Cross-representation transferable adversarial examples generation for audio classification

TIAN Zilin; LONG Yunfei; TIAN Ye; ZHANG Liguo

doi:10.11959/j.issn.2096-109x.2025022

您当前的位置：

首页 >

文章列表页 >

Cross-representation transferable adversarial examples generation for audio classification

Papers | 更新时间：2025-05-14

- Cross-representation transferable adversarial examples generation for audio classification
- Chinese Journal of Network and Information Security Vol. 11, Issue 2, Pages: 125-135(2025)
- 作者机构：
  
  1.哈尔滨工程大学计算机科学与技术学院，黑龙江哈尔滨 150000
  2.西安电子科技大学杭州研究院，浙江杭州 310000
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China(52071111);Hainan Provincial Natural Science Foundation of China(623CXTD394);National Sponsored Postdoctoral Researcher Program(GZC20232046)
- DOI：10.11959/j.issn.2096-109x.2025022
  CLC： TP393
- Received：27 August 2024，
  
  Revised：2025-01-16，
  
  Published：25 April 2025
- 稿件说明：
移动端阅览
田梓琳, 龙云飞, 田野, 等. 针对音频分类的跨表征可迁移对抗样本生成方法[J]. 网络与信息安全学报, 2025, 11(2): 125-135.

TIAN Z L, LONG Y F, TIAN Y, et al. Cross-representation transferable adversarial examples generation for audio classification[J]. Chinese Journal of Network and Information Security, 2025, 11(2): 125-135.
田梓琳, 龙云飞, 田野, 等. 针对音频分类的跨表征可迁移对抗样本生成方法[J]. 网络与信息安全学报, 2025, 11(2): 125-135. DOI： 10.11959/j.issn.2096-109x.2025022.

TIAN Z L, LONG Y F, TIAN Y, et al. Cross-representation transferable adversarial examples generation for audio classification[J]. Chinese Journal of Network and Information Security, 2025, 11(2): 125-135. DOI： 10.11959/j.issn.2096-109x.2025022.

摘要

对抗样本是检测深度神经网络漏洞的重要手段。可迁移性是对抗样本的一种特有属性，赋予其欺骗未知深度神经网络模型的能力。针对音频分类任务的迁移攻击方法引起了广泛讨论。然而，现有的针对音频分类的攻击方法大多数只考虑单一的音频表征，忽略了音频对抗样本从一维时域波形到二维梅尔谱图的可迁移性。以波形分类模型作为替代模型生成的对抗样本无法成功攻击以梅尔谱图作为输入的模型。针对这一问题，提出针对音频分类的跨表征可迁移对抗样本生成方法，通过线性组合两个以不同表征为输入的替代模型的损失训练生成网络，使其能够生成具有跨表征和跨模型可迁移性的音频对抗样本。同时，通过减少两个替代模型之间的预测差异，进一步增强对抗样本跨表征可迁移性。此外，利用生成网络输出对抗性的训练替代模型，同步优化替代模型鲁棒性来提高对抗样本的跨模型可迁移性。在UrbanSound8k和ShipsEar数据集上的大量实验结果表明，所提方法可以提高对抗样本的跨表征可迁移性，并显著优于现有的迁移攻击。

Abstract

Adversarial examples have been used as an important tool for detecting vulnerabilities in deep neural networks. The unique property of transferability enables them to deceive black-box deep neural network models. Transfer-based attack methods for audio classification have recently attracted extensive discussion. However

in the audio domain

existing transfer-based methods overlooked the transferability of adversarial audio examples from 1D waveform to 2D Mel-spectrogram representation. It was observed that adversarial examples generated against a raw-waveform surrogate model could not successfully attack Mel-spectrogram target models. A method for generating cross-representation transferable adversarial examples for audio classification was proposed. Specifically

losses from two pre-trained surrogate models accepting different representations were linearly combined to train generators for crafting adversarial audio examples with high cross-representation and cross-model transferability. Furthermore

the predictive discrepancies between the two surrogate models were minimized to enhance cross-representation transferability. Additionally

the generator's output was used to train these surrogate models adversarially

which significantly enhanced the robustness of the surrogate models and consequently boosted the cross-model transferability of adversarial examples. Extensive experiments were carried out on the Urban Sound8k and ShipsEar datasets. The results demonstrate that this approach could improve the cross-representation transferability of adversarial examples and significantly outperform existing transfer-based attacks.

