Audio Adversarial Examples: Targeted Attacks on Speech-to-Text

We construct targeted audio adversarial examples on automatic speech recognition. Given any audio waveform, we can produce another that is over 99.9% similar, but transcribes as any phrase we choose (recognizing up to 50 characters per second of audio). We apply our white-box iterative optimization-based attack to Mozilla's implementation DeepSpeech end-to-end, and show it has a 100% success rate. The feasibility of this attack introduce a new domain to study adversarial examples.

• Publication year

  2018

• Venue

  2018 IEEE Security and Privacy Workshops (SPW)

• Publication date

  2018-01-05

• Fields of study

  Mathematics, Computer Science

• Identifiers
  DOI 10.1109/SPW.2018.00009arXiv 1801.01944
• External record

  Open on Semantic Scholar

• Source metadata

  Semantic Scholar

• No claims are published for this paper.

• No concepts are published for this paper.

• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples

  2018cited by this paper
• Houdini: Fooling Deep Structured Prediction Models

  2017influential reference
• Query-Efficient Black-box Adversarial Examples

  2017cited by this paper
• Adversarial Examples for Evaluating Reading Comprehension Systems

  2017cited by this paper
• Sequence Modeling with CTC

  2017cited by this paper
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression

  2017cited by this paper
• Crafting Adversarial Examples For Speech Paralinguistics Applications

  2017cited by this paper
• DolphinAttack: Inaudible Voice Commands

  2017cited by this paper
• Synthesizing Robust Adversarial Examples

  2017cited by this paper
• JPEG-resistant Adversarial Images

  2017cited by this paper
• Towards Deep Learning Models Resistant to Adversarial Attacks

  2017cited by this paper
• MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples

  2017cited by this paper
• On the Robustness of Semantic Segmentation Models to Adversarial Attacks

  2017cited by this paper
• Vulnerability of Deep Reinforcement Learning to Policy Induction Attacks

  2017cited by this paper
• Adversarial Examples for Generative Models

  2017cited by this paper
• Adversarial Attacks on Neural Network Policies

  2017cited by this paper
• Accessorize to a Crime: Real and Stealthy Attacks on State-of-the-Art Face Recognition

  2016cited by this paper
• Practical Black-Box Attacks against Machine Learning

  2016cited by this paper
• Adversarial examples in the physical world

  2016cited by this paper
• Towards Evaluating the Robustness of Neural Networks

  2016influential reference
• Hidden Voice Commands

  2016influential reference
• Adversarial Perturbations Against Deep Neural Networks for Malware Classification

  2016cited by this paper
• Universal Adversarial Perturbations

  2016cited by this paper
• A study of the effect of JPG compression on adversarial images

  2016cited by this paper
• Practical Black-Box Attacks against Deep Learning Systems using Adversarial Examples

  2016cited by this paper
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples

  2016cited by this paper
• Adversarial Diversity and Hard Positive Generation

  2016cited by this paper
• Delving into Transferable Adversarial Examples and Black-box Attacks

  2016cited by this paper
• Deep Learning and Music Adversaries

  2015cited by this paper
• Adam: A Method for Stochastic Optimization

  2014cited by this paper
• Explaining and Harnessing Adversarial Examples

  2014influential reference
• Deep Speech: Scaling up end-to-end speech recognition

  2014influential reference
• Deep neural networks are easily fooled: High confidence predictions for unrecognizable images

  2014cited by this paper
• Intriguing properties of neural networks

  2013influential reference
• Estimating or Propagating Gradients Through Stochastic Neurons for Conditional Computation

  2013cited by this paper
• Evasion Attacks against Machine Learning at Test Time

  2013influential reference
• The security of machine learning

  2010cited by this paper
• Heat Transfer: Study guide

  2008cited by this paper
• Can machine learning be secure?

  2006cited by this paper
• Connectionist temporal classification: labelling unsegmented sequence data with recurrent neural networks

  2006influential reference
• Adversarial learning

  2005cited by this paper
• Long Short-Term Memory

  1997cited by this paper

• DUAP: Dual-task Universal Adversarial Perturbations Against Voice Control Systems

  2026cites this paper
• Adversarial Malware Detection on Consumer Devices Using Optimized Image-Based Ensembles

  2026cites this paper
• Beyond Noise Suppression: Dynamic Distortion Control Loss for Speech Enhancement and Robust Automatic Speech Recognition

  2026cites this paper
• ACES: Accent Subspaces for Coupling, Explanations, and Stress-Testing in Automatic Speech Recognition

  2026cites this paper
• Most Convolutional Networks Suffer from Small Adversarial Perturbations

  2026cites this paper
• IO-RAE: Information-Obfuscation Reversible Adversarial Example for Audio Privacy Protection

  2026cites this paper
• Audio Adversarial Example With No Noise in the Silent Area for Speech Recognition System

  2026influential citation
• I Guess That's Why They Call it the Blues: Causal Analysis for Audio Classifiers

  2026cites this paper
• HGA: Heuristic Black‐Box Test Case Generation for NLP Intelligent Software

  2026cites this paper
• A Survey on Artificial Intelligence Systems Robustness: Adversarial Attacks and Defenses

