{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T22:28:33Z","timestamp":1783204113180,"version":"3.54.6"},"reference-count":215,"publisher":"Association for Computing Machinery (ACM)","issue":"4","license":[{"start":{"date-parts":[[2022,11,21]],"date-time":"2022-11-21T00:00:00Z","timestamp":1668988800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"China NSFC","award":["61925109, 62071428, and 61941120"],"award-info":[{"award-number":["61925109, 62071428, and 61941120"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2023,4,30]]},"abstract":"<jats:p>Voice assistants (VA) have become prevalent on a wide range of personal devices such as smartphones and smart speakers. As companies build voice assistants with extra functionalities, attacks that trick a voice assistant into performing malicious behaviors can pose a significant threat to a user\u2019s security, privacy, and even safety. However, the diverse attacks and stand-alone defenses in the literature often lack a systematic perspective, making it challenging for designers to properly identify, understand, and mitigate the security threats against voice assistants. To overcome this problem, this article provides a thorough survey of the attacks and countermeasures for voice assistants. We systematize a broad category of relevant but seemingly unrelated attacks by the vulnerable system components and attack methods, and categorize existing countermeasures based on the defensive strategies from a system designer\u2019s perspective. To assist designers in planning defense based on their demands, we provide a qualitative comparison of existing countermeasures by the implementation cost, usability, and security and propose practical suggestions. We envision this work can help build more reliability into voice assistants and promote research in this fast-evolving area.<\/jats:p>","DOI":"10.1145\/3527153","type":"journal-article","created":{"date-parts":[[2022,3,25]],"date-time":"2022-03-25T13:06:20Z","timestamp":1648213580000},"page":"1-36","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":55,"title":["A Survey on Voice Assistant Security: Attacks and Countermeasures"],"prefix":"10.1145","volume":"55","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-4430-5263","authenticated-orcid":false,"given":"Chen","family":"Yan","sequence":"first","affiliation":[{"name":"Zhejiang University, Hangzhou, Zhejiang, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1101-0007","authenticated-orcid":false,"given":"Xiaoyu","family":"Ji","sequence":"additional","affiliation":[{"name":"Zhejiang University, Hangzhou, Zhejiang, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6391-3286","authenticated-orcid":false,"given":"Kai","family":"Wang","sequence":"additional","affiliation":[{"name":"Zhejiang University, Hangzhou, Zhejiang, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7628-9005","authenticated-orcid":false,"given":"Qinhong","family":"Jiang","sequence":"additional","affiliation":[{"name":"Zhejiang University, Hangzhou, Zhejiang, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3251-456X","authenticated-orcid":false,"given":"Zizhi","family":"Jin","sequence":"additional","affiliation":[{"name":"Zhejiang University, Hangzhou, Zhejiang, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5043-9148","authenticated-orcid":false,"given":"Wenyuan","family":"Xu","sequence":"additional","affiliation":[{"name":"Zhejiang University, Hangzhou, Zhejiang, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2022,11,21]]},"reference":[{"key":"e_1_3_1_2_2","article-title":"Universal adversarial audio perturbations","author":"Abdoli Sajjad","year":"2019","unstructured":"Sajjad Abdoli, Luiz G. Hafemann, Jerome Rony, Ismail Ben Ayed, Patrick Cardinal, and Alessandro L. Koerich. 2019. Universal adversarial audio perturbations. arXiv:1908.03173. Retrieved from https:\/\/arxiv.org\/abs\/1908.03173.","journal-title":"arXiv:1908.03173."},{"key":"e_1_3_1_3_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23362"},{"key":"e_1_3_1_4_2","article-title":"Hear \u201cNo Evil\u201d, See \u201cKenansville\u201d: Efficient and transferable black-box attacks on speech recognition and voice identification systems","author":"Abdullah Hadi","year":"2019","unstructured":"Hadi Abdullah, Muhammad Sajidur Rahman, Washington Garcia, Logan Blue, Kevin Warren, Anurag Swarnim Yadav, Tom Shrimpton, and Patrick Traynor. 2019. Hear \u201cNo Evil\u201d, See \u201cKenansville\u201d: Efficient and transferable black-box attacks on speech recognition and voice identification systems. arXiv:1910.05262. Retrieved from https:\/\/arxiv.org\/abs\/1910.05262.","journal-title":"arXiv:1910.05262."},{"key":"e_1_3_1_5_2","article-title":"The faults in our ASRs: An overview of attacks against automatic speech recognition and speaker identification systems","author":"Abdullah Hadi","year":"2020","unstructured":"Hadi Abdullah, Kevin Warren, Vincent Bindschaedler, Nicolas Papernot, and Patrick Traynor. 2020. The faults in our ASRs: An overview of attacks against automatic speech recognition and speaker identification systems. arXiv:2007.06622. Retrieved from https:\/\/arxiv.org\/abs\/2007.06622.","journal-title":"arXiv:2007.06622."},{"key":"e_1_3_1_6_2","first-page":"2685","volume-title":"Proceedings of the 29th USENIX Security Symposium","author":"Ahmed Muhammad Ejaz","year":"2020","unstructured":"Muhammad Ejaz Ahmed, Il-Youp Kwak, Jun Ho Huh, Iljoo Kim, Taekkyung Oh, and Hyoungshick Kim. 2020. Void: A fast and light voice liveness detection system. In Proceedings of the 29th USENIX Security Symposium. 2685\u20132702."},{"key":"e_1_3_1_7_2","article-title":"Identifying audio adversarial examples via anomalous pattern detection","author":"Akinwande Victor","year":"2020","unstructured":"Victor Akinwande, Celia Cintas, Skyler Speakman, and Srihari Sridharan. 2020. Identifying audio adversarial examples via anomalous pattern detection. arXiv:2002.05463. Retrieved from https:\/\/arxiv.org\/abs\/2002.05463.","journal-title":"arXiv:2002.05463."},{"key":"e_1_3_1_8_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2013.6638222"},{"key":"e_1_3_1_9_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2017.2747626"},{"key":"e_1_3_1_10_2","first-page":"6","volume-title":"Proceedings of the 31st Conference on Neural Information Processing Systems","author":"Alzantot Moustafa","year":"2017","unstructured":"Moustafa Alzantot, Bharathan Balaji, and Mani Srivastava. 