CAFAD is proposed, a plug-and-play detection framework that combines multi-domain acoustic feature fusion and temporal pyramid matching for variable-length adversarial audio detection that achieves an average detection accuracy of 99.25%, with a false positive rate of 1.00% on benign samples.
Abstract
Recent studies have shown that deep learning-based automatic speech recognition (ASR) systems are vulnerable to adversarial examples (AEs), which can mislead ASR systems by embedding carefully crafted perturbations into speech signals. These attacks introduce significant challenges to the real-world deployment and reliability of ASR systems. Most existing AE detection methods align inputs by truncating or padding audio samples, which fails to fully use the information in speech and leads to a degradation in detection performance. In addition, few studies have explored the intrinsic characteristics of audio adversarial examples or how these characteristics can be leveraged for robust detection. To address this limitation, this paper proposes CAFAD, a plug-and-play detection framework that combines multi-domain acoustic feature fusion and temporal pyramid matching for variable-length adversarial audio detection. Experiments on LibriSpeech with nine adversarial attacks demonstrate that CAFAD achieves an average detection accuracy of 99.25%, with a false positive rate of 1.00% on benign samples. These results suggest that CAFAD has the potential to be used as a front-end screening module for ASR services, where incoming speech inputs can be inspected before transcription to reduce the risk of adversarial commands in security-sensitive applications such as voice-controlled authentication, smart-home control, and in-vehicle voice interaction. The source code is publicly available at https://anonymous.4open.science/r/CAFAD-59D0.
Automatic speech recognition (ASR) systems trained on clean speech often experience significant performance degradation when deployed in noisy acoustic environments. Existing approaches to improving robustness, such as speech enhancement and feature normalization, mainly operate at the signal or feature level and do not directly address the sensitivity of the acoustic model itself to noise. In this paper, we introduce AMGAN, a generative adversarial acoustic modeling framework designed to improve noise robustness at the acoustic model level. In the proposed approach, a clean-trained acoustic model is used as the generator to produce phoneme posterior distributions from noisy speech, while a discriminator encourages these outputs to align with oracle posteriors obtained from clean speech. In contrast to conventional GAN-based enhancement methods and teacher–student approaches that typically rely on point-wise supervision, AMGAN performs alignment at the distribution level in the posterior-probability space, allowing the model to learn representations that are more stable under noisy conditions. Experimental results on the TIMIT dataset show consistent improvements across MLP, RNN, and LSTM acoustic models, with the LSTM achieving absolute WER reductions of 3.4% and 2.7% under white and babble noise, respectively. On the larger LibriSpeech corpus, AMGAN outperforms both clean-only and multi-condition training baselines while maintaining competitive performance on clean speech. Furthermore, experiments with a pretrained Whisper encoder demonstrate that the proposed framework can be applied to modern end-to-end ASR systems, yielding an average absolute WER reduction of 2.3% under noisy conditions. Overall, the results suggest that adversarial alignment in posterior-probability space provides an effective and scalable way to improve ASR robustness without modifying the input representation, offering a practical alternative to enhancement-based methods.
Automatic speech recognition (ASR) systems rely on deep learning models to transform human speech into text and actionable commands. Despite their effectiveness, such systems are vulnerable to adversarial audio, which can cause incorrect transcriptions and lead to unintended system behavior. Understanding these vulnerabilities is therefore essential for the safe deployment of ASR in security-sensitive and safetycritical contexts. In this paper, we present Speech-GAN, a generative adversarial network designed to perform black-box untargeted attacks against deep learning-based ASR systems by generating adversarial audio samples.We validate the effectiveness of Speech-GAN through 10,000 attack runs conducted on 1,000 audio samples spanning 10 command words, targeting theWav2Vec 2.0 ASR model. Speech-GAN achieves success rates exceeding 99%, with average signal-to-noise ratios of -9.53 dB for basic attacks and -11.21 dB for semantically constrained attacks. A set of 10 humans confirmed the effectiveness of Speech-GAN: they understand 91.4% (resp. 97.6%) of the semantically constrained (resp. basic) adversarial audios as the intended command.
