{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,7]],"date-time":"2025-11-07T09:48:11Z","timestamp":1762508891074,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":80,"publisher":"ACM","license":[{"start":{"date-parts":[[2022,11,7]],"date-time":"2022-11-07T00:00:00Z","timestamp":1667779200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2022,11,7]]},"DOI":"10.1145\/3548606.3559350","type":"proceedings-article","created":{"date-parts":[[2022,11,7]],"date-time":"2022-11-07T11:41:28Z","timestamp":1667821288000},"page":"905-919","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":7,"title":["Perception-Aware Attack"],"prefix":"10.1145","author":[{"given":"Rui","family":"Duan","sequence":"first","affiliation":[{"name":"University of South Florida, Tampa, FL, USA"}]},{"given":"Zhe","family":"Qu","sequence":"additional","affiliation":[{"name":"University of South Florida, Tampa, FL, USA"}]},{"given":"Shangqing","family":"Zhao","sequence":"additional","affiliation":[{"name":"University of Oklahoma, Tulsa, OK, USA"}]},{"given":"Leah","family":"Ding","sequence":"additional","affiliation":[{"name":"American University, Washington, D.C., DC, USA"}]},{"given":"Yao","family":"Liu","sequence":"additional","affiliation":[{"name":"University of South Florida, Tampa, FL, USA"}]},{"given":"Zhuo","family":"Lu","sequence":"additional","affiliation":[{"name":"University of South Florida, Tampa, FL, USA"}]}],"member":"320","published-online":{"date-parts":[[2022,11,7]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"https:\/\/developer.amazon.com\/en-US\/alexa","author":"Alexa Amazon","year":"2022","unstructured":"Amazon Alexa . https:\/\/developer.amazon.com\/en-US\/alexa , 2022 . Accessed : 2022-01-07. Amazon Alexa. https:\/\/developer.amazon.com\/en-US\/alexa, 2022. Accessed: 2022-01-07."},{"key":"e_1_3_2_1_2_1","volume-title":"https:\/\/assistant.google.com\/","author":"Assistant Google","year":"2022","unstructured":"Google Assistant . https:\/\/assistant.google.com\/ , 2022 . Accessed : 2022-01-07. Google Assistant. https:\/\/assistant.google.com\/, 2022. Accessed: 2022-01-07."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23362"},{"key":"e_1_3_2_1_4_1","volume-title":"Proc. of IEEE S&P","author":"Abdullah Hadi","year":"2021","unstructured":"Hadi Abdullah , Muhammad Sajidur Rahman , Washington Garcia , Logan Blue , Kevin Warren , Anurag Swarnim Yadav , Tom Shrimpton , and Patrick Traynor . Hear\" no evil\", see\" kenansville\" : Efficient and transferable black-box attacks on speech recognition and voice identification systems . In Proc. of IEEE S&P , 2021 . Hadi Abdullah, Muhammad Sajidur Rahman, Washington Garcia, Logan Blue, Kevin Warren, Anurag Swarnim Yadav, Tom Shrimpton, and Patrick Traynor. Hear\" no evil\", see\" kenansville\": Efficient and transferable black-box attacks on speech recognition and voice identification systems. In Proc. of IEEE S&P, 2021."},{"key":"e_1_3_2_1_5_1","volume-title":"Proc. of AES","author":"Allamanche Eric","year":"2001","unstructured":"Eric Allamanche . Audioid : Towards content-based identification of audio material . In Proc. of AES , 2001 . Eric Allamanche. Audioid: Towards content-based identification of audio material. In Proc. of AES, 2001."