Original: Transferable and Conﬁgurable Audio Adversarial Attack from Low-Level Features
Revised: Transferable and Conﬁgurable Audio Adversarial Attack from Low-Level Features

Original: Abstract
Revised: Abstract

Original: Recent works revealed that state-of-the-art machine learning based Automatic
Revised: Recent works revealed that state-of-the-art machine learning based Automatic

Original: Speech Recognition systems (ASR) have a considerable vulnerability to the craftedadversarial examples.
Revised: Speech Recognition systems (ASR) have a considerable vulnerability to the craftedadversarial examples.

Original: However, limited by individual ASR system’s speciﬁc machine learning models, the current audio adversarial attacks still lack certain modeltransferability as well as conﬁgurability for different deployment scenarios.
Revised: However, limited by individual ASR system’s speciﬁc machine learning models, the current audio adversarial attacks still lack certain modeltransferability as well as conﬁgurability for different deployment scenarios.

Original: In thiswork, we propose a novel untargeted adversarial example generation method to
Revised: In thiswork, we propose a novel untargeted adversarial example generation method to

Original: ASR systems, which shifts the adversarial example generation from the high-levelmachine learning models to the low-level feature extraction stage.
Revised: ASR systems, which shifts the adversarial example generation from the high-levelmachine learning models to the low-level feature extraction stage.

Original: By taking advantage of the fundamental impact and direct conﬁguration of the low-level features,the proposed method can generate transferable and conﬁgurable adversarial examples for ASR system perturbation.
Revised: By taking advantage of the fundamental impact and direct conﬁguration of the low-level features,the proposed method can generate transferable and conﬁgurable adversarial examples for ASR system perturbation.

Original: During the evaluation, we use 6 commercial
Revised: During the evaluation, we use 6 commercial

Original: ASR models to test the proposed attack method.
Revised: ASR models to test the proposed attack method.

Original: The results show that the proposed method can achieve stronger transferability and comparable perturbationeffectiveness compared to the state-of-the-art method.
Revised: The results show that the proposed method can achieve stronger transferability and comparable perturbationeffectiveness compared to the state-of-the-art method.

Original: Also, it can conﬁgure theadversarial examples with desired audio attributes for better scenario adaptation.
Revised: Also, it can conﬁgure theadversarial examples with desired audio attributes for better scenario adaptation.

Original:  Introduction
Revised:  Introduction

Original: Rapid progress in the machine learning technologies have largely promoted the performance of
Revised: Rapid progress in the machine learning technologies have largely promoted the performance of

Original: Automatic Speech Recognition systems (ASR).
Revised: Automatic Speech Recognition systems (ASR).

Original: However, recent research works have shown that themachine learning models in the ASR systems can be easily perturbed by the adversarial examplesand therefore mislead the systems to incorrect recognition results.
Revised: However, recent research works have shown that themachine learning models in the ASR systems can be easily perturbed by the adversarial examplesand therefore mislead the systems to incorrect recognition results.

Original: Many works have been proposed[1,2,3,4,5,6,7] and most of them share a same methodology which applies the backpropagationalgorithm through the ASR machine learning models (e g. Recurrent Neural Network (RNN)) to castthe logit errors to input data.
Revised: Many works have been proposed[1,2,3,4,5,6,7] and most of them share a same methodology which applies the backpropagationalgorithm through the ASR machine learning models (e g. Recurrent Neural Network (RNN)) to castthe logit errors to input data.

Original: However, because of the huge variance among different machine learningmodels and the indirect backpropagation casting process through the models, these methods fail togenerate adversarial examples with strong model transferability to attack arbitrary ASR systems, andcan’t directly conﬁgure the adversarial examples with desired audio attributes.
Revised: However, because of the huge variance among different machine learningmodels and the indirect backpropagation casting process through the models, these methods fail togenerate adversarial examples with strong model transferability to attack arbitrary ASR systems, andcan’t directly conﬁgure the adversarial examples with desired audio attributes.

Original: In this paper, we propose a novel untargeted adversarial attack method to address these two issues.
Revised: In this paper, we propose a novel untargeted adversarial attack method to address these two issues.