F. Mogal, A. O. Topal, Enea Mançellari et al.· Vietnam Journal of Computer...· 0 citations
Recent advances in speech synthesis and audio generation have made high-fidelity acoustic forgery low-cost and difficult to attribute, enabling a realistic attack scenario in which speech and background audio are independently manipulated over otherwise authentic video. Yet existing research either focuses on visual manipulation, addresses speech detection in isolation, or conflates speech and non-speech audio as a single undifferentiated audio stream, overlooking the distinct forensic challenges posed by background audio. This conflation is consequential: the two acoustic components arise from fundamentally different generative mechanisms, exhibit distinct artifact profiles, and pose different challenges to detection systems. We introduce MADBench, the first benchmark that treats speech and environmental audio as distinct acoustic components, enabling component-aware evaluation of audio deepfake detection across independently manipulated forgery sources. We benchmark representative state-of-the-art detectors and multimodal large language models under a unified protocol. Our experiments reveal that environmental audio manipulation is more detectable than synthetic speech across general-purpose encoders, while existing pretrained detectors fail on both acoustic components, and manipulated environmental audio asymmetrically degrades speech deepfake detection, findings entirely invisible under the single-label paradigm of prior benchmarks. MADBench establishes a rigorous foundation for future research into robust, component-aware audio deepfake detection.
Yanqiu Li, Yang Xiao, Jisheng Bai et al.· 0 citations
Recent advances in generative audio models have enabled highly realistic synthetic speech, increasing the importance of reliable audio deepfake detection (ADD) systems. While prior studies have primarily focused on adversarially optimized perturbations, the robustness of ADD systems under realistic signal transformations remains insufficiently understood. In this work, we investigate the impact of audio watermarking on ADD systems by treating watermarking as a structured, non-adversarial perturbation rather than a conventional attack mechanism. Using a watermark-based evaluation framework built upon WavMark, we evaluate multiple self-supervised learning (SSL), Convolutional Neural Network (CNN) and Graph Neural Netrowk (GNN)-based ADD models across several benchmark datasets. Beyond conventional detection metrics, we further analyze watermark-induced representation shifts using Fr\'echet Distance, cosine similarity, and L2 distance in the embedding space. Experimental results reveal a strong dataset-dependent behavior: watermarking causes substantial performance degradation on ASVspoof 2021 LA and DF, while exhibiting limited impact on ASVspoof 2024, FoR, and ITW. Moreover, large embedding-space shifts are strongly associated with severe detection degradation, suggesting that watermark-induced perturbations can substantially alter the feature representations relied upon by current ADD systems. These findings demonstrate that benign signal transformations designed for content protection can expose previously overlooked robustness vulnerabilities in audio deepfake detection systems. Our code is available at https://github.com/ziqian0925/wm-ADD-robustness.git
Z. Yong, Ajinkya Kulkarni, J. Lau et al.· 0 citations
Automatic speech recognition (ASR) systems have achieved high accuracy with transformer-based models, enabling deployment in critical applications. However, they remain vulnerable to adversarial manipulation, particularly in black-box settings where attacks must preserve perceptual naturalness. This work introduces GATAS, a black-box testing approach that generates failure inducing inputs by operating in the phoneme-level latent space of a text- to-speech model. Instead of perturbing waveforms directly, the approach interpolates latent representations to induce transcription errors while remaining within the manifold of natural speech. The attack is formulated as a multi-objective optimization problem balancing semantic divergence and perceptual quality. Our empirical evaluation against both white-box and black-box baselines shows that GATAS achieves a 98% success rate while producing lower distortion and higher perceptual quality, as confirmed by human studies. Despite operating without gradient access, GATAS remains competitive against white-box methods, highlighting that representation and perceptual alignment are more critical than access to model internals. Overall, our results demonstrate that untargeted latent-space optimization enables the efficient generation of realistic and effective test cases for ASR systems.
Yanis Xabier Wilbrand Pena, Oliver Weissl, Andrea Stocco· 0 citations
Deep-OCR (DeepSeek-OCR) advances document recognition by treating the visual modality as an optical compression medium, enabling long-context OCR at low token cost. However, its increased complexity may introduce new security vulnerabilities. In this paper, we present, to the best of our knowledge, the first pure black-box adversarial attack against a generative OCR vision-language model, where only the decoded string can be queried and no gradients, logits, or model internals are available. We recast the attack as a zeroth-order optimization problem driven by a bounded scalar loss defined directly on the string output via sequence similarity, and estimate the gradient with a random-direction finite-difference scheme whose query cost is independent of the image dimension. An Adam update with ell_infinity projection yields imperceptible perturbations for both untargeted and targeted objectives. Pilot experiments on Deep-OCR validate the string-only attack and evaluation pipeline and expose severe qualitative decoder failures, including repetition, truncation, and prompt leakage. They also show that controlled targeted rewriting remains substantially harder than untargeted degradation; we avoid claiming targeted success until the pre-registered evaluation is complete.
Wenbo Sun, Hong-Zong Li, Yanyun Wang et al.· 0 citations
