Patent Description:
Automatic speech recognition is an important technology that is used in computing devices. A speech recognition service for an electronic device generally receives the vocal utterances that include spoken words from a user, and transcribes the spoken words into text. Vocal utterances may include a hotword, i.e., a predetermined reserved word that causes a system or device to perform a corresponding action or actions.

<CIT> describes a system and method for detecting a recorded voice, which can be employed independently or to provide protection from fraudulent use of a recording to defeat an automatic speaker recognition system. An "audio watermark" is used to determine whether a detected audio sample is a recording of a previous communication by an authorized user.

<CIT> describes a method of voice authentication that comprises enrolment and authentication stages. During enrolment, a user is prompted to provide a spoken response which is recorded using a microphone. To stop replay attacks, a method comprises prompting the user for a plurality of responses, and checking the responses to see if they are substantially identical.

<NPL> describes a playback attack detector (PAD), which can be mobilized in guarding speaker verification systems against playback attacks. To detect playback attacks, the PAD uses a feature set called peakmap, which includes the frame and FFT bin numbers of the five highest spectral peaks from each of the voiced frames in an utterance. During the detection, the peakmap of the incoming recording is first extracted and then compared to those of all the other recordings that are stored at the system end. Each comparison will yield a similarity score that represents the level of similarity between the two recordings. The incoming recording is declared to be a playback recording if its maximum similarity score is above a threshold.

<CIT> describes a device that can be configured to receive speech input from a user. The speech input can include a command for accessing a restricted feature of the device. The speech input can be compared to a voiceprint of the user's voice to authenticate the user to the device. Responsive to successful authentication of the user to the device, the user is allowed access to the restricted feature without the user having to perform additional authentication steps or speaking the command again.

The aspects of the present invention are defined in the independent claims. Some preferred features are defined in the dependent claims.

Examples of the present disclosure provided to assist understanding relate to hotword recognition, for example, using a hotword to unlock or enable access to a mobile device via voice, and inhibiting replay attacks. A replay attack is the process by which an unauthorized user captures the audio for a hotword spoken by the device's owner or authorized user, and replays it in order to gain some level of unauthorized access to the device. According to implementations of the disclosure, hotword or any speech-based replay attacks may be inhibited by verifying the uniqueness of each utterance.

Other examples not forming part of the invention, provided to assist understanding, include methods that include the actions of receiving audio data corresponding to an utterance; determining that the audio data corresponds to a hotword; generating a hotword audio fingerprint of the audio data that is determined to correspond to the hotword; determining a similarity between the hotword audio fingerprint and one or more stored audio fingerprints of audio data that was previously determined to correspond to the hotword; detecting whether the hotword audio fingerprint matches a stored audio fingerprint of audio data that was previously determined to correspond to the hotword based on whether the similarity between the hotword audio fingerprint and one of the one or more stored audio fingerprints satisfies a predetermined threshold; and in response to detecting that the hotword audio fingerprint matches a stored audio fingerprint, disabling access to a computing device into which the utterance was spoken.

In general, another example not forming part of the invention and provided to assist understanding includes methods that include the actions of receiving additional audio data corresponding to an additional utterance; identifying speaker-identification d-vectors using the additional audio data; determining a similarity between the speaker-identification d-vectors from the additional audio data and hotword d-vectors from the audio data corresponding to the utterance; detecting whether the audio data corresponding to the hotword matches the additional audio data based on whether the similarity between the hotword d-vectors from the audio data corresponding to the utterance and the speaker-identification d-vectors from the additional audio data satisfies a particular threshold; and in response to detecting that the audio data corresponding to the hotword does not match the additional audio data, disabling access to the computing device.

According to another example not forming part of the invention and provided to assist understanding , the hotword may be a particular term that triggers semantic interpretation of an additional term of one or more terms that follow the particular term. The additional term of one or more terms that follow the particular term may be associated with a query or command.

Another example not forming part of the invention and provided to assist understanding includes methods that include the actions of receiving additional audio data corresponding to a voice command or query, and determining a type of the voice command or query. Further, the predetermined threshold may be adjusted based on the determined type of the voice command or query.

These and other examples may each optionally include one or more of the following features. For instance, determining that the audio data corresponds to a hotword may include identifying one or more acoustic features of the audio data; comparing the one or more acoustic features of the audio data to one or more acoustic features associated with one or more hotwords stored in a database; and determining that the audio data corresponds to one of the one or more hotwords stored in the database based on the comparison of the one or more acoustic features of the audio data to the one or more acoustic features associated with one or more hotwords stored in the database.

In some examples, determining that the audio data corresponds to a hotword includes determining that an initial portion of the audio data corresponds to an initial portion of the hotword; and in response to determining that the initial portion of the audio data corresponds to the initial portion of the hotword, causing one of a plurality of unique ultrasonic audio samples to be outputted after the initial portion of the audio data is received.