Original: Different with previous works focusing on the machine learning models, we apply the adversarialexample generation on the low-level feature extraction stage.
Revised: Different with previous works focusing on the machine learning models, we apply the adversarialexample generation on the low-level feature extraction stage.

Original: Speciﬁcally, we use Mel-Frequency
Revised: Speciﬁcally, we use Mel-Frequency

Original: Cepstral Coefﬁcient (MFCC) features as low-level features which transfers input audio waveformto MFCC feature vectors.
Revised: Cepstral Coefﬁcient (MFCC) features as low-level features which transfers input audio waveformto MFCC feature vectors.

Original: Shared by all the ASR systems, low-level feature extraction stage like
Revised: Shared by all the ASR systems, low-level feature extraction stage like

Original: MFCC has the fundamental impact to later high-level machine learning models.
Revised: MFCC has the fundamental impact to later high-level machine learning models.

Original: Therefore, theadversarial examples generated from the low-level features are expected to have strong transferabilityfor different ASR systems.
Revised: Therefore, theadversarial examples generated from the low-level features are expected to have strong transferabilityfor different ASR systems.

Original: Meanwhile, the adversarial example generation over the MFCC stage candirect regulate the audio attributes and achieve ﬂexible attack conﬁguration.
Revised: Meanwhile, the adversarial example generation over the MFCC stage candirect regulate the audio attributes and achieve ﬂexible attack conﬁguration.

Original: During the evaluation, we evaluate our proposed attack method on 6 commercial ASR systems.
Revised: During the evaluation, we evaluate our proposed attack method on 6 commercial ASR systems.

Original: The results show that the proposed method can achieve stronger transferability and comparable perturbation effectiveness compared to the state-of-the-art method.
Revised: The results show that the proposed method can achieve stronger transferability and comparable perturbation effectiveness compared to the state-of-the-art method.

Original: Also, it can conﬁgure theadversarial examples with desired audio attributes for better scenario adaptation.
Revised: Also, it can conﬁgure theadversarial examples with desired audio attributes for better scenario adaptation.

Original: [Figure]
Revised: [Figure]

Original:  Low-Level Feature Based Attack Method
Revised:  Low-Level Feature based Attack Method

Original: [Figure]
Revised: [Figure]

Original: What’syour
Revised: What’syour

Original: [Figure]
Revised: [Figure]

Original: he asked
Revised: he asked

Original: [Figure]
Revised: [Figure]

Original: 2.1 General Adversarial At-
Revised: 2.1 General Adversarial At-

Original: [Figure]
Revised: [Figure]

Original: tack Deﬁnition Typically, for au-
Revised: tack Deﬁnition Typically, for au-

Original: [Figure]
Revised: [Figure]

Original: dio adversarial attack, the ASR
Revised: dio adversarial attack, the ASR

Original: [Figure]
Revised: [Figure]

Original: process can be formulated as f ( · ) ,the original input waveformis
Revised: process can be formulated as f ( · ) , [Figure] while the original input waveform

Original: [Figure]
Revised: [Figure]

Original:  X , and the recognition resultis
Revised: is X , and the recognition result

Original: [Figure]
Revised: [Figure]

Original:  f ( X ) =
Revised: is f ( X ) =

Original: Y .
Revised: Y .

Revised: When superpos-

Original: When adding a human imperceptible noise  δ on theoriginal input waveformX , weget adversarial example X
Revised: [Figure] ing a human imperceptible noise [Figure] δ on the original input waveform

Original:  + δand the recognition result will bechanged as f ( X + δ ) (cid:54)
Revised: [Figure] X , we can get adversarial example X + δ , and the recognition result is expected to be changed asf ( X + δ ) (cid:54)

Original: =
Revised: =

Original: Y .
Revised: Y .

Original: Previous works generate δ by attackingthe whole ASR f ( · ) especially the inner machine learning model, thus their δ is highly dependentto speciﬁc machine learning model, which will fail to perturb various ASR systems for same δ .
Revised: Previous worksgenerate δ by attacking f ( · ) through the high-level machine learning models, thus the δ is highlyrelated to speciﬁc model structure and conﬁguration. Therefore, such a methodology defects thetransferability of the adversarial attacks.