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1126\/science.1106881"},{"key":"e_1_3_2_1_7_1","volume-title":"Instance adaptive adversarial training: Improved accuracy tradeoffs in neural nets. arXiv preprint arXiv:1910.08051","author":"Balaji Yogesh","year":"2019","unstructured":"Yogesh Balaji , Tom Goldstein , and Judy Hoffman . Instance adaptive adversarial training: Improved accuracy tradeoffs in neural nets. arXiv preprint arXiv:1910.08051 , 2019 . Yogesh Balaji, Tom Goldstein, and Judy Hoffman. Instance adaptive adversarial training: Improved accuracy tradeoffs in neural nets. arXiv preprint arXiv:1910.08051, 2019."},{"key":"e_1_3_2_1_8_1","volume-title":"Proc. of ICLR","author":"Balunovic Mislav","year":"2019","unstructured":"Mislav Balunovic and Martin Vechev . Adversarial training and provable defenses: Bridging the gap . In Proc. of ICLR , 2019 . Mislav Balunovic and Martin Vechev. Adversarial training and provable defenses: Bridging the gap. In Proc. of ICLR, 2019."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/MMCS.1996.535015"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2018\/520"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1126\/science.1164015"},{"key":"e_1_3_2_1_12_1","volume-title":"A review of audio fin- gerprinting. Journal of VLSI signal processing systems for signal, image and video technology, 41(3):271--284","author":"Cano Pedro","year":"2005","unstructured":"Pedro Cano , Eloi Batlle , Ton Kalker , and Jaap Haitsma . A review of audio fin- gerprinting. Journal of VLSI signal processing systems for signal, image and video technology, 41(3):271--284 , 2005 . Pedro Cano, Eloi Batlle, Ton Kalker, and Jaap Haitsma. A review of audio fin- gerprinting. Journal of VLSI signal processing systems for signal, image and video technology, 41(3):271--284, 2005."},{"key":"e_1_3_2_1_13_1","volume-title":"Proc. AES 112th Int. Conv","author":"Cano Pedro","year":"2002","unstructured":"Pedro Cano , Eloi Batlle , Harald Mayer , and Helmut Neuschmied . Robust sound modeling for song detection in broadcast audio . In Proc. AES 112th Int. Conv , 2002 . Pedro Cano, Eloi Batlle, Harald Mayer, and Helmut Neuschmied. Robust sound modeling for song detection in broadcast audio. In Proc. AES 112th Int. Conv, 2002."},{"key":"e_1_3_2_1_14_1","volume-title":"Proc. of USENIX Security","author":"Carlini Nicholas","year":"2016","unstructured":"Nicholas Carlini , Pratyush Mishra , Tavish Vaidya , Yuankai Zhang , Micah Sherr , Clay Shields , David Wagner , and Wenchao Zhou . Hidden voice commands . In Proc. of USENIX Security , 2016 . Nicholas Carlini, Pratyush Mishra, Tavish Vaidya, Yuankai Zhang, Micah Sherr, Clay Shields, David Wagner, and Wenchao Zhou. Hidden voice commands. In Proc. of USENIX Security, 2016."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00009"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2008.916370"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00004"},{"key":"e_1_3_2_1_19_1","volume-title":"Proc. of USENIX Security","author":"Chen Yuxuan","year":"2020","unstructured":"Yuxuan Chen , Xuejing Yuan , Jiangshan Zhang , Yue Zhao , Shengzhi Zhang , Kai Chen , and XiaoFeng Wang . Devil\u00e2\u0102\u0179's whisper : A general approach for physical adversarial attacks against commercial black-box speech recognition devices . In Proc. of USENIX Security , 2020 . Yuxuan Chen, Xuejing Yuan, Jiangshan Zhang, Yue Zhao, Shengzhi Zhang, Kai Chen, and XiaoFeng Wang. Devil\u00e2\u0102\u0179's whisper: A general approach for physical adversarial attacks against commercial black-box speech recognition devices. In Proc. of USENIX Security, 2020."