  2026cites this paper
• Efficient Understanding of Machine Learning Model Mispredictions

  2025cites this paper
• Breaking Audio Large Language Models by Attacking Only the Encoder: A Universal Targeted Latent-Space Audio Attack

  2025cites this paper
• k-Sparse Audio Adversarial Attack: Budget-Constrained Audio Perturbations with Total Variation Regularization

  2025cites this paper
• Robustness of emotion recognition in dialogue systems: A study on third-party API integrations and black-box attacks

  2025cites this paper
• Mirage Fools the Ear, Mute Hides the Truth: Precise Targeted Adversarial Attacks on Polyphonic Sound Event Detection Systems

  2025influential citation
• Electronic music assassin: towards imperceptible physical adversarial attacks against black-box automatic speech recognitions

  2025influential citation
• GuidedDE: Targeted black-box adversarial attacks via confidence-guided mutation on automatic speech recognition systems

  2025cites this paper
• Quantum Voice‐Based Cyber‐Attacks: Threats, Vulnerabilities, and Post‐Quantum Mitigation Strategies

  2025cites this paper
• Are Inherently Interpretable Models More Robust? A Study In Music Emotion Recognition

  2025cites this paper
• EvilHarmony: Stealthy Adversarial Attacks Against Black-Box Speech Recognition Systems

  2025influential citation
• Adversarial Robustness Evaluation of a Vietnamese Handwriting OCR System

  2025cites this paper
• Efficient Detection of Targeted Adversarial Attacks in Automatic Speech Recognition Systems

  2025cites this paper
• Evaluating the Robustness of a Production Malware Detection System to Transferable Adversarial Attacks

  2025cites this paper
• On the Robustness of State-of-the-Art Transformers for Sound Event Classification Against Black Box Adversarial Attacks

  2025cites this paper
• Degrading Voice: A Comprehensive Overview of Robust Voice Conversion Through Input Manipulation

  2025cites this paper
• Black-Box Universal Adversarial Attack on Automatic Speech Recognition Systems for Maritime Radio Communication Using Evolutionary Strategies

  2025cites this paper
• Voxia: A Virtual Voice Assistant

  2025cites this paper
• Whisper Smarter, not Harder: Adversarial Attack on Partial Suppression

  2025cites this paper
• Decoding Deception: Understanding Automatic Speech Recognition Vulnerabilities in Evasion and Poisoning Attacks

  2025cites this paper
• Adversarial Machine Learning: Analyzing Carlini & Wagner Attacks

  2025cites this paper
• Remote Rowhammer Attack using Adversarial Observations on Federated Learning Clients

  2025cites this paper
• Boosting the Transferability of Audio Adversarial Examples with Acoustic Representation Optimization

  2025cites this paper
• Trustworthy AI Must Account for Interactions

  2025cites this paper
• Universal Acoustic Adversarial Attacks for Flexible Control of Speech-LLMs

  2025cites this paper
• DiffAttack: Imperceptible and Transferable Audio Adversarial Attack via Diffusion Model

  2025cites this paper
• Selective Masking Adversarial Attack on Automatic Speech Recognition Systems

  2025influential citation
• Runtime Verification for Deep Learning Systems

  2025cites this paper
• GAME-RL: Generating Adversarial Malware Examples Against API Call Based Detection via Reinforcement Learning

  2025cites this paper
• Low-Effort Handheld Device User Authentication Using Musical Sounds

  2025cites this paper
• Existence of Adversarial Examples for Random Convolutional Networks via Isoperimetric Inequalities on $\mathbb{SO}(d)$

  2025cites this paper
• Attacker's Noise Can Manipulate Your Audio-based LLM in the Real World

  2025cites this paper
• When Good Sounds Go Adversarial: Jailbreaking Audio-Language Models with Benign Inputs

  2025cites this paper
• Adversarial OFDM Spectrum Modification to Manipulate Channel State Information Systems

  2025cites this paper
• Towards stable AI systems for Evaluating Arabic Pronunciations

  2025cites this paper
• ERIS: Evolutionary Real-world Interference Scheme for Jailbreaking Audio Large Models

  2025cites this paper
• Are Modern Speech Enhancement Systems Vulnerable to Adversarial Attacks?

  2025cites this paper
• Exploiting Vulnerabilities in Speech Translation Systems through Targeted Adversarial Attacks

  2025cites this paper
• Toward Understanding the Transferability of Adversarial Suffixes in Large Language Models

  2025cites this paper
• Securing Automatic Speech Recognition with Attention-driven Adversarial Detection

  2025cites this paper
• Shedding Light on VLN Robustness: A Black-box Framework for Indoor Lighting-based Adversarial Attack

  2025cites this paper
• Software and Hardware Implementations of a Cyber-Physical Firewall

  2025influential citation
• Adversarial Beats: Feasibility Study of Spoofed Arrhythmia in Automated Electrocardiogram Diagnosis

  2025cites this paper
• When comments aren't what they seem: The social media comment toxicity detector for understanding contextual comments

  2025cites this paper
• Speech-GAN: Black-Box Attack against Automatic Speech Recognition Systems

  2025cites this paper
• Generating Targeted Universal Adversarial Perturbation against Automatic Speech Recognition via Phoneme Tailoring

  2025cites this paper
• "I am bad": Interpreting Stealthy, Universal and Robust Audio Jailbreaks in Audio-Language Models

  2025cites this paper
• Attention-guided universal adversarial perturbations for EEG-based brain-computer interfaces

  2025cites this paper
• DeepSeek on a Trip: Inducing Targeted Visual Hallucinations via Representation Vulnerabilities

  2025cites this paper
• Are Deep Speech Denoising Models Robust to Adversarial Noise?