Revised: Also, the backpropagation process hinders the conﬁgurationof the audio attributs of the adversarial examples.

Original: Inour work, instead of attacking f ( · ) , we use another MFCC process f P ( · ) with given parameters togenerate adversarial examples.
Revised: In our work, instead of attacking f ( · ) , we useanother MFCC process f P ( · ) with given parameters to generate adversarial examples.

Original: It should be noted that f P ( · ) is not part of f ( · ) , therefore our methodcan be considered as a black-box attack.
Revised: It should benoted that f P ( · ) is not part of f ( · ) , therefore our method can be considered as a black-box attack.

Original: 2.2 MFCC Based Adversarial 
Revised: 2.2 MFCC Based Adversarial Example Generation

Original: Example Generation

Original: Our method can be shown in the Fig.
Revised: Our method is illustrated in the Fig.

Original: Theoriginal audio waveform is X , we feed it into a MFCC process f P ( · ) to generate adversarial noise δ .
Revised: Theoriginal audio waveform is X , we feed it into a MFCC process f P ( · ) to generate adversarial noise δ .

Original: By adding δ into original waveform X , we get the adversarial waveform X (cid:48) that can mislead otherparameter unknown ASR recognition.
Revised: By adding δ into original waveform X , we get the adversarial waveform X (cid:48) that can mislead otherparameter unknown ASR recognition.

Original: According to our preliminary experiment, by considering both perturbation performance and methodimplementation convenience, Basic Iterative Method (BIM) is utilized in this paper to iterativelygenerate adversarial noise through backpropagation algorithm[9].
Revised: According to our preliminary experiment, by considering both perturbation performance and methodimplementation convenience, Basic Iterative Method (BIM) is utilized in this paper to iterativelygenerate adversarial noise through backpropagation algorithm[9].

Original: The BIM method in our approachcan be formulated as:
Revised: The BIM method in our approachcan be formulated as:

Original: [Equation]
Revised: [Equation]

Original: where θ is the parameters for MFCC process f P ( · ) , Y w indicates the desired MFCC features manipulation result.
Revised: where θ is the parameters for MFCC process f P ( · ) , Y w indicates the desired MFCC features manipulation result.

Original: δ N is the adversarial noise generated in the N th iteration.
Revised: δ N is the adversarial noise generated in the N th iteration.

Original: Clip means that thegenerated adversarial examples will be limited in a certain range.
Revised: Clip means that thegenerated adversarial examples will be limited in a certain range.

Original: J is the cost function that measuresthe difference between f P ( X N + δ N ) and Y w , and (cid:53) is a partial differentiate process.
Revised: J is the cost function that measuresthe difference between f P ( X N + δ N ) and Y w , and (cid:53) is a partial differentiate process.

Original: During the adversarial example generation, we need to use backpropagation to differentiate the costfunction J .
Revised: During the adversarial example generation, we need to use backpropagation to differentiate the costfunction J .

Original: Therefore, it is necessary to formulate and integrate MFCC process to facilitate ourmethod design.
Revised: Therefore, it is necessary to formulate and integrate MFCC process to facilitate ourmethod design.

Original: For MFCC process, it transforms an input speech waveform into feature vectorscomposed of coefﬁcients of Mel-Frequency Cepstrum by following 6 steps. 1)
Revised: For MFCC process, it transforms an input speech waveform into feature vectorscomposed of coefﬁcients of Mel-Frequency Cepstrum by following 6 steps. 1)

Original: Speech waveform
Revised: Speech waveform

Original: X is pre-emphasized as speech vector y pre according to the equation y pres =
Revised: X is pre-emphasized as speech vector y pre according to the equation y pres =

Original: X − αX ( WIN ) .2)
Revised: X − αX ( WIN ) .2)

Original: y pre is further divided into N fra frames y fra with frame length n . 3)
Revised: y pre is further divided into N fra frames y fra with frame length n . 3)

Original: A hamming windowingfunction is applied to each frame: y win =
Revised: A hamming windowingfunction is applied to each frame: y win =

Original: (cid:110) 0 .
Revised: (cid:110) 0 .

