CHARACTERIZING AUDIO ADVERSARIAL EXAMPLES USING TEMPORAL DEPENDENCY
Recent studies have highlighted adversarial examples as a ubiquitous threat to different neural network models and many downstream applications. Nonetheless, as unique data properties have inspired distinct and powerful learning principles, this paper aims to explore their potentials towards mitigating adversarial inputs. In particular, our results reveal the importance of using the temporal dependency in audio data to gain discriminate power against adversarial examples. Tested on the automatic speech recognition (ASR) tasks and three recent audio adversarial attacks, we find that (i) input transformation developed from image adversarial defense provides limited robustness improvement and is subtle to advanced attacks; (ii) temporal dependency can be exploited to gain discriminative power against audio adversarial examples and is resistant to adaptive attacks considered in our experiments. Our results not only show promising means of improving the robustness of ASR systems but also offer novel insights in exploiting domain-specific data properties to mitigate negative effects of adversarial examples.
This paper investigates adversarial examples for audio data. The standard defense techniques proposed for images are studied in the context of audio. It is shown that these techniques are somewhat robust to adversarial attacks, but fail against adaptive attacks. A method exploiting the temporal dependencies of the data is then presented and shown to be robust to adversarial examples and to adaptive attacks.
The paper addresses an important issue, and the two main findings of the paper, the transformation methods used in computer vision are not useful against audio adversarial example and using temporal dependencies improves the defense capability are significant. The proposed TD method is novel.
The first part of the paper is easy to read (Section 1-3), but Section 4 is hard to follow, for the following reasons:
* Section 4.1 presents the metrics used in the evaluation, which is nice. But in the following subsections, other metrics are used: effectiveness ratio, detection rate and relative perturbation. They should be clearly defined in 4.1, and the authors should discuss why they used these metrics.
* Section 4.2 should be reorganized as it is hard to follow: there are three types of attack, so one subsection per attack should make the section clearer.
* It's not always clear what each attack is doing and why it is used. I suggest the authors to have a separate subsection with the description of each attack and the motivation of why it is used.
Because of the above, it's hard to clearly assess the performance of each method for each attack, it would be better to have a Table that summarizes the results for the transformation methods. Also, I don't understand the statement in 4.2: "We report that the autoencoder works fine for transforming benign instances (57.6% WER in Common Voice compared to 27.5%)": given that it's not an attack, the PER should be the same with and without transform, as we don't want the transform to affect non-adversarial examples ? Please clarify that.
The experiments on the proposed TD method are clear enough to show the viability of the approach.
Overall, the findings of this paper are significant and it is good step towards audio adversarial examples defense. But the experimental part is hard to follow and does not bring a clear picture. I am still willing to accept the paper if the authors improve and clarify Section 4.
Revision after rebuttal:
The new version is definitely clearer and easier to read, hence I support the paper for acceptance and change my rating to 7. 
There are still minor improvements that can be done in Section 4 to improve the overall clarity:
* About the metrics, the "Average attack success rate" and the "Target command recognition rate" should be clearly defined, probably under the description of the attack methods.
* The Adaptive attack approach could be introduced unter "Attack methods" in 4.1.
* Table 4 is not easy to read, the authors should improve it.
* The first paragraph in Section 4 ("The presentation flows ...") is very interesting, but almost reads like a conclusion, so maybe the authors could move that to the end of Section 4 or to Section 5.