Zero-Query Adversarial Attack on Black-box Automatic Speech Recognition Systems
<|reference_start|>Zero-Query Adversarial Attack on Black-box Automatic Speech Recognition Systems: In recent years, extensive research has been conducted on the vulnerability of ASR systems, revealing that black-box adversarial example attacks pose significant threats to real-world ASR systems. However, most existing black-box attacks rely on queries to the target ASRs, which is impractical when queries are not permitted. In this paper, we propose ZQ-Attack, a transfer-based adversarial attack on ASR systems in the zero-query black-box setting. Through a comprehensive review and categorization of modern ASR technologies, we first meticulously select surrogate ASRs of diverse types to generate adversarial examples. Following this, ZQ-Attack initializes the adversarial perturbation with a scaled target command audio, rendering it relatively imperceptible while maintaining effectiveness. Subsequently, to achieve high transferability of adversarial perturbations, we propose a sequential ensemble optimization algorithm, which iteratively optimizes the adversarial perturbation on each surrogate model, leveraging collaborative information from other models. We conduct extensive experiments to evaluate ZQ-Attack. In the over-the-line setting, ZQ-Attack achieves a 100% success rate of attack (SRoA) with an average signal-to-noise ratio (SNR) of 21.91dB on 4 online speech recognition services, and attains an average SRoA of 100% and SNR of 19.67dB on 16 open-source ASRs. For commercial intelligent voice control devices, ZQ-Attack also achieves a 100% SRoA with an average SNR of 15.77dB in the over-the-air setting.<|reference_end|>
@article{fang2024zero-query,
    title={Zero-Query Adversarial Attack on Black-box Automatic Speech Recognition
  Systems},
    author={Zheng Fang, Tao Wang, Lingchen Zhao, Shenyi Zhang, Bowen Li, Yunjie
  Ge, Qi Li, Chao Shen, Qian Wang},
    journal={arXiv preprint arXiv:2406.19311},
    year={2024},
    archivePrefix={arXiv},
    eprint={2406.19311},
    primaryClass={cs.CR cs.SD eess.AS}
}