally be undesirable. For example, if a virtual assistant is used to control home automation devices, unintentional activation of the virtual assistant may for example lead to lighting, heating or air-conditioning equipment being unintentionally turned on, thereby leading to unnecessary energy consumption, as well as being inconvenient for the user. Also, when a device is turned on it may transmit messages to other devices (for example, to retrieve information from other devices, to signal its status to other devices, to communicate with a search engine to perform a search, etc.) so that unintentionally turning on a device may also lead to unnecessary network traffic and/or unnecessary use of processing capacity, to unnecessary power consumption, etc.. Moreover, unintentional activation of equipment, such as lighting, heating or air-conditioning equipment, can cause unnecessary wear of the equipment and degrade its reliability. Further, as the range of virtual assistant -controlled equipment and devices increases, so does the possibility that unintentional activation of a virtual assistant may be potentially dangerous. Also, unintentional activation of a virtual assistant can cause concerns over privacy.

According to innovative aspects of the subject matter described in this application, a method according to independent claim <NUM>, an apparatus according to independent claim <NUM> and a non-transitory computer-readable storage medium according to independent claim <NUM> are provided. Preferred embodiments are provided as set forth in the dependent claims.

Particular implementations of the subject matter described in this specification can be implemented so as to realize one or more of the following advantages. A computing device may respond to hotwords included in live speech while not responding to hotwords that are included in recorded media. This can reduce or prevent unintentional activation of the device, and so save battery power and processing capacity of the computing device. Network bandwidth may also be preserved with fewer computing devices performing search queries upon receiving hotwords with audio watermarks.

In the drawings, like reference numbers represent corresponding parts throughout.

<FIG> illustrates an example system <NUM> for suppressing hotword triggers when detecting a "hotword" in recorded media. Briefly, and as described in more detail below, the computing device <NUM> outputs an utterance <NUM> that includes an audio watermark <NUM> and an utterance of a predefined hotword <NUM>. The computing device <NUM> detects the utterance <NUM> and determines that the utterance <NUM> includes the audio watermark <NUM> by using an audio watermark identification model <NUM>. Based on the utterance <NUM> including the audio watermark <NUM>, the computing device <NUM> does not respond to the predefined hotword <NUM>.

In more detail, the computing device <NUM> is playing a commercial for Nugget World. During the commercial, an actor in the commercial says the utterance <NUM>, "Ok computer, what's in a nugget?" The utterance <NUM> includes the hotword <NUM> "Ok computer" and a query <NUM> that includes other terms of "what's in a nugget?" The computing device <NUM> outputs the utterance <NUM> through a loudspeaker. Any computing device in the vicinity with a microphone is able to detect the utterance <NUM>.

The audio of the utterance <NUM> includes a speech portion <NUM> and an audio watermark <NUM>. The creator of the commercial adds the audio watermark <NUM> to ensure computing devices that detect the utterance <NUM> do not respond to the hotword <NUM>. In some implementations, the audio watermark <NUM> may include audio frequencies that are higher or lower than the human hearing range. For example, the audio watermark <NUM> may include frequencies that are greater than <NUM> or less than <NUM>. In some implementations, the audio watermark <NUM> may include audio that is within the human hearing range but is not detectable by humans because of its sounds similar to noise. For example, the audio watermark <NUM> may include a frequency pattern between <NUM> and <NUM>. The strength of different frequency bands may be imperceptible to a human, but may be detectable by a computing device. As illustrated by the frequency domain representation <NUM>, the utterance <NUM> includes an audio watermark <NUM> that is in a higher frequency range than the audible portion <NUM>.

In some implementations, the computing device <NUM> may use an audio watermarker <NUM> to add a watermark to speech data <NUM>. The speech data <NUM> may be the recorded utterance <NUM> of "Ok computer, what's in a nugget?" The audio watermarker <NUM> may add a watermark at periodic intervals in the speech data <NUM>. For example, the audio watermarker <NUM> may add a watermark every two hundred milliseconds. In some implementations, the computing device <NUM> may identify the portion of the speech data <NUM> that includes the hotword <NUM>, for example, by performing speech recognition. The audio watermarker <NUM> may add periodic watermarks over the audio of the hotword <NUM>, before the hotword <NUM>, and/or after the hotword <NUM>. For example, the audio watermarker <NUM> can add three (or any other number) watermarks at periodic intervals over the audio of "ok computer.

The techniques for adding a watermark <NUM> are discussed in detail below with respect to <FIG>. In general, each watermark <NUM> is different for each speech data sample. The audio watermarker <NUM> may add an audio watermark every two or three hundred milliseconds to the audio of utterance <NUM> and add a different or the same audio watermark every two or three hundred milliseconds to audio of the utterance, "Ok computer, order a cheese pizza. " The audio watermarker <NUM> may generate a watermark for each audio sample such that the watermark minimizes distortion of the audio sample. This may be important because the audio watermarker <NUM> may add watermarks that are within the frequency range that humans can detect. The computing device <NUM> may store the watermarked audio samples in the watermarked speech <NUM> for later output by the computing device <NUM>.