Original: 54 − 0 .
Revised: 54 − 0 .

Original: 46 cos ( 2 π ( n − 1) N fra − 1 ) (cid:111)
Revised: 46 cos ( 2 π ( n − 1) N fra − 1 ) (cid:111)

Original: × y fra ( WIN ) .
Revised: × y fra ( WIN ) .

Original: Eachframe y win do a N FFT points Fast Fourier-Transforming and calculate the power spectrum byusing equation: y FFT =
Revised: Eachframe y win do a N FFT points Fast Fourier-Transforming and calculate the power spectrum byusing equation: y FFT =

Original: [Equation]
Revised: [Equation]

Original:  1 ≤ k ≤ K ( FFT ) , where Kis the total frequency points.
Revised: n = y win e − j 2 πkn/N FFT ) 2 | , 1 ≤ k ≤ K ( FFT ) , where Kis the total frequency points.

Original: A set of Mel-Filter vectors MB ( f 1 , f 2 , ..., f L ) are applied to thepower spectrum y FFT and the Mel-power spectrum y Mel can be obtained according to: y Mel =y FFT × MB ( f 1 , f 2 , ..., f L ) , 1 ≤ l ≤ L ( MFB ) , where L is number of ﬁlters.
Revised: A set of Mel-Filter vectors MB ( f 1 , f 2 , ..., f L ) are applied to thepower spectrum y FFT and the Mel-power spectrum y Mel can be obtained according to: y Mel =y FFT × MB ( f 1 , f 2 , ..., f L ) , 1 ≤ l ≤ L ( MFB ) , where L is number of ﬁlters.

Original: We apply Discrete
Revised: We apply Discrete

Original: Cosine Transform to calculate MFCC features Y MFCC :
Revised: Cosine Transform to calculate MFCC features Y MFCC :

Original: y MFCC =
Revised: y MFCC =

Original: y Mel cos [( l − 0 .
Revised: y Mel cos [( l − 0 .

Original: 5) πl L ] ( DCT ) .
Revised: 5) πlL ] ( DCT ) .

Original: With the aforementioned 6 steps, the input speech waveform X can be transfered as MFCC featurevectors of Y MFCC , which offers distinct speech perceptive features for the ASR process.
Revised: With the aforementioned 6 steps, the input speech waveform X can be transfered as MFCC featurevectors of Y MFCC , which offers distinct speech perceptive features for the ASR process.

Revised: [Table]

Original: In our case, we ﬁrst take Y MFCC into J in Eq.
Revised: In our case, we ﬁrst take Y MFCC into J in Eq.

Original: Then we replace f P ( · ) and θ with parameters in
Revised: Then we replace f P ( · ) and θ with parameters in

Original: MFCC process.
Revised: MFCC process.

Original: Finally, we set Y w to 0 for maximizing the perturbation effectiveness regardless the [Table] [Table] speech content.
Revised: Finally, we set Y w to 0 for maximizing the perturbation effectiveness regardless thespeech content.

Original: Furthermore, according to the chain rule of partial differentiation, we differentiate Jfrom DCT process to PRE process step by step.
Revised: Furthermore, according to the chain rule of partial differentiation, we differentiate Jfrom DCT process to PRE process step by step.

Original: Such a differentiation can be formulated as:
Revised: Such a differentiation can be formulated as:

Original: [Equation]
Revised: [Equation]

Original: As the derivation value of equations in step 3 and step 5 are constants, which can be obtained directly, 90 Eq.
Revised: As the derivation value of equations in step 3 and step 5 are constants, which can be obtained directly, 91 Eq.

Original: 2 can be simpliﬁed as:
Revised: 2 can be simpliﬁed as:

Original: [Equation]

Original: [Equation]
Revised: [Equation]

Original: where δ MFCC is the generated adversarial noise and T adv is its strength constraints.
Revised: where δ MFCC is the generated adversarial noise and T adv is its strength constraints.

Original: By use Eq. 3, we can obtain the adversarial noise in each iteration.
Revised: By use Eq. 3, we can obtain the adversarial noise in each iteration.

