Collaborative Research: SaTC: CORE: Small: Securing IoT and Edge Devices under Audio Adversarial Attacks

在人工智能(AI)技术进步的推动下，下一代语音可控物联网和EDGE系统极大地方便了人们的日常生活。这类系统包括语音助理系统和语音认证手机银行等。然而，这些系统中使用的底层机器学习方法天生就容易受到音频对手攻击，在这种攻击中，对手可以通过向原始音频输入注入不可感知的扰动来误导机器学习模型。鉴于语音可控物联网和EDGE系统在许多隐私关键型和安全关键型应用中的广泛采用，如个人银行和自动驾驶，对基于音频的对抗性攻击的严重性和后果以及相应的防御解决方案的深入了解和调查是非常必要的。该项目将从时间和空间两个角度全面研究和分析语音可控物联网和EDGE系统对抗音频域对手攻击的脆弱性和健壮性。该项目的研究成果将为构建可信赖的语音可控物联网和EDGE系统奠定坚实的基础。开发的防御技术将提高许多智能音频系统的安全性，如自动语音识别(ASR)、关键字检测和说话人识别。该项目将通过各种参与性计划让未被充分代表的学生、本科生和研究生以及K-12学生参与。该项目的目标是演示音频对抗性攻击在物理世界中的可行性，确定攻击的严重程度和后果，并在实际环境中进一步开发防御策略，以构建攻击弹性强、语音可控的物联网(IoT)设备和边缘系统。为了在实际的时间限制下研究音频对抗攻击的可能性和严重性，该项目将开发低成本的音频不可知的无同步攻击发射方案，包括音频特定的快速对抗扰动生成器和通用对抗扰动生成器。为了研究敌意干扰如何在现实环境中经受住各种传播因素的影响，该项目将使用先进的房间脉冲响应模拟器和物理环境测量来分析空中传播造成的音频失真。该项目还将开发几种防御技术，包括防御性去噪、模型增强和基于麦克风阵列的活性检测。该技术将有助于保护语音可控的物联网和边缘设备在音频攻击下的安全。该项目还将在基于音频的对抗性机器学习的理论基础和面向安全的面向音频的新兴应用程序中贡献一种新的计算范式。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Powered by the advancement of artificial intelligence (AI) techniques, the next-generation voice-controllable IoT and edge systems have substantially facilitated people’s daily lives. Such systems include voice assistant systems and voice authenticated mobile banking, among many others. However, the underlying machine learning approaches used in these systems, are inherently vulnerable to audio adversarial attacks, in which an adversary can mislead the machine learning models via injecting imperceptible perturbation to the original audio input. Given the widespread adoption of voice-controllable IoT and edge systems in many privacy-critical and safety-critical applications, e.g., personal banking and autonomous driving, the in-depth understanding and investigation of severity and consequences of audio-based adversarial attack as well as the corresponding defense solutions, are highly demanded. This project will perform a comprehensive study and analysis of the vulnerability and robustness of voice-controllable IoT and edge systems against audio-domain adversarial attacks in both temporal and spatial perspectives. The research outcome of this project will form solid foundations for building trustworthy voice-controllable IoT and edge systems. The developed defense techniques will improve the security of many intelligent audio systems, such as automatic speech recognition (ASR), keyword spotting, and speaker recognition. This project will involve underrepresented students, undergraduate and graduate students, and K-12 students through a variety of engaging programs.The objective of this project is to demonstrate the feasibility of audio adversarial attacks in the physical world, determine the attack severity and consequences, and further develop defending strategies in practical environments to build attack-resilient voice-controllable Internet-of-Things (IoT) devices and edge systems. To study the possibility and severity of audio adversarial attacks in a practical time-constraint setting, the project will develop low-cost audio-agnostic synchronization-free attack launching schemes, including audio-specific fast adversarial perturbation generator and universal adversarial perturbation generator. To investigate how the adversarial perturbations survive various propagation factors in realistic environments, the project will analyze the audio distortions caused by the over-the-air propagation using an advanced room impulse response simulator and physical environment measurements. The project will also develop several defense techniques, including defensive denoiser, model enhancement, and microphone-array-based liveness detection. The presented technique will help to secure the voice-controllable IoT and edge devices under audio adversarial attacks. The project will also contribute to a new computing paradigm in audio-based adversarial machine learning in both theoretic foundations as well as safety-critical audio-oriented emerging applications.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.