Physical Adversarial Example in Car Plate Recognition Systems Based on SA Algorithm

INOR—An Intelligent noise reduction method to defend against adversarial audio examples

The automatic speech recognition (ASR) system based on deep neural network is easy to be attacked by an adversarial example due to the vulnerability of neural network, which is a hot topic in recent years. The adversarial example does harm to the ASR system, especially if the common-dependent ASR goes wrong, it will lead to serious consequences. To improve the robustness and security of the ASR system, the defense method against adversarial examples must be proposed. Based on this idea, we propose an algorithm of devastation and detection on adversarial examples which can attack the current advanced ASR system. We choose advanced text-dependent and command-dependent ASR system as our target system. Generating adversarial examples by the OPT on text-dependent ASR and the GA-based algorithm on command-dependent ASR. The main idea of our method is input transformation of the adversarial examples. Different random intensities and kinds of noise are added to the adversarial examples to devastate the perturbation previously added to the normal examples. From the experimental results, the method performs well. For the devastation of examples, the original speech similarity before and after adding noise can reach 99.68%, the similarity of the adversarial examples can reach 0%, and the detection rate of the adversarial examples can reach 94%.

Increasing methods use deep learning for auto-generating speech adversarial examples that can easily lead speech recognition systems to make incorrect predictions. It is necessary to prevent the speech adversarial example generation model from being abused by any unauthorized users. It implies that, both the model and the adversarial examples generated by the model should be protected and monitored. One may build a complex access protocol to avoid the model leakage, which, however, has limited control when the model was obtained by authorized users. To deal with this problem, in this paper, we propose a method to mark the speech adversarial example generation model by optimizing a combined loss function allowing a watermark to be embedded into the generated adversarial examples. Accordingly, the resultant model not only generates speech adversarial examples that can fool the target model, but also allows us to identify the ownership by detecting watermarks from outputs. Moreover, by retrieving the watermark from an unknown speech signal, we can judge whether the speech signal is an adversarial example generated by a specific model. We have proved through experiments that the speech adversarial example generation model optimized with the proposed method can effectively deceive the state-of-the-art speech classification network and trace the source of the generated adversarial examples.

Feature-filter: Detecting adversarial examples by filtering out recessive features

Audio adversarial detection through classification score on speech recognition systems

Audio adversarial examples, imperceptible to humans, have been constructed to attack automatic speech recognition (ASR) systems. However, the adversarial examples generated by existing approaches usually incorporate noticeable noises, especially during the periods of silences and pauses. Moreover, the added noises often break temporal dependency property of the original audio, which can be easily detected by state-of-the-art defense mechanisms. In this paper, we propose a new Iterative Proportional Clipping (IPC) algorithm that preserves temporal dependency in audios for generating more robust adversarial examples. We are motivated by an observation that the temporal dependency in audios imposes a significant effect on human perception. Following our observation, we leverage a proportional clipping strategy to reduce noise during the low-intensity periods. Experimental results and user study both suggest that the generated adversarial examples can significantly reduce human-perceptible noises and resist the defenses based on the temporal structure.

Deep neural network-based synthetic aperture radar (SAR) automatic target recognition (ATR) systems are susceptible to attack by adversarial examples, which leads to misclassification by the SAR ATR system, resulting in theoretical model robustness problems and security problems in practice. Inspired by optical images, current SAR ATR adversarial example generation is performed in the image domain. However, the imaging principle of SAR images is based on the imaging of the echo signals interacting between the SAR and objects. Generating adversarial examples only in the image domain cannot change the physical world to achieve adversarial attacks. To solve these problems, this article proposes a framework for generating SAR adversarial examples in a 3D physical scene. First, adversarial attacks are implemented in the 2D image space, and the perturbation in the image space is converted into simulated rays that constitute SAR images through backpropagation optimization methods. The mapping between the simulated rays constituting SAR images and the 3D model is established through coordinate transformation, and point correspondence to triangular faces and intensity values to texture parameters are established. Thus, the simulated rays constituting SAR images are mapped to the 3D model, and the perturbation in the 2D image space is converted back to the 3D physical space to obtain the position and intensity of the perturbation in the 3D physical space, thereby achieving physical adversarial attacks. The experimental results show that our attack method can effectively perform SAR adversarial attacks in the physical world. In the digital world, we achieved an average fooling rate of up to 99.02% for three objects in six classification networks. In the physical world, we achieved an average fooling rate of up to 97.87% for these objects, with a certain degree of transferability across the six different network architectures. To the best of our knowledge, this is the first work to implement physical attacks in a full physical simulation condition. Our research establishes a theoretical foundation for the future concealment of SAR targets in practical settings and offers valuable insights for enhancing the attack and defense capabilities of subsequent DNNs in SAR ATR systems.

AdvFAS: A robust face anti-spoofing framework against adversarial examples

As a countermeasure against malicious authentication in a face recognition system using a face image obtained from SNS or the like, de-identification methods based on adversarial example have been studied. However, since adversarial example directly uses the gradient information of a face recognition model, it is highly dependent on the model, and a de-identification effect and image quality are difficult to achieve for an unknown recognition model. In this study, we propose a novel deidentification method based on a diffusion model, which has high generalizability to an unknown recognition model by applying minute changes to face shapes. Experiments using LFW showed that the proposed method has a higher de-identification effect for unknown models and better image quality than a conventional method using adversarial example.