In some implementations, each time the computing device <NUM> outputs watermarked audio, the computing device <NUM> may store data indicating the outputted audio in the playback logs <NUM>. The playback logs <NUM> may include data identifying any combination of the outputted audio <NUM>, the date and time of outputting the audio <NUM>, the computing device <NUM>, the location of the computing device <NUM>, a transcription of the audio <NUM>, and the audio <NUM> without the watermark.

The computing device <NUM> detects the utterance <NUM> through a microphone. The computing device <NUM> may be any type of device that is capable of receiving audio. For example, computing device <NUM> can be a desktop computer, laptop computer, a tablet computer, a wearable computer, a cellular phone, a smart phone, a music player, an e-book reader, a navigation system, a smart speaker and home assistant, wireless (e.g., Bluetooth) headset, hearing aid, smart watch, smart glasses, activity tracker, or any other appropriate computing device. As illustrated in <FIG>, computing device <NUM> is a smart phone. The computing device <NUM> can be any device capable of outputting audio such as, for example, a television, a radio, a music player, a desktop computer, laptop computer, a tablet computer, a wearable computer, a cellular phone, or a smart phone. As illustrated in <FIG>, the computing device <NUM> is a television.

The microphone of computing device <NUM> may be part of an audio subsystem <NUM>. The audio subsystem <NUM> may include buffers, filters, analog to digital converters that are each designed to initially process the audio received through the microphone. The buffer may store the current audio received through the microphone and processed by the audio subsystem <NUM>. For example, the buffer stores the previous five seconds of audio data.

The computing device <NUM> includes an audio watermark identifier <NUM>. The audio watermark identifier <NUM> is configured to process the audio received through the microphone and/or stored in the buffer and identify audio watermarks that are included in the audio. The audio watermark identifier <NUM> may be configured to provide the processed audio as an input to the audio watermark identification model <NUM>. The audio watermark identification model <NUM> may be configured to receive audio data and output data indicating whether the audio data includes a watermark. For example, the audio watermark identifier <NUM> may continuously provide audio processed through the audio subsystem <NUM> to the audio watermark identification model <NUM>. As the audio watermark identifier <NUM> provides more audio, the accuracy of the audio watermark identification model <NUM> may increase. For example, after three hundred milliseconds, the audio watermark identification model <NUM> may have received audio that includes one watermarks. After five hundred milliseconds, the audio watermark identification model <NUM> may have received audio that includes two watermarks. In an embodiment where the watermarks in any one audio sample are all identical to one another, the audio watermark identification model <NUM> can improve its accuracy by processing more audio.

In some implementations, the audio watermark identifier <NUM> may be configured to remove any detected watermark from the audio received from the audio subsystem <NUM>. After removing the watermark, the audio watermark identifier <NUM> may provide audio without the watermark to the hotworder <NUM> and/or the speech recognizer <NUM>. In some implementations, the audio watermark identifier <NUM> may be configured to pass the audio received from the audio subsystem <NUM> to the hotworder <NUM> and/or the speech recognizer <NUM> without removing the watermark.

The hotworder <NUM> is configured to identify hotwords in audio received through the microphone and/or stored in the buffer. In some implementations, the hotworder <NUM> may be active at any time that the computing device <NUM> are powered on. The hotworder <NUM> may continuously analyze the audio data stored in the buffer. The hotworder <NUM> computes a hotword confidence score that reflects the likelihood that current audio data in the buffer includes a hotword. To compute the hotword confidence score, the hotworder <NUM> may extract audio features from the audio data such as filterbank energies or mel-frequency cepstral coefficients. The hotworder <NUM> may use classifying windows to process these audio features such as by using a support vector machine or a neural network. In some implementations, the hotworder <NUM> does not perform speech recognition to determine a hotword confidence score (for example by comparing extracted audio features from the received audio with corresponding audio features for one or more of hotwords, but without using the extracted audio features to perform speech recognition on the audio data). The hotworder <NUM> determines that the audio includes a hotword if the hotword confidence score satisfies a hotword confidence score threshold. For example, the hotworder <NUM> determines that the audio that corresponds to utterance <NUM> includes the hotword <NUM> if the hotword confidence score is <NUM> and the hotword confidence score threshold is <NUM>. In some instances, the hotword may be referred to as a wake up word or an attention word.

The speech recognizer <NUM> may perform any type of process that generates a transcription based on incoming audio. For example, the speech recognizer <NUM> may user an acoustic model to identify phonemes in the audio data in the buffer. The speech recognizer <NUM> may use a language model to determine a transcription that corresponds to the phonemes. As another example, the speech recognizer <NUM> may use a single model that processes the audio data in the buffer and outputs a transcription.

