Audio applications involving environmental sound analysis increasingly use
general-purpose audio representations, also known as embeddings, for transfer
learning. Recently, Holistic Evaluation of Audio Representations (HEAR)
evaluated twenty-nine embedding models on nineteen diverse tasks. However, the
evaluation's effectiveness depends on the variation already captured within a
given dataset. Therefore, for a given data domain, it is unclear how the
representations would be affected by the variations caused by myriad
microphones' range and acoustic conditions -- commonly known as channel
effects. We aim to extend HEAR to evaluate invariance to channel effects in
this work. To accomplish this, we imitate channel effects by injecting
perturbations to the audio signal and measure the shift in the new (perturbed)
embeddings with three distance measures, making the evaluation domain-dependent
but not task-dependent. Combined with the downstream performance, it helps us
make a more informed prediction of how robust the embeddings are to the channel
effects. We evaluate two embeddings -- YAMNet, and OpenL3 on monophonic
(UrbanSound8K) and polyphonic (SONYC-UST) urban datasets. We show that one
distance measure does not suffice in such task-independent evaluation. Although
Fréchet Audio Distance (FAD) correlates with the trend of the performance
drop in the downstream task most accurately, we show that we need to study FAD
in conjunction with the other distances to get a clear understanding of the
overall effect of the perturbation. In terms of the embedding performance, we
find OpenL3 to be more robust than YAMNet, which aligns with the HEAR
evaluation.

本文中，我们将 Holistic Evaluation of Audio Representations (HEAR) 扩展到评估在通道效应 invariant 的 embedding 性能，通过注入扰动来模拟通道效应和三种距离测量，评估两种嵌入模型 (YAMNet 和 OpenL3) 在两个城市数据集上的性能，结果表明 OpenL3 嵌入模型比 YAMNet 更稳健。

环境声音表示的扰动鲁棒性研究

A Study on Robustness to Perturbations for Representations of Environmental Sound

We consider a wireless communication system that consists of a transmitter, a
receiver, and an adversary. The transmitter transmits signals with different
modulation types, while the receiver classifies its received signals to
modulation types using a deep learning-based classifier. In the meantime, the
adversary makes over-the-air transmissions that are received as superimposed
with the transmitter's signals to fool the classifier at the receiver into
making errors. While this evasion attack has received growing interest
recently, the channel effects from the adversary to the receiver have been
ignored so far such that the previous attack mechanisms cannot be applied under
realistic channel effects. In this paper, we present how to launch a realistic
evasion attack by considering channels from the adversary to the receiver. Our
results show that modulation classification is vulnerable to an adversarial
attack over a wireless channel that is modeled as Rayleigh fading with path
loss and shadowing. We present various adversarial attacks with respect to
availability of information about channel, transmitter input, and classifier
architecture. First, we present two types of adversarial attacks, namely a
targeted attack (with minimum power) and non-targeted attack that aims to
change the classification to a target label or to any other label other than
the true label, respectively. Both are white-box attacks that are transmitter
input-specific and use channel information. Then we introduce an algorithm to
generate adversarial attacks using limited channel information where the
adversary only knows the channel distribution. Finally, we present a black-box
universal adversarial perturbation (UAP) attack where the adversary has limited
knowledge about both channel and transmitter input.

本研究考虑无线通信系统中的对抗攻击，通过不同的对抗方式，从而使得在考虑信道效果的情况下，仍然可以分类错误，结果表明在 Rayleigh 多径衰落信道下，无线调制分类易受到对抗攻击的影响。