Sequential Randomized Smoothing for Adversarially Robust Speech Recognition (2021)

Abstract: While Automatic Speech Recognition has been shown to be vulnerable to adversarial attacks, defenses against these attacks are still lagging. Existing, naive defenses can be partially broken with an adaptive attack. In classification tasks, the Randomized Smoothing paradigm has been shown to be effective at defending models. However, it is difficult to apply this paradigm to ASR tasks, due to their complexity and the sequential nature of their outputs. Our paper overcomes some of these challenges by leveraging speech-specific tools like enhancement and ROVER voting to design an ASR model that is robust to perturbations. We apply adaptive versions of state-of-the-art attacks, such as the Imperceptible ASR attack, to our model, and show that our strongest defense is robust to all attacks that use inaudible noise, and can only be broken with very high distortion.

## adversarial attacks on speech recognition as in previous work, we evaluate our defenses against white-box attacks, that can access model weights and their gradients and are aware of the defenses applied. provided with an input, these attacks will run gradient-based iterations to craft an additive noise. they are the hardest attacks to defend against, and a great metric to evaluate defenses that will carryover well to more practical attacks run over-the-air, without gradient access or in real time @xcite . we consider two threat models. untargeted attacks generate a small, additive adversarial noise that causes a denial-of-service (dos) by altering drastically the transcription. targeted attacks on the other hand craft an additive noise that forces the model to recognize a specific target of the attacker's choice, such as "ok google, browse to evil.com" @xcite . as their objective is more precise than simple denial-ofservice, targeted attacks typically require slightly larger perturbations. we now present the specific attacks that we use. perturbed samples for all these attacks are provided as supplementary material. ## voting strategies on text outputs even with augmented training and/or enhancement, when feeding noisy inputs to asr models the output distribution has high variance. running multiple forward passes and "averaging" the outputs can help reduce that variance and improve accuracy. but this requires a good voting strategy on text outputs. we first discuss some elementary strategies and their potential drawbacks, then describe the rover-based vote that we use. all of these strategies are empirically compared in section 7.1. we denote the sampled transcriptions as t 1 , ..., t n and t is our final transcription. ## results we first show that our defended models, which add gaussian noise to all inputs, retain low wer on this noisy but non-adversarial data. then we report their performance against adversarial attacks. we show that they successfully recover all attacks that use near-imperceptible noise. ## conclusion we have proposed a state-of-the-art adversarial defense for asr models based on randomized smoothing. it is successful against all attacks using inaudible distortion, while retaining a low error rate on natural data. to achieve strong performance under noise, we have leveraged speech enhancement methods and proposed a novel use for asr output ensembling methods like rover. we successfully defend against state-of-the-art adaptive attacks, and analyse the importance and limits of each component of our defense. finally, we show that randomized smoothing on asr is to some extent a provably robust defense. this work paves the way for a thorough exploration of smoothing defenses for asr. practical certification, extension to other architectures and ensembling with other defenses are some areas of interest. our approach could also be crossed with @xcite to generate noise that defends specifically against psychoacoustic-based attacks @xcite .