The invention described in this specification is embodied in methods that include the actions of determining that the received audio data comprises audio data corresponding to one of the plurality of unique ultrasonic audio samples; and in response to determining that the received audio data comprises audio data corresponding to one of the plurality of unique ultrasonic audio samples, disabling access to the computing device.

Another example of subject matter described in this specification and not forming part of the invention is embodied in methods that include the actions of receiving, by a mobile computing device, an audio input corresponding to a recording of an utterance of a hotword that was previously input to the same mobile computing device, and in response to receiving, by the mobile computing device, the audio input corresponding to a recording of an utterance of a hotword that was previously input to the same mobile computing device, disabling, by the mobile computing device, access to one or more resources of the mobile computing device. The utterance of the hotword that was previously input may be stored in a database. The hotword may be a particular term that triggers semantic interpretation of an additional term of one or more terms that follow the particular term. The method may further include the action of determining that the audio input corresponds to an utterance of a hotword that was previously input based on a similarity between the audio input and one or more stored utterances of the hotword. Disabling, by the mobile computing device, access to one or more resources of the mobile computing device may comprise one or more of preventing the mobile computing device from being unlocked, locking the mobile computing device, initiating an authentication process, and preventing the mobile computing device from waking. The method may include the action of receiving, by the mobile computing device, additional audio data corresponding to a voice command or query and determining a type of the voice command or query. The method may include the action of storing the audio input corresponding to a recording of an utterance of a hotword that was previously input to the same mobile computing device in a database.

Another example of the subject matter described in this specification is embodied in methods that include the actions of receiving, by a mobile computing device, an initial audio input corresponding to an utterance of an initial portion of a hotword, while a remaining portion of the hotword is being uttered and before the hotword is fully uttered, providing, by the mobile computing device, verification audio for output through a speaker of the mobile computing device, and selectively enabling access to one or more resources of the mobile computing device after the hotword is fully uttered. The verification audio comprises one of a plurality of unique ultrasonic audio samples. The hotword may be a particular term that triggers semantic interpretation of an additional term of one or more terms that follow the particular term. The method may further comprise the actions of receiving, by the mobile computing device, an additional audio input corresponding to an utterance of the remaining portion of a hotword, determining that one of either the initial audio input corresponding to an utterance of an initial portion of a hotword or the additional audio input corresponding to an utterance of the remaining portion of a hotword comprises audio data corresponding to verification audio different than the verification audio provided for output through the speaker of the mobile computing device, and disabling access to one or more resources of the mobile computing device. Disabling access to one or more resources of the mobile computing device may comprise one or more of preventing the mobile computing device from being unlocked, locking the mobile computing device, initiating an authentication process, and preventing the mobile computing device from waking. The method may include the actions of receiving, by the mobile computing device, an additional audio input corresponding to an utterance of the remaining portion of a hotword, and determining that the initial audio input corresponding to an utterance of an initial portion of a hotword and the additional audio input corresponding to an utterance of the remaining portion of a hotword, collectively, correspond to the entire hotword, wherein selectively enabling access to one or more resources of the mobile computing device after the hotword is fully uttered is based at least in part on determining that the initial audio input corresponding to an utterance of an initial portion of a hotword and the additional audio input corresponding to an utterance of the remaining portion of a hotword, collectively, correspond to the entire hotword. The verification audio may be stored in a database in association with the initial audio input corresponding to an utterance of an initial portion of a hotword.

Other implementations of these aspects include a corresponding system.

The details of one or more implementations of the invention are set forth in the accompanying drawings and the description below. Other features and advantages of the invention will become apparent from the description, the drawings, and the claims.

<FIG> depicts an example system <NUM> for detecting and verifying a hotword, according to implementations of the invention. Such a system <NUM> may inhibit replay attacks. In some implementations system <NUM> includes an audio subsystem <NUM>, a hotword detector <NUM>, an audio fingerprint generator <NUM>, and a replay attack engine <NUM>. In some examples, system <NUM> may be embodied in a computing device, e.g., a smartphone, a laptop computer, a desktop or personal computer, a tablet, or the like, or a combination thereof. The computing device may include any audio detection means, e.g., a microphone, for detecting utterances from a user.

Implementations of the present disclosure enable hotword recognition, for example, using a hotword to unlock or enable access to a mobile device via voice. One way to enable that use of a hotword is through hotword recognition that is always on. Always-on hotword recognition is the process of continuously listening for a predefined phrase, e.g., "OK Computer", in order to wake up a computing device and initiate an activity. One advantage of hotword detection over running a full speech recognizer is that hotword detection allows for highly efficient and robust recognition because only a fixed trigger phrase needs to be recognized. Further, hotword recognition may involve comparing audio features of input speech with audio features of known utterances of a hotword, without performing speech recognition on the input utterance. Such operations may be performed at drastically less computational expense than implementing a speech recognizer.