Original: With the number of iterationincrease, the adversarial noise will approach to a best perturbation performance which we will showin the Section 3.1.2.3{+experiment section.2.
+} Adversarial Example conﬁguration In this part, we further explore the conﬁgurability ofgenerated adversarial example in our proposed method.
Revised: With the number of iterationincrease, the adversarial noise will approach to a best perturbation performance which we will showin the {+experiment section.2.
+} Adversarial Example Conﬁguration In this part, we further explore the conﬁgurability ofgenerated adversarial example in our proposed method.

Original: During the process of adding adversarialnoise δ into original input waveform X , a lot of practical requirements should be considered suchas: whether adding adversarial noise into fully frequency range or just focusing on certain frequencyrange, how to hide parts of adversarial noise into original speech, etc .
Revised: During the process of adding adversarialnoise δ into original input waveform X , a lot of practical requirements should be considered such asfrequency conﬁguration.

Original: Therefore, generated adversarialexamples should have strong conﬁgurability with respect to  different deployment scenarios.
Revised: Therefore, generated adversarial examples should have strong conﬁgurabilitywith respect to these different practical requirements.

Original: As aforementioned, during the adversarial example generation process, we leverage backpropagationto differentiate MFCC process from MFCC feature to input waveform.
Revised: As aforementioned, during the adversarial example generation process, we leverage backpropagationto differentiate MFCC process from MFCC feature to input waveform.

Original: Hence, it is possible toconﬁgure the adversarial example by selectively blocking some values in different stages of MFCCprocess during the backpropagation.
Revised: Hence, it is possible toconﬁgure the adversarial example by selectively blocking some values in different stages of MFCCprocess during the backpropagation.

Original: To explain it more clearly, we can use human hearing perception quality as a case study.
Revised: To explain it more clearly, we can use human hearing perception quality as a case study.

Original: We leveragetwo auditory masking effects to reduce the impact of adversarial noise on human hearing perception:
Revised: We leveragetwo auditory masking effects to reduce the impact of adversarial noise on human hearing perception:

Original: The signiﬁcant sensitivity frequency range of human hearing perception is from 200 Hz to 5 KHz .
Revised: The signiﬁcant sensitivity frequency range of human hearing perception is from 200 Hz to 5 KHz .

Original: 2) Frequency component with higher sound intensity C H may prevent its adjacent lower frequency
Revised: 2) Frequency component with higher sound intensity C H may prevent its adjacent lower frequency

Original: component C L from human perception which can be formulates as:
Revised: component C L from human perception, which can be formulates as:

Original: [Equation]
Revised: [Equation]

Original: where D represents the human perception system.
Revised: where D represents the human perception system.

Original: During the FFT step of MFCC process, we can get multiple y FFT and each of them representscertain frequency band.
Revised: During the FFT step of MFCC process, we can get multiple y FFT and each of them representscertain frequency band.

Original: So, we ﬁrst prevent y FFT which represent the frequency range from 20 Hzto 20k Hz from being differentiated during the backpropagation process.
Revised: So, we ﬁrst prevent y FFT which represent the frequency range from 20 Hzto 20k Hz from being differentiated during the backpropagation process.

Original: Then, we locate the top t%frequency component with the highest sound intensity (empirically, t ≈ 10).
Revised: Then, we locate the top t%frequency component with the highest sound intensity (empirically, t ≈ 10).

Original: Then, we further generateadversarial noise around those frequency components.
Revised: Then, we further generateadversarial noise around those frequency components.

Original: We will evaluate the performance of thisconﬁguration scheme in the experiment section.
Revised: We will evaluate the performance of thisconﬁguration scheme in the experiment section.

Original:  Evaluation
Revised:  Evaluation

Original: The proposed method is implemented on the Tensorﬂow platform [11], and evaluated on a desktopserver equipped with Intel Xeon and NIVIDA 1080.During the implementation, the MFCC parameter Original Method Optimized Method
Revised: The proposed method is implemented on the Tensorﬂow platform [11], and evaluated on a desktopserver equipped with Intel Xeon and NIVIDA 1080.