Small perturbations can make deep models fail. Since deep models are widely used in face recognition systems (FRS) such as surveillance and access control, adversarial examples may introduce more subtle threats to face recognition systems. In this paper, we propose a practical white-box adversarial attack method. The method can automatically form a local area with key semantics on the face. The shape of the local area generated by the algorithm varies according to the environment and light of the character. Since these regions contain major facial features, we generated patch-like adversarial examples based on this region, which can effectively deceive FRS. The algorithm introduced the momentum parameter to stabilize the optimization directions. We accelerated the generation process by increasing the learning rate in segments. Compared with the traditional adversarial algorithm, our algorithms are very inconspicuous, which is very suitable for application in real scenes. The attack was verified on the CASIA WebFace and LFW datasets which were also proved to have good transferability.

DiffProtect: Generative adversarial examples using diffusion models for facial privacy protection

Automatic speech recognition (ASR) systems are now ubiquitous in many commonly used applications, as various commercial products rely on ASR techniques, which are increasingly based on machine learning, to transcribe voice commands into text for further processing. However, audio adversarial examples (AEs) have emerged as a serious security threat, as they have been shown to be able to fool ASR models into producing incorrect results. Although there are proposed methods to defend against audio AEs, the intrinsic properties of audio AEs compared with benign audio have not been well studied. In this paper, we show that the machine learning decision boundary patterns around audio AEs and benign audio are fundamentally different. In addition, using dimensionality reduction techniques, we show that these different patterns can be distinguished visually in 2D space. Based on dimensionality reduction results, this paper also demonstrates that it is feasible to detect previously unknown audio AEs using anomaly detection methods.

In this study, we investigate whether noise-augmented training can concurrently improve adversarial robustness in automatic speech recognition (ASR) systems. We conduct a comparative analysis of the adversarial robustness of four different ASR architectures, each trained under three different augmentation conditions: (1) background noise, speed variations, and reverberations; (2) speed variations only; (3) no data augmentation. We then evaluate the robustness of all resulting models against attacks with white-box or black-box adversarial examples. Our results demonstrate that noise augmentation not only enhances model performance on noisy speech but also improves the model’s robustness to adversarial attacks. • Comparative analysis: We examine for state-of-the-art automatic speech recognition (ASR) architectures under three different training conditions and evaluate their robustness with respect to white- and black-box adversarial attacks. • Practical implications: Our work has direct practical applications, as it shows that noise-augmented training, which is much cheeper than adversarial training, already helps in reducing the risks for adversarial attacks. This has not been explored in the context of automatic speech recognition yet and, thus, is a relevant contribution. • Contribution to security and privacy: Our paper provides necessary and useful insights to improve robustness against adversarial attacks.

Recently, the continuous evolution of deep learning has opened up promising avenues to groundbreaking advancements in wireless sensing systems, which significantly enhance the practical applications of WiFi-based Human Activity Recognition (HAR) systems. However, despite these strides, such systems remain susceptible to adversarial attacks. This article unveils the vulnerability of existing WiFi-based HAR systems to common adversaries, revealing their insufficient robustness. While the intuitive approach is to employ adversarial training to fortify the models, our investigation exposes inherent deficiencies in the current approach. Specifically, we confirm that the strength of perturbations directly influences training outcomes. Moreover, even when confined within a specified perturbation radius, the perturbation strength exhibits variability within a prescribed range, potentially giving rise to “extreme” samples that could compromise training results. To address this challenge, we propose a two-stage Selective Adversarial Training (SAT) approach that integrates model confidence calibration and sample selection. Specifically, we start with calibrating the model and then selectively choose samples from all adversarial examples based on the calibrated confidence outputs that align with the desired criteria for adversarial training. This sample-wise perturbation intensity control effectively prevents the inclusion of inappropriate samples in training, a capability lacking in previous domain-wise perturbation control. Our experiments demonstrate that the proposed fine-grained training method, SAT, is both straightforward and effective in augmenting adversarial training results.

Obtaining excellent speaker embedding representations can leverage the performance of a series of tasks, such as speaker/speech recognition, multi-speaker dialogue, and translation systems. The automatic speech recognition (ASR) system is trained with massive speech data and contains many speaker information. There are no existing attempts to protect the speaker embedding space of ASR from adversarial attacks. This paper proposes GhostVec, a novel method to export the speaker space from the ASR system without any external speaker verification system or real human voice as reference. More specifically, we extract speaker embedding from a transformer-based ASR system. Two kinds of targeted adversarial embedding (GhostVec) are proposed from features-level and embedding-level, respectively. The similarities are evaluated between GhostVecs and corresponding speakers randomly selected from Librispeech. Experiment results show that the proposed methods have superior performance in generating a similar embedding of the target speaker. We hope the preliminary discovery in this study to catalyze future downstream research speaker recognition-related topics.