2017. Did you hear that? Adversarial examples against automatic speech recognition. In Proceedings of the 31st Conference on Neural Information Processing Systems. 6."},{"key":"e_1_3_1_11_2","article-title":"MP3 compression to diminish adversarial noise in end-to-end speech recognition","author":"Andronic Iustina","year":"2020","unstructured":"Iustina Andronic, Ludwig K\u00fcrzinger, Edgar Ricardo Chavez Rosas, Gerhard Rigoll, and Bernhard U. Seeber. 2020. MP3 compression to diminish adversarial noise in end-to-end speech recognition. arXiv:2007.12892. Retrieved from https:\/\/arxiv.org\/abs\/2007.12892.","journal-title":"arXiv:2007.12892."},{"key":"e_1_3_1_12_2","article-title":"Exploring the space of black-box attacks on deep neural networks","author":"Bhagoji Arjun Nitin","year":"2017","unstructured":"Arjun Nitin Bhagoji, Warren He, Bo Li, and Dawn Song. 2017. Exploring the space of black-box attacks on deep neural networks. arXiv:1712.09491. Retrieved from https:\/\/arxiv.org\/abs\/1712.09491.","journal-title":"arXiv:1712.09491."},{"key":"e_1_3_1_13_2","doi-asserted-by":"crossref","unstructured":"Sourav Bhattacharya Dionysis Manousakas Alberto Gil C. P. Ramos Stylianos I. Venieris Nicholas D. Lane and Cecilia Mascolo. 2020. Countering acoustic adversarial attacks in microphone-equipped smart home devices. Proceedings of the ACM on Interactive Mobile Wearable and Ubiquitous Technologies 4 2 (2020) 1\u201324.","DOI":"10.1145\/3397332"},{"key":"e_1_3_1_14_2","article-title":"High fidelity speech synthesis with adversarial networks","author":"Bi\u0144kowski Miko\u0142aj","year":"2019","unstructured":"Miko\u0142aj Bi\u0144kowski, Jeff Donahue, Sander Dieleman, Aidan Clark, Erich Elsen, Norman Casagrande, Luis C. Cobo, and Karen Simonyan. 2019. High fidelity speech synthesis with adversarial networks. arXiv:1909.11646. Retrieved from https:\/\/arxiv.org\/abs\/1909.11646.","journal-title":"arXiv:1909.11646."},{"issue":"1","key":"e_1_3_1_15_2","article-title":"The speech interface as an attack surface: An overview","volume":"12","author":"Bispham M.","year":"2019","unstructured":"M. Bispham, Ioannis Agrafiotis, and Michael Goldsmith. 2019. The speech interface as an attack surface: An overview. International Journal On Advances in Security 12, 1 and 2 (2019).","journal-title":"International Journal On Advances in Security"},{"key":"e_1_3_1_16_2","doi-asserted-by":"publisher","DOI":"10.5220\/0007309500750087"},{"key":"e_1_3_1_17_2","doi-asserted-by":"publisher","DOI":"10.1145\/3196494.3196545"},{"key":"e_1_3_1_18_2","first-page":"123","volume-title":"Proceedings of the ACM WiSec 2018","author":"Blue Logan","year":"2018","unstructured":"Logan Blue, Luis Vargas, and Patrick Traynor. 2018. Hello, is it me you\u2019re looking for? differentiating between human and electronic speakers for voice interface security. In Proceedings of the ACM WiSec 2018. 123\u2013133."},{"key":"e_1_3_1_19_2","unstructured":"Fabian Braunlein and Luise Frerichs. 2020. Smart Spies: Alexa and Google Home Expose Users to Vishing and Eavesdropping. Retrieved from https:\/\/srlabs.de\/bites\/smart-spies\/."},{"key":"e_1_3_1_20_2","doi-asserted-by":"publisher","DOI":"10.5555\/3241094.3241135"},{"key":"e_1_3_1_21_2","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00009"},{"key":"e_1_3_1_22_2","unstructured":"Lucy Chai Thavishi Illandara and Zhongxia Yan. 2019. Private speech adversaries. (2019)."},{"key":"e_1_3_1_23_2","doi-asserted-by":"publisher","DOI":"10.1109\/ASP-DAC47756.2020.9045597"},{"key":"e_1_3_1_24_2","volume-title":"A Two-layer Authentication Using Voiceprint for Voice Assistants","author":"Chang Yun-Tai","year":"2018","unstructured":"Yun-Tai Chang. 2018. A Two-layer Authentication Using Voiceprint for Voice Assistants. Ph.D. Dissertation."},{"key":"e_1_3_1_25_2","article-title":"Who is real bob? adversarial attacks on speaker recognition systems","author":"Chen Guangke","year":"2019","unstructured":"Guangke Chen, Sen Chen, Lingling Fan, Xiaoning Du, Zhe Zhao, Fu Song, and Yang Liu. 2019. Who is real bob? adversarial attacks on speaker recognition systems. arXiv:1911.01840. Retrieved from https:\/\/arxiv.org\/abs\/1911.01840.","journal-title":"arXiv:1911.01840."},{"key":"e_1_3_1_26_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS.2017.133"},{"key":"e_1_3_1_27_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.23055"},{"key":"e_1_3_1_28_2","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485365"},{"key":"e_1_3_1_29_2","volume-title":"Proceedings of the 29th USENIX Security Symposium","author":"Chen Yuxuan","year":"2020","unstructured":"Yuxuan Chen, Xuejing Yuan, Jiangshan Zhang, Yue Zhao, Shengzhi Zhang, Kai Chen, and XiaoFeng Wang. 2020. Devil\u2019s whisper: A general approach for physical adversarial attacks against commercial black-box speech recognition devices. In Proceedings of the 29th USENIX Security Symposium."},{"key":"e_1_3_1_30_2","unstructured":"Long Cheng Christin Wilson Jeffrey Alan Young Daniel Dong and Hongxin Hu. 2020. Dangerous skills got certified: Measuring the trustworthiness of amazon alexa platform. (2020)."},{"key":"e_1_3_1_31_2","first-page":"358","volume-title":"Proceedings of the 10th ASSTA Conference","author":"Chetty Girija","year":"2004","unstructured":"Girija Chetty and Michael Wagner. 2004. Liveness verification in audio-video speaker authentication. In Proceedings of the 10th ASSTA Conference. Macquarie University Press, 358\u2013363."},{"key":"e_1_3_1_32_2","first-page":"197","volume-title":"Proceedings of the WISA 2018","author":"Cho Geumhwan","year":"2018","unstructured":"Geumhwan Cho, Jusop Choi, Hyoungshick Kim, Sangwon Hyun, and Jungwoo Ryoo. 2018. Threat modeling and analysis of voice assistant applications. In Proceedings of the WISA 2018. Springer, 197\u2013209."},{"key":"e_1_3_1_33_2","first-page":"6977","volume-title":"Proceedings of the 31st NeurIPS","author":"Cisse Moustapha M.","year":"2017","unstructured":"Moustapha M. Cisse, Yossi Adi, Natalia Neverova, and Joseph Keshet. 2017. Houdini: Fooling deep structured visual and speech recognition models with adversarial examples. In Proceedings of the 31st NeurIPS. 6977\u20136987."