Because the spoken hotword provides access to the device, the hotword is a particular utterance, and the hotword is spoken aloud, the use of hotword recognition may be susceptible to replay attacks. A replay attack is the process by which an unauthorized user captures the audio for a hotword spoken by the device's owner or authorized user, and replays it in order to gain some level of unauthorized access to the device. According to implementations of the disclosure, hotword or any speech-based replay attacks may be inhibited by verifying the uniqueness of each utterance.

In certain implementations, always-on hotword recognition may be used in combination with speaker verification to filter out utterances that were not spoken by the device's owner. The combination of speaker verification with hotword recognition is advantageous because hotword recognition is text-dependent, i.e., the spoken utterance is the same for a given hotword.

In some implementations, the user may say one or more words that the computing device detects as an utterance. The utterance may include one or more hotwords, or partial hotwords, that cause an action to be performed by the computing device.

In certain implementations, when the computing device is locked, a hotword may act as a way to gain partial or full access to the device. For example, if a user says "OK Computer" when the screen is off and/or the device is locked, and the speaker profile is successfully verified, certain queries may be allowed that access private or sensitive data, such as "when is my next meeting," "send a message to Boss," or the like. In some implementations, a hotword may allow the user to perform voice actions such as "send an email", or may be used to fully unlock the device, particularly when combined with additional contextual signals such as location.

As depicted in the illustrated example, the user may say, for example, "OK Computer. " The computing device may detect the utterance "OK Computer" <NUM> with the audio subsystem <NUM> appropriately receiving audio data of the utterance "OK Computer" <NUM>.

In the illustrated example, the audio subsystem <NUM> may receive the audio data associated with the utterance "OK Computer" <NUM>. The received audio data may include a series of audio frames of the utterance, or a predetermined amount of time of the audio data associated with the utterance. In some implementations, the audio subsystem <NUM> may processes the utterance to generate waveform data that includes a portion of the utterance, or substantially a whole portion of the utterance.

In some implementations, the audio subsystem <NUM> appropriately may process the received audio data. For example, the audio subsystem <NUM> may identify one or more acoustic features of the audio data. In the illustrated example, the audio subsystem <NUM> may identify acoustic features associated with the audio data associated with the utterance "OK Computer.

In some implementations, the audio subsystem <NUM> may provide the processed audio data to the hotword detector <NUM>. For example, the audio subsystem <NUM> may provide the processed audio data associated with the utterance "OK Computer" to the hotword detector <NUM>. In some implementations, the processed audio data may include acoustic features associated with the utterance "OK Computer," audio data associated with the utterance "OK Computer," a transcription associated with the utterance "OK Computer," or any combination thereof.

The hotword detector <NUM> may receive the processed audio data. In the illustrated example, the hotword detector <NUM> may receive the processed audio data associated with the utterance "OK Computer. " The hotword detector <NUM> may determine that the received audio data corresponds to a hotword. Specifically, the hotword may determine that the audio data corresponds to a hotword. In the illustrated example, the hotword detector <NUM> may determine that the audio data associated with the utterance "OK Computer" corresponds to the hotword "OK Computer.

In some implementations, the received audio data may include associated acoustic features, e.g., as identified by the audio subsystem <NUM>. The hotword detector <NUM> may compare the acoustic features of the audio data associated with the utterance "OK Computer" to acoustic features associated with one or more hotwords stored in a database. Specifically, each hotword may be associated with one or more acoustic features, e.g., phonetics of the hotword. A database, or table, may store a mapping between the hotwords and an associated acoustic feature(s). In some implementations, a hotword, may be associated with two or more acoustic features. In some implementations, an acoustic feature may be associated with two or more hotwords.

Based on the comparing of acoustic features, the audio data associated with the utterance "OK Computer" may be determined to correspond to a hotword stored in the database. For example, it is determined that the acoustic features of the audio data associated with the utterance "OK Computer" corresponds to the hotword "OK Computer" based on the comparison of the acoustic features of the utterance "OK Computer" and the acoustic features of the hotword "OK Computer. " Exemplary hotword recognition techniques that may be used in accordance with implementations of the present disclosure are described in <CIT>; and more specifically, the process of FIG. <NUM>, the details of which are depicted in FIGs. <NUM>-<NUM>.

The hotword detector <NUM> may provide a result of the determination that the audio data corresponds to a hotword to the audio fingerprint generator <NUM>. Specifically, in the illustrated example, the hotword detector <NUM> may provide the hotword "OK Computer," or a signal associated with the hotword "OK Computer," to the audio fingerprint generator <NUM>.

The audio fingerprint generator <NUM> may receive the result of the determination that the audio data corresponds to the hotword from the hotword detector <NUM>. Specifically, in the illustrated example, the audio fingerprint generator <NUM> may receive audio data that corresponds to the hotword "OK Computer," or a signal associated with the hotword "OK Computer," from the hotword detector <NUM>. The signal may include an indication that the audio data associated with the utterance "OK Computer" corresponds to a hotword.

