Adversarial attacks can mislead automatic speech recognition (ASR) systems into predicting an arbitrary target text, thus posing a clear security threat. To prevent such attacks, we propose DistriBlock, an efficient detection strategy applicable to any ASR system that predicts a probability distribution over output tokens in each time step. We measure a set of characteristics of this distribution: the median, maximum, and minimum over the output probabilities, the entropy of the distribution, as well as the Kullback-Leibler and the Jensen-Shannon divergence with respect to the distributions of the subsequent time step. Then, by leveraging the characteristics observed for both benign and adversarial data, we apply binary classifiers, including simple threshold-based classification, ensembles of such classifiers, and neural networks. Through extensive analysis across different state-of-the-art ASR systems and language data sets, we demonstrate the supreme performance of this approach, with a mean area under the receiver operating characteristic for distinguishing target adversarial examples against clean and noisy data of 99% and 97%, respectively. To assess the robustness of our method, we show that adaptive adversarial examples that can circumvent DistriBlock are much noisier, which makes them easier to detect through filtering and creates another avenue for preserving the system's robustness.

翻译：对抗性攻击可误导自动语音识别（ASR）系统预测任意目标文本，从而构成明确的安全威胁。为防范此类攻击，我们提出DistriBlock——一种高效的检测策略，适用于任何在每个时间步预测输出令牌概率分布的ASR系统。我们测量该分布的一组特征：输出概率的中位数、最大值和最小值、分布的熵，以及与后续时间步分布之间的Kullback-Leibler散度和Jensen-Shannon散度。通过利用良性数据和对抗性数据中观察到的分布特征，我们应用二元分类器，包括基于简单阈值的分类、此类分类器的集成以及神经网络。经过对不同最先进ASR系统和语言数据集的广泛分析，我们证明了该方法的卓越性能：区分目标对抗性样本与干净数据及噪声数据的受试者工作特征曲线下面积均值分别达到99%和97%。为评估我们的方法的鲁棒性，我们证明能够规避DistriBlock的自适应对抗性样本噪声显著增强，这使其更容易通过滤波检测，并为维护系统鲁棒性创造了另一途径。