},{"key":"e_1_3_2_1_20_1","volume-title":"Jeffrey Adam Bloom, and Chris Honsinger. Digital watermarking","author":"Cox Ingemar J","year":"2002","unstructured":"Ingemar J Cox , Matthew L Miller , Jeffrey Adam Bloom, and Chris Honsinger. Digital watermarking , volume 53 . Springer , 2002 . Ingemar J Cox, Matthew L Miller, Jeffrey Adam Bloom, and Chris Honsinger. Digital watermarking, volume 53. Springer, 2002."},{"key":"e_1_3_2_1_21_1","volume-title":"Proc. of Biostatis- tics: A Foundation for Analysis in the Health Sciences","author":"Daniel Wayne W","year":"1987","unstructured":"Wayne W Daniel . The spearman rank correlation coefficient . In Proc. of Biostatis- tics: A Foundation for Analysis in the Health Sciences , 1987 . Wayne W Daniel. The spearman rank correlation coefficient. In Proc. of Biostatis- tics: A Foundation for Analysis in the Health Sciences, 1987."},{"key":"e_1_3_2_1_22_1","first-page":"677","volume-title":"Joint European Conference on Machine Learning and Knowledge Discovery in Databases","author":"Das Nilaksh","year":"2018","unstructured":"Nilaksh Das , Madhuri Shanbhogue , Shang-Tse Chen , Li Chen , Michael E Kounavis , and Duen Horng Chau . Adagio : Interactive experimentation with adversarial attack and defense for audio . In Joint European Conference on Machine Learning and Knowledge Discovery in Databases , pages 677 -- 681 . Springer , 2018 . Nilaksh Das, Madhuri Shanbhogue, Shang-Tse Chen, Li Chen, Michael E Kounavis, and Duen Horng Chau. Adagio: Interactive experimentation with adversarial attack and defense for audio. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases, pages 677--681. Springer, 2018."},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/TASSP.1980.1163420"},{"key":"e_1_3_2_1_24_1","volume-title":"Proc. of EUSIPCO","author":"Leon Franz De","year":"2012","unstructured":"Franz De Leon and Kirk Martinez . Enhancing timbre model using mfcc and its time derivatives for music similarity estimation . In Proc. of EUSIPCO , 2012 . Franz De Leon and Kirk Martinez. Enhancing timbre model using mfcc and its time derivatives for music similarity estimation. In Proc. of EUSIPCO, 2012."},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.5555\/2209820.2210677"},{"key":"e_1_3_2_1_26_1","first-page":"121","volume-title":"Proc. of ISMIR","author":"Fenet S\u00e9bastien","year":"2011","unstructured":"S\u00e9bastien Fenet , Ga\u00ebl Richard , Yves Grenier , A scalable audio fingerprint method with robustness to pitch-shifting . In Proc. of ISMIR , pages 121 -- 126 , 2011 . S\u00e9bastien Fenet, Ga\u00ebl Richard, Yves Grenier, et al. A scalable audio fingerprint method with robustness to pitch-shifting. In Proc. of ISMIR, pages 121--126, 2011."},{"key":"e_1_3_2_1_27_1","first-page":"1769","volume-title":"IEEE International Conference on Acoustics, Speech, and Signal Processing","volume":"2","author":"Godsill Simon","unstructured":"Simon Godsill and Manuel Davy . Bayesian harmonic models for musical pitch estimation and analysis . In IEEE International Conference on Acoustics, Speech, and Signal Processing , volume 2 , pages II-- 1769 . IEEE, 2002. Simon Godsill and Manuel Davy. Bayesian harmonic models for musical pitch estimation and analysis. In IEEE International Conference on Acoustics, Speech, and Signal Processing, volume 2, pages II--1769. IEEE, 2002."