mlsanityData to 7 Oct 2026

SoK: A Modularized Approach to Study the Security of Automatic Speech Recognition Systems

arXiv 2103.10651 ↗First posted 19 Mar 2021cs.CR cs.LG cs.SDcited by 4

Not on the map. Why?

Abstract (arXiv)

With the wide use of Automatic Speech Recognition (ASR) in applications such as human machine interaction, simultaneous interpretation, audio transcription, etc., its security protection becomes increasingly important. Although recent studies have brought to light the weaknesses of popular ASR systems that enable out-of-band signal attack, adversarial attack, etc., and further proposed various remedies (signal smoothing, adversarial training, etc.), a systematic understanding of ASR security (both attacks and defenses) is still missing, especially on how realistic such threats are and how general existing protection could be. In this paper, we present our systematization of knowledge for ASR security and provide a comprehensive taxonomy for existing work based on a modularized workflow. More importantly, we align the research in this domain with that on security in Image Recognition System (IRS), which has been extensively studied, using the domain knowledge in the latter to help understand where we stand in the former. Generally, both IRS and ASR are perceptual systems. Their similarities allow us to systematically study existing literature in ASR security based on the spectrum of attacks and defense solutions proposed for IRS, and pinpoint the directions of more advanced attacks and the directions potentially leading to more effective protection in ASR. In contrast, their differences, especially the complexity of ASR compared with IRS, help us learn unique challenges and opportunities in ASR security. Particularly, our experimental study shows that transfer learning across ASR models is feasible, even in the absence of knowledge about models (even their types) and training data.

Key facts. Cited by 4 papers in the map (data through 7 Oct 2026). Builds on 75 of its 170 references that are in the map. First posted on arXiv 19 Mar 2021.

Builds on

75 of 170 references.

References · 75

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2013Intriguing properties of neural networkscited by 5,114
  4. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  5. 2016Adversarial examples in the physical worldcited by 1,762
  6. 2016Adversarial Machine Learning at Scalecited by 934
  7. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  8. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  9. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  10. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
  11. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  12. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
38 more
  1. 2017One pixel attack for fooling deep neural networkscited by 579
  2. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  3. 2015Deep Speech 2: End-to-End Speech Recognition in English and Mandarincited by 449
  4. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  5. 2017MagNet: a Two-Pronged Defense against Adversarial Examplescited by 268
  6. 2018Audio Adversarial Examples: Targeted Attacks on Speech-to-Textcited by 268
  7. 2017Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradientscited by 236
  8. 2019Enhancing Adversarial Example Transferability with an Intermediate Level Attackcited by 139
  9. 2019Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognitioncited by 123
  10. 2020Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor Attack and Countermeasurescited by 95
  11. 2019Lingvo: a Modular and Scalable Framework for Sequence-to-Sequence Modelingcited by 86
  12. 2018Adversarial Attacks Against Automatic Speech Recognition Systems via Psychoacoustic Hidingcited by 83
  13. 2019Who is Real Bob? Adversarial Attacks on Speaker Recognition Systemscited by 66
  14. 2017DolphinAtack: Inaudible Voice Commandscited by 65
  15. 2018CommanderSong: A Systematic Approach for Practical Adversarial Voice Recognitioncited by 63
  16. 2015Adversarial Manipulation of Deep Representationscited by 56
  17. 2019Speech2Face: Learning the Face Behind a Voicecited by 55
  18. 2019Stateful Detection of Black-Box Adversarial Attackscited by 55
  19. 2017Houdini: Fooling Deep Structured Prediction Modelscited by 50
  20. 2018Did you hear that? Adversarial Examples Against Automatic Speech Recognitioncited by 48
  21. 2020SoK: The Faults in our ASRs: An Overview of Attacks against Automatic Speech Recognition and Speaker Identification Systemscited by 46
  22. 2016Wav2Letter: an End-to-End ConvNet-based Speech Recognition Systemcited by 43
  23. 2018Robust Audio Adversarial Example for a Physical Attackcited by 42
  24. 2018Targeted Adversarial Examples for Black Box Audio Systemscited by 41
  25. 2019Universal Adversarial Perturbations for Speech Recognition Systemscited by 41
  26. 2018Fooling End-to-end Speaker Verification by Adversarial Examplescited by 39
  27. 2021WaveGuard: Understanding and Mitigating Audio Adversarial Examplescited by 39
  28. 2019Curls & Whey: Boosting Black-Box Adversarial Attackscited by 37
  29. 2019Hear "No Evil", See "Kenansville": Efficient and Transferable Black-Box Attacks on Speech Recognition and Voice Identification Systemscited by 37
  30. 2018Characterizing Audio Adversarial Examples Using Temporal Dependencycited by 34
  31. 2019Practical Hidden Voice Attacks against Speech and Speaker Recognition Systemscited by 34
  32. 2019SirenAttack: Generating Adversarial Audio for End-to-End Acoustic Systemscited by 33
  33. 2020Enabling Fast and Universal Audio Adversarial Attack Using Generative Modelcited by 31
  34. 2017Crafting Adversarial Examples For Speech Paralinguistics Applicationscited by 30
  35. 2020Real-time, Universal, and Robust Adversarial Attacks Against Speaker Recognition Systemscited by 26
  36. 2019Adversarial Attacks on Spoofing Countermeasures of automatic speaker verificationcited by 23
  37. 2019Adversarial Attacks on GMM i-vector based Speaker Verification Systemscited by 23
  38. 2019Adversarial Music: Real World Audio Adversary Against Wake-word Detection Systemcited by 20

50 most cited of 75 All 75 (JSON)

Built on by

Cited by year

Citing papers per year: 2021: 2; 2022: 1; 2023: 1.

4 papers.

  1. 2022Towards Understanding and Mitigating Audio Adversarial Examples for Speaker Recognitioncited by 22
  2. 2021SEC4SR: A Security Analysis Platform for Speaker Recognitioncited by 3
  3. 2023Towards the Transferable Audio Adversarial Attack via Ensemble Methodscited by 1
  4. 2021SoK: A Study of the Security on Voice Processing Systemscited by 0