},{"key":"e_1_3_1_34_2","first-page":"677","volume-title":"Proceedings of the Joint European Conference on Machine Learning and Knowledge Discovery in Databases","author":"Das Nilaksh","year":"2018","unstructured":"Nilaksh Das, Madhuri Shanbhogue, Shang-Tse Chen, Li Chen, Michael E. Kounavis, and Duen Horng Chau. 2018. Adagio: Interactive experimentation with adversarial attack and defense for audio. In Proceedings of the Joint European Conference on Machine Learning and Knowledge Discovery in Databases. Springer, 677\u2013681."},{"key":"e_1_3_1_35_2","article-title":"The attacker\u2019s perspective on automatic speaker verification: An overview","author":"Das Rohan Kumar","year":"2020","unstructured":"Rohan Kumar Das, Xiaohai Tian, Tomi Kinnunen, and Haizhou Li. 2020. The attacker\u2019s perspective on automatic speaker verification: An overview. arXiv:2004.08849. Retrieved from https:\/\/arxiv.org\/abs\/2004.08849.","journal-title":"arXiv:2004.08849."},{"key":"e_1_3_1_36_2","article-title":"Detecting adversarial examples for speech recognition via uncertainty quantification","author":"D\u00e4ubener Sina","year":"2020","unstructured":"Sina D\u00e4ubener, Lea Sch\u00f6nherr, Asja Fischer, and Dorothea Kolossa. 2020. Detecting adversarial examples for speech recognition via uncertainty quantification. arXiv:2005.14611. Retrieved from https:\/\/arxiv.org\/abs\/2005.14611.","journal-title":"arXiv:2005.14611."},{"key":"e_1_3_1_37_2","doi-asserted-by":"publisher","DOI":"10.1145\/2666620.2666623"},{"key":"e_1_3_1_38_2","article-title":"Sirenattack: Generating adversarial audio for end-to-end acoustic systems","author":"Du Tianyu","year":"2019","unstructured":"Tianyu Du, Shouling Ji, Jinfeng Li, Qinchen Gu, Ting Wang, and Raheem Beyah. 2019. Sirenattack: Generating adversarial audio for end-to-end acoustic systems. arXiv:1901.07846. Retrieved from https:\/\/arxiv.org\/abs\/1901.07846.","journal-title":"arXiv:1901.07846."},{"key":"e_1_3_1_39_2","doi-asserted-by":"publisher","DOI":"10.1145\/3394171.3413603"},{"key":"e_1_3_1_40_2","article-title":"Smart home personal assistants: A security and privacy review","author":"Edu Jide S.","year":"2019","unstructured":"Jide S. Edu, Jose M. Such, and Guillermo Suarez-Tangil. 2019. Smart home personal assistants: A security and privacy review. arXiv:1903.05593. Retrieved from https:\/\/arxiv.org\/abs\/1903.05593.","journal-title":"arXiv:1903.05593."},{"key":"e_1_3_1_41_2","article-title":"Remote and silent voice command injection on a smartphone through conducted IEMI: Threats of smart IEMI for information security","volume":"48","author":"Esteves J. Lopes","year":"2018","unstructured":"J. Lopes Esteves and C. Kasmi. 2018. Remote and silent voice command injection on a smartphone through conducted IEMI: Threats of smart IEMI for information security. Technical Report 48 (2018).","journal-title":"Technical Report"},{"key":"e_1_3_1_42_2","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2013-288"},{"key":"e_1_3_1_43_2","first-page":"1178","volume-title":"Proceedings of the Advances in Neural Information Processing Systems","author":"Fawzi Alhussein","year":"2018","unstructured":"Alhussein Fawzi, Hamza Fawzi, and Omar Fawzi. 2018. Adversarial vulnerability for any classifier. In Proceedings of the Advances in Neural Information Processing Systems. 1178\u20131187."},{"key":"e_1_3_1_44_2","doi-asserted-by":"publisher","DOI":"10.1145\/3117811.3117823"},{"key":"e_1_3_1_45_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-74695-9_23"},{"key":"e_1_3_1_46_2","doi-asserted-by":"publisher","DOI":"10.1145\/3176402"},{"key":"e_1_3_1_47_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.specom.2014.12.004"},{"key":"e_1_3_1_48_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2019.00167"},{"key":"e_1_3_1_49_2","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/649"},{"key":"e_1_3_1_50_2","first-page":"1","volume-title":"Proceedings of the DYNAMICS 2018","author":"Gong Yuan","year":"2018","unstructured":"Yuan Gong and Christian Poellabauer. 2018. Crafting adversarial examples for speech paralinguistics applications. In Proceedings of the DYNAMICS 2018. ACM, 1\u20138."},{"key":"e_1_3_1_51_2","article-title":"An overview of vulnerabilities of voice controlled systems","author":"Gong Yuan","year":"2018","unstructured":"Yuan Gong and Christian Poellabauer. 2018. An overview of vulnerabilities of voice controlled systems. arXiv:1803.09156. Retrieved from https:\/\/arxiv.org\/abs\/1803.09156.","journal-title":"arXiv:1803.09156."},{"key":"e_1_3_1_52_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCCN.2018.8487334"},{"key":"e_1_3_1_53_2","doi-asserted-by":"publisher","DOI":"10.1109\/LSP.2020.2996908"},{"key":"e_1_3_1_54_2","doi-asserted-by":"crossref","unstructured":"Xavi Gonzalvo Siamak Tazari Chun-an Chan Markus Becker Alexander Gutkin and Hanna Silen. 2016. Recent advances in Google real-time HMM-driven unit selection synthesizer. (2016).","DOI":"10.21437\/Interspeech.2016-264"},{"key":"e_1_3_1_55_2","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow Ian J.","year":"2014","unstructured":"Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv:1412.6572. Retrieved from https:\/\/arxiv.org\/abs\/1412.6572.","journal-title":"arXiv:1412.6572."},{"key":"e_1_3_1_56_2","article-title":"INOR\u2013an intelligent noise reduction method to defend against adversarial audio examples","author":"Guo Qingli","year":"2020","unstructured":"Qingli Guo, Jing Ye, Yiran Chen, Yu Hu, Yazhu Lan, Guohe Zhang, and Xiaowei Li. 2020. INOR\u2013an intelligent noise reduction method to defend against adversarial audio examples. Neurocomputing (2020).","journal-title":"Neurocomputing"},{"key":"e_1_3_1_57_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2985231"},{"key":"e_1_3_1_58_2","first-page":"1","volume-title":"Proceedings of the 29th USENIX Security Symposium","author":"Guo Zhixiu","year":"2020","unstructured":"Zhixiu Guo, Zijin Lin, Pan Li, and Kai Chen. 2020. SkillExplorer: Understanding the behavior of skills in large scale. In Proceedings of the 29th USENIX Security Symposium. 1\u201318."},{"key":"e_1_3_1_59_2","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363264"},{"key":"e_1_3_1_60_2","unstructured":"Abeerah Hashim. 2019. New Attack Strategy Against Smart Assistants Dubbed LightCommands. Retrieved from https:\/\/latesthackingnews.com\/2019\/11\/10\/new-attack-strategy-against-smart-assistants-dubbed-lightcommands\/."