关键词: 对抗攻击, 语音识别, 黑盒攻击, 样本生成, 量子粒子群算法, 梯度评估方法

Abstract: System vulnerability can be detected by adversarial attack to improve system robustness. However, the parameter information of the system is required before adversarial attack, which makes the attack conditions limited. Therefore, combined with a new quantum particle swarm optimization algorithm, a black box targeted adversarial attack method is proposed. By adding small noise to the original example, the differentiated particle swarm is constructed as the initial antagonistic sample population. The global optimal particle of the current population is obtained based on the domain redistribution strategy of memory search, and the initial adversarial example is generated. To make the population closer to the target, the integration of expansion and adaptive weight position updating is performed. According to the editing distance between the adversarial example and the target statement, the initial adversarial example is optimized and the final adversarial example is generated. In order to verify the attack effect of the method, the speech recognition model DeepSpeech is experimented on Google Speech, LibriSpeech and Common Voice datasets. The target phrases are set as common voice commands in various scenarios. Experimental results show that the success rate of the proposed method is better than that of the compared method on the three datasets, and the success rate on the Common Voice dataset is 10 percentage points higher than that of the compared method. At the same time, volunteers are recruited to evaluate the noise intensity of the generated adversarial examples subjectively, and 82.4% of adversarial examples are judged by volunteers as no noise or little noise.

Key words: adversarial attack, speech recognition, black-box attack, example generation, quantum particle swarm optimization algorithm, gradient evaluation method