# Robust Audio Adversarial Example for a Physical Attack

arXiv: https://arxiv.org/abs/1810.11793 · HTML: https://mlsanity.com/paper/1810.11793/

## Key facts

- Cited by 44 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 Oct 2018.

## Built on by (most cited first, 30 of 44)

- [WaveGuard: Understanding and Mitigating Audio Adversarial Examples](https://mlsanity.com/paper/2103.03344/) (2021)
- [Black-box Adversarial Attacks on Commercial Speech Platforms with Minimal Information](https://mlsanity.com/paper/2110.09714/) (2021)
- [Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspective](https://mlsanity.com/paper/2302.09457/) (2023)
- [Improving the Adversarial Robustness for Speaker Verification by Self-Supervised Learning](https://mlsanity.com/paper/2106.00273/) (2021)
- [The Best Defense is a Good Offense: Adversarial Augmentation against Adversarial Attacks](https://mlsanity.com/paper/2305.14188/) (2023)
- [Sequential Randomized Smoothing for Adversarially Robust Speech Recognition](https://mlsanity.com/paper/2112.03000/) (2021)
- [A Review of Speech-centric Trustworthy Machine Learning: Privacy, Safety, and Fairness](https://mlsanity.com/paper/2212.09006/) (2022)
- [Voting for the right answer: Adversarial defense for speaker verification](https://mlsanity.com/paper/2106.07868/) (2021)
- [DIMBA: Discretely Masked Black-Box Attack in Single Object Tracking](https://mlsanity.com/paper/2207.08044/) (2022)
- [SoK: Machine Learning Governance](https://mlsanity.com/paper/2109.10870/) (2021)
- [Adversarial Examples in the Physical World: A Survey](https://mlsanity.com/paper/2311.01473/) (2023)
- [Characterizing the adversarial vulnerability of speech self-supervised learning](https://mlsanity.com/paper/2111.04330/) (2021)
- [Real-Time Neural Voice Camouflage](https://mlsanity.com/paper/2112.07076/) (2021)
- [ALIF: Low-Cost Adversarial Audio Attacks on Black-Box Speech Platforms using Linguistic Features](https://mlsanity.com/paper/2408.01808/) (2024)
- [Multi-Discriminator Sobolev Defense-GAN Against Adversarial Attacks for End-to-End Speech Systems](https://mlsanity.com/paper/2103.08086/) (2021)
- [SoK: A Modularized Approach to Study the Security of Automatic Speech Recognition Systems](https://mlsanity.com/paper/2103.10651/) (2021)
- [Transferable Adversarial Attacks against ASR](https://mlsanity.com/paper/2411.09220/) (2024)
- [Towards Robust Speech-to-Text Adversarial Attack](https://mlsanity.com/paper/2103.08095/) (2021)
- [SEC4SR: A Security Analysis Platform for Speaker Recognition](https://mlsanity.com/paper/2109.01766/) (2021)
- [Perception-Aware Attack: Creating Adversarial Music via Reverse-Engineering Human Perception](https://mlsanity.com/paper/2207.13192/) (2022)
- [Push-Pull: Characterizing the Adversarial Robustness for Audio-Visual Active Speaker Detection](https://mlsanity.com/paper/2210.00753/) (2022)
- [Application of Adversarial Examples to Physical ECG Signals](https://mlsanity.com/paper/2108.08972/) (2021)
- [Mitigating Closed-model Adversarial Examples with Bayesian Neural Modeling for Enhanced End-to-End Speech Recognition](https://mlsanity.com/paper/2202.08532/) (2022)
- [On the robustness of non-intrusive speech quality model by adversarial examples](https://mlsanity.com/paper/2211.06508/) (2022)
- [Towards Evaluating the Robustness of Automatic Speech Recognition Systems via Audio Style Transfer](https://mlsanity.com/paper/2405.09470/) (2024)
- [Catch Me If You Can: Blackbox Adversarial Attacks on Automatic Speech Recognition using Frequency Masking](https://mlsanity.com/paper/2112.01821/) (2021)
- [Attacks as Defenses: Designing Robust Audio CAPTCHAs Using Attacks on Automatic Speech Recognition Systems](https://mlsanity.com/paper/2203.05408/) (2022)
- [Disappeared Command: Spoofing Attack On Automatic Speech Recognition Systems with Sound Masking](https://mlsanity.com/paper/2204.08977/) (2022)
- [Universal Fourier Attack for Time Series](https://mlsanity.com/paper/2209.00757/) (2022)
- [Group-based Robustness: A General Framework for Customized Robustness in the Real World](https://mlsanity.com/paper/2306.16614/) (2023)

## Abstract (arXiv)

We propose a method to generate audio adversarial examples that can attack a state-of-the-art speech recognition model in the physical world. Previous work assumes that generated adversarial examples are directly fed to the recognition model, and is not able to perform such a physical attack because of reverberation and noise from playback environments. In contrast, our method obtains robust adversarial examples by simulating transformations caused by playback or recording in the physical world and incorporating the transformations into the generation process. Evaluation and a listening experiment demonstrated that our adversarial examples are able to attack without being noticed by humans. This result suggests that audio adversarial examples generated by the proposed method may become a real threat.