},{"key":"e_1_3_2_1_28_1","first-page":"105","article-title":"Bayesian harmonic models for musical signal analysis","volume":"7","author":"Godsill SIMON J","year":"2003","unstructured":"SIMON J Godsill and M Davy . Bayesian harmonic models for musical signal analysis . In Proc. of Bayesian Statistics , 7 : 105 -- 124 , 2003 . SIMON J Godsill and M Davy. Bayesian harmonic models for musical signal analysis. In Proc. of Bayesian Statistics, 7:105--124, 2003.","journal-title":"Proc. of Bayesian Statistics"},{"key":"e_1_3_2_1_29_1","volume-title":"Proc. of ITelCon","author":"Gomez Emilia","year":"2002","unstructured":"Emilia Gomez , Pedro Cano , L Gomes , Eloi Batlle , and Madeleine Bonnet . Mixed watermarking-fingerprinting approach for integrity verification of audio record- ings . In Proc. of ITelCon , 2002 . Emilia Gomez, Pedro Cano, L Gomes, Eloi Batlle, and Madeleine Bonnet. Mixed watermarking-fingerprinting approach for integrity verification of audio record- ings. In Proc. of ITelCon, 2002."},{"key":"e_1_3_2_1_30_1","volume-title":"Explaining and har- nessing adversarial examples. arXiv preprint arXiv:1412.6572","author":"Goodfellow Ian J","year":"2014","unstructured":"Ian J Goodfellow , Jonathon Shlens , and Christian Szegedy . Explaining and har- nessing adversarial examples. arXiv preprint arXiv:1412.6572 , 2014 . Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and har- nessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/APSIPA.2017.8282110"},{"key":"e_1_3_2_1_32_1","first-page":"7","article-title":"A technical framework for auto- matic perceptual evaluation of singing quality","author":"Gupta Chitralekha","year":"2018","unstructured":"Chitralekha Gupta , Haizhou Li , and Ye Wang . A technical framework for auto- matic perceptual evaluation of singing quality . In Proc. of APSIPA Transactions on Signal and Information Processing , 7 , 2018 . Chitralekha Gupta, Haizhou Li, and Ye Wang. A technical framework for auto- matic perceptual evaluation of singing quality. In Proc. of APSIPA Transactions on Signal and Information Processing, 7, 2018.","journal-title":"Proc. of APSIPA Transactions on Signal and Information Processing"},{"key":"e_1_3_2_1_33_1","first-page":"107","volume-title":"Proc. of Ismir","volume":"2002","author":"Haitsma Jaap","year":"2002","unstructured":"Jaap Haitsma and Ton Kalker . A highly robust audio fingerprinting system . In Proc. of Ismir , volume 2002 , pages 107 -- 115 , 2002 . Jaap Haitsma and Ton Kalker. A highly robust audio fingerprinting system. In Proc. of Ismir, volume 2002, pages 107--115, 2002."},{"key":"e_1_3_2_1_34_1","volume-title":"Proc. of CBMIW","author":"Haitsma Jaap","year":"2001","unstructured":"Jaap Haitsma , Ton Kalker , and Job Oostveen . Robust audio hashing for content identification . In Proc. of CBMIW , 2001 . Jaap Haitsma, Ton Kalker, and Job Oostveen. Robust audio hashing for content identification. In Proc. of CBMIW, 2001."},{"key":"e_1_3_2_1_35_1","volume-title":"Proc. of Springer Science & Business Media","author":"Hartmann William M","year":"2004","unstructured":"William M Hartmann . Signals, sound, and sensation. In Proc. of Springer Science & Business Media , 2004 . William M Hartmann. Signals, sound, and sensation. In Proc. of Springer Science & Business Media, 2004."},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-63387-9_5"},{"key":"e_1_3_2_1_37_1","volume-title":"Proc. of ICMC","author":"Kereliuk Corey","year":"2007","unstructured":"Corey Kereliuk , Bertrand Scherrer , Vincent Verfaille , Philippe Depalle , and Marcelo M Wanderley . Indirect acquisition of fingerings of harmonic notes on the flute . In Proc. of ICMC , 2007 . Corey Kereliuk, Bertrand Scherrer, Vincent Verfaille, Philippe Depalle, and Marcelo M Wanderley. Indirect acquisition of fingerings of harmonic notes on the flute. In Proc. of ICMC, 2007."