The audio fingerprint generator <NUM> may generate a fingerprint of the audio data associated with the utterance of the hotword. In particular, in the illustrated example, the audio fingerprint generator <NUM> may process the audio data associated with the utterance "OK Computer," which corresponds to a hotword, to generate an audio fingerprint of the utterance "OK Computer.

In some implementations, audio fingerprints may be designed to allow for precise matching in the presence of extreme noise or other distortions such as pitch shifts and time stretches. In addition, each respective audio fingerprint is unique. For example, hotword utterances from the same speaker in the same environmental conditions still have different fingerprints. The audio fingerprint may include any background noise in addition to the spoken utterance.

Any type of audio fingerprint may be used according to implementations of the invention. For example, the audio fingerprint described in: <CIT>. The audio fingerprint may provide resistance against noise, pitch and time shifts, which are transformations that may be applied by a replay attacker. The fingerprint may be generated by detecting time-frequency peaks in the audio signal, which may be combined into triples and characterized by frequency ratios to provide invariance to pitch.

Alternatively, other features may be used to generate the fingerprint. For example, the fingerprint may consist of a series of frames of filterbank energies. The series of frames may be normalized and compared with a frame from another utterance using a distance function such as L2 distance. According to another alternative the features used to generate the fingerprint may be the activations of an intermediate layer in a neural network trained on a near-exact matching task.

In some implementations, the audio fingerprint generator <NUM> may provide the audio fingerprint of the hotword utterance to the replay attack engine <NUM>. Specifically, in the illustrated example, the replay attack the audio fingerprint generator <NUM> may provide the audio fingerprint of the utterance "OK Computer" to the replay attack engine <NUM>.

The replay attack engine <NUM> may receive the audio fingerprint of the hotword utterance generated by the audio fingerprint generator <NUM>. In some implementations, the replay attack engine may access a hotword fingerprint database <NUM>. The hotword fingerprint database <NUM> may be a database that stores the most recent, last N, or all hotword utterances associated with a particular device, or with a particular user, or both. The most recent hotword utterances may be determined according to a particular period of time. The hotword fingerprint database <NUM> may be a database that stores a particular subset of hotword utterances, for example, those most likely to be susceptible to replay attacks. For example, the hotword fingerprint database <NUM> may store hotword utterances that were made in public places, e.g., based on location, background noise, or the like, or any combination thereof, or that were made outside of a trusted environment, e.g., the user's home, car, office, or the like. The hotword fingerprint database <NUM> may store the most recent, last N, or all hotword utterances of the particular subset of hotword utterances.

The replay attack engine <NUM> may compare the audio fingerprint of the hotword utterance generated by the audio fingerprint generator <NUM> to the hotword fingerprints stored in the hotword fingerprint database <NUM>. By comparing the audio fingerprint of the hotword utterance generated by the audio fingerprint generator <NUM> to the hotword fingerprints stored in the hotword fingerprint database <NUM>, the replay attack engine <NUM> may determine whether the hotword utterance generated by the audio fingerprint generator <NUM> matches one or more of the hotword fingerprints stored in the hotword fingerprint database <NUM>.

A pair of fingerprints may be determined to match by comparing the fingerprint or features at all pairs of times x and y in the two utterances, i.e., the received hotword utterance and each of the stored hotword utterances. For example, fingerprints may be compared using a similarity function, such as L2 similarity, or using a measure of overlap of the triple descriptors, or using a measure of overlap of the interest points and other derived features. The similarity function may be used to generate a graphical heatmap. A match may be detected based upon a strong similarity along a diagonal line in the heatmap. The line may be shifted vertically or horizontally to allow for a variable start offset at which the match begins. The strength of the similarity may be detected by aggregating similarity scores for all (x - y). A strong peak in the resulting histogram indicates a match between the two at some shift. The peak in the histogram may also have a wide peak if the utterance has been time stretched. Alternatively, the heatmap may be provided as input to a classifier, which may determine whether the pair of fingerprints match. In any case, the replay attack engine <NUM> may determine a match based on a predetermined similarity threshold being satisfied. For example, the replay attack engine <NUM> may generate a similarity score or value, and may determine whether the similarity score or value satisfies a predetermined threshold score or value.

In some implementations, the replay attack engine <NUM> determining that the audio fingerprint of the hotword utterance generated by the audio fingerprint generator <NUM> matches a hotword fingerprint stored in the hotword fingerprint database <NUM> indicates a replay attack. In particular, the audio fingerprint of the utterance "OK Computer" generated by the audio fingerprint generator <NUM> matching an audio fingerprint stored in the hotword fingerprint database <NUM> indicates that the same utterance of "OK Computer" was previously received and is being replayed in an attempt to access or use the device by an unauthorized user.