In instances where the audio watermark identification model <NUM> determines that that the audio includes a watermark, the audio watermark identifier <NUM> may deactivate the speech recognizer <NUM> and/or the hotworder <NUM>. By deactivating the speech recognizer <NUM> and/or the hotworder <NUM>, the audio watermark identifier <NUM> may prevent further processing of the audio that may trigger the computing device <NUM> to respond to the hotword <NUM> and/or the query <NUM>. As illustrated in <FIG>, the audio watermark identifier <NUM> sets the hotworder <NUM> to an inactive state <NUM> and the speech recognizer <NUM> to an inactive state <NUM>.

In some implementations, the default state of the hotworder <NUM> may be an active state and the default state of the speech recognizer <NUM> may be an active state. In this instance, the inactive state <NUM> and the inactive state <NUM> may expire after a predetermined amount of time. For example, after five seconds (or another predetermined amount of time), the states of both the hotworder <NUM> and the speech recognizer <NUM> may return to an active state. The five second period may renew each time the audio watermark identifier <NUM> detects an audio watermark. For example, if the audio <NUM> of the utterance <NUM> includes watermarks throughout the duration of the audio, then the hotworder <NUM> and the speech recognizer <NUM> may be set to the inactive state <NUM> and the inactive state <NUM> and may remain in that state for an additional five seconds after the end of the computing device <NUM> outputting the utterance <NUM>. As another example, if the audio <NUM> of the utterance <NUM> includes watermarks throughout the utterance of the hotword <NUM>, then then the hotworder <NUM> and the speech recognizer <NUM> may be set to the inactive state <NUM> and the inactive state <NUM> and may remain in that state for an additional five seconds after the computing device <NUM> outputs the hotword <NUM>, which will overlap outputting of the query <NUM>.

In some implementations, the audio watermark identifier <NUM> may store data in the identification logs <NUM> that indicates a date and time that the audio watermark identifier <NUM> identified a watermark. For example, the audio watermark identifier <NUM> may identify a watermark in the audio of utterance <NUM> at <NUM>:15pm on June <NUM>, <NUM>. The identification logs <NUM> may store data identifying any combination of the time and date of receipt of the watermark, the transcription of the utterance that includes the watermark <NUM>, the computing device <NUM>, the watermark <NUM>, the location of the computing device <NUM> when detecting the watermark, the underlying audio <NUM>, the combined audio and watermark, and any audio detected a period of time before or after the utterance <NUM> or the watermark <NUM>.

In some implementations, audio watermark identifier <NUM> may store data in the identification logs <NUM> that indicates a date and time that the audio watermark identifier <NUM> did not identify a watermark and the hotworder <NUM> identified a hotword. For example, at <NUM>:15pm on June <NUM>, <NUM> the audio watermark identifier <NUM> may not identify a watermark in the audio of an utterance, and the hotworder <NUM> may identify a hotword in the audio of the utterance. The identification logs <NUM> may store data identifying any combination of the time and date of receipt of the non-watermarked audio and the hotword, the transcription of the utterance, the computing device <NUM>, the location of the computing device, the audio detected a period of time before or after the utterance or the hotword.

In some implementations, the hotworder <NUM> may process the audio received from the audio subsystem <NUM> before, after, or concurrently with the audio watermark identifier <NUM>. For example, the audio watermark identifier <NUM> may determine that the audio of the utterance <NUM> includes a watermark, and, at the same time, the hotworder <NUM> may determine that the audio of the utterance <NUM> includes a hotword. In this instance, the audio watermark identifier <NUM> may set the state of the speech recognizer <NUM> to the inactive state <NUM>. The audio watermark identifier <NUM> may not be able to update the state <NUM> of the hotworder <NUM>.

In some implementations, before the audio watermark identifier <NUM> uses the audio watermark identification model <NUM>, the computing device <NUM> generates the watermark identification model <NUM> and provides the watermark identification data <NUM> to the computing device <NUM>. The computing device <NUM> uses non-watermarked speech samples <NUM>, an audio watermarker <NUM>, and a trainer <NUM> that uses machine learning to generate the audio watermark identification models <NUM>.

The non-watermarked speech samples <NUM> may include various speech samples collected under various conditions. The non-watermarked speech samples <NUM> may include audio samples of different users saying different terms, saying the same terms, saying terms with different types of background noise, saying terms in different languages, saying terms in different accents, saying terms recorded by different devices, etc. In some implementations, the non-watermarked speech samples <NUM> each include an utterance of a hotword. In some implementations, only some of the non-watermarked speech samples <NUM> include an utterance of a hotword.

The audio watermarker <NUM> may generate a different watermark for each non-watermarked speech sample. The audio watermarker <NUM> may generate one or more watermarked speech samples <NUM> for each non-watermarked speech sample. Using the same non-watermarked speech sample, the audio watermarker <NUM> may generate a watermarked speech sample that includes watermarks every two hundred milliseconds and another watermarked speech sample that includes watermarks every three hundred milliseconds. The audio watermarker <NUM> may also generate a watermarked speech sample that includes watermarks only overlapping the hotword, if present. The audio watermarker <NUM> may also generate a watermarked speech sample that includes watermarks that overlap the hotword and precede the hotword. In this instance, the audio watermarker <NUM> can make four different watermarked speech samples with the same non-watermarked speech sample. The audio watermarker <NUM> can also make more or less than four. In some instances, the audio watermarker <NUM> may operate similarly to the audio watermarker <NUM>.

