Imperio: Robust Over-the-Air Adversarial Examples for Automatic Speech Recognition Systems

Previous research showed that automatic speech recognition (ASR) systems can be fooled via adversarial examples. These can induce the ASR system to produce an arbitrary transcription in response to any type of audio signal. Unfortunately, the adversarial examples introduced in prior work did not work in a real-world setup, where the attack is played over the air. Instead, most examples rather have to be fed directly into the ASR system, ignoring practical side-effects such as reflections. In the few cases where the adversarial examples have been successfully demonstrated over the air, the attacks were not transferable between environments, but instead required precise information about the room where the attack was to take place. The remaining over-the-air attacks in the literature are either handcrafted examples or human listeners can easily recognize the target transcription once they have been alerted to its content. We demonstrate the first algorithm that produces generic adversarial examples, which remain robust in an over-the-air attack that is not adapted to the specific environment. Hence, no prior knowledge of the room characteristics is required. Instead, we use room impulse responses to compute robust adversarial examples for arbitrary room characteristics and employ the open-source ASR system Kaldi to demonstrate a full end-to-end attack. Further, we utilize psychoacoustic masking to hide the changes of the original audio signal below the human thresholds of hearing. We show that the adversarial examples work for varying room setups and that no line-of-sight between speaker and microphone is necessary. As a result, an attacker can optimize adversarial examples for any kind of target transcription, based on any kind of audio content, for arbitrary room setups without any prior knowledge. Additionally, the adversarial examples remain transferable across a wide range of rooms.