},{"key":"e_1_3_1_61_2","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2013-289"},{"key":"e_1_3_1_62_2","volume-title":"Proceedings of the 31th USENIX Security Symposium","author":"He Ruiwen","year":"2022","unstructured":"Ruiwen He, Xiaoyu Ji, Xinfeng Li, Yushi Cheng, and Wenyuan Xu. 2022. \u201cOK, Siri\u201d or \u201cHey, Google\u201d: Evaluating voiceprint distinctiveness via content-based PROLE score. In Proceedings of the 31th USENIX Security Symposium."},{"key":"e_1_3_1_63_2","doi-asserted-by":"publisher","DOI":"10.1145\/3300061.3345429"},{"key":"e_1_3_1_64_2","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2019.1900006"},{"key":"e_1_3_1_65_2","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3278497"},{"key":"e_1_3_1_66_2","article-title":"Generating adversarial examples for speech recognition","author":"Iter Dan","year":"2017","unstructured":"Dan Iter, Jade Huang, and Mike Jermann. 2017. Generating adversarial examples for speech recognition. Stanford Technical Report (2017).","journal-title":"Stanford Technical Report"},{"key":"e_1_3_1_67_2","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660295"},{"key":"e_1_3_1_68_2","doi-asserted-by":"publisher","DOI":"10.1007\/s00034-017-0639-x"},{"key":"e_1_3_1_69_2","doi-asserted-by":"crossref","unstructured":"Tejas Jayashankar Jonathan Le Roux and Pierre Moulin. 2020. Detecting audio attacks on ASR systems with dropout uncertainty. arXiv:2006.01906. Retrieved from https:\/\/arxiv.org\/abs\/2006.01906.","DOI":"10.21437\/Interspeech.2020-1846"},{"key":"e_1_3_1_70_2","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2018-1297"},{"key":"e_1_3_1_71_2","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485389"},{"key":"e_1_3_1_72_2","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2018-1675"},{"key":"e_1_3_1_73_2","doi-asserted-by":"publisher","DOI":"10.1109\/TEMC.2015.2463089"},{"key":"e_1_3_1_74_2","doi-asserted-by":"publisher","DOI":"10.1038\/1961253a0"},{"key":"e_1_3_1_75_2","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2019-2420"},{"key":"e_1_3_1_76_2","doi-asserted-by":"publisher","DOI":"10.1109\/LSP.2018.2811740"},{"key":"e_1_3_1_77_2","article-title":"Adam: A method for stochastic optimization","author":"Kingma Diederik P.","year":"2014","unstructured":"Diederik P. Kingma and Jimmy Ba. 2014. Adam: A method for stochastic optimization. arXiv:1412.6980. Retrieved from https:\/\/arxiv.org\/abs\/1412.6980.","journal-title":"arXiv:1412.6980."},{"key":"e_1_3_1_78_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.specom.2009.08.009"},{"key":"e_1_3_1_79_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2018.8462693"},{"key":"e_1_3_1_80_2","doi-asserted-by":"publisher","DOI":"10.5555\/3277203.3277207"},{"key":"e_1_3_1_81_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2013.20"},{"key":"e_1_3_1_82_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2925452"},{"key":"e_1_3_1_83_2","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363246"},{"key":"e_1_3_1_84_2","doi-asserted-by":"publisher","DOI":"10.1007\/11554028_3"},{"key":"e_1_3_1_85_2","first-page":"145","volume-title":"Proceedings of the ISIMP 2004","author":"Lau Yee Wah","year":"2004","unstructured":"Yee Wah Lau, Michael Wagner, and Dat Tran. 2004. Vulnerability of speaker verification to voice mimicking. In Proceedings of the ISIMP 2004. IEEE, 145\u2013148."},{"issue":"1","key":"e_1_3_1_86_2","first-page":"1","article-title":"Using sonar for liveness detection to protect smart speakers against remote attackers","volume":"4","author":"Lee Yeonjoon","year":"2020","unstructured":"Yeonjoon Lee, Yue Zhao, Jiutian Zeng, Kwangwuk Lee, Nan Zhang, Faysal Hossain Shezan, Yuan Tian, Kai Chen, and XiaoFeng Wang. 2020. Using sonar for liveness detection to protect smart speakers against remote attackers. Proceedings of the ACM UbiComp 2020 4, 1 (2020), 1\u201328.","journal-title":"Proceedings of the ACM UbiComp 2020"},{"key":"e_1_3_1_87_2","doi-asserted-by":"publisher","DOI":"10.1145\/3384419.3430779"},{"key":"e_1_3_1_88_2","first-page":"11908","volume-title":"Proceedings of the 33rd NeurIPS","author":"Li Juncheng","year":"2019","unstructured":"Juncheng Li, Shuhui Qu, Xinjian Li, Joseph Szurley, J. Zico Kolter, and Florian Metze. 2019. Adversarial music: Real world audio adversary against wake-word detection system. In Proceedings of the 33rd NeurIPS. 11908\u201311918."},{"key":"e_1_3_1_89_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICME46284.2020.9102886"},{"key":"e_1_3_1_90_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP40776.2020.9053058"},{"key":"e_1_3_1_91_2","article-title":"Investigating robustness of adversarial samples detection for automatic speaker verification","author":"Li Xu","year":"2020","unstructured":"Xu Li, Na Li, Jinghua Zhong, Xixin Wu, Xunying Liu, Dan Su, Dong Yu, and Helen Meng. 2020. Investigating robustness of adversarial samples detection for automatic speaker verification. arXiv:2006.06186. Retrieved from https:\/\/arxiv.org\/abs\/2006.06186.","journal-title":"arXiv:2006.06186."},{"key":"e_1_3_1_92_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP40776.2020.9053076"},{"key":"e_1_3_1_93_2","doi-asserted-by":"publisher","DOI":"10.1145\/3376897.3377856"},{"key":"e_1_3_1_94_2","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423348"},{"key":"e_1_3_1_95_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-07974-5_2"},{"key":"e_1_3_1_96_2","doi-asserted-by":"publisher","DOI":"10.21437\/Eurospeech.1999-283"},{"key":"e_1_3_1_97_2","doi-asserted-by":"publisher","DOI":"10.1109\/ASRU46091.2019.9003763"},{"key":"e_1_3_1_98_2","unstructured":"Xiaolei Liu Xiaosong Zhang Kun Wan Qingxin Zhu and Yufei Ding. 2019. Towards weighted-sampling audio adversarial example attack. arXiv:1901.10300. Retrieved from https:\/\/arxiv.org\/abs\/1901.10300."},{"key":"e_1_3_1_99_2","article-title":"Can we steal your vocal identity from the Internet?: Initial investigation of cloning Obama\u2019s voice using GAN, WaveNet and low-quality found data","author":"Lorenzo-Trueba Jaime","year":"2018","unstructured":"Jaime Lorenzo-Trueba, Fuming Fang, Xin Wang, Isao Echizen, Junichi Yamagishi, and Tomi Kinnunen. 2018. Can we steal your vocal identity from the Internet?: Initial investigation of cloning Obama\u2019s voice using GAN, WaveNet and low-quality found data. arXiv:1803.00860. Retrieved from https:\/\/arxiv.org\/abs\/1803.00860.","journal-title":"arXiv:1803.00860."