The trainer <NUM> uses machine learning and training data that includes the non-watermarked speech samples <NUM> and the watermarked speech samples <NUM> to generate the audio watermark identification model <NUM>. Because the non-watermarked speech samples <NUM> and the watermarked speech samples <NUM> are labeled as including a watermark or not including a watermark, the trainer <NUM> can use training data that includes the non-watermarked speech samples <NUM> and labels that indicate that each sample does not include a watermark and the watermarked speech samples <NUM> and labels that indicate that each sample includes a watermark. The trainer <NUM>, uses machine learning, to generate the audio watermark identification model <NUM> to be able to receive an audio sample and output whether the audio sample includes a watermark.

The computing device <NUM> can access the audio watermark identification model <NUM> and provide the model <NUM> to the computing device <NUM> to use in processing received audio data. The computing device <NUM> can store the model <NUM> in the audio watermark identification model <NUM>.

The computing device <NUM> may update the audio watermark identification model <NUM> based on the playback logs <NUM> and the identification logs <NUM>. The playback logs <NUM> may include data such as the playback data <NUM> received from the computing device <NUM> and stored in the playback logs <NUM>. The playback logs <NUM> may include playback data from multiple computing devices that have outputted watermarked audio. The identification logs <NUM> may include data such as the identification data <NUM> received from the computing device <NUM> and stored in identification logs <NUM>. The identification logs <NUM> may include additional identification data from multiple computing devices that are configured to identify audio watermarks and prevent execution of any command or queries included in the watermarked audio.

The trainer <NUM> may compare the playback logs <NUM> and the identification logs <NUM> to identify the matching entries that indicate that a computing device outputted watermarked audio and another computing device identified the watermark in the watermarked audio. The trainer <NUM> may also identify watermark identification errors in the identification logs <NUM> and the playback logs <NUM>. A first type of watermark identification error may occur when the identification logs <NUM> indicate that a computing device identifies a watermark, but the playback logs <NUM> do not indicate the output of watermarked audio. A second type of watermark identification error may occur when the playback logs <NUM> indicate the output of watermarked audio, but the identification logs <NUM> indicate that a computing device in the vicinity of the watermarked audio did not identify the watermark.

The trainer <NUM> may update the errors and use the corresponding audio data as additional training data to update the audio watermark identification model <NUM>. The trainer <NUM> may also update the audio watermark identification model <NUM> using the audio where the computing devices properly identified the watermarks. The trainer <NUM> may use both the audio outputted by the computing devices and the audio detected by the computing devices as training data. The trainer <NUM> may update the audio watermark identification model <NUM> using machine learning and the audio data stored in the playback logs <NUM> and the identification logs <NUM>. The trainer <NUM> may use the watermarking labels provided in the playback logs <NUM> and identification logs <NUM> and the corrected labels from the error identification technique described above as part of the machine learning training process.

In some implementations, the computing device <NUM> and several other computing devices may be configured to transmit the audio <NUM> to a server for processing by a server-based hotworder and/or a server-based speech recognizer that are running on the server. The audio watermark identifier <NUM> may indicate that the audio <NUM> does not include an audio watermark. Based on that determination, the computing device <NUM> may transmit the audio to the server for further processing by the server-based hotworder and/or the server-based speech recognizer. The audio watermark identifiers of the several other computing devices may also indicate that the audio <NUM> does not include an audio watermark. Based on those determinations, each of the other computing devices may transmit their respective audio to the server for further processing by the server-based hotworder and/or the server-based speech recognizer. The server may determine whether audio from each computing device includes a hotword and/or generate a transcription of the audio and transmit the results back to each computing device.

In some implementations, the server may receive data indicating a watermark confidence score for each of the watermark decisions. The server may determine that the audio received the by the computing device <NUM> and the other computing devices is from the same source based on the location of the computing device <NUM> and the other computing devices, characteristics of the received audio, receiving each audio portion at a similar time, and any other similar indicators. In some instances, each of the watermark confidence scores may be within a particular range that includes a watermark confidence score threshold on one end of the range and another confidence score that may be a percentage difference from the watermark confidence score threshold, such as five percent less. For example, the range may be the watermark confidence score threshold of <NUM> to <NUM>. In other instances, the other end of the range may be a fixed distance from the watermark confidence score threshold, such as <NUM>. For example, the range may be the watermark confidence score threshold of <NUM> to <NUM>.

If the server determines that each of the watermark confidence scores are within the range of being near the watermark confidence score threshold but not satisfying it, then the server may determine that the watermark confidence score threshold should be adjusted. In this instance, the server may adjust the watermark confidence score threshold to the lower end of the range. In some implementations, the server may update the watermarked speech samples <NUM> by including the audio received from each computing device in the watermarked speech samples <NUM>. The trainer <NUM> may update the audio watermark identification model <NUM> using machine learning and the updated watermarked speech samples <NUM>.

