# Adversarial Example Detection by Classification for Deep Speech Recognition

arXiv: https://arxiv.org/abs/1910.10013 · HTML: https://mlsanity.com/paper/1910.10013/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 22 Oct 2019.

## Built on by (most cited first, 10 of 10)

- [Can You Hear It? Backdoor Attacks via Ultrasonic Triggers](https://mlsanity.com/paper/2107.14569/) (2021)
- [SoK: A Modularized Approach to Study the Security of Automatic Speech Recognition Systems](https://mlsanity.com/paper/2103.10651/) (2021)
- [A Backdoor Approach with Inverted Labels Using Dirty Label-Flipping Attacks](https://mlsanity.com/paper/2404.00076/) (2024)
- [Adversarial Attacks on Speech Recognition Systems for Mission-Critical Applications: A Survey](https://mlsanity.com/paper/2202.10594/) (2022)
- [Arabic Synonym BERT-based Adversarial Examples for Text Classification](https://mlsanity.com/paper/2402.03477/) (2024)
- [Detecting and Defending Against Adversarial Attacks on Automatic Speech Recognition via Diffusion Models](https://mlsanity.com/paper/2409.07936/) (2024)
- [Leveraging Domain Features for Detecting Adversarial Attacks Against Deep Speech Recognition in Noise](https://mlsanity.com/paper/2211.01621/) (2022)
- [Gradient Norm-based Fine-Tuning for Backdoor Defense in Automatic Speech Recognition](https://mlsanity.com/paper/2502.01152/) (2025)
- [SpeechGuard: Online Defense against Backdoor Attacks on Speech Recognition Models](https://mlsanity.com/paper/2607.15697/) (2026)
- [Natural Backdoor Attacks on Speech Recognition Models](https://mlsanity.com/paper/2607.15724/) (2026)

## Abstract (arXiv)

Machine Learning systems are vulnerable to adversarial attacks and will highly likely produce incorrect outputs under these attacks. There are white-box and black-box attacks regarding to adversary's access level to the victim learning algorithm. To defend the learning systems from these attacks, existing methods in the speech domain focus on modifying input signals and testing the behaviours of speech recognizers. We, however, formulate the defense as a classification problem and present a strategy for systematically generating adversarial example datasets: one for white-box attacks and one for black-box attacks, containing both adversarial and normal examples. The white-box attack is a gradient-based method on Baidu DeepSpeech with the Mozilla Common Voice database while the black-box attack is a gradient-free method on a deep model-based keyword spotting system with the Google Speech Command dataset. The generated datasets are used to train a proposed Convolutional Neural Network (CNN), together with cepstral features, to detect adversarial examples. Experimental results show that, it is possible to accurately distinct between adversarial and normal examples for known attacks, in both single-condition and multi-condition training settings, while the performance degrades dramatically for unknown attacks. The adversarial datasets and the source code are made publicly available.