Audio adversarial examples are audio files that have been manipulated to fool an automatic speech recognition (ASR) system, while still sounding benign to a human listener. Most methods to generate such samples are based on a two-step algorithm: first, a viable adversarial audio file is produced, then, this is fine-tuned with respect to perceptibility and robustness. In this work, we present an integrated algorithm that uses psychoacoustic models and room impulse responses (RIR) in the generation step. The RIRs are dynamically created by a neural network during the generation process to simulate a physical environment to harden our examples against transformations experienced in over-the-air attacks. We compare the different approaches in three experiments: in a simulated environment and in a realistic over-the-air scenario to evaluate the robustness, and in a human study to evaluate the perceptibility. Our algorithms considering psychoacoustics only or in addition to the robustness show an improvement in the signal-to-noise ratio (SNR) as well as in the human perception study, at the cost of an increased word error rate (WER).

音频对抗样本指对自动语音识别系统进行欺骗的音频文件，既能愚弄自动语音识别系统又能在人类听众中听起来正常。本文介绍了一种集成算法，在生成步骤中使用了心理声学模型和房间脉冲响应。我们通过三个实验比较不同方法的效果，包括在模拟环境和真实无线环境中评估鲁棒性，以及在人类研究中评估可感知性。我们的算法在考虑心理声学效果或结合鲁棒性时，信噪比和人类感知研究都有所改善，但错误率有所增加。

鲁棒且不可察觉的音频对抗例子的综合算法