In response to determining that the audio fingerprint of the hotword utterance generated by the audio fingerprint generator <NUM> matches a hotword fingerprint stored in the hotword fingerprint database <NUM>, the replay attack engine may output a signal that prevents the device from being unlocked, locks the device, disables access to the device, initiates a secondary authentication process, or the like. In response to determining that the audio fingerprint of the hotword utterance generated by the audio fingerprint generator <NUM> does not match a hotword fingerprint stored in the hotword fingerprint database <NUM>, the replay attack engine may output a signal that allows an action to be executed on the device.

<FIG> depicts a diagram of example processes for detecting and verifying a hotword, according to implementations of the invention. The diagram shows states <NUM> to <NUM>, which may or may not be illustrated in particular sequence.

At <NUM>, the audio subsystem <NUM> may receive audio data corresponding to the portion of the utterance "OK Computer. " The audio subsystem <NUM> may process the received audio data corresponding to the utterance "OK Computer" and provide the audio data to the hotword detector <NUM>. At <NUM>, the hotword detector <NUM> may receive audio data corresponding to the utterance "OK Computer" and determine whether the utterance "OK Computer" corresponds to a hotword for the device, for example, based on the comparing of acoustic features as described above.

If the hotword detector <NUM> determines that the received utterance does not correspond to a hotword for the device, the hotword detector <NUM> may provide a signal indicating that a hotword has not been received, and the process may restart with the audio subsystem <NUM> listening for an utterance. However, in response to the hotword detector <NUM> determining that the utterance "OK Computer" corresponds to a hotword for the device, the audio fingerprint generator <NUM> may generate an audio fingerprint of the utterance "OK Computer" at <NUM>. The audio fingerprint of the utterance "OK Computer" that is generated by the audio fingerprint generator <NUM> may be stored at <NUM>.

At <NUM>, the replay attack engine <NUM> may receive the audio fingerprint of the utterance "OK Computer" generated by the audio fingerprint generator <NUM>, and compare the generated audio fingerprint to hotword fingerprints that are stored, for example, in a database. In particular, the replay attack engine <NUM> may access stored hotword fingerprints at <NUM> for making the comparison with the audio fingerprint of the utterance "OK Computer" generated by the audio fingerprint generator <NUM>.

If the replay attack engine <NUM> determines no match <NUM> between the audio fingerprint of the utterance "OK Computer" generated by the audio fingerprint generator <NUM> and one or more of the stored hotword fingerprints, then access to the device may be granted or processing of a query or command that follows the hotword may be enabled at <NUM>. If the replay attack engine <NUM> determines a match <NUM> between the audio fingerprint of the utterance "OK Computer" generated by the audio fingerprint generator <NUM> and one or more of the stored hotword fingerprints, then access to the device may be disabled or limited at <NUM> or the device may be prevented from unlocking, or waking, or the like.

In some implementations, since the hotword utterance may be followed by a query or command utterance, whether the d-vectors extracted from the hotword utterance approximately match the d-vectors extracted from the query or command utterance may be determined. The comparison between the hotword utterance and the query or command utterance may inhibit an unauthorized user's ability to replay a recorded hotword and issue a new query or command with their own voice.

At <NUM>, the audio subsystem <NUM> may receive a query or command utterance that follows the utterance of the hotword. In the illustrated example, the audio subsystem <NUM> may receive the command utterance "Call Mom" after the hotword utterance "OK Computer". The audio subsystem <NUM> may process the received audio data corresponding to the utterance "Call Mom" and provide the audio data to the hotword detector <NUM>.

At <NUM>, the hotword detector <NUM> may receive audio data corresponding to the utterance "Call Mom" and determine whether the utterance "Call Mom" corresponds to a hotword for the device, for example, based on the comparing of acoustic features as described above. In the illustrated example, the hotword detector <NUM> may determine that the utterance "Call Mom" does not correspond to a hotword. If the hotword detector <NUM> determines that the received utterance does not correspond to a hotword for the device, the hotword detector <NUM> may provide a signal indicating that a hotword has not been received.

In some implementations, when it is determined that a hotword has not been received, it may be determined that a query or command is received. For example, in response to determining that a hotword has been received and verifying that there is no match with a stored hotword previously received, query or command processing may be enabled for an utterance the follows the hotword utterance. In the illustrated example, the audio fingerprint generator <NUM> may generate an audio fingerprint of the utterance "Call Mom" at <NUM>.

In some implementations, the audio fingerprint of the query or command may be used to perform cross-utterance verification of the hotword. In particular, at <NUM>, the replay attack engine <NUM> may receive speaker-identification d-vectors generated from the utterance "Call Mom", and compare the generated speaker-identification d-vectors of the utterance "Call Mom" to generated hotword d-vectors of the utterance "OK Computer". In some implementations, the replay attack engine <NUM> may compare the speaker-identification d-vectors of the utterance "Call Mom" to hotword d-vectors of the utterance "OK Computer" that are stored, for example, in a database.

