DistriBlock: Identifying adversarial audio samples by leveraging characteristics of the output distribution

arXiv:2305.17000v2 Announce Type: replace-cross
Abstract: Adversarial attacks can mislead automatic speech recognition (ASR) systems into predicting an arbitrary target text, thus posing a clear security threat. To prevent such attacks, we propose DistriBlock, an efficient detection strategy applicable to any ASR system that predicts a probability distribution over output tokens in each time step. We measure a set of characteristics of this distribution: the median, maximum, and minimum over the output probabilities, the entropy of the distribution, as well as …

abstract adversarial adversarial attacks arxiv asr attacks audio automatic speech recognition clear cs.cr cs.lg cs.sd detection distribution eess.as probability recognition samples security speech speech recognition strategy systems text threat type