Deep noise suppression (DNS) models enjoy widespread use throughout a variety of high-stakes speech applications. However, we show that four recent DNS models can each be reduced to outputting unintelligible gibberish through the addition of psychoacoustically hidden adversarial noise, even in low-background-noise and simulated over-the-air settings. For three of the models, a small transcription study with audio and multimedia experts confirms unintelligibility of the attacked audio; simultaneously, an ABX study shows that the adversarial noise is generally imperceptible, with some variance between participants and samples. While we also establish several negative results around targeted attacks and model transfer, our results nevertheless highlight the need for practical countermeasures before open-source DNS systems can be used in safety-critical applications.

翻译：深度噪声抑制（DNS）模型广泛应用于各类高风险的语音应用场景。然而，我们发现，即使是在低背景噪声和模拟无线传输环境中，通过添加心理声学上隐蔽的对抗性噪声，四种近期提出的DNS模型均可能被诱导输出无法理解的混乱语音。针对其中三种模型，我们通过音频与多媒体专家参与的小规模转录实验证实了受攻击音频的不可理解性；同时，ABX感知实验表明对抗性噪声总体上难以被察觉，但不同参与者和样本间存在一定差异。尽管我们在定向攻击和模型迁移方面也获得了若干负面结果，但本研究仍凸显出在开源DNS系统应用于安全关键领域前，亟需开发有效的防御机制。