If the replay attack engine <NUM> determines a match <NUM> between the audio data corresponding to the utterance "OK Computer" and the audio data corresponding to the utterance "Call Mom", then access to the device may be granted or processing of a query or command that follows the hotword may be executed at <NUM>. If the replay attack engine <NUM> determines no match <NUM> between the audio data corresponding to the utterance "OK Computer" and the audio data corresponding to the utterance "Call Mom", then, at <NUM>, the query or command may not be executed, access to the device may be disabled or limited, a secondary authentication process may be initiated, or the device may be prevented from unlocking, or waking, or the like, or any combination thereof. Alternatively, in a similar process, the audio data corresponding to the hotword utterance may be compared to any prior utterance received and stored.

As described above, the replay attack engine <NUM> may generate a similarity score or value for the comparison of the generated audio fingerprint of the utterance "Call Mom" to the generated hotword fingerprint of the utterance "OK Computer", and may determine whether the similarity score or value satisfies a predetermined threshold score or value. In some implementations, the context of the query or command may be determined. The determined context of the query or command may be used, for example, to weight the similarity score or value or to adjust the predetermined threshold score or value.

For example, if the context of the command or query indicates a lower level of sensitivity with regards to personal or private data, then the similarity score or value may be weighted or the predetermined threshold score or value may be adjusted to more often allow the query or command to be executed regardless of a close similarity between the generated audio fingerprint of the utterance "Call Mom" and the generated hotword fingerprint of the utterance "OK Computer". Conversely, if the context of the command or query indicates a higher level of sensitivity, then the similarity score or value may be weighted or the predetermined threshold score or value may be adjusted to less often allow the query or command to be executed, e.g., requiring a closer similarity between the generated audio fingerprint of the utterance "Call Mom" and the generated hotword fingerprint of the utterance "OK Computer". Thus, the comparison between the hotword utterance and the query or command utterance may inhibit an unauthorized user's ability to replay a recorded hotword and issue a new query or command with their own voice.

A partial hotword may be detected, for example, as described in <CIT>; and more specifically, the process of <FIG> , some of the details of which are depicted in <FIG>. In some implementations, after detecting a partial hotword, or during an utterance that follows the hotword, the device may output a unique ultrasonic audio clip, e.g., using frequency-shift keying, which may encode a unique token for recognition. If a previous token is recognized as part of the hotword, the hotword may be rejected. A unique set of frequencies may be used to encode each token so that the token may be detected when the device is outputting a new token.

Alternatively, instead of the device detecting an encoded token, the device may detect any significant ultrasound audio other than in the frequency bands the device is using for the new token. If any significant ultrasound audio is detected, the hotword may be rejected.

For example, as depicted in <FIG>, the hotword detector <NUM> may comprise a partial hotword detector <NUM>. In addition, the audio subsystem <NUM> may comprise an ultrasonic audio subsystem <NUM>. The ultrasonic audio subsystem <NUM> may be configured to output the unique ultrasonic audio clip. The ultrasonic audio subsystem <NUM> may be configured to receive and process ultrasonic audio samples.

<FIG> depicts a diagram of example processes for detecting and verifying a hotword, according to implementations of the invention. For example, as depicted in <FIG>, the audio subsystem <NUM> may receive the initial portion of the audio data associated with the utterance "OK" at <NUM>. The initial portion of the audio data can include a first few audio frames of the utterance, or a first few hundred milliseconds of audio data associated with the utterance. In some examples, the audio subsystem <NUM> processes the utterance to generate waveform data that includes a portion of the utterance, or substantially a whole portion of the utterance. The audio subsystem <NUM> may identify one or more acoustic features of the initial portion of the audio data. In the illustrated example, the audio subsystem <NUM> may identify acoustic features associated with the initial portion of the audio data associated with the utterance "OK.

In the illustrated example, the hotword detector <NUM> initially receives the processed audio data associated with the utterance "OK," e.g., an initial portion of the audio data. The hotword detector <NUM> may determine that the received audio data corresponds to an initial portion of a hotword. Specifically, the hotword detector <NUM> includes the partial hotword detector <NUM>. The partial hotword detector <NUM> may determine that the initial portion of the audio data corresponds to an initial portion of a hotword. In the illustrated example, the partial hotword detector <NUM> may determine that the initial portion of the audio data associated with the utterance "OK" corresponds to an initial portion of a hotword "OK Computer. " In some implementations, the initial portion of a hotword includes less than the entire hotword. For example, the initial portion "OK" is less than the entire hotword "OK Computer. " The partial hotword detector <NUM> may compare the acoustic features of the initial portion of the audio data associated with the utterance "OK" to acoustic features associated with one or more hotwords stored in a database.

Based on the comparing of acoustic features, the initial portion of the audio data associated with the utterance "OK" may be determined to correspond to an initial portion of a hotword stored in the database. For example, the hotword detector <NUM> may determine that the acoustic features of the initial portion of the audio data associated with the utterance "OK" corresponds to an initial portion of a hotword "OK Computer" at <NUM>, based on the comparison of the acoustic features of the utterance "OK" and the acoustic features of the hotword "OK Computer.

