Automatic speech recognition (ASR) systems have been shown to be vulnerable to adversarial examples (AEs). Recent success all assumes that users will not notice or disrupt the attack process despite the existence of music/noise-like sounds and spontaneous responses from voice assistants. Nonetheless, in practical user-present scenarios, user awareness may nullify existing attack attempts that launch unexpected sounds or ASR usage. In this paper, we seek to bridge the gap in existing research and extend the attack to user-present scenarios. We propose VRIFLE, an inaudible adversarial perturbation (IAP) attack via ultrasound delivery that can manipulate ASRs as a user speaks. The inherent differences between audible sounds and ultrasounds make IAP delivery face unprecedented challenges such as distortion, noise, and instability. In this regard, we design a novel ultrasonic transformation model to enhance the crafted perturbation to be physically effective and even survive long-distance delivery. We further enable VRIFLE's robustness by adopting a series of augmentation on user and real-world variations during the generation process. In this way, VRIFLE features an effective real-time manipulation of the ASR output from different distances and under any speech of users, with an alter-and-mute strategy that suppresses the impact of user disruption. Our extensive experiments in both digital and physical worlds verify VRIFLE's effectiveness under various configurations, robustness against six kinds of defenses, and universality in a targeted manner. We also show that VRIFLE can be delivered with a portable attack device and even everyday-life loudspeakers.

翻译：自动语音识别（ASR）系统已被证明易受对抗样本（AEs）攻击。近期研究成果均假设用户不会注意或干扰攻击过程，尽管存在类似音乐/噪声的声音及语音助手的自发响应。然而，在实际用户在场场景中，用户意识可能使现有攻击尝试失效——这些攻击会触发意外声响或ASR使用异常。本文旨在弥合现有研究空白，将攻击扩展至用户在场场景。我们提出VRIFLE——一种通过超声波传输实现不可听对抗扰动（IAP）的攻击方法，可在用户说话时操纵ASR系统。可听声与超声波之间的固有差异使得IAP传输面临失真、噪声和不稳定性等前所未有的挑战。为此，我们设计了一种新型超声波变换模型，使精心制作的扰动具有物理有效性，甚至能在远距离传输中存活。我们进一步通过在生成过程中对用户及真实世界变化采用一系列增强策略，提升VRIFLE的鲁棒性。由此，VRIFLE能够基于"交替-静音"策略有效抑制用户干扰影响，在不同距离及用户任意语音条件下实时操纵ASR输出。我们在数字与物理世界中的大量实验验证了VRIFLE在多种配置下的有效性、针对六类防御的鲁棒性以及目标导向的通用性。我们还证明了VRIFLE可通过便携式攻击设备乃至日常扬声器进行传输。