While <FIG> illustrates three different computing devices performing the different functions described above, any combination of one or more computing devices can perform any combination of the functions. For example, the computing device <NUM> may train the audio watermark identification model <NUM> instead of a separate computing device <NUM> training the audio watermark identification model <NUM>.

<FIG> illustrates an example process <NUM> for suppressing hotword triggers when detecting a hotword in recorded media. In general, the process <NUM> processes received audio to determine whether the audio includes an audio watermark. If the audio includes an audio watermark, then the process <NUM> may suppress further processing of the audio. If the audio does not include an audio watermark, then the process <NUM> continues to process the audio and execute any query or command included in the audio. The process <NUM> will be described as being performed by a computer system comprising one or more computers, for example, the computing devices <NUM>, <NUM>, and/or <NUM> as shown in <FIG>.

The system receives audio data corresponding to playback of an utterance (<NUM>). For example, a television may be playing a commercial and an actor in the commercial may say, "Ok computer, turn on the lights. " The system includes a microphone, and the microphone detects the audio of the commercial including the utterance of the actor.

The system provides the audio data as an input to a model (i) that is configured to determine whether a given audio data sample includes an audio watermark and (ii) that was trained using watermarked audio data samples that each include an audio watermark sample and non-watermarked audio data samples that do not each include an audio watermark sample (<NUM>). In some implementations, the system may determine that the audio data includes a hotword. Based on detecting the hotword, the system provides the audio data as an input to the model. For example, the system may determine that the audio data include "ok computer. " Based on detecting "ok computer," the system provides the audio data to the model. The system may provide the portion of the audio data that included the hotword and the audio received after the hotword. In some instances, the system may provide a portion of audio from before the hotword.

In some implementations, the system may analyze the audio data to determine whether the audio data includes a hotword. The analysis may occur before or after providing the audio data as an input to the model. In some implementations, the system may train the model using machine learning and watermarked audio data samples that each include an audio watermark, non-watermarked audio data samples that do not each include an audio watermark, and data indicating whether each watermarked and non-watermarked audio sample includes an audio watermark. The system may train the model to output data indicating whether audio input to the model includes a watermark or does not include a watermark.

In some implementations, different watermarked audio signals may include different watermarks from one another (the watermarks in any one audio sample may be all identical to one another, but with watermarks in one audio signal being different to watermarks in another audio signal). The system may generate a different watermark for each audio signal to minimize distortion in the audio signal. In some implementations, the system may place the watermark at periodic intervals in the audio signal. For example, the system may place the watermark every two hundred milliseconds. In some implementations, the system may place the watermark over the audio that includes the hotword and/or a period of time before the hotword.

The system receives, from the model (i) that is configured to determine whether the given audio data sample includes the audio watermark and (ii) that was trained using the watermarked audio data samples that include the audio watermark and the non-watermarked audio data samples that do not include the audio watermark, data indicating whether the audio data includes the audio watermark (<NUM>). The system may receive an indication that the audio data includes a watermark or receive an indication that the audio data does not include a watermark.

The system, based on the data indicating whether the audio data includes the audio watermark, continues or ceases processing of the audio data (<NUM>). In some implementations, the system may cease processing of the audio data if the audio data includes the audio watermark. In some implementations, the system may continue processing of the audio data if the audio data does not include an audio watermark. In some implementations, the processing of the audio data may include performing speech recognition on the audio data and/or determining whether the audio data includes a hotword. In some implementations, the processing may include executing a query or command included in the audio data.

In some implementations, the system logs the time and date that the system received the audio data. The system may compare the time and date to a time and date received from the computing device that output the audio data. If the system determines that the date and time of the receipt of the audio data match the date and time of outputting the audio data, then the system may update the model using the audio data as additional training data. The system may identify whether the model was correct in determining whether the audio data included a watermark, and ensure that the audio data includes the correct watermark label when added to the training data.

In more detail, a software agent that can perform tasks for a user is generally referred to as a "virtual assistant". A virtual assistant may for example be actuated by voice input from the user - for example may be programmed to recognize one or more trigger words that, when spoken by the user, cause the virtual assistant to be activated and perform a task associated with the trigger word that has been spoken. Such a trigger word is often referred to as a "hotword". A virtual assistant may be provided on, for example, a user's computer mobile telephone or other user device. Alternatively, a virtual assistant may be integrated into another device, such as a so-called "smart speaker" (a type of wireless speaker with an integrated virtual assistant that offers interactive actions and hands-free activation with the help of one or more hotwords).

With the wide adoption of smart speakers additional issues arise. During events with large audience e.g., sports event that attracts over a <NUM> million viewers, advertisements with hotwords can lead to simultaneous triggering of virtual assistants. Due to the large viewership there can be a significant increase in the simultaneous queries to the speech recognition servers which can lead to denial-of-service (DOS).