In some implementations, in response to initial portion of the audio data associated with the utterance being determined to correspond to an initial portion of a hotword, the ultrasonic audio subsystem <NUM> may output unique ultrasonic audio clip at <NUM>. In some implementations, the ultrasonic audio subsystem <NUM> may output the unique ultrasonic audio clip after the full hotword has been received.

At <NUM>, the audio subsystem <NUM> may receive audio data corresponding to the portion of the utterance "Computer. " The audio subsystem <NUM> may process the received audio data corresponding to the utterance "Computer" and provide the audio data to the hotword detector <NUM>. At <NUM>, the hotword detector <NUM> may receive audio data corresponding to the utterance "Computer" in addition to the audio data previously received corresponding to the utterance "OK" and determine whether the utterance "OK Computer" corresponds to a hotword for the device, for example, based on the comparing of acoustic features as described above.

Thus, according to implementations of the disclosure, hotword or any speech-based replay attacks may be inhibited by verifying the uniqueness of each utterance. In particular, the most recent, last N, or all hotword utterances that were recognized by a particular device or by a particular user may be recorded and stored. An audio fingerprint may be generated and stored for each hotword utterance, and a comparison may be performed between the audio fingerprint generated from a new utterance with each previously recorded audio fingerprint to check whether the same utterance audio has been previously used, indicating a replay. For example, when a hotword is recognized, an audio fingerprint of the hotword utterance may be generated and the derived fingerprint may be compared against fingerprints from previous utterances of the hotword. If a match is determined, the utterance may have been previously used, indicating a likely replay, and may be rejected. In response to the utterance being rejected, additional actions may be taken, e.g., blocking the device, alerting the device owner, displaying a warning, or the like, or any combination thereof. In addition, in certain implementations, other signals, e.g., ultrasonic audio injection and cross-utterance verification, may be used to further limit the effectiveness of replay attacks.

<FIG> depicts an example flowchart for detecting and verifying a hotword, according to implementations of the invention. As depicted in <FIG>, the process <NUM> may comprise receiving audio data corresponding to an utterance at <NUM>. The received audio data may be processed and then used to determine whether the audio data associated with the utterance corresponds to a hotword at <NUM>. For example, a comparison may be made between audio characteristics of the received utterance and audio characteristics of a hotword utterance for the device. In particular, a sequence of vectors may be generated from the received audio data corresponding to an utterance, and the sequence of vectors may be compared to vectors of an utterance of the hotword associated with the device.

At <NUM>, an audio fingerprint may be generated for the received utterance. For example, the audio data corresponding to the received utterance may be used to generate or compute a hotword audio fingerprint of the received hotword utterance. At <NUM>, the hotword audio fingerprint may be compared to stored hotword audio fingerprints. For example, a database of stored hotword audio fingerprints may be accessed and the hotword audio fingerprint may be compared to the stored hotword audio fingerprints, e.g., determining a similarity between the generated hotword audio fingerprint and each of the stored hotword audio fingerprints.

The comparison between the generated hotword audio fingerprint and the stored hotword audio fingerprints may be used to determine if a match exists between any of the stored hotword audio fingerprints and the generated hotword audio fingerprint at <NUM>. For example, it may be determined whether a similarity between the generated hotword audio fingerprint and one or more of the stored hotword audio fingerprints satisfies a predetermined threshold.

If it is determined that the generated hotword audio fingerprint matches one or more of the stored hotword audio fingerprints ("YES"), then access to the device may be disabled or prevented at <NUM>. For example, a match may indicate that an unauthorized user is replaying recorded audio of a hotword previously uttered by an authorized user in an attempt to gain unauthorized access to the device.

If it is determined that the generated hotword audio fingerprint does not match one or more of the stored hotword audio fingerprints ("NO"), then access to the device may be enabled or an action may be executed at <NUM>. For example, a determination that there is no match may indicate that the utterance is a new unique utterance of the hotword and is not a replay of recorded audio of a hotword previously uttered by the authorized user.

According to implementations of the disclosure, the hotword detection and speaker verification may be performed in either hardware or software or in a combination of both hardware and software. The fingerprint-based hotword verification may be applied at the level of a single device, or across multiple devices.

If hotword verification is applied at the level of a single device, the set of fingerprints from previous utterances may be stored locally on the device. If the set of fingerprints from previous utterances are stored locally on the device, the fingerprinting and matching process and functions may occur after hotword detection, e.g., on the device's digital signal processor, before waking the device.

