CAREER: Ensuring Privacy, Inclusiveness, and Policy Compliance in the Era of Voice Personal Assistants

亚马逊Alexa和谷歌助手等语音个人助理在国内和企业中的普及率都在迅速上升。尽管它们提供了许多方便的功能，但它们也对最终用户带来了安全和隐私以及内容安全相关风险的担忧。在与语音助手的交互期间，用户期望语音助手在不损害隐私或暴露于不安全内容的情况下满足他们的请求，并且在自动语音识别方面不会经历种族或性别差异。该项目的创新之处在于新技术和机制，以确保语音助理系统的隐私性、包容性和政策合规性。该项目更广泛的意义和重要性包括：1）通过各种宣传和教育活动，提高K-12社区对网络安全的普遍认识; 2）培训下一代网络安全研究人员，特别是代表性不足和少数民族; 3）通过开发新的课程材料和动手实验室加强网络安全教育。该项目首先开发了一个语音-基于隐私通知机制，使用户（特别是视障用户）能够通过语音通道做出知情的隐私决定。它为可访问和包容性的隐私通知创建了一个新的范例。然后，该项目提出了一个基于机器学习的动态分析框架，该框架允许系统地评估语音助理系统中的政策遵从性和社会偏见。用户可以使用它来检查语音应用程序中的任何隐私或内容安全违规行为，并可能帮助政府机构对亚马逊Alexa和Google Assistant平台中现有语音应用程序的政策合规性做法进行大规模调查。最后，本项目开发静态分析技术，以帮助开发人员在开发阶段产生符合政策的语音应用程序。该项目还整合了一个全面的教育和推广计划与拟议的研究，以培养下一代网络安全研究人员在跨学科的环境中，并吸引更多的学生从代表性不足的群体进入网络安全领域。该奖项反映了NSF的法定使命，并已被认为是值得支持的评估使用基金会的智力价值和更广泛的影响审查标准。

Voice personal assistants such as Amazon Alexa and Google Assistant are rapidly gaining in both domestic and business popularity. Despite many convenient features they provide, concerns have been raised about the security and privacy, and content safety related risks to end users they also pose. During the interaction with voice assistants, users expect the voice assistants to fulfill their requests without compromising the privacy or being exposed to unsafe content, and without experiencing racial or gender disparities in terms of the automated speech recognition. The project’s novelties are new techniques and mechanisms to ensure privacy, inclusiveness, and policy compliance in voice assistant systems. The project's broader significance and importance include 1) increasing general awareness of cybersecurity in the K-12 community through various outreach and educational activities; 2) training the next generation of cybersecurity researchers especially underrepresented and minorities; and 3) strengthening cybersecurity education by developing new course materials and hands-on labs.This project first develops a voice-based privacy notice mechanism to enable users (in particular, visually impaired users) to make informed privacy decisions through the voice channel. It creates a new paradigm for accessible and inclusive privacy notification. This project then proposes a machine learning-based dynamic analysis framework, which allows a systematic evaluation of policy compliance and social biases in voice assistant systems. It can be used by users to check for any privacy or content safety violations in voice applications, and can potentially aid government agencies to perform a large-scale investigation into the policy compliance practices of existing voice applications in the Amazon Alexa and Google Assistant platforms. Finally, this project develops static analysis techniques to assist developers in producing policy-compliant voice applications at the development phase. This project also integrates a comprehensive education and outreach plan with the proposed research to train the next generation of cybersecurity researchers in an interdisciplinary environment, and to attract more students from underrepresented groups into the cybersecurity field.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.