},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2018.8462693"},{"key":"e_1_3_2_1_39_1","volume-title":"Adversarial examples in the physical world","author":"Kurakin Alexey","year":"2016","unstructured":"Alexey Kurakin , Ian Goodfellow , Samy Bengio , Adversarial examples in the physical world , 2016 . Alexey Kurakin, Ian Goodfellow, Samy Bengio, et al. Adversarial examples in the physical world, 2016."},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1371\/journal.pone.0052508"},{"volume-title":"Proc. of NIPS.","author":"Li Juncheng B","key":"e_1_3_2_1_41_1","unstructured":"Juncheng B Li , Shuhui Qu , Xinjian Li , Zico Kolter , and Florian Metze . Real world audio adversary against wake-word detection systems . In Proc. of NIPS. Juncheng B Li, Shuhui Qu, Xinjian Li, Zico Kolter, and Florian Metze. Real world audio adversary against wake-word detection systems. In Proc. of NIPS."},{"key":"e_1_3_2_1_42_1","first-page":"1121","volume-title":"Proc. of ACM CCS","author":"Li Zhuohang","year":"2020","unstructured":"Zhuohang Li , Yi Wu , Jian Liu , Yingying Chen , and Bo Yuan . Advpulse : Univer- sal, synchronization-free, and targeted audio adversarial attacks via subsecond perturbations . In Proc. of ACM CCS , pages 1121 -- 1134 , 2020 . Zhuohang Li, Yi Wu, Jian Liu, Yingying Chen, and Bo Yuan. Advpulse: Univer- sal, synchronization-free, and targeted audio adversarial attacks via subsecond perturbations. In Proc. of ACM CCS, pages 1121--1134, 2020."},{"key":"e_1_3_2_1_44_1","volume-title":"Proc. of ICML Work Shop","author":"Madry Aleksander","year":"2017","unstructured":"Aleksander Madry , Aleksandar Makelov , Ludwig Schmidt , Dimitris Tsipras , and Adrian Vladu . Towards deep learning models resistant to adversarial attacks . In Proc. of ICML Work Shop , 2017 . Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In Proc. of ICML Work Shop, 2017."},{"key":"e_1_3_2_1_45_1","first-page":"3578","volume-title":"Proc. of ICML","author":"Mirman Matthew","year":"2018","unstructured":"Matthew Mirman , Timon Gehr , and Martin Vechev . Differentiable abstract interpretation for provably robust neural networks . In Proc. of ICML , pages 3578 -- 3586 . PMLR, 2018 . Matthew Mirman, Timon Gehr, and Martin Vechev. Differentiable abstract interpretation for provably robust neural networks. In Proc. of ICML, pages 3578--3586. PMLR, 2018."},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2013.6637747"},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1109\/PROC.1977.10660"},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1109\/JSTSP.2011.2112333"},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1038\/nature02771"},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1109\/WDM.2001.990163"},{"key":"e_1_3_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2006.1628889"},{"key":"e_1_3_2_1_52_1","volume-title":"The structural components of music perception. a functional anatomical study. Brain: a journal of neurology, 120(2):229--243","author":"Platel Herv\u00e9","year":"1997","unstructured":"Herv\u00e9 Platel , Cathy Price , Jean-Claude Baron , Richard Wise , Jany Lambert , Richard S Frackowiak , Bernard Lechevalier , and Francis Eustache . The structural components of music perception. a functional anatomical study. Brain: a journal of neurology, 120(2):229--243 , 1997 . Herv\u00e9 Platel, Cathy Price, Jean-Claude Baron, Richard Wise, Jany Lambert, Richard S Frackowiak, Bernard Lechevalier, and Francis Eustache. The structural components of music perception. a functional anatomical study. Brain: a journal of neurology, 120(2):229--243, 1997."