Adversarial attacks can mislead automatic speech recognition (ASR) systems into predicting an arbitrary target text, thus posing a clear security threat. To prevent such attacks, we propose DistriBlock, an efficient detection strategy applicable to any ASR system that predicts a probability distribution over output tokens in each time step. We measure a set of characteristics of this distribution: the median, maximum, and minimum over the output probabilities, the entropy of the distribution, as well as the Kullback-Leibler and the Jensen-Shannon divergence with respect to the distributions of the subsequent time step. Then, by leveraging the characteristics observed for both benign and adversarial data, we apply binary classifiers, including simple threshold-based classification, ensembles of such classifiers, and neural networks. Through extensive analysis across different state-of-the-art ASR systems and language data sets, we demonstrate the supreme performance of this approach, with a mean area under the receiver operating characteristic for distinguishing target adversarial examples against clean and noisy data of 99\% and 97\%, respectively. To assess the robustness of our method, we show that adaptive adversarial examples that can circumvent DistriBlock are much noisier, which makes them easier to detect through filtering and creates another avenue for preserving the system's robustness.

翻译：对抗性攻击能够误导自动语音识别（ASR）系统预测任意目标文本，从而构成明确的安全威胁。为防范此类攻击，我们提出DistriBlock，这是一种高效的检测策略，适用于任何在每个时间步对输出令牌预测概率分布的ASR系统。我们测量该分布的一组特征：输出概率的中位数、最大值和最小值，分布的熵，以及相对于后续时间步分布的Kullback-Leibler散度和Jensen-Shannon散度。然后，通过利用良性数据和对抗数据中观察到的特征，我们应用二分类器，包括简单的基于阈值的分类、此类分类器的集成以及神经网络。通过对不同最先进ASR系统和语言数据集的大量分析，我们证明了该方法的卓越性能，在区分目标对抗样本与干净数据和噪声数据时，受试者工作特征曲线下的平均面积分别达到99%和97%。为评估我们方法的鲁棒性，我们展示了能够绕过DistriBlock的自适应对抗样本噪声更大，这使得它们更容易通过滤波被检测到，并为保持系统的鲁棒性创造了另一条途径。