面向Transformer语音识别模型的高迁移通用对抗样本生成方法
作者:
作者单位:

哈尔滨工业大学计算机科学与技术学院,哈尔滨 150001

作者简介:

通讯作者:

基金项目:


Universal Adversarial Example Generation Method with High Transferability for Transformer-Based Speech Recognition Models
Author:
Affiliation:

College of Computer Science and Technology, Harbin Institute of Technology, Harbin 150001, China

Fund Project:

  • 摘要
  • |
  • 图/表
  • |
  • 访问统计
  • |
  • 参考文献
  • |
  • 相似文献
  • |
  • 引证文献
  • |
  • 资源附件
    摘要:

    Transformer模型的出现使得语音识别的正确率有了巨大提升。随着深度学习技术的发展,通过对抗样本来攻击语音识别系统,以了解该系统的脆弱性并进行完善,进而提高识别系统的鲁棒性。由于通用语音对抗样本对于任意语音都有效,更是受到了广泛关注,其关键问题是如何提高对抗样本的迁移性,进而实现高攻击成功率。本文利用Transformer类语音识别模型结构特征的相似性,通过使扰动后的语音与原始语音的中间层特征尽可能不同,以改变其中间层特征表示的规律,实现有效的通用对抗攻击。鉴于通用对抗样本需要利用与样本无关的底层声学信息,而与样本依赖的语义信息会抑制其性能,因而通过控制注意力梯度以减弱通用对抗样本对于语义上下文特征的学习,进而实现通用对抗样本的高迁移性。实验结果表明,本文所提出的通用对抗样本生成方法可以有效地提高对抗样本在Transformer类语音识别模型之间的迁移性。

    Abstract:

    In recent years, the emergence of the Transformer model has significantly enhanced the accuracy of automatic speech recognition technology. This research aims to address the critical security vulnerabilities in Transformer-based automatic speech recognition systems by enhancing the transferability of universal speech adversarial examples. While Transformer models have significantly advanced speech processing, their susceptibility to universal adversarial perturbations remains a major concern. To exploit these weaknesses effectively, we propose a novel attack framework that leverages the structural commonalities of Transformer architectures. First, we implement a feature-level disruption strategy that maximizes the dissimilarity between perturbed and original speech within the middle-layer representations. By altering these latent representation patterns, the attack successfully shifts the internal decision boundaries of models. Second, given that sample-dependent semantic information often inhibits the generalization of universal noise, we introduce an attention gradient control mechanism. This mechanism strategically weakens the gradients associated with semantic context features, forcing the perturbation to capture underlying, sample-independent acoustic vulnerabilities instead. Finally, experimental evaluations conducted on LibriSpeech demonstrate the superior performance of the proposed method. The results indicate that our approach achieves an average word error rate of 80.6% across multiple target models, representing a 36.6% improvement in transferability compared to existing baseline universal attacks. These findings conclude that the targeted manipulation of middle-layer features combined with the suppression of semantic dependencies is a highly effective strategy for cross-model adversarial threats.Highlights:1. Propose a novel framework of universal speech adversarial attacks that maximizes middle-layer feature dissimilarity to exploit the structural similarities inherent in Transformer-based speech recognition models.2. Introduce a targeted attention gradient control mechanism to decouple sample-independent acoustic features from sample-dependent semantic context, significantly boosting attack transferability.3. Achieve a substantial increase in universal attack success rates across diverse Transformer architectures, outperforming traditional universal perturbation methods.

    参考文献
    相似文献
    引证文献
引用本文

王振,韩纪庆,何勇军,郑铁然,郑贵滨.面向Transformer语音识别模型的高迁移通用对抗样本生成方法[J].数据采集与处理,2026,(1):109-116

复制
分享
文章指标
  • 点击次数:
  • 下载次数:
历史
  • 收稿日期:2024-03-30
  • 最后修改日期:2024-10-12
  • 录用日期:
  • 在线发布日期: 2026-02-13