# Adversarial Attacks and Defenses for Speech Recognition Systems

arXiv: https://arxiv.org/abs/2103.17122 · HTML: https://mlsanity.com/paper/2103.17122/

## Key facts

- Cited by 20 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 31 Mar 2021.

## Built on by (most cited first, 20 of 20)

- [LLMs Meet Multimodal Generation and Editing: A Survey](https://mlsanity.com/paper/2405.19334/) (2024)
- [Deep Transfer Learning for Automatic Speech Recognition: Towards Better Generalization](https://mlsanity.com/paper/2304.14535/) (2023)
- [Sequential Randomized Smoothing for Adversarially Robust Speech Recognition](https://mlsanity.com/paper/2112.03000/) (2021)
- [There is more than one kind of robustness: Fooling Whisper with adversarial examples](https://mlsanity.com/paper/2210.17316/) (2022)
- [A Survey on AI Sustainability: Emerging Trends on Learning Algorithms and Research Challenges](https://mlsanity.com/paper/2205.03824/) (2022)
- [Real-Time Neural Voice Camouflage](https://mlsanity.com/paper/2112.07076/) (2021)
- [Adversarial Attacks on Speech Recognition Systems for Mission-Critical Applications: A Survey](https://mlsanity.com/paper/2202.10594/) (2022)
- [Arabic Synonym BERT-based Adversarial Examples for Text Classification](https://mlsanity.com/paper/2402.03477/) (2024)
- [Perceptual-based deep-learning denoiser as a defense against adversarial attacks on ASR systems](https://mlsanity.com/paper/2107.05222/) (2021)
- [Mitigating Closed-model Adversarial Examples with Bayesian Neural Modeling for Enhanced End-to-End Speech Recognition](https://mlsanity.com/paper/2202.08532/) (2022)
- [Defensive Distillation based Adversarial Attacks Mitigation Method for Channel Estimation using Deep Learning Models in Next-Generation Wireless Networks](https://mlsanity.com/paper/2208.10279/) (2022)
- [Detecting Adversarial Examples](https://mlsanity.com/paper/2410.17442/) (2024)
- [Universal and Efficient Detection of Adversarial Data through Nonuniform Impact on Network Layers](https://mlsanity.com/paper/2506.20816/) (2025)
- [Mel Frequency Spectral Domain Defenses against Adversarial Attacks on Speech Recognition Systems](https://mlsanity.com/paper/2203.15283/) (2022)
- [Comparative Study on Noise-Augmented Training and its Effect on Adversarial Robustness in ASR Systems](https://mlsanity.com/paper/2409.01813/) (2024)
- [A Tutorial on Clinical Speech AI Development: From Data Collection to Model Validation](https://mlsanity.com/paper/2410.21640/) (2024)
- [Quantifying the Risk of Transferred Black Box Attacks](https://mlsanity.com/paper/2511.05102/) (2025)
- [Hear No Evil: Towards Adversarial Robustness of Automatic Speech Recognition via Multi-Task Learning](https://mlsanity.com/paper/2204.02381/) (2022)
- [Measuring Equality in Machine Learning Security Defenses: A Case Study in Speech Recognition](https://mlsanity.com/paper/2302.08973/) (2023)
- [Empirical evaluation of the Frank-Wolfe methods for constructing white-box adversarial attacks](https://mlsanity.com/paper/2512.10936/) (2025)

## Abstract (arXiv)

The ubiquitous presence of machine learning systems in our lives necessitates research into their vulnerabilities and appropriate countermeasures. In particular, we investigate the effectiveness of adversarial attacks and defenses against automatic speech recognition (ASR) systems. We select two ASR models - a thoroughly studied DeepSpeech model and a more recent Espresso framework Transformer encoder-decoder model. We investigate two threat models: a denial-of-service scenario where fast gradient-sign method (FGSM) or weak projected gradient descent (PGD) attacks are used to degrade the model's word error rate (WER); and a targeted scenario where a more potent imperceptible attack forces the system to recognize a specific phrase. We find that the attack transferability across the investigated ASR systems is limited. To defend the model, we use two preprocessing defenses: randomized smoothing and WaveGAN-based vocoder, and find that they significantly improve the model's adversarial robustness. We show that a WaveGAN vocoder can be a useful countermeasure to adversarial attacks on ASR systems - even when it is jointly attacked with the ASR, the target phrases' word error rate is high.