关键词

Keywords

references

PRABHAKAR S K , LEE S W . Holistic approaches to music genre classification using efficient transfer and deep learning techniques [J ] . Expert Systems with Applications , 2023 , 211 : 118636 .

DEMIR F , ABDULLAH D , SENGUR A . A new deep CNN model for environmental sound classification [J ] . IEEE Access , 2020 , 8 : 66529 - 66537 .

黄诗瑀 , 叶锋 , 黄添强 , 等 . 人脸伪造与检测中的对抗攻防综述 [J ] . 网络与信息安全学报 , 2023 , 9 ( 04 ): 1 - 15 .

HUANG S Y , YE F , HUANG T Q , et al . Survey on adversarial attacks and defense of face forgery and detection [J ] . Chinese Journal of Network and Information Security , 2023 , 9 ( 4 ): 1 - 15 .

林点 , 潘理 , 易平 . 面向图像识别的卷积神经网络鲁棒性研究进展 [J ] . 网络与信息安全学报 , 2022 , 8 ( 3 ): 111 - 122 .

LIN D , PAN L , YI P . Research on the robustness of convolutional neural networks in image recognition [J ] . Chinese Journal of Network and Information Security , 2022 , 8 ( 3 ): 111 - 122 .

刘西蒙 , 谢乐辉 , 王耀鹏 , 等 . 深度学习中的对抗攻击与防御 [J ] . 网络与信息安全学报 , 2020 , 6 ( 5 ): 36 - 53 .

LIU X M , XIE L H , WANG Y P , et al . Adversarial attacks and defenses in deep learning [J ] . Chinese Journal of Network and Information Security , 2020 , 6 ( 5 ): 36 - 53 .

陈晋音 , 吴长安 , 郑海斌 . 基于softmax激活变换的对抗防御方法 [J ] . 网络与信息安全学报 , 2022 , 8 ( 2 ): 48 - 63 .

CHEN J Y , WU C A , ZHENG H B . Novel defense based on softmax activation transformation [J ] . Chinese Journal of Network and Information Security , 2022 , 8 ( 2 ): 48 - 63 .

SZEGEDY C , ZAREMBA W , SUTSKEVER I , et al . Intriguing properties of neural networks [J ] . arXiv preprint arXiv: 1312.6199 , 2013 .

DONG Y P , LIAO F Z , PANG T Y , et al . Boosting adversarial attacks with momentum [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2018 : 9185 - 9193 .

DONG Y P , PANG T Y , SU H , et al . Evading defenses to transferable adversarial examples by translation-invariant attacks [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 2019 : 4312 - 4321 .

XIE C H , ZHANG Z S , ZHOU Y X , et al . Improving transferability of adversarial examples with input diversity [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 2019 : 2730 - 2739 .

ZHAO A Q , CHU T , LIU Y H , et al . Minimizing maximum model discrepancy for transferable black-box targeted attacks [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 2023 : 8153 - 8162 .

何媛媛 , 胡淼 , 彭祖权 , 等 . 语音识别对抗攻击方法综述 [J ] . 华中科技大学学报(自然科学版) , 2023 , 51 ( 2 ): 10 - 18 .

HE Y Y , HU M , PENG Z Q , et al . Survey of adversarial attacks on speech recognition [J ] . Journal of Huazhong University of Science and Technology (Natural Science Edition) , 2023 , 51 ( 2 ): 10 - 18 .

KIM H , PARK J , LEE J . Generating transferable adversarial examples for speech classification [J ] . Pattern Recognition , 2023 , 137 : 109286 .

李珠海 , 郭武 . 基于自注意力机制的音频对抗样本生成方法 [J ] . 数据采集与处理 , 2024 , 39 ( 2 ): 416 - 423 .

LI Z H , GUO W . Audio adversarial examples generation method based on self-attention mechanism [J ] . Journal of Data Acquisition & Processing , 2024 , 39 ( 2 ): 416 - 423 .

LI Y , CAO W , XIE W , et al . Few-shot class-incremental audio classification using dynamically expanded classifier with self-attention modified prototypes [J ] . IEEE Transactions on Multimedia , 2023 , 26 : 1346 - 1360 .

ASHRAF M , ABID F , DIN I U , et al . A hybrid CNN and RNN variant model for music classification [J ] . Applied Sciences , 2023 , 13 ( 3 ): 1476 .

