Metamorph: Injecting Inaudible Commands into Over-the-air Voice Controlled Systems
Metamorph: Injecting Inaudible Commands into Over-the-air Voice Controlled Systems
复制标题
DOI：
10.14722/ndss.2020.23055
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
Tao Chen;Longfei Shangguan;Zhenjiang Li;K. Jamieson
中科院分区：
文献类型：
--
作者：
Tao Chen;Longfei Shangguan;Zhenjiang Li;K. Jamieson
本文介绍了Metamorph，一种生成无法感知的音频的系统，该音频可以通过空中传输来攻击语音识别系统的神经网络。关键的挑战来自于如何确保在发送端预先增加的原始音频扰动不受传输过程中未知信号失真的影响。我们的实证研究表明，信号失真主要是由于设备和信道的频率选择性，但有不同的特点。这带来了捕捉并进一步预编码这种影响的机会，以生成对空中传输具有鲁棒性的对抗性示例。我们在Metamorph中利用这个机会，并获得一个初始扰动，该扰动仅从一小部分先前测量中捕获核心失真的影响，然后利用域自适应算法来细化扰动，以进一步提高攻击距离和可靠性。此外，我们还考虑减少人类的感知所添加的扰动。评估在长达6米的攻击距离上实现了高攻击成功率（90%）。在中等距离内，例如3米，Metamorph保持了这种高成功率，但可以进一步调整以大大提高音频质量，这一点得到了人类感知研究的证实。
—This paper presents Metamorph, a system that generates imperceptible audio that can survive over-the-air transmission to attack the neural network of a speech recognition system. The key challenge stems from how to ensure the added perturbation of the original audio in advance at the sender side is immune to unknown signal distortions during the transmission process. Our empirical study reveals that signal distortion is mainly due to device and channel frequency selectivity but with different characteristics. This brings a chance to capture and further pre-code this impact to generate adversarial examples that are robust to the over-the-air transmission. We leverage this opportunity in Metamorph and obtain an initial perturbation that captures the core distortion’s impact from only a small set of prior measurements, and then take advantage of a domain adaptation algorithm to refine the perturbation to further improve the attack distance and reliability. Moreover, we consider also reducing human perceptibility of the added perturbation. Evaluation achieves a high attack success rate (90%) over the attack distance of up to 6 m. Within a moderate distance, e.g. , 3 m, Metamorph maintains this high success rate, yet can be further adapted to largely improve the audio quality, confirmed by a human perceptibility study.