},{"key":"e_1_3_2_1_53_1","first-page":"5231","volume-title":"Proc. of ICML","author":"Qin Yao","year":"2019","unstructured":"Yao Qin , Nicholas Carlini , Garrison Cottrell , Ian Goodfellow , and Colin Raffel . Imperceptible, robust , and targeted adversarial examples for automatic speech recognition . In Proc. of ICML , pages 5231 -- 5240 . PMLR, 2019 . Yao Qin, Nicholas Carlini, Garrison Cottrell, Ian Goodfellow, and Colin Raffel. Imperceptible, robust, and targeted adversarial examples for automatic speech recognition. In Proc. of ICML, pages 5231--5240. PMLR, 2019."},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1137\/1.9781611972740.2"},{"key":"e_1_3_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1016\/B978-012213564-4\/50006-8"},{"key":"e_1_3_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2001.941023"},{"key":"e_1_3_2_1_57_1","first-page":"8307","volume-title":"Proc. of ICML","author":"Saadatpanah Parsa","year":"2020","unstructured":"Parsa Saadatpanah , Ali Shafahi , and Tom Goldstein . Adversarial attacks on copyright detection systems . In Proc. of ICML , pages 8307 -- 8315 . PMLR, 2020 . Parsa Saadatpanah, Ali Shafahi, and Tom Goldstein. Adversarial attacks on copyright detection systems. In Proc. of ICML, pages 8307--8315. PMLR, 2020."},{"key":"e_1_3_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1109\/TASSP.1978.1163055"},{"key":"e_1_3_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.3233\/IDA-2007-11508"},{"key":"e_1_3_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23288"},{"key":"e_1_3_2_1_61_1","volume-title":"Proc","author":"Sedgwick Philip","year":"2014","unstructured":"Philip Sedgwick . Spearman\u00e2's rank correlation coefficient . In Proc , of Bmj , 349, 2014 . Philip Sedgwick. Spearman\u00e2's rank correlation coefficient. In Proc, of Bmj, 349, 2014."},{"key":"e_1_3_2_1_62_1","volume-title":"Adversarial training for free! In Proc. of NIPS","author":"Shafahi Ali","year":"2019","unstructured":"Ali Shafahi , Mahyar Najibi , Amin Ghiasi , Zheng Xu , John Dickerson , Christoph Studer , Larry S Davis , Gavin Taylor , and Tom Goldstein . Adversarial training for free! In Proc. of NIPS , 2019 . Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! In Proc. of NIPS, 2019."},{"key":"e_1_3_2_1_63_1","volume-title":"Proc. of ICLR Work Shop","author":"Sharma Yash","year":"2018","unstructured":"Yash Sharma and Pin-Yu Chen . Attacking the madry defense model with l _1- based adversarial examples . In Proc. of ICLR Work Shop , 2018 . Yash Sharma and Pin-Yu Chen. Attacking the madry defense model with l _1- based adversarial examples. In Proc. of ICLR Work Shop, 2018."},{"key":"e_1_3_2_1_64_1","volume-title":"Robust quad-based audio finger- printing","author":"Sonnleitner Reinhard","year":"2015","unstructured":"Reinhard Sonnleitner and Gerhard Widmer . Robust quad-based audio finger- printing . IEEE\/ACM Transactions on Audio, Speech, and Language Processing , 24(3):409--421, 2015 . Reinhard Sonnleitner and Gerhard Widmer. Robust quad-based audio finger- printing. IEEE\/ACM Transactions on Audio, Speech, and Language Processing, 24(3):409--421, 2015."},{"key":"e_1_3_2_1_65_1","volume-title":"Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199","author":"Szegedy Christian","year":"2013","unstructured":"Christian Szegedy , Wojciech Zaremba , Ilya Sutskever , Joan Bruna , Dumitru Erhan , Ian Goodfellow , and Rob Fergus . Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 , 2013 . Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013."},{"issue":"1","key":"e_1_3_2_1_66_1","first-page":"3","article-title":"Peaq-the itu standard for objective measurement of perceived audio quality","volume":"48","author":"Thiede Thilo","year":"2000","unstructured":"Thilo Thiede , William C Treurniet , Roland Bitto , Christian Schmidmer , Thomas Sporer , John G Beerends , and Catherine Colomes . Peaq-the itu standard for objective measurement of perceived audio quality . Journal of the Audio Engineering Society , 48 ( 1\/2 ): 3 -- 29 , 2000 . Thilo Thiede, William C Treurniet, Roland Bitto, Christian Schmidmer, Thomas Sporer, John G Beerends, and Catherine Colomes. Peaq-the itu standard for objective measurement of perceived audio quality. Journal of the Audio Engineering Society, 48(1\/2):3--29, 2000.","journal-title":"Journal of the Audio Engineering Society"},{"key":"e_1_3_2_1_67_1","volume-title":"Proc. of ICLR","author":"Tram\u00e8r Florian","year":"2018","unstructured":"Florian Tram\u00e8r , Alexey Kurakin , Nicolas Papernot , Ian Goodfellow , Dan Boneh , and Patrick McDaniel . Ensemble adversarial training: Attacks and defenses . In Proc. of ICLR , 2018 . Florian Tram\u00e8r, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. Ensemble adversarial training: Attacks and defenses. In Proc. of ICLR, 2018."},{"key":"e_1_3_2_1_68_1","doi-asserted-by":"publisher","DOI":"10.1109\/TASL.2011.2174224"},{"key":"e_1_3_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2017.7952158"},{"key":"e_1_3_2_1_70_1","doi-asserted-by":"publisher","DOI":"10.21437\/SSW.2016-24"},{"key":"e_1_3_2_1_71_1","doi-asserted-by":"publisher","DOI":"10.5555\/1212811"},{"key":"e_1_3_2_1_72_1","first-page":"1","volume-title":"9th European Signal Processing Conference (EUSIPCO 1998","author":"Walmsley Paul J","year":"1998","unstructured":"Paul J Walmsley , Simon J Godsill , and Peter JW Rayner . Multidimensional optimisation of harmonic signals . In 9th European Signal Processing Conference (EUSIPCO 1998 ), pages 1 -- 4 . IEEE, 1998 . Paul J Walmsley, Simon J Godsill, and Peter JW Rayner. Multidimensional optimisation of harmonic signals. In 9th European Signal Processing Conference (EUSIPCO 1998), pages 1--4. IEEE, 1998."},{"key":"e_1_3_2_1_73_1","first-page":"7","volume-title":"Proc. of Ismir","author":"Avery Wang","year":"2003","unstructured":"Avery Wang et al. An industrial strength audio search algorithm . In Proc. of Ismir , volume 2003 , pages 7 -- 13 . Washington , DC , 2003 . Avery Wang et al. An industrial strength audio search algorithm. In Proc. of Ismir, volume 2003, pages 7--13. Washington, DC, 2003."},{"key":"e_1_3_2_1_74_1","first-page":"235","volume-title":"Proc. of ACM CCS","author":"Wenger Emily","year":"2021","unstructured":"Emily Wenger , Max Bronckers , Christian Cianfarani , Jenna Cryan , Angela Sha , Haitao Zheng , and Ben Y Zhao . \"hello, it's me\" : Deep learning-based speech synthesis attacks in the real world . In Proc. of ACM CCS , pages 235 -- 251 , 2021 . Emily Wenger, Max Bronckers, Christian Cianfarani, Jenna Cryan, Angela Sha, Haitao Zheng, and Ben Y Zhao. \"hello, it's me\": Deep learning-based speech synthesis attacks in the real world. In Proc. of ACM CCS, pages 235--251, 2021."},{"key":"e_1_3_2_1_75_1","first-page":"45","volume-title":"Timbre space as a musical control structure. Computer music journal","author":"Wessel David L","year":"1979","unstructured":"David L Wessel . Timbre space as a musical control structure. Computer music journal , pages 45 -- 52 , 1979 . David L Wessel. Timbre space as a musical control structure. Computer music journal, pages 45--52, 1979."