If hotword verification is applied across multiple devices, the set of fingerprints from previous utterances may be stored on a server. If the set of fingerprints from previous utterances is stored on a server, the hotword may wake the device and the hotword utterance, or the audio fingerprint of the hotword utterance, may be sent to the same server that is used to perform recognition of the subsequent query or command. The server may verify the uniqueness of the hotword utterance, and may return a status that indicates whether the query or command should be allowed or should be rejected. Alternatively, if hotword verification is applied across multiple devices, the set of fingerprints from previous utterances may be synced across the multiple devices to enable the verification to be performed on the client device.

<FIG> shows an example of a generic computer device <NUM> and a generic mobile computer device <NUM>, which may be used with the techniques described here. Computing device <NUM> is intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. Computing device <NUM> is intended to represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smartphones, and other similar computing devices.

The processor <NUM> may process instructions for execution within the computing device <NUM>, including instructions stored in the memory <NUM> or on the storage device <NUM> to display graphical information for a GUI on an external input/output device, such as display <NUM> coupled to high speed interface <NUM>. Also, multiple computing devices <NUM> may be connected, with each device providing portions of the necessary operations (e.g., as a server bank, a group of blade servers, or a multiprocessor system).

A computer program product may be tangibly embodied in an information carrier. The information carrier is a computer- or machine-readable medium, such as the memory <NUM>, the storage device <NUM>, or a memory on processor <NUM>.

The processor <NUM> may execute instructions within the computing device <NUM>, including instructions stored in the memory <NUM>.

The memory <NUM> may be implemented as one or more of a computer-readable medium or media, a volatile memory unit or units, or a non-volatile memory unit or units.

The information carrier is a computer- or machine-readable medium, such as the memory <NUM>, expansion memory <NUM>, memory on processor <NUM>, or a propagated signal that may be received, for example, over transceiver <NUM> or external interface <NUM>.

A number of implementations have been described. Nevertheless, it will be understood that the scope of protection is defined by the claims.

Implementations of the invention and all of the functional operations described in this specification can be implemented in digital electronic circuitry, or in computer software, firmware, or hardware, including the structures disclosed in this specification and their structural equivalents, or in combinations of one or more of them. Implementations of the invention can be implemented as one or more computer program products, i.e., one or more modules of computer program instructions encoded on a computer readable medium for execution by, or to control the operation of, data processing apparatus. The computer readable medium can be a machine-readable storage device, a machine-readable storage substrate, a memory device, a composition of matter effecting a machine-readable propagated signal, or a combination of one or more of them. A propagated signal is an artificially generated signal, e.g., a machine-generated electrical, optical, or electromagnetic signal that is generated to encode information for transmission to suitable receiver apparatus.

These computer programs (also known as programs, software, software applications or code) include machine instructions for a programmable processor, and may be implemented in a high-level procedural and/or object-oriented programming language, and/or in assembly/machine language.

Moreover, a computer can be embedded in another device, e.g., a tablet computer, a mobile telephone, a personal digital assistant (PDA), a mobile audio player, a Global Positioning System (GPS) receiver, to name just a few.

To provide for interaction with a user, implementations of the invention can be implemented on a computer having a display device, e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor, for displaying information to the user and a keyboard and a pointing device, e.g., a mouse or a trackball, by which the user can provide input to the computer.

Implementations of the invention can be implemented in a computing system that includes a back end component, e.g., as a data server, or that includes a middleware component, e.g., an application server, or that includes a front end component, e.g., a client computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the invention, or any combination of one or more such back end, middleware, or front end components.

In each instance where an HTML file is mentioned, other file types or formats may be substituted. For instance, an HTML file may be replaced by an XML, JSON, plain text, or other types of files. Moreover, where a table or hash table is mentioned, other data structures (such as spreadsheets, relational databases, or structured files) may be used.

Various implementations of the systems and techniques described here may be realized in digital electronic circuitry, integrated circuitry, specially designed ASICs (application specific integrated circuits), computer hardware, firmware, software, and/or combinations thereof. These various implementations may include implementation in one or more computer programs that are executable and/or interpretable on a programmable system including at least one programmable processor, which may be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

Claim 1:
A computer-implemented method comprising:
receiving (<NUM>), by a first computing device, first audio data of a first utterance;
determining, by the first computing device, that the first utterance includes a particular predefined hotword;
based on determining that the first utterance includes the particular predefined hotword, determining, by the first computing device, whether the first audio data includes a unique ultrasonic audio signal previously outputted by a second computing device while the second computing device received second audio data of a second utterance that included the particular predefined hotword; and
based on determining whether the first audio data includes the unique ultrasonic audio signal previously outputted by the second computing device, determining, by the first computing device, whether to perform a command that is included in the first utterance and that follows the particular predefined hotword, wherein determining whether to perform a command comprises:
based on determining that the first audio data includes the unique ultrasonic audio signal previously outputted by the second computing device, rejecting the hotword or command and disabling access to one or more resources of the first computing device or preventing the device from unlocking or waking; and
based on determining that the first audio data does not include the unique ultrasonic audio signal previously outputted by the second computing device, determining to accept a hotword or command and enable access to the device or unlock or wake the device.