# Beyond Lp clipping: Equalization-based Psychoacoustic Attacks against ASRs

arXiv: https://arxiv.org/abs/2110.13250 · HTML: https://mlsanity.com/paper/2110.13250/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 25 Oct 2021.

## Built on by (most cited first, 4 of 4)

- [Catch Me If You Can: Blackbox Adversarial Attacks on Automatic Speech Recognition using Frequency Masking](https://mlsanity.com/paper/2112.01821/) (2021)
- [Attacks as Defenses: Designing Robust Audio CAPTCHAs Using Attacks on Automatic Speech Recognition Systems](https://mlsanity.com/paper/2203.05408/) (2022)
- [Hearing the Unspoken: Language Model Priors for Acoustic Adversarial Attacks](https://mlsanity.com/paper/2606.06833/) (2026)
- [The Perceived Fragility of Explanations in Audio Models: Manipulation of Attribution with Unchanged Predictions](https://mlsanity.com/paper/2606.14466/) (2026)

## Abstract (arXiv)

Automatic Speech Recognition (ASR) systems convert speech into text and can be placed into two broad categories: traditional and fully end-to-end. Both types have been shown to be vulnerable to adversarial audio examples that sound benign to the human ear but force the ASR to produce malicious transcriptions. Of these attacks, only the "psychoacoustic" attacks can create examples with relatively imperceptible perturbations, as they leverage the knowledge of the human auditory system. Unfortunately, existing psychoacoustic attacks can only be applied against traditional models, and are obsolete against the newer, fully end-to-end ASRs. In this paper, we propose an equalization-based psychoacoustic attack that can exploit both traditional and fully end-to-end ASRs. We successfully demonstrate our attack against real-world ASRs that include DeepSpeech and Wav2Letter. Moreover, we employ a user study to verify that our method creates low audible distortion. Specifically, 80 of the 100 participants voted in favor of all our attack audio samples as less noisier than the existing state-of-the-art attack. Through this, we demonstrate both types of existing ASR pipelines can be exploited with minimum degradation to attack audio quality.