  2025cites this paper
• Enhancing Certified Robustness via Block Reflector Orthogonal Layers and Logit Annealing Loss

  2025cites this paper
• When Silence Matters: The Impact of Irrelevant Audio on Text Reasoning in Large Audio-Language Models

  2025cites this paper
• Audio Adversarial Example Generation via Information Reduction

  2025cites this paper
• Perception-Aware Attack Against Music Copyright Detection: Impacts and Defenses

  2025influential citation
• Friend-Guard Textfooler Attack on Text Classification System

  2025cites this paper
• Avoiding catastrophic overfitting in fast adversarial training with adaptive similarity step size

  2025cites this paper
• Instability in deep learning – when algorithms cannot compute uncertainty quantifications for neural networks

  2025cites this paper
• Paradoxical Role of Adversarial Attacks: Enabling Crosslinguistic Attacks and Information Hiding in Multilingual Speech Recognition

  2025cites this paper
• Advancing Trustworthy AI: A Comparative Evaluation of AI Robustness Toolboxes

  2025cites this paper
• Improving transferability of adversarial examples via statistical attribution-based attacks

  2025cites this paper
• Enhanced Estimation Techniques for Certified Radii in Randomized Smoothing

  2025cites this paper
• Dual-Mode Method for Generating Adversarial Examples to Attack Deep Neural Networks

  2025cites this paper
• reWordBench: Benchmarking and Improving the Robustness of Reward Models with Transformed Inputs

  2025cites this paper
• Whispering Under the Eaves: Protecting User Privacy Against Commercial and LLM-powered Automatic Speech Recognition Systems

  2025cites this paper
• R2DN: Scalable Parameterization of Contracting and Lipschitz Recurrent Deep Networks

  2025cites this paper
• Upper and lower bounds for the Lipschitz constant of random neural networks

  2025cites this paper
• Framework, Standards, Applications and Best practices of Responsible AI : A Comprehensive Survey

  2025cites this paper
• Adversarial Attacks in Multimodal Systems: A Practitioner’s Survey

  2025cites this paper
• Selective Audio Perturbations for Targeting Specific Phrases in Speech Recognition Systems

  2025cites this paper
• When Translators Refuse to Translate: A Novel Attack to Speech Translation Systems

  2025cites this paper
• APFT: Adaptive Phoneme Filter Template to Generate Anti-Compression Speech Adversarial Example in Real-Time

  2025cites this paper
• ASRJam: Human-Friendly AI Speech Jamming to Prevent Automated Phone Scams

  2025cites this paper
• Investigating Vulnerabilities and Defenses Against Audio-Visual Attacks: A Comprehensive Survey Emphasizing Multimodal Models

  2025cites this paper
• Natural sounds can be reconstructed from human neuroimaging data using deep neural network representation

  2025cites this paper
• Hijacking JARVIS: Benchmarking Mobile GUI Agents against Unprivileged Third Parties

  2025cites this paper
• GLAMP: Generative Learning for Adversarially-Robust Malware Prediction

  2025cites this paper
• AdvAudio: A New Information Hiding Method via Fooling Automatic Speech Recognition Model

  2025cites this paper
• Hallucinations in medical devices

  2025cites this paper
• A Review of Attack and Defensive Research on Speech Adversarial Samples

  2025cites this paper
• When Audio and Text Disagree: Revealing Text Bias in Large Audio-Language Models

  2025cites this paper
• Backdoor threats in large language models—a survey

  2025cites this paper
• LowDDAWP-Net: Low-Resolution Double Deep Audio Waveform Prior Network for Audio Systems Reliability Defence

  2025cites this paper
• A Second-Order Optimization-Based Adaptive Attack Method for Deep Convolutional Neural Networks

  2025cites this paper
• For Human Ears Only: Preventing Automated Monitoring on Voice Data

  2025cites this paper
• Impact of Phonetics on Speaker Identity in Adversarial Voice Attack

  2025cites this paper
• EveGuard: Defeating Vibration-based Side-Channel Eavesdropping with Audio Adversarial Perturbations

  2024cites this paper
• WavePurifier: Purifying Audio Adversarial Examples via Hierarchical Diffusion Models

  2024influential citation
• Exploring the uncertainty principle in neural networks through binary classification

  2024cites this paper
• Privacy-preserving explainable AI: a survey

  2024cites this paper
• Adversarial Attack and Defense for Commercial Black-box Chinese-English Speech Recognition Systems

  2024influential citation
• Evaluating Synthetic Command Attacks on Smart Voice Assistants

  2024influential citation