We propose a method to generate audio adversarial examples that can attack a
state-of-the-art speech recognition model in the physical world. Previous work
assumes that generated adversarial examples are directly fed to the recognition
model, and is not able to perform such a physical attack because of
reverberation and noise from playback environments. In contrast, our method
obtains robust adversarial examples by simulating transformations caused by
playback or recording in the physical world and incorporating the
transformations into the generation process. Evaluation and a listening
experiment demonstrated that our adversarial examples are able to attack
without being noticed by humans. This result suggests that audio adversarial
examples generated by the proposed method may become a real threat.

本研究提出了一种生成音频对抗样本的方法，可以在实际场景中攻击一种最先进的语音识别模型。通过模拟播放或录制的变换并将这些变换融合到生成过程中，我们得到的对抗样本具有鲁棒性，能够在不被人类察觉的情况下进行攻击，这表明所提出的音频对抗样本可能会成为一个真正的威胁。