RADHA K , BANSAL M , PACHORI R B . Speech and speaker recognition using raw waveform modeling for adult and children’s speech: a comprehensive review [J ] . Engineering Applications of Artificial Intelligence , 2024 , 131 : 107661 .

ABDALLAH H B , HENRY C J , RAMANNA S . 1-Dimensional polynomial neural networks for audio signal related problems [J ] . Knowledge-Based Systems , 2022 , 240 : 108174 .

PAN Z S , WANG B , ZHANG R B , et al . MIML-GAN: A GAN-based algorithm for multi-instance multi-label learning on overlapping signal waveform recognition [J ] . IEEE Transactions on Signal Processing , 2023 , 71 : 859 - 872 .

ZHAO Z P , LI Q F , ZHANG Z X , et al . Combining a parallel 2D CNN with a self-attention dilated residual network for CTC-based discrete speech emotion recognition [J ] . Neural Networks , 2021 , 141 : 52 - 60 .

CHENG M , WANG W Q , ZHANG Y C , et al . Target-speaker voice activity detection via sequence-to-sequence prediction [C ] // ICASSP 2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . 2023 : 1 - 5 .

ZHANG L G , TIAN Z , LONG Y F , et al . Cross-modal and cross-medium adversarial attack for audio [C ] // Proceedings of the 31st ACM International Conference on Multimedia . 2023 : 444 - 453 .

SALAMON J , JACOBY C , BELLO J . 2014 . A dataset and taxonomy for urban sound research [C ] // Proceedings of the 22nd ACM International Conference on Multimedia . 2014: 1041 - 1044 .

SANTOS-DOMINGUEZ D , TORRES-GUIJARRO S , CARDE-NAL-LOPZE A , et al . ShipsEar: an underwater vessel noise database [J ] . Applied Acoustics , 2016 , 113 : 64 - 69 .

GOODFELLOW I J , SHLENS J , SZEGEDY C . Explaining and harnessing adversarial examples [C ] // Proceedings of the IEEE International Conference on Learning Representations , 2015 : 2931 - 2944 .

KURAKIN A , GOODFELLOW I J , BENGIO S . Adversarial examples in the physical world [M ] . Artificial Intelligence Safety and Security. Chapman and Hall/CRC , 2018 : 99 - 112 .

LIN J , SONG C , HE K , et al . Nesterov accelerated gradient and scale invariance for adversarial attacks [J ] . arXiv preprint arXiv: 1908.06281 , 2019 .

POURSAEED O , KATSMAN I , GAO B , et al . Generative adversarial perturbations [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2018 : 4422 - 4431 .

NASEER M , KHAN S , HAYAT M , et al . On generating transferable targeted perturbations [C ] // Proceedings of the IEEE/CVF International Conference on Computer Vision . 2021 : 7708 - 7717 .

ZHANG Q L , LI X D , CHEN Y F , et al . Beyond imagenet attack: Towards crafting adversarial examples for black-box domains [J ] . arXiv preprint arXiv: 2201.11528 , 2022 .

HE K M , ZHANG X Y , REN S Q , et al . Deep residual learning for image recognition [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2016 : 770 - 778 .

HUANG G , LIU Z , VAN DER MAATEN L , et al . Densely connected convolutional networks [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2017 : 4700 - 4708 .

TAN M X , LE Q V . 2019 . Efficientnet: Rethinking model scaling for convolutional neural networks [C ] // International Conference on Machine Learning (PMLR) . 2019: 6105 - 6114 .

MA N , ZHANG X , ZHENG H T , et al . 2018 . Shufflenet v2: Practical guidelines for efficient CNN architecture design [C ] // Proceedings of the European Conference on Computer Vision (ECCV) . 2018: 116 - 131 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Survey on adversarial attacks and defense of face forgery and detection

Research on the robustness of convolutional neural networks in image recognition

Adversarial example defense algorithm for MNIST based on image reconstruction

Research on structure and defense of adversarial example in deep learning

Related Author

Haifeng LUO

Liqing HUANG

Wei LI

Tianqiang HUANG

Feng YE

Shiyu HUANG

Dian LIN

Ping YI

Related Institution

College of Computer and Cyber Security, Fujian Normal University

Digital Fujian Institute of Big Data Security Technology

School of Cyber Science and Engineering, Southeast University

Network Communication and Security Purple Mountain Laboratory

College of Computer Science and Technology,Harbin Engineering University

⁰