Two possible mechanisms for filtering of false hotwords are those based on (<NUM>) audio fingerprinting, where the fingerprint from the query audio is checked against a database of fingerprints from known audio, like advertisements, to filter out false triggers, and (<NUM>) audio watermarking, where the audio is watermarked by the publisher and the query recorded by the virtual assistant is checked for the watermark for filtering.

This disclosure describes the design of a low-latency, small footprint watermark detector which uses convolutional neural networks. This watermark detector is trained to be robust to noisy and reverberant environments which may be frequent in the scenario-of-interest.

Audio watermarking may be used in copyright protection and second screen applications. In copyright protection watermark detection generally does not need to be latency sensitive as the entire audio signal is available for detection. In the case of second screen applications delays introduced due to high latency watermark detection may be tolerable. Unlike these two scenarios watermark detection in virtual assistants is very latency sensitive.

In known applications involving watermark detection, the embedded message constituting the watermark is typically unknown ahead of time, and the watermark detector has to decode the message sequence before it can determine whether the message sequence includes a watermark and, if so, determine the watermark. However, in some applications described herein, the watermark detector may be detecting a watermark pattern which is exactly known by the decoder/watermark detector. That is the publisher or provider of rerecorded speech content may watermark this with a watermark, and may make details of the watermark available to, for example, providers of a virtual assistant and/or providers of devices that include a virtual assistant. Similarly, the provider of a virtual assistant may arrange for speech output from the virtual assistant to be provided with a watermark and make details of the watermark available. As a result, once the watermark has been detected in a received message it is known that the received message is not live speech input from a user and the activation of a virtual assistant resulting from any hotword in the received message can be suppressed, without the need to wait until the entire message has been received and processed. This provides reduction in latency.

Some implementations for hotword suppression utilize the audio fingerprinting approach. This approach requires a fingerprint database of known audio. As maintenance of this database on the device is non-trivial on-device deployment of such solutions are not viable. However, a significant advantage of audio fingerprinting approach is that it may not require modifications to the audio publishing process. Hence, it can tackle even adversarial scenarios where the audio publisher is not a collaborator.

This disclosure describes a watermark based hotword suppression mechanism. The hotword suppression mechanism may use an on-device deployment that brings in the design constraints of memory and computation footprints. Further there is a constraint on latency to avoid impact on the user experience.

Watermark based approaches may require modification of the audio publishing process to add the watermark. Hence, they can sometimes only be used to detect audio published by collaborators. However, they may not require the maintenance of fingerprint databases. This feature enables several advantages.

A first advantage may be the feasibility of on-device deployment. This can be an advantage during high viewership events when several virtual assistants can get simultaneously triggered. Server based solutions for detecting these false triggers can lead to denial of service due to the scale of simultaneous triggers. A second advantage may be detection of unknown audio published by a collaborator, e.g., text-to-speech (TTS) synthesizer output where the publisher can be collaborative, but the audio is not known ahead of time. A third advantage may be scalability. Entities such as audio/video publishers on online platforms can watermark their audio to avoid triggering the virtual assistants. In some implementations, these platforms host several million hours of content which cannot be practically handled using the audio fingerprinting based approaches.

In some implementations, the watermark based approach described herein can be combined with the audio fingerprinting based approach which may have the ability to tackle adversarial agents.

The description below describes the watermark embedder and the watermark detector.

The watermark embedder may be based on spread spectrum based watermarking in the FFT domain. The watermark embedder may use a psychoacoustic model to estimate the minimum masking threshold (MMT) which is used to shape the amplitude of watermark signal.

To summarize this technique, regions of the host signal amenable for watermark addition are selected based on a minimum energy criterion. Discrete Fourier transform (DFT) coefficients are estimated for every host signal frame (<NUM> windows - <NUM> hop) in these regions. These DFT coefficients are used to estimate the minimum masking threshold (MMT) using the psychoacoustic model. The MMT is used to shape the magnitude spectrum for a frame of the watermark signal. <FIG> presents the estimated MMT, along with the host signal energy and absolute threshold of hearing. The phase of the host signal may be used for the watermark signal and the sign of the DFT coefficients is determined from the message payload. The message bit payload may be spread over a chunk of frames using multiple scrambling. In some implementations, the system may be detecting if a query is watermarked and may not have to transmit any payload. Hence, the system may randomly choose a sign matrix over a chunk of frames (e.g., <NUM> frames or <NUM>) and repeat this sign matrix across the watermarking region. This repetition of the sign matrix may be exploited to post-process the watermark detector output and improve the detection performance. Overlap add of the individual watermark frames may generate the watermark signal. Subplots (a) and (b) of <FIG> represent the magnitude spectra of the host signal and the watermark signal, and subplot (c) represents the sign matrix. The vertical lines represent the boundaries between two replications of the matrix.

The watermark signal may be added to the host signal in the time domain, after scaling it by a factor (e.g., α ∈ [<NUM>, <NUM>]), to further ensure inaudibility of the watermark. In some implementations, α is determined iteratively using objective evaluation metrics like Perceptual Evaluation of Audio Quality (PEAQ). In some implementations, the system may use conservative scaling factors (e.g., α ∈ {<NUM>, <NUM>, <NUM>, <NUM>, <NUM>}) and evaluate detection performance at each of these scaling factors.

