# Enabling Fast and Universal Audio Adversarial Attack Using Generative Model

arXiv: https://arxiv.org/abs/2004.12261 · HTML: https://mlsanity.com/paper/2004.12261/

## Key facts

- Cited by 32 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 26 Apr 2020.

## Built on by (most cited first, 30 of 32)

- [A Survey On Universal Adversarial Attack](https://mlsanity.com/paper/2103.01498/) (2021)
- [A Zeroth-Order Block Coordinate Descent Algorithm for Huge-Scale Black-Box Optimization](https://mlsanity.com/paper/2102.10707/) (2021)
- [Towards Understanding and Mitigating Audio Adversarial Examples for Speaker Recognition](https://mlsanity.com/paper/2206.03393/) (2022)
- [Enhancing Generalization of Universal Adversarial Perturbation through Gradient Aggregation](https://mlsanity.com/paper/2308.06015/) (2023)
- [Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspective](https://mlsanity.com/paper/2302.09457/) (2023)
- [Fast Adversarial Training with Smooth Convergence](https://mlsanity.com/paper/2308.12857/) (2023)
- [Recent improvements of ASR models in the face of adversarial attacks](https://mlsanity.com/paper/2203.16536/) (2022)
- [There is more than one kind of robustness: Fooling Whisper with adversarial examples](https://mlsanity.com/paper/2210.17316/) (2022)
- [AS2T: Arbitrary Source-To-Target Adversarial Attack on Speaker Recognition Systems](https://mlsanity.com/paper/2206.03351/) (2022)
- [GE-AdvGAN: Improving the transferability of adversarial samples by gradient editing-based adversarial generative model](https://mlsanity.com/paper/2401.06031/) (2024)
- [Who Can Withstand Chat-Audio Attacks? An Evaluation Benchmark for Large Audio-Language Models](https://mlsanity.com/paper/2411.14842/) (2024)
- [LCANets++: Robust Audio Classification using Multi-layer Neural Networks with Lateral Competition](https://mlsanity.com/paper/2308.12882/) (2023)
- [ROOM: Adversarial Machine Learning Attacks Under Real-Time Constraints](https://mlsanity.com/paper/2201.01621/) (2022)
- [Enrollment-stage Backdoor Attacks on Speaker Recognition Systems via Adversarial Ultrasound](https://mlsanity.com/paper/2306.16022/) (2023)
- [SoK: A Modularized Approach to Study the Security of Automatic Speech Recognition Systems](https://mlsanity.com/paper/2103.10651/) (2021)
- [RIBAC: Towards Robust and Imperceptible Backdoor Attack against Compact DNN](https://mlsanity.com/paper/2208.10608/) (2022)
- [Improving Generalization of Universal Adversarial Perturbation via Dynamic Maximin Optimization](https://mlsanity.com/paper/2503.12793/) (2025)
- [SEC4SR: A Security Analysis Platform for Speaker Recognition](https://mlsanity.com/paper/2109.01766/) (2021)
- [Data-Driven Lipschitz Continuity: A Cost-Effective Approach to Improve Adversarial Robustness](https://mlsanity.com/paper/2406.19622/) (2024)
- [LMD: A Learnable Mask Network to Detect Adversarial Examples for Speaker Verification](https://mlsanity.com/paper/2211.00825/) (2022)
- [Towards Evaluating the Robustness of Automatic Speech Recognition Systems via Audio Style Transfer](https://mlsanity.com/paper/2405.09470/) (2024)
- [Whispering Under the Eaves: Protecting User Privacy Against Commercial and LLM-powered Automatic Speech Recognition Systems](https://mlsanity.com/paper/2504.00858/) (2025)
- [Symmetric Saliency-based Adversarial Attack To Speaker Identification](https://mlsanity.com/paper/2210.16777/) (2022)
- [STAA-Net: A Sparse and Transferable Adversarial Attack for Speech Emotion Recognition](https://mlsanity.com/paper/2402.01227/) (2024)
- [Investigating Vulnerabilities and Defenses Against Audio-Visual Attacks: A Comprehensive Survey Emphasizing Multimodal Models](https://mlsanity.com/paper/2506.11521/) (2025)
- [Interpretable Spectrum Transformation Attacks to Speaker Recognition](https://mlsanity.com/paper/2302.10686/) (2023)
- [AudioFool: Fast, Universal and synchronization-free Cross-Domain Attack on Speech Recognition](https://mlsanity.com/paper/2309.11462/) (2023)
- [Are Deep Speech Denoising Models Robust to Adversarial Noise?](https://mlsanity.com/paper/2503.11627/) (2025)
- [Novel Loss-Enhanced Universal Adversarial Patches for Sustainable Speaker Privacy](https://mlsanity.com/paper/2505.19951/) (2025)
- [Exploiting Neural Audio Codec Latents for Adversarial Audio Attacks](https://mlsanity.com/paper/2606.20893/) (2026)

## Abstract (arXiv)

Recently, the vulnerability of DNN-based audio systems to adversarial attacks has obtained the increasing attention. However, the existing audio adversarial attacks allow the adversary to possess the entire user's audio input as well as granting sufficient time budget to generate the adversarial perturbations. These idealized assumptions, however, makes the existing audio adversarial attacks mostly impossible to be launched in a timely fashion in practice (e.g., playing unnoticeable adversarial perturbations along with user's streaming input). To overcome these limitations, in this paper we propose fast audio adversarial perturbation generator (FAPG), which uses generative model to generate adversarial perturbations for the audio input in a single forward pass, thereby drastically improving the perturbation generation speed. Built on the top of FAPG, we further propose universal audio adversarial perturbation generator (UAPG), a scheme crafting universal adversarial perturbation that can be imposed on arbitrary benign audio input to cause misclassification. Extensive experiments show that our proposed FAPG can achieve up to 167X speedup over the state-of-the-art audio adversarial attack methods. Also our proposed UAPG can generate universal adversarial perturbation that achieves much better attack performance than the state-of-the-art solutions.