},{"issue":"2","key":"e_1_3_1_100_2","first-page":"1","article-title":"VocalLock: Sensing vocal tract for passphrase-independent user authentication leveraging acoustic signals on smartphones","volume":"4","author":"Lu Li","year":"2020","unstructured":"Li Lu, Jiadi Yu, Yingying Chen, and Yan Wang. 2020. VocalLock: Sensing vocal tract for passphrase-independent user authentication leveraging acoustic signals on smartphones. Proceedings of the ACM UbiComp 2020 4, 2 (2020), 1\u201324.","journal-title":"Proceedings of the ACM UbiComp 2020"},{"key":"e_1_3_1_101_2","article-title":"Detecting adversarial attacks on audio-visual speech recognition","author":"Ma Pingchuan","year":"2019","unstructured":"Pingchuan Ma, Stavros Petridis, and Maja Pantic. 2019. Detecting adversarial attacks on audio-visual speech recognition. arXiv:1912.08639. Retrieved from https:\/\/arxiv.org\/abs\/1912.08639.","journal-title":"arXiv:1912.08639."},{"key":"e_1_3_1_102_2","article-title":"Towards deep learning models resistant to adversarial attacks","author":"Madry Aleksander","year":"2017","unstructured":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv:1706.06083. Retrieved from https:\/\/arxiv.org\/abs\/1706.06083.","journal-title":"arXiv:1706.06083."},{"key":"e_1_3_1_103_2","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2020.2997779"},{"key":"e_1_3_1_104_2","volume-title":"Can a Professional Imitator Fool a GMM-based Speaker Verification System?","author":"Mari\u00e9thoz Johnny","year":"2005","unstructured":"Johnny Mari\u00e9thoz and Samy Bengio. 2005. Can a Professional Imitator Fool a GMM-based Speaker Verification System?Technical Report. IDIAP."},{"key":"e_1_3_1_105_2","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2019-2430"},{"key":"e_1_3_1_106_2","unstructured":"Jenny Medeiros. 2019. Here\u2019s How The Military is Using Voice Technology. Retrieved from https:\/\/www.voicesummit.ai\/blog\/how-the-military-is-using-voice-technology."},{"key":"e_1_3_1_107_2","unstructured":"Ethan Mendes and Kyle Hogan. 2020. Defending against imperceptible audio adversarial examples using proportional additive gaussian noise. (2020)."},{"key":"e_1_3_1_108_2","doi-asserted-by":"publisher","DOI":"10.1145\/3209582.3209591"},{"key":"e_1_3_1_109_2","doi-asserted-by":"publisher","DOI":"10.1145\/3321705.3329842"},{"key":"e_1_3_1_110_2","volume-title":"Proceedings of the Odyssey 2018 Speaker and Language Recognition Workshop","author":"Mochizuki Shihono","year":"2018","unstructured":"Shihono Mochizuki, Sayaka Shiota, and Hitoshi Kiya. 2018. Voice liveness detection using phoneme-based pop-noise detector for speaker verifcation. In Proceedings of the Odyssey 2018 Speaker and Language Recognition Workshop."},{"key":"e_1_3_1_111_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.specom.2017.01.008"},{"key":"e_1_3_1_112_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"e_1_3_1_113_2","article-title":"Universal adversarial perturbations for speech recognition systems","author":"Neekhara Paarth","year":"2019","unstructured":"Paarth Neekhara, Shehzeen Hussain, Prakhar Pandey, Shlomo Dubnov, Julian McAuley, and Farinaz Koushanfar. 2019. Universal adversarial perturbations for speech recognition systems. arXiv:1905.03828. Retrieved from https:\/\/arxiv.org\/abs\/1905.03828.","journal-title":"arXiv:1905.03828."},{"key":"e_1_3_1_114_2","first-page":"3918","volume-title":"Proceedings of the ICML 2018","author":"Oord Aaron","year":"2018","unstructured":"Aaron Oord, Yazhe Li, Igor Babuschkin, Karen Simonyan, Oriol Vinyals, Koray Kavukcuoglu, George Driessche, Edward Lockhart, Luis Cobo, Florian Stimberg, et\u00a0al. 2018. Parallel wavenet: Fast high-fidelity speech synthesis. In Proceedings of the ICML 2018. 3918\u20133926."},{"key":"e_1_3_1_115_2","article-title":"Wavenet: A generative model for raw audio","author":"Oord Aaron van den","year":"2016","unstructured":"Aaron van den Oord, Sander Dieleman, Heiga Zen, Karen Simonyan, Oriol Vinyals, Alex Graves, Nal Kalchbrenner, Andrew Senior, and Koray Kavukcuoglu. 2016. Wavenet: A generative model for raw audio. arXiv:1609.03499. Retrieved from https:\/\/arxiv.org\/abs\/1609.03499.","journal-title":"arXiv:1609.03499."},{"key":"e_1_3_1_116_2","article-title":"Digital processing of speech signals","author":"Oppenheim E.","year":"1980","unstructured":"E. Oppenheim and R. W. Schafer. 1980. Digital processing of speech signals. Moscow: Mir.\u2013323 (1980).","journal-title":"Moscow: Mir.\u2013323"},{"key":"e_1_3_1_117_2","doi-asserted-by":"publisher","DOI":"10.1080\/02564602.2015.1010611"},{"key":"e_1_3_1_118_2","unstructured":"Mary Papenfuss. 201. Amazon Voice Assistant Alexa Orders Herself Some Dollhouses. Retrieved from https:\/\/www.huffpost.com\/entry\/amazon-alexa-orders-dollhouses_n_587317bbe4b099cdb0fdff5b."},{"key":"e_1_3_1_119_2","article-title":"Transferability in machine learning: From phenomena to black-box attacks using adversarial samples","author":"Papernot Nicolas","year":"2016","unstructured":"Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. 2016. Transferability in machine learning: From phenomena to black-box attacks using adversarial samples. arXiv:1605.07277. Retrieved from https:\/\/arxiv.org\/abs\/1605.07277.","journal-title":"arXiv:1605.07277."},{"key":"e_1_3_1_120_2","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"e_1_3_1_121_2","doi-asserted-by":"publisher","DOI":"10.32604\/cmc.2019.08520"},{"key":"e_1_3_1_122_2","article-title":"SEGAN: Speech enhancement generative adversarial network","author":"Pascual Santiago","year":"2017","unstructured":"Santiago Pascual, Antonio Bonafonte, and Joan Serra. 2017. SEGAN: Speech enhancement generative adversarial network. arXiv:1703.09452. Retrieved from https:\/\/arxiv.org\/abs\/1703.09452.","journal-title":"arXiv:1703.09452."},{"key":"e_1_3_1_123_2","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2019-2742"},{"issue":"3","key":"e_1_3_1_124_2","first-page":"1","article-title":"Combating replay attacks against voice assistants","volume":"3","author":"Pradhan Swadhin","year":"2019","unstructured":"Swadhin Pradhan, Wei Sun, Ghufran Baig, and Lili Qiu. 2019. Combating replay attacks against voice assistants. Proceedings of the ACM UbiComp 2019 3, 3 (2019), 1\u201326.","journal-title":"Proceedings of the ACM UbiComp 2019"},{"key":"e_1_3_1_125_2","volume-title":"Proceedings of the 36th ICML","author":"Qin Yao","year":"2019","unstructured":"Yao Qin, Nicholas Carlini, Ian Goodfellow, Garrison Cottrell, and Colin Raffel. 