Original: F r e qu e n c y ( KH z )

Original: Time

Original: [-S e n s iti v e r a ng e  
-]
Revised: [-S e n s iti v e r a ng e  
-]

Original: S e n s i t i v e R a n g e 5kHz Boundary Pertb. Removed conﬁguration is adopted from [2][10], the original speech data is from the Common Voice Dataset[12], and the rest of ASR system is based on DeepSpeech platform [10].
Revised: During the implementation, the MFCC parameterconﬁguration is adopted from [2][10], the original speech data is from the Common Voice Dataset[12], and the rest of ASR system is based on DeepSpeech platform [10].

Original: During the evaluation, 6different state-of-the-art ASR systems are considered to evaluate the effectiveness and transferability.
Revised: During the evaluation, 6different state-of-the-art ASR systems are considered to evaluate the effectiveness and transferability.

Original: 3.1 Perturbation Effectiveness and Efﬁciency
Revised: 3.1 Perturbation Effectiveness and Efﬁciency

Revised: To evaluate

Original: To evaluate the proposed method, we ﬁrst comparethe perturbation of our low-level feature based to one machine learning model based adversarial attack,which is referred as the CTC attack.
Revised: proposed method, we ﬁrst comparethe perturbation of our low-level feature based to one machine learning model based adversarial attack, [Table] which is referred as the CTC attack.

Original: The CTC attack is a state-of-the-art method that attacks thehigh-level CTC features and generates adversarial examples from RNN models [2].
Revised: The CTC attack is a state-of-the-art method that attacks thehigh-level CTC features and generates adversarial examples from RNN models [2].

Original: As the proposed
Revised: As the proposed

Original: MFCC based method is designed as an untargeted attack, the CTC is also conﬁgured for misleadingthe ASR results to random noises.
Revised: MFCC based method is designed as an untargeted attack, the CTC is also conﬁgured for misleadingthe ASR results to random noises.

Original: Table 1 shows the perturbation effectiveness on DeepSpeechmodel by comparing the WER achieved by 2000 adversarial examples from each method, amongwhich every 500 examples are generated with different amounts of iterations.
Revised: Table 1 shows the perturbation effectiveness on DeepSpeechmodel by comparing the WER achieved by 2000 adversarial examples from each method, amongwhich every 500 examples are generated with different amounts of iterations.

Original: For the limitationof the adversarial noise strength T adv , we set it as 28 dB .
Revised: For the limitationof the adversarial noise strength T adv , we set it as 28 dB .

Original: With the iteration incremented from 1 to1000, the proposed MFCC based attack could achieve an WER of 56.5% ∼ 100%, and the CTC attackachieves 36.0% ∼ 100%.
Revised: With the iteration incremented from 1 to1000, the proposed MFCC based attack could achieve an WER of 56.5% ∼ 100%, and the CTC attackachieves 36.0% ∼ 100%.

Original: However, the MFCC based attack only takes 100 iterations to achieve the100% WER, while the CTC attack needs 10 times more effort.
Revised: However, the MFCC based attack only takes 100 iterations to achieve the100% WER, while the CTC attack needs 10 times more effort.

Original: From such a comparison, we can tellthat the MFCC based attack can effective achieve the same perturbation effectiveness as the machinelearning based method, but with signiﬁcant efﬁciency improvement.3.2 Attack Transferability to Different ASR Systems To further evaluate the transferability ofthe proposed MFCC based attack, another 6 different state-of-the-art ASR systems are also tested( i,e, Google Voice, Sphinx, Wit.ai, Microsoft, Houndify, and IBM).
Revised: From such a comparison, we can tellthat the MFCC based attack can effective achieve the same perturbation effectiveness as the machinelearning based method, but with signiﬁcant efﬁciency improvement.3.2 Attack Transferability to Different ASR Systems To further evaluate the transferability ofthe proposed MFCC based attack, another 6 different state-of-the-art ASR systems are also tested( i,e, Google Voice, Sphinx, Wit.ai, Microsoft, Houndify, and IBM).

Original: 500 adversarial examples aregenerated respectively from the proposed MFCC based and CTC attack method with 1000 iterationson DeepSpeech system.
Revised: 500 adversarial examples aregenerated respectively from the proposed MFCC based and CTC attack method with 1000 iterationson DeepSpeech system.