},{"key":"e_1_3_2_1_76_1","first-page":"5286","volume-title":"Proc. of ICML","author":"Wong Eric","year":"2018","unstructured":"Eric Wong and Zico Kolter . Provable defenses against adversarial examples via the convex outer adversarial polytope . In Proc. of ICML , pages 5286 -- 5295 . PMLR, 2018 . Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In Proc. of ICML, pages 5286--5295. PMLR, 2018."},{"key":"e_1_3_2_1_77_1","volume-title":"Fast is better than free: Revisiting adversarial training. arXiv preprint arXiv:2001.03994","author":"Wong Eric","year":"2020","unstructured":"Eric Wong , Leslie Rice , and J Zico Kolter . Fast is better than free: Revisiting adversarial training. arXiv preprint arXiv:2001.03994 , 2020 . Eric Wong, Leslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training. arXiv preprint arXiv:2001.03994, 2020."},{"key":"e_1_3_2_1_78_1","volume-title":"Proc. of IJCAI","author":"Yakura Hiromu","year":"2018","unstructured":"Hiromu Yakura and Jun Sakuma . Robust audio adversarial example for a physical attack . Proc. of IJCAI , 2018 . Hiromu Yakura and Jun Sakuma. Robust audio adversarial example for a physical attack. Proc. of IJCAI, 2018."},{"key":"e_1_3_2_1_79_1","volume-title":"Proc. of USENIX Security","author":"Yuan Xuejing","year":"2018","unstructured":"Xuejing Yuan , Yuxuan Chen , Yue Zhao , Yunhui Long , Xiaokang Liu , Kai Chen , Shengzhi Zhang , Heqing Huang , XiaoFeng Wang , and Carl A Gunter . Commandersong : A systematic approach for practical adversarial voice recognition . In Proc. of USENIX Security , 2018 . Xuejing Yuan, Yuxuan Chen, Yue Zhao, Yunhui Long, Xiaokang Liu, Kai Chen, Shengzhi Zhang, Heqing Huang, XiaoFeng Wang, and Carl A Gunter. Commandersong: A systematic approach for practical adversarial voice recognition. In Proc. of USENIX Security, 2018."},{"key":"e_1_3_2_1_80_1","first-page":"103","volume-title":"Proc. of ACM CCS","author":"Zhang Guoming","year":"2017","unstructured":"Guoming Zhang , Chen Yan , Xiaoyu Ji , Tianchen Zhang , Taimin Zhang , and Wenyuan Xu. Dolphinattack : Inaudible voice commands . In Proc. of ACM CCS , pages 103 -- 117 , 2017 . Guoming Zhang, Chen Yan, Xiaoyu Ji, Tianchen Zhang, Taimin Zhang, and Wenyuan Xu. Dolphinattack: Inaudible voice commands. In Proc. of ACM CCS, pages 103--117, 2017."},{"key":"e_1_3_2_1_81_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485383"}],"event":{"name":"CCS '22: 2022 ACM SIGSAC Conference on Computer and Communications Security","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"],"location":"Los Angeles CA USA","acronym":"CCS '22"},"container-title":["Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3548606.3559350","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3548606.3559350","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T17:50:56Z","timestamp":1750182656000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3548606.3559350"}},"subtitle":["Creating Adversarial Music via Reverse-Engineering Human Perception"],"short-title":[],"issued":{"date-parts":[[2022,11,7]]},"references-count":80,"alternative-id":["10.1145\/3548606.3559350","10.1145\/3548606"],"URL":"https:\/\/doi.org\/10.1145\/3548606.3559350","relation":{},"subject":[],"published":{"date-parts":[[2022,11,7]]},"assertion":[{"value":"2022-11-07","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}