2019. Imperceptible, robust, and targeted adversarial examples for automatic speech recognition. In Proceedings of the 36th ICML."},{"key":"e_1_3_1_126_2","doi-asserted-by":"crossref","unstructured":"Krishan Rajaratnam Basemah Alshemali Kunal Shah and Jugal Kalita. 2018. Speech Coding and Audio Preprocessing for Mitigating and Detecting Audio Adversarial Examples on Automatic Speech Recognition.","DOI":"10.1109\/ISSPIT.2018.8642623"},{"key":"e_1_3_1_127_2","doi-asserted-by":"publisher","DOI":"10.1109\/ISSPIT.2018.8642623"},{"key":"e_1_3_1_128_2","article-title":"Isolated and ensemble audio preprocessing methods for detecting adversarial examples against automatic speech recognition","author":"Rajaratnam Krishan","year":"2018","unstructured":"Krishan Rajaratnam, Kunal Shah, and Jugal Kalita. 2018. Isolated and ensemble audio preprocessing methods for detecting adversarial examples against automatic speech recognition. arXiv:1809.04397. Retrieved from https:\/\/arxiv.org\/abs\/1809.04397.","journal-title":"arXiv:1809.04397."},{"key":"e_1_3_1_129_2","doi-asserted-by":"publisher","DOI":"10.1016\/0167-6393(95)00009-D"},{"key":"e_1_3_1_130_2","first-page":"547","volume-title":"Proceedings of the 15th NSDI","author":"Roy Nirupam","year":"2018","unstructured":"Nirupam Roy, Sheng Shen, Haitham Hassanieh, and Romit Roy Choudhury. 2018. Inaudible voice commands: The long-range attack and defense. In Proceedings of the 15th NSDI. 547\u2013560."},{"key":"e_1_3_1_131_2","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2013-203"},{"issue":"1","key":"e_1_3_1_132_2","first-page":"44","article-title":"Robust voice liveness detection and speaker verification using throat microphones","volume":"26","author":"Sahidullah Md","year":"2017","unstructured":"Md Sahidullah, Dennis Alexander Lehmann Thomsen, Rosa Gonzalez Hautam\u00e4ki, Tomi Kinnunen, Zheng-Hua Tan, Robert Parts, and Martti Pitk\u00e4nen. 2017. Robust voice liveness detection and speaker verification using throat microphones. IEEE\/ACM TASLP 26, 1 (2017), 44\u201356.","journal-title":"IEEE\/ACM TASLP"},{"key":"e_1_3_1_133_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2015.7178838"},{"issue":"1","key":"e_1_3_1_134_2","first-page":"84","article-title":"Statistical parametric speech synthesis incorporating generative adversarial networks","volume":"26","author":"Saito Yuki","year":"2017","unstructured":"Yuki Saito, Shinnosuke Takamichi, and Hiroshi Saruwatari. 2017. Statistical parametric speech synthesis incorporating generative adversarial networks. IEEE\/ACM TASLP 26, 1 (2017), 84\u201396.","journal-title":"IEEE\/ACM TASLP"},{"key":"e_1_3_1_135_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP40776.2020.9054750"},{"key":"e_1_3_1_136_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23288"},{"key":"e_1_3_1_137_2","article-title":"Imperio: Robust over-the-air adversarial examples against automatic speech recognition systems","author":"Sch\u00f6nherr Lea","year":"2019","unstructured":"Lea Sch\u00f6nherr, Steffen Zeiler, Thorsten Holz, and Dorothea Kolossa. 2019. Imperio: Robust over-the-air adversarial examples against automatic speech recognition systems. arXiv:1908.01551. Retrieved from https:\/\/arxiv.org\/abs\/1908.01551.","journal-title":"arXiv:1908.01551."},{"key":"e_1_3_1_138_2","article-title":"FoolHD: Fooling speaker identification by highly imperceptible adversarial disturbances","author":"Shamsabadi Ali Shahin","year":"2020","unstructured":"Ali Shahin Shamsabadi, Francisco Sep\u00falveda Teixeira, Alberto Abad, Bhiksha Raj, Andrea Cavallaro, and Isabel Trancoso. 2020. FoolHD: Fooling speaker identification by highly imperceptible adversarial disturbances. arXiv:2011.08483. arXiv preprint arXiv:2011.08483.","journal-title":"a"},{"key":"e_1_3_1_139_2","doi-asserted-by":"publisher","DOI":"10.1109\/MASS.2018.00016"},{"key":"e_1_3_1_140_2","doi-asserted-by":"publisher","DOI":"10.1109\/SAHCN.2019.8824980"},{"key":"e_1_3_1_141_2","article-title":"Secure voice input on augmented reality headsets","author":"Shang Jiacheng","year":"2020","unstructured":"Jiacheng Shang and Jie Wu. 2020. Secure voice input on augmented reality headsets. IEEE TMC (2020).","journal-title":"IEEE TMC"},{"key":"e_1_3_1_142_2","doi-asserted-by":"publisher","DOI":"10.1109\/MASS50613.2020.00089"},{"key":"e_1_3_1_143_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2010.5495503"},{"key":"e_1_3_1_144_2","doi-asserted-by":"publisher","DOI":"10.1145\/3366423.3380179"},{"key":"e_1_3_1_145_2","doi-asserted-by":"publisher","DOI":"10.21437\/Odyssey.2016-37"},{"key":"e_1_3_1_146_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3138836"},{"key":"e_1_3_1_147_2","unstructured":"Statista. 2020. Number of Digital Voice Assistants in Use Worldwide from 2019 to 2023. Retrieved from https:\/\/www.statista.com\/statistics\/973815\/worldwide-digital-voice-assistant-in-use\/."},{"key":"e_1_3_1_148_2","article-title":"\u201cAre you home alone?\u201d \u201cYes\u201d disclosing security and privacy vulnerabilities in alexa skills","author":"Su Dan","year":"2020","unstructured":"Dan Su, Jiqiang Liu, Sencun Zhu, Xiaoyang Wang, and Wei Wang. 2020. \u201cAre you home alone?\u201d \u201cYes\u201d disclosing security and privacy vulnerabilities in alexa skills. arXiv:2010.10788. Retrieved from https:\/\/arxiv.org\/abs\/2010.10788.","journal-title":"arXiv:2010.10788."},{"key":"e_1_3_1_149_2","unstructured":"Takeshi Sugawara Benjamin Cyr Sara Rampazzi Daniel Genkin and Kevin Fu. 2019. Light commands: Laser-based audio injection attacks on voice-controllable systems. (2019)."},{"key":"e_1_3_1_150_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICME.2016.7552917"},{"issue":"11","key":"e_1_3_1_151_2","first-page":"1826","article-title":"Adversarial regularization for attention based end-to-end robust speech recognition","volume":"27","author":"Sun Sining","year":"2019","unstructured":"Sining Sun, Pengcheng Guo, Lei Xie, and Mei-Yuh Hwang. 2019. Adversarial regularization for attention based end-to-end robust speech recognition. IEEE\/ACM TASLP 27, 11 (2019), 1826\u20131838.","journal-title":"IEEE\/ACM TASLP"},{"key":"e_1_3_1_152_2","article-title":"Training augmentation with adversarial examples for robust speech recognition","author":"Sun Sining","year":"2018","unstructured":"Sining Sun, Ching-Feng Yeh, Mari Ostendorf, Mei-Yuh Hwang, and Lei Xie. 2018. Training augmentation with adversarial examples for robust speech recognition. arXiv:1806.02782. Retrieved from https:\/\/arxiv.org\/abs\/1806.02782.","journal-title":"arXiv:1806.02782."