Original: The original examples are also tested as the baseline.
Revised: The original examples are also tested as the baseline.

Original: Table 2 illustrates theexperiment results.
Revised: Table 2 illustrates theexperiment results.

Original: In Table 2, different ASR systems have different recognition performance withvarying WERs of 8% ∼ 21.2%.
Revised: In Table 2, different ASR systems have different recognition performance withvarying WERs of 8% ∼ 21.2%.

Original: The proposed method can effectively maintain a high WER over 50%(51% ∼ 77.8%) over different ASR systems, while the WER of CTC attack drops to 16.3% ∼ 51.1%.
Revised: The proposed method can effectively maintain a high WER over 50%(51% ∼ 77.8%) over different ASR systems, while the WER of CTC attack drops to 16.3% ∼ 51.1%.

Original: Therefore, the proposed MFCC based attack method demonstrates strong model transferability.3.

Revised: Therefore, the proposed MFCC based attack method demonstrates strong model transferability.3.

Original: Attack Conﬁgurability
Revised: Attack Conﬁgurability

Original: In this part, we will evaluate the conﬁgurability under the case of humanhearing perception quality.
Revised: In this part, we will evaluate the conﬁgurability under the case of humanhearing perception quality.

Original: Since the sampling rat of audio samples in Common Voice Dataset is16k Hz , fully frequency range for each audio samples will be from 0 Hz to 8k Hz .
Revised: Since the sampling rat of audio samples in Common Voice Dataset is16k Hz , fully frequency range for each audio samples will be from 0 Hz to 8k Hz .

Original: During the FFT stagein MFCC process, there are 257 value numbers and each of them represents a frequency bands around31 Hz .
Revised: During the FFT stagein MFCC process, there are 257 value numbers and each of them represents a frequency bands around31 Hz .

Original: Then we do the conﬁguration according to the Section 2.3 and the result is shown in the Fig.
Revised: Then we do the conﬁguration according to the Section 2.3 and the result is shown in the Fig.

Original: The left one is the frequency spectrum of generated adversarial example without conﬁguration, whilethe right one is generated after conﬁguration.
Revised: The left one is the frequency spectrum of generated adversarial example without conﬁguration, whilethe right one is generated after conﬁguration.

Original: We can clearly ﬁnd that much adversarial noise arerestricted outside of human sensitive range which indicated by a clear boundary presents around 5k Hzand white circles in sensitive frequency range.
Revised: We can clearly ﬁnd that much adversarial noise arerestricted outside of human sensitive range which indicated by a clear boundary presents around 5k Hzand white circles in sensitive frequency range.

Original: Also, the adversarial noise remain in the sensitiverange is more concentrated to the speech component with high sound intensity.
Revised: Also, the adversarial noise remain in the sensitiverange is more concentrated to the speech component with high sound intensity.

Original:  Conclusion
Revised:  Conclusion

Original: In this work, we proposed a transferable and reconﬁgurable audio adversarial attack method.
Revised: In this work, we proposed a transferable and reconﬁgurable audio adversarial attack method.

Original: Bygenerating adversarial examples from low-level features in the ASR system, we show that transferableadversarial examples can be well generated in the fundamental stage before the machine learningmodels.
Revised: Bygenerating adversarial examples from low-level features in the ASR system, we show that transferableadversarial examples can be well generated in the fundamental stage before the machine learningmodels.

Original: Also, without complex backpropagation process through the machine learning models, theproposed method can directly conﬁgure the adversarial examples with desired audio attributes forbetter scenario adaptation.
Revised: Also, without complex backpropagation process through the machine learning models, theproposed method can directly conﬁgure the adversarial examples with desired audio attributes forbetter scenario adaptation.

Original: The proposed attack method can be well utilized as an effective andefﬁcient non-target attack method, which can be well deployed in scenarios of transferable attack,black-box attack, and even audio encryption against undesired analysis.
Revised: The proposed attack method can be well utilized as an effective andefﬁcient non-target attack method, which can be well deployed in scenarios of transferable attack,black-box attack, and even audio encryption against undesired analysis.