Audio adversarial examples are audio files that have been manipulated to fool
an automatic speech recognition (ASR) system, while still sounding benign to a
human listener. Most methods to generate such samples are based on a two-step
algorithm: first, a viable adversarial audio file is produced, then, this is
fine-tuned with respect to perceptibility and robustness. In this work, we
present an integrated algorithm that uses psychoacoustic models and room
impulse responses (RIR) in the generation step. The RIRs are dynamically
created by a neural network during the generation process to simulate a
physical environment to harden our examples against transformations experienced
in over-the-air attacks. We compare the different approaches in three
experiments: in a simulated environment and in a realistic over-the-air
scenario to evaluate the robustness, and in a human study to evaluate the
perceptibility. Our algorithms considering psychoacoustics only or in addition
to the robustness show an improvement in the signal-to-noise ratio (SNR) as
well as in the human perception study, at the cost of an increased word error
rate (WER).

音频对抗样本指对自动语音识别系统进行欺骗的音频文件，既能愚弄自动语音识别系统又能在人类听众中听起来正常。本文介绍了一种集成算法，在生成步骤中使用了心理声学模型和房间脉冲响应。我们通过三个实验比较不同方法的效果，包括在模拟环境和真实无线环境中评估鲁棒性，以及在人类研究中评估可感知性。我们的算法在考虑心理声学效果或结合鲁棒性时，信噪比和人类感知研究都有所改善，但错误率有所增加。