},{"key":"e_1_3_1_153_2","article-title":"Intriguing properties of neural networks","author":"Szegedy Christian","year":"2013","unstructured":"Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv:1312.6199. Retrieved from https:\/\/arxiv.org\/abs\/1312.6199.","journal-title":"arXiv:1312.6199."},{"key":"e_1_3_1_154_2","article-title":"Perceptual based adversarial audio attacks","author":"Szurley Joseph","year":"2019","unstructured":"Joseph Szurley and J. Zico Kolter. 2019. Perceptual based adversarial audio attacks. arXiv:1906.06355. Retrieved from https:\/\/arxiv.org\/abs\/1906.06355.","journal-title":"arXiv:1906.06355."},{"key":"e_1_3_1_155_2","doi-asserted-by":"publisher","DOI":"10.1109\/IWCIA47330.2019.8955062"},{"key":"e_1_3_1_156_2","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2019.00016"},{"key":"e_1_3_1_157_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2007.367303"},{"key":"e_1_3_1_158_2","article-title":"Asvspoof 2019: Future horizons in spoofed and fake audio detection","author":"Todisco Massimiliano","year":"2019","unstructured":"Massimiliano Todisco, Xin Wang, Ville Vestman, Md Sahidullah, H\u00e9ctor Delgado, Andreas Nautsch, Junichi Yamagishi, Nicholas Evans, Tomi Kinnunen, and Kong Aik Lee. 2019. Asvspoof 2019: Future horizons in spoofed and fake audio detection. arXiv:1904.05441. Retrieved from https:\/\/arxiv.org\/abs\/1904.05441.","journal-title":"arXiv:1904.05441."},{"key":"e_1_3_1_159_2","doi-asserted-by":"crossref","unstructured":"Keiichi Tokuda Yoshihiko Nankaku Tomoki Toda Heiga Zen Junichi Yamagishi and Keiichiro Oura. 2013. Speech synthesis based on hidden Markov models. 101 5 (2013) 1234\u20131252.","DOI":"10.1109\/JPROC.2013.2251852"},{"key":"e_1_3_1_160_2","doi-asserted-by":"publisher","DOI":"10.5555\/3241094.3241142"},{"key":"e_1_3_1_161_2","unstructured":"Kai Tubbesing. 2018. Alexa is Engaged as Voice Assistant in Industry. Retrieved from https:\/\/www.hannovermesse.de\/en\/news\/news-articles\/alexa-is-engaged-as-voice-assistant-in-industry."},{"key":"e_1_3_1_162_2","article-title":"Universal adversarial examples in speech command classification","author":"Vadillo Jon","year":"2019","unstructured":"Jon Vadillo and Roberto Santana. 2019. Universal adversarial examples in speech command classification. arXiv:1911.10182. Retrieved from https:\/\/arxiv.org\/abs\/1911.10182.","journal-title":"arXiv:1911.10182."},{"key":"e_1_3_1_163_2","article-title":"On the human evaluation of audio adversarial examples","author":"Vadillo Jon","year":"2020","unstructured":"Jon Vadillo and Roberto Santana. 2020. On the human evaluation of audio adversarial examples. arXiv:2001.08444. Retrieved from https:\/\/arxiv.org\/abs\/2001.08444.","journal-title":"arXiv:2001.08444."},{"key":"e_1_3_1_164_2","volume-title":"Proceedings of the 9th USENIX Workshop on Offensive Technologies","author":"Vaidya Tavish","year":"2015","unstructured":"Tavish Vaidya, Yuankai Zhang, Micah Sherr, and Clay Shields. 2015. Cocaine noodles: Exploiting the gap between human and machine speech recognition. In Proceedings of the 9th USENIX Workshop on Offensive Technologies."},{"key":"e_1_3_1_165_2","first-page":"131","volume-title":"Proceedings of the FALA Workshop","author":"Villalba Jes\u00fas","year":"2010","unstructured":"Jes\u00fas Villalba and Eduardo Lleida. 2010. Speaker verification performance degradation against spoofing and tampering attacks. In Proceedings of the FALA Workshop. 131\u2013134."},{"key":"e_1_3_1_166_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-19530-3_25"},{"key":"e_1_3_1_167_2","doi-asserted-by":"publisher","DOI":"10.1109\/CCST.2011.6095943"},{"key":"e_1_3_1_168_2","volume-title":"Verbmobil: Foundations of Speech-to-speech Translation","author":"Wahlster Wolfgang","year":"2013","unstructured":"Wolfgang Wahlster. 2013. Verbmobil: Foundations of Speech-to-speech Translation. Springer Science & Business Media."},{"key":"e_1_3_1_169_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00038"},{"key":"e_1_3_1_170_2","article-title":"WearID: Wearable-assisted low-effort authentication to voice assistants using cross-domain speech similarity","author":"Wang Chen","year":"2020","unstructured":"Chen Wang, Cong Shi, Yingying Chen, Yan Wang, and Nitesh Saxena. 2020. WearID: Wearable-assisted low-effort authentication to voice assistants using cross-domain speech similarity. arXiv:2003.09083. Retrieved from https:\/\/arxiv.org\/abs\/2003.09083.","journal-title":"arXiv:2003.09083."},{"key":"e_1_3_1_171_2","article-title":"Targeted speech adversarial example generation with generative adversarial network","author":"Wang Donghua","year":"2020","unstructured":"Donghua Wang, Li Dong, Rangding Wang, Diqun Yan, and Jie Wang. 2020. Targeted speech adversarial example generation with generative adversarial network. IEEE Access (2020).","journal-title":"IEEE Access"},{"key":"e_1_3_1_172_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-15-9129-7_31"},{"key":"e_1_3_1_173_2","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2019-2983"},{"key":"e_1_3_1_174_2","doi-asserted-by":"crossref","unstructured":"Qing Wang Pengcheng Guo and Lei Xie. 2020. Inaudible adversarial perturbations for targeted attack in speaker recognition. arXiv:2005.10637. Retrieved from https:\/\/arxiv.org\/abs\/2005.10637.","DOI":"10.21437\/Interspeech.2020-1955"},{"key":"e_1_3_1_175_2","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2019.8737422"},{"key":"e_1_3_1_176_2","article-title":"Towards query-efficient adversarial attacks against automatic speech recognition systems","author":"Wang Qian","year":"2020","unstructured":"Qian Wang, Baolin Zheng, Qi Li, Chao Shen, and Zhongjie Ba. 2020. Towards query-efficient adversarial attacks against automatic speech recognition systems. IEEE Transactions on Information Forensics and Security (2020).","journal-title":"IEEE Transactions on Information Forensics and Security"},{"key":"e_1_3_1_177_2","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417254"},{"key":"e_1_3_1_178_2","first-page":"365","volume-title":"Proceedings of the RAID 2020","author":"Wang Shu","year":"2020","unstructured":"Shu Wang, Jiahao Cao, Kun Sun, and Qi Li. 2020. SIEVE: Secure in-vehicle automatic speech recognition systems. In Proceedings of the RAID 2020. 