Acoustic Adversarial Example

The perturbation must be psychoacoustically masked—inaudible or indistinguishable from background noise to human ears. Attackers leverage frequency masking and temporal masking phenomena, where louder sounds at nearby frequencies or times render the perturbation inaudible. The perturbation magnitude is typically constrained to a small Lp-norm (often L-infinity or L2) relative to the original waveform's amplitude, ensuring the modified audio sounds identical to the clean sample.

Unlike untargeted attacks that simply cause any error, acoustic adversarial examples aim for a specific, attacker-chosen transcription. The waveform is optimized so the ASR system outputs a target phrase (e.g., 'authorize transfer') while a human hears the original utterance (e.g., 'play music'). This is achieved by minimizing the Connectionist Temporal Classification (CTC) loss or sequence-to-sequence cross-entropy between the model's output distribution and the target token sequence.

For real-world attacks, the adversarial example must survive physical channel distortions. The perturbation is optimized using Expectation Over Transformation (EOT) to remain effective across varying room acoustics, microphone responses, speaker distances, and ambient noise. Without EOT, an example crafted in a digital domain fails immediately when played through a speaker and re-recorded due to reverberation, Doppler effects, and non-linear hardware distortion.

Acoustic adversarial examples exhibit cross-model transferability, where perturbations generated against one ASR model (e.g., DeepSpeech) partially fool another (e.g., Kaldi or commercial APIs). This property enables black-box attacks on proprietary systems without gradient access. Transferability is enhanced by:

• Generating examples on an ensemble of surrogate models
• Using momentum-based iterative optimization
• Crafting perturbations that align with universal, model-agnostic spectrogram features

Advanced attacks incorporate psychoacoustic models directly into the loss function to enforce imperceptibility. Rather than relying solely on Lp-norm constraints, the optimizer penalizes perturbations that exceed frequency-dependent hearing thresholds. This is formalized using auditory masking curves from perceptual audio coding standards (e.g., MP3's psychoacoustic model), ensuring the added noise is shaped to fall below the absolute threshold of hearing at each frequency band.

Gradient-based acoustic attacks can be generated in near real-time on commodity hardware. Using optimized frameworks, a short utterance (under 5 seconds) can be adversarially perturbed in under 100 milliseconds. This enables interactive attack scenarios where an adversary injects a malicious command into a live audio stream—such as a phone call or smart speaker interaction—with imperceptible latency. The speed is achieved through fast gradient sign methods and pre-computed universal perturbation bases.

An attack that embeds inaudible or obfuscated voice commands into audio streams—such as white noise, music, or ultrasonic carriers—to silently control voice assistants without the user's knowledge.

• Psychoacoustic hiding: Commands masked below human hearing thresholds using frequency masking models
• Ultrasonic upconversion: Baseband commands modulated onto ultrasonic carriers (>20kHz) that microphones nonlinearly demodulate
• DolphinAttack: Classic attack modulating voice commands onto ultrasonic carriers to control smartphones and smart speakers
• Key distinction: Unlike general acoustic adversarial examples, hidden voice commands specifically target human imperceptibility rather than just transcription alteration

A perturbation crafted to simultaneously fool multiple sensing modalities—such as vision, audio, and depth—or to exploit inconsistencies in how a model fuses cross-modal information.

• Cross-modal transfer: Audio perturbations that degrade video action recognition when models rely on sound cues
• Fusion-layer targeting: Attacks on the concatenation or attention layers where unimodal features merge
• Embodied agent threat: An acoustic adversarial example could cause a robot to mishear a navigation command while visual input remains clean, creating dangerous action discrepancies
• Audio-visual speech recognition: Perturbing the audio track to alter lip-reading model outputs in tandem

An attack on an embodied agent that injects falsified data into hardware sensors such as microphones, LiDAR, or inertial measurement units to corrupt the agent's perception of its physical environment.

• Microphone array spoofing: Injecting phase-shifted adversarial audio to manipulate beamforming direction estimates
• Acoustic injection path: Direct electromagnetic interference on MEMS microphone diaphragms bypassing air-gapped systems
• Physical realization: Playing adversarial audio through a directional speaker to target a specific agent's microphone while humans hear normal sound
• Relationship: Acoustic adversarial examples are the payload; sensor spoofing is the delivery mechanism

A defensive technique that augments the training dataset with adversarially perturbed examples labeled with the ground-truth class, forcing the model to learn robust decision boundaries.

• Audio-specific challenges: Generating adversarial examples over raw waveforms requires differentiable audio processing pipelines
• Projected Gradient Descent on spectrograms: Iteratively perturbing mel-frequency cepstral coefficients while constraining perturbation magnitude
• Psychoacoustic constraints: Incorporating frequency masking thresholds into the perturbation budget to ensure imperceptibility during training
• Limitation: Adversarially trained ASR models often show reduced clean-audio accuracy and remain vulnerable to unseen attack formulations

An adversarial attack executed without knowledge of the target model's architecture, parameters, or training data, relying instead on query access to observe input-output pairs or transferability.

• Transfer-based attacks: Crafting acoustic adversarial examples against a surrogate ASR model and playing them against the target system
• Query-based attacks: Genetic algorithms that iteratively mutate audio perturbations based on transcription feedback from cloud APIs
• Commercial ASR targeting: Black-box attacks against proprietary systems like Apple Siri, Amazon Alexa, or Google Speech-to-Text where model internals are opaque
• Practical threat model: Most real-world acoustic adversarial attacks operate in the black-box setting due to API-only access

A formal, provable guarantee that a model's prediction will not change for any input perturbation within a specified Lp-norm bound, often achieved through randomized smoothing or interval bound propagation.

• Randomized smoothing for audio: Adding Gaussian noise to raw waveforms and aggregating transcriptions to provide certified radii against L2 perturbations
• Temporal smoothing: Applying noise across time-stretched or pitch-shifted copies to certify robustness against temporal distortions
• Practical gap: Certified bounds for ASR models are typically too small to cover perceptible acoustic variations, limiting real-world deployment
• Active research area: Extending certification to sequence-to-sequence models where output length varies remains an open problem