In some implementations, a design requirement for the watermark detector may be on-device deployment that places significant constraints on both the memory footprint of the model and its computational complexity. The description below describes convolutional neural network based model architectures for on-device keyword detection. In some implementations, the system may use temporal convolutional neural networks.

In some implementations, the neural network is trained to estimate the cross-correlation of the embedded watermark sign matrix (<FIG>, subplot (c)) which may be a replication of the same <NUM> pattern with one instance of the <NUM> pattern. Subplot (d) in <FIG> shows the cross-correlation. Cross correlation may encode information about the start of each sign matrix block and may non-zero for the entire duration of the watermark signal within the host signal.

The system may train the neural network using a multi-task loss function. The primary task may be the estimation of the ground truth cross-correlation, and the auxiliary tasks may be the estimation of energy perturbation pattern and/or the watermark magnitude spectra. Mean square error may be computed between the ground-truth(s) and network output(s). Some or all of the losses may be interpolated after scaling the auxiliary losses with regularization constants. In some implementations, bounding each network output to just cover the dynamic range of the corresponding ground-truth may improve performance.

In some implementations, the system may post process network outputs. In some implementations, the watermark may not have a payload message and a single sign matrix is replicated throughout the watermarking region. This may result in a cross-correlation pattern which is periodic (<FIG>, subplot (d)). This aspect can be exploited to eliminate spurious peaks in the network outputs. In some implementations and to improve performance, the system may use a match-filter created by replicating the cross-correlation pattern (see <FIG>) over band-pass filters isolating the frequency of interest. <FIG> compares the network outputs, generated for a non-watermarked signal, before and after match-filtering. In some implementations, spurious peaks which do not have periodicity can be significantly suppressed. The ground truth <NUM> may be approximately <NUM> (e.g., between -<NUM> and <NUM>) and may track the x-axis more closely than the network output <NUM> and the match filtered network output <NUM>. The network output <NUM> may vary with respect to the x-axis more than the ground truth <NUM> and the match filtered network output <NUM>. The match filtered network output <NUM> may track the x-axis more closely than the network output <NUM> and may not track the x-axis as closely as the ground truth <NUM>. The match filtered network output <NUM> may be smoother than the network output <NUM>. The match filtered network output <NUM> may remain within a smaller range than the network output <NUM>. For example, the match filtered network output <NUM> may stay between -<NUM> and <NUM>. The network output <NUM> may stay between -<NUM> and <NUM>.

Once the neural network has been trained, it may be used in a method of determining whether a given audio data sample includes an audio watermark, by applying a model embodying the neural network to an audio data sample. The method may include determining a confidence score that reflects a likelihood that the audio data includes the audio watermark; comparing the confidence score that reflects the likelihood that the audio data includes the audio watermark to a confidence score threshold; and based on comparing the confidence score that reflects the likelihood that the audio data includes the audio watermark to the confidence score threshold, determining whether to perform additional processing on the audio data.

In an embodiment the method comprises: based on comparing the confidence score that reflects the likelihood that the audio data includes the audio watermark to the confidence score threshold, determining that the confidence score satisfies the confidence score threshold, wherein determining whether to perform additional processing on the audio data, comprises determining to suppress performance of the additional processing on the audio data. In an embodiment the method comprises: based on comparing the confidence score that reflects the likelihood that the utterance includes the audio watermark to the confidence score threshold, determining that the confidence score does not satisfy the confidence score threshold, wherein determining whether to perform additional processing on the audio data, comprises determining to perform the additional processing on the audio data. In an embodiment the method comprises: receiving, from a user, data confirming performance of the additional processing on the audio data; and based on receiving the data confirming performance of the additional processing on the audio data, updating the model. In an embodiment the additional processing on the audio data comprises performing an action based on a transcription of the audio data; or determining whether the audio data includes a particular, predefined hotword. In an embodiment the method comprises: before applying, to the audio data, the model (i) that is configured to determine whether the given audio data sample includes the audio watermark and (ii) that was trained using the watermarked audio data samples that include the audio watermark and the non-watermarked audio data samples that do not include the audio watermark, determining that the audio data includes a particular, predefined hotword. In an embodiment the method comprises: determining that the audio data includes a particular, predefined hotword, wherein applying, to the audio data, the model (i) that is configured to determine whether the given audio data sample includes the audio watermark and (ii) that was trained using watermarked audio data samples that include the audio watermark and non-watermarked audio data samples that do not include the audio watermark is in response to determining that the audio data includes the particular, predefined hotword. In an embodiment the method comprises: receiving the watermarked audio data samples that include the audio watermark and the non-watermarked audio data samples that do not include the audio watermark; and training, using machine learning, the model using the watermarked audio data samples that include the audio watermark and the non-watermarked audio data samples that do not include the audio watermark. In an embodiment the method comprises: at least a portion of the watermarked audio data samples include the audio watermark at multiple, periodic locations.