365\u2013379."},{"key":"e_1_3_1_179_2","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2017-304"},{"key":"e_1_3_1_180_2","doi-asserted-by":"crossref","unstructured":"Yao Wang Wandong Cai Tao Gu Wei Shao Yannan Li and Yong Yu. 2019. Secure your voice: An oral airflow-based continuous liveness detection for voice assistants. 3 4 (2019) 1\u201328.","DOI":"10.1145\/3369811"},{"key":"e_1_3_1_181_2","doi-asserted-by":"publisher","DOI":"10.3115\/v1\/D14-1007"},{"key":"e_1_3_1_182_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLC.2011.6016982"},{"key":"e_1_3_1_183_2","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2017-776"},{"key":"e_1_3_1_184_2","unstructured":"Venessa Wong. 2017. Burger King\u2019s New Ad Will Hijack Your Google Home. Retrieved from https:\/\/www.cnbc.com\/2017\/04\/12\/burger-kings-new-ad-will-hijack-your-google-home.html."},{"key":"e_1_3_1_185_2","doi-asserted-by":"publisher","DOI":"10.1109\/DySPAN.2019.8935789"},{"key":"e_1_3_1_186_2","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2012-465"},{"key":"e_1_3_1_187_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.specom.2014.10.005"},{"key":"e_1_3_1_188_2","doi-asserted-by":"publisher","DOI":"10.1109\/APSIPA.2014.7041636"},{"key":"e_1_3_1_189_2","first-page":"1","volume-title":"Proceedings of the APSIPA ASC","author":"Wu Zhizheng","year":"2012","unstructured":"Zhizheng Wu, Tomi Kinnunen, Eng Siong Chng, Haizhou Li, and Eliathamby Ambikairajah. 2012. A study on spoofing attack in state-of-the-art speaker verification: The telephone speech case. In Proceedings of the APSIPA ASC. IEEE, 1\u20135."},{"key":"e_1_3_1_190_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP40776.2020.9053747"},{"key":"e_1_3_1_191_2","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/741"},{"key":"e_1_3_1_192_2","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354248"},{"key":"e_1_3_1_193_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00026"},{"key":"e_1_3_1_194_2","article-title":"The feasibility of injecting inaudible voice commands to voice assistants","author":"Yan Chen","year":"2019","unstructured":"Chen Yan, Guoming Zhang, Xiaoyu Ji, Tianchen Zhang, Taimin Zhang, and Wenyuan Xu. 2019. The feasibility of injecting inaudible voice commands to voice assistants. IEEE TDSC (2019).","journal-title":"IEEE TDSC"},{"key":"e_1_3_1_195_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24068"},{"key":"e_1_3_1_196_2","article-title":"Characterizing audio adversarial examples using temporal dependency","author":"Yang Zhuolin","year":"2018","unstructured":"Zhuolin Yang, Bo Li, Pin-Yu Chen, and Dawn Song. 2018. Characterizing audio adversarial examples using temporal dependency. arXiv:1809.10875. Retrieved from https:\/\/arxiv.org\/abs\/1809.10875.","journal-title":"arXiv:1809.10875."},{"key":"e_1_3_1_197_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2974290"},{"key":"e_1_3_1_198_2","first-page":"882","volume-title":"Proceedings of the 8th ICUFN","author":"Young Park Joon","year":"2016","unstructured":"Park Joon Young, Jo Hyo Jin, Samuel Woo, and Dong Hoon Lee. 2016. BadVoice: Soundless voice-control replay attack on modern smartphones. In Proceedings of the 8th ICUFN. IEEE, 882\u2013887."},{"key":"e_1_3_1_199_2","doi-asserted-by":"publisher","DOI":"10.1109\/GLOCOM.2018.8647762"},{"key":"e_1_3_1_200_2","first-page":"49","volume-title":"Proceedings of the 27th USENIX Security Symposium","author":"Yuan Xuejing","year":"2018","unstructured":"Xuejing Yuan, Yuxuan Chen, Yue Zhao, Yunhui Long, Xiaokang Liu, Kai Chen, Shengzhi Zhang, Heqing Huang, XiaoFeng Wang, and Carl A. Gunter. 2018. Commandersong: A systematic approach for practical adversarial voice recognition. In Proceedings of the 27th USENIX Security Symposium. 49\u201364."},{"key":"e_1_3_1_201_2","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2018.2886017"},{"key":"e_1_3_1_202_2","first-page":"294","volume-title":"Proceedings of the SSW 2007","author":"Zen Heiga","year":"2007","unstructured":"Heiga Zen, Takashi Nose, Junichi Yamagishi, Shinji Sako, Takashi Masuko, Alan W. Black, and Keiichi Tokuda. 2007. The HMM-based speech synthesis system (HTS) version 2.0. In Proceedings of the SSW 2007. Citeseer, 294\u2013299."},{"key":"e_1_3_1_203_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.specom.2009.04.004"},{"key":"e_1_3_1_204_2","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2019.00019"},{"key":"e_1_3_1_205_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24551"},{"key":"e_1_3_1_206_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134052"},{"key":"e_1_3_1_207_2","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2020\/438"},{"key":"e_1_3_1_208_2","doi-asserted-by":"publisher","DOI":"10.1145\/3327962.3331456"},{"key":"e_1_3_1_209_2","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM41043.2020.9155483"},{"key":"e_1_3_1_210_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3133962"},{"key":"e_1_3_1_211_2","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978296"},{"key":"e_1_3_1_212_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00016"},{"key":"e_1_3_1_213_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2945791"},{"key":"e_1_3_1_214_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23525"},{"key":"e_1_3_1_215_2","doi-asserted-by":"publisher","DOI":"10.1109\/MWC.2019.1800477"},{"key":"e_1_3_1_216_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2019.8683746"}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3527153","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3527153","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T17:51:00Z","timestamp":1750182660000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3527153"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,11,21]]},"references-count":215,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2023,4,30]]}},"alternative-id":["10.1145\/3527153"],"URL":"https:\/\/doi.org\/10.1145\/3527153","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,11,21]]},"assertion":[{"value":"2020-12-15","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-03-14","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-11-21","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}