CAREER: Ensuring Privacy, Inclusiveness, and Policy Compliance in the Era of Voice Personal Assistants

语音个人助理，如亚马逊Alexa和谷歌助手，正迅速在国内和商业中流行起来。尽管它们提供了许多方便的功能，但人们对它们的安全和隐私以及与内容安全相关的风险也提出了担忧。在与语音助手的交互过程中，用户期望语音助手在不损害隐私或暴露于不安全内容的情况下满足他们的请求，并且在自动语音识别方面不会遇到种族或性别差异。该项目的新颖性是确保语音助理系统中的隐私、包容性和策略合规性的新技术和机制。该项目的广泛意义和重要性包括1)通过各种外展和教育活动提高K-12社区对网络安全的普遍认识；2)培训下一代网络安全研究人员，特别是代表不足和少数族裔的研究人员；以及3)通过开发新的课程材料和动手实验室来加强网络安全教育。该项目首先开发了基于语音的隐私通知机制，使用户(特别是视障用户)能够通过语音渠道做出知情的隐私决定。它为可访问和包容性的隐私通知创造了一个新的范例。然后，这个项目提出了一个基于机器学习的动态分析框架，它允许系统地评估语音助理系统中的政策遵从性和社会偏见。用户可以使用它来检查语音应用程序中是否存在任何违反隐私或内容安全的行为，并可能帮助政府机构对Amazon Alexa和Google Assistant平台中现有语音应用程序的策略合规性进行大规模调查。最后，该项目开发静态分析技术，以帮助开发人员在开发阶段生成符合策略的语音应用程序。该项目还将全面的教育和推广计划与拟议的研究相结合，以在跨学科环境中培训下一代网络安全研究人员，并吸引更多来自代表性不足群体的学生进入网络安全领域。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Voice personal assistants such as Amazon Alexa and Google Assistant are rapidly gaining in both domestic and business popularity. Despite many convenient features they provide, concerns have been raised about the security and privacy, and content safety related risks to end users they also pose. During the interaction with voice assistants, users expect the voice assistants to fulfill their requests without compromising the privacy or being exposed to unsafe content, and without experiencing racial or gender disparities in terms of the automated speech recognition. The project’s novelties are new techniques and mechanisms to ensure privacy, inclusiveness, and policy compliance in voice assistant systems. The project's broader significance and importance include 1) increasing general awareness of cybersecurity in the K-12 community through various outreach and educational activities; 2) training the next generation of cybersecurity researchers especially underrepresented and minorities; and 3) strengthening cybersecurity education by developing new course materials and hands-on labs.This project first develops a voice-based privacy notice mechanism to enable users (in particular, visually impaired users) to make informed privacy decisions through the voice channel. It creates a new paradigm for accessible and inclusive privacy notification. This project then proposes a machine learning-based dynamic analysis framework, which allows a systematic evaluation of policy compliance and social biases in voice assistant systems. It can be used by users to check for any privacy or content safety violations in voice applications, and can potentially aid government agencies to perform a large-scale investigation into the policy compliance practices of existing voice applications in the Amazon Alexa and Google Assistant platforms. Finally, this project develops static analysis techniques to assist developers in producing policy-compliant voice applications at the development phase. This project also integrates a comprehensive education and outreach plan with the proposed research to train the next generation of cybersecurity researchers in an interdisciplinary environment, and to attract more students from underrepresented groups into the cybersecurity field.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.