<FIG> shows an example of a computing device <NUM> and a mobile computing device <NUM> that can be used to implement the techniques described here. The mobile computing device <NUM> is intended to represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smart-phones, and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not meant to be limiting.

The computing device <NUM> includes a processor <NUM>, a memory <NUM>, a storage device <NUM>, a high-speed interface <NUM> connecting to the memory <NUM> and multiple high-speed expansion ports <NUM>, and a low-speed interface <NUM> connecting to a low-speed expansion port <NUM> and the storage device <NUM>. Each of the processor <NUM>, the memory <NUM>, the storage device <NUM>, the high-speed interface <NUM>, the high-speed expansion ports <NUM>, and the low-speed interface <NUM>, are interconnected using various buses, and may be mounted on a common motherboard or in other manners as appropriate. The processor <NUM> can process instructions for execution within the computing device <NUM>, including instructions stored in the memory <NUM> or on the storage device <NUM> to display graphical information for a GUI on an external input/output device, such as a display <NUM> coupled to the high-speed interface <NUM>. Also, multiple computing devices may be connected, with each device providing portions of the necessary operations (e.g., as a server bank, a group of blade servers, or a multi-processor system).

The high-speed interface <NUM> manages bandwidth-intensive operations for the computing device <NUM>, while the low-speed interface <NUM> manages lower bandwidth-intensive operations. Such allocation of functions is an example only. In some implementations, the high-speed interface <NUM> is coupled to the memory <NUM>, the display <NUM> (e.g., through a graphics processor or accelerator), and to the high-speed expansion ports <NUM>, which may accept various expansion cards. In the implementation, the low-speed interface <NUM> is coupled to the storage device <NUM> and the low-speed expansion port <NUM>. The low-speed expansion port <NUM>, which may include various communication ports (e.g., USB, Bluetooth, Ethernet, wireless Ethernet) may be coupled to one or more input/output devices, such as a keyboard, a pointing device, a scanner, or a networking device such as a switch or router, e.g., through a network adapter.

Alternatively, components from the computing device <NUM> may be combined with other components in a mobile device, such as a mobile computing device <NUM>.

The memory <NUM> stores information within the mobile computing device <NUM>. An expansion memory <NUM> may also be provided and connected to the mobile computing device <NUM> through an expansion interface <NUM>, which may include, for example, a SIMM (Single In Line Memory Module) card interface. The expansion memory <NUM> may provide extra storage space for the mobile computing device <NUM>, or may also store applications or other information for the mobile computing device <NUM>. Specifically, the expansion memory <NUM> may include instructions to carry out or supplement the processes described above, and may include secure information also. Thus, for example, the expansion memory <NUM> may be provided as a security module for the mobile computing device <NUM>, and may be programmed with instructions that permit secure use of the mobile computing device <NUM>.

The memory may include, for example, flash memory and/or NVRAM memory (non-volatile random access memory), as discussed below. In some implementations, instructions are stored in an information carrier. that the instructions, when executed by one or more processing devices (for example, processor <NUM>), perform one or more methods, such as those described above. The instructions can also be stored by one or more storage devices, such as one or more computer- or machine-readable mediums (for example, the memory <NUM>, the expansion memory <NUM>, or memory on the processor <NUM>). In some implementations, the instructions can be received in a propagated signal, for example, over the transceiver <NUM> or the external interface <NUM>.

The mobile computing device <NUM> may communicate wirelessly through the communication interface <NUM>, which may include digital signal processing circuitry where necessary. The communication interface <NUM> may provide for communications under various modes or protocols, such as GSM voice calls (Global System for Mobile communications), SMS (Short Message Service), EMS (Enhanced Messaging Service), or MMS messaging (Multimedia Messaging Service), CDMA (code division multiple access), TDMA (time division multiple access), PDC (Personal Digital Cellular), WCDMA (Wideband Code Division Multiple Access), CDMA2000, or GPRS (General Packet Radio Service), among others. Such communication may occur, for example, through the transceiver <NUM> using a radio-frequency. In addition, short-range communication may occur, such as using a Bluetooth, WiFi, or other such transceiver. In addition, a GPS (Global Positioning System) receiver module <NUM> may provide additional navigation- and location-related wireless data to the mobile computing device <NUM>, which may be used as appropriate by applications running on the mobile computing device <NUM>.

Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

Claim 1:
A computer-implemented method, comprising:
adding, by a first computing device, a first audio watermark to first speech data corresponding to playback of a first utterance including a hotword used to invoke an attention of a second computing device; and
outputting, by the first computing device, the playback of the first utterance corresponding to the watermarked first speech data, to the second computing device, which is configured to receive the watermarked first speech data and determine, based on a determination that the watermarked first speech data includes the first audio watermark based on a model (i) that is configured to determine whether a given audio data sample includes an audio watermark and (ii) that was trained using watermarked audio data samples that each include an audio watermark sample and non-watermarked audio data samples that do not each include an audio watermark sample, to cease processing of the watermarked first speech data.