{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,3]],"date-time":"2025-12-03T18:04:21Z","timestamp":1764785061427,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":62,"publisher":"ACM","license":[{"start":{"date-parts":[[2022,11,6]],"date-time":"2022-11-06T00:00:00Z","timestamp":1667692800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"National Key R&D Program of China","award":["2020AAA0107700"],"award-info":[{"award-number":["2020AAA0107700"]}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["2021FZZX001-27"],"award-info":[{"award-number":["2021FZZX001-27"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62102354, 62032021, 62122066, 62172359, 61972348, 62172277"],"award-info":[{"award-number":["62102354, 62032021, 62122066, 62172359, 61972348, 62172277"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2022,11,6]]},"DOI":"10.1145\/3560905.3568518","type":"proceedings-article","created":{"date-parts":[[2023,1,24]],"date-time":"2023-01-24T23:37:10Z","timestamp":1674603430000},"page":"710-724","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":5,"title":["Push the Limit of Adversarial Example Attack on Speaker Recognition in Physical Domain"],"prefix":"10.1145","author":[{"given":"Qianniu","family":"Chen","sequence":"first","affiliation":[{"name":"Zhejiang University and ZJU-HIC"}]},{"given":"Meng","family":"Chen","sequence":"additional","affiliation":[{"name":"Zhejiang University"}]},{"given":"Li","family":"Lu","sequence":"additional","affiliation":[{"name":"Zhejiang University"}]},{"given":"Jiadi","family":"Yu","sequence":"additional","affiliation":[{"name":"Shanghai Jiao Tong University"}]},{"given":"Yingying","family":"Chen","sequence":"additional","affiliation":[{"name":"Rutgers University"}]},{"given":"Zhibo","family":"Wang","sequence":"additional","affiliation":[{"name":"Zhejiang University"}]},{"given":"Zhongjie","family":"Ba","sequence":"additional","affiliation":[{"name":"Zhejiang University"}]},{"given":"Feng","family":"Lin","sequence":"additional","affiliation":[{"name":"Zhejiang University"}]},{"given":"Kui","family":"Ren","sequence":"additional","affiliation":[{"name":"Zhejiang University"}]}],"member":"320","published-online":{"date-parts":[[2023,1,24]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"FAKEBOB adversarial attack Tom Dorr Golfer Chen and Pengfei Gao. 2019. FAKEBOB. https:\/\/github.com\/FAKEBOB-adversarial-attack\/FAKEBOB."},{"key":"e_1_3_2_1_2_1","unstructured":"Amazon Help & Customer Service. 2022. What Is Alexa Voice ID? https:\/\/www.amazon.com\/gp\/help\/customer\/display.html?nodeId=202199440."},{"key":"e_1_3_2_1_3_1","unstructured":"Apple. 2022. Apple Siri. https:\/\/www.apple.com\/sg\/siri\/."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.21105\/joss.03958"},{"key":"e_1_3_2_1_5_1","unstructured":"Raghav Bharadwaj. 2019. Voice and Speech Recognition in Banking - What's Possible Today. https:\/\/emerj.com\/ai-sector-overviews\/voice-speech-recognition-banking\/."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1155\/S1110865704310024"},{"volume-title":"Proceedings of SP Workshops. IEEE Computer Society","author":"Carlini Nicholas","key":"e_1_3_2_1_7_1","unstructured":"Nicholas Carlini and David A. Wagner. 2018. Audio Adversarial Examples: Targeted Attacks on Speech-to-Text. In Proceedings of SP Workshops. IEEE Computer Society, San Francisco, CA, USA, 1--7."},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00004"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM48880.2022.9796934"},{"key":"e_1_3_2_1_10_1","volume-title":"Proceedings of NDSS. The Internet Society","author":"Chen Tao","year":"2020","unstructured":"Tao Chen, Longfei Shangguan, Zhenjiang Li, and Kyle Jamieson. 2020. Meta-morph: Injecting Inaudible Commands into Over-the-air Voice Controlled Systems. In Proceedings of NDSS. The Internet Society, San Diego, California, USA."},{"key":"e_1_3_2_1_11_1","volume-title":"Proceedings of USENIX Security Symposium. USENIX Association, 2667--2684","author":"Chen Yuxuan","year":"2020","unstructured":"Yuxuan Chen, Xuejing Yuan, Jiangshan Zhang, Yue Zhao, Shengzhi Zhang, Kai Chen, and XiaoFeng Wang. 2020. Devil's Whisper: A General Approach for Physical Adversarial Attacks against Commercial Black-box Speech Recognition Devices. In Proceedings of USENIX Security Symposium. USENIX Association, 2667--2684."},{"key":"e_1_3_2_1_12_1","volume-title":"Proceedings of ICLR. OpenReview.net, Virtual Event.","author":"Chiquier Mia","year":"2022","unstructured":"Mia Chiquier, Chengzhi Mao, and Carl Vondrick. 2022. Real-Time Neural Voice Camouflage. In Proceedings of ICLR. OpenReview.net, Virtual Event."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2018.8461587"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP39728.2021.9413626"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2011.5947549"},{"key":"e_1_3_2_1_16_1","volume-title":"Proceedings of ICLR. OpenReview.net","author":"Goodfellow Ian J.","year":"2015","unstructured":"Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and Harnessing Adversarial Examples. In Proceedings of ICLR. OpenReview.net, San Diego, CA, USA."},{"key":"e_1_3_2_1_17_1","unstructured":"Google Assistant Help. 2022. Teach Google Assistant to recognize your voice with Voice Match. https:\/\/support.google.com\/assistant\/answer\/9071681."},{"key":"e_1_3_2_1_18_1","volume-title":"Proceedings of APSIPA ASC. IEEE","author":"Goto Keita","year":"2020","unstructured":"Keita Goto and Nakamasa Inoue. 2020. Quasi-Newton Adversarial Attacks on Speaker Verification Systems. In Proceedings of APSIPA ASC. IEEE, Auckland, New Zealand, 527--531."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2005.06.042"},{"key":"e_1_3_2_1_20_1","volume-title":"Proceedings of ICML","volume":"80","author":"Ilyas Andrew","year":"2018","unstructured":"Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. 2018. Black-box Adversarial Attacks with Limited Queries and Information. In Proceedings of ICML, Vol. 80. IEEE, Stockholmsm\u00e4ssan, Stockholm, Sweden, 2142--2151."},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/3412382.3458265"},{"volume-title":"Measurement of room acoustic parameters-part 1: Performance spaces. Standard","author":"ISO.","key":"e_1_3_2_1_22_1","unstructured":"ISO. 2009. Measurement of room acoustic parameters-part 1: Performance spaces. Standard. International Organization for Standardization."},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.csl.2021.101199"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2019-2420"},{"key":"e_1_3_2_1_25_1","unstructured":"Aldebaro Klautau. 2001. ARPABET and the TIMIT alphabet. (2001)."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2018.8462693"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/PACRIM.1993.407206"},{"key":"e_1_3_2_1_28_1","volume-title":"Proceedings of ICLR. OpenReview.net","author":"Kurakin Alexey","year":"2017","unstructured":"Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. 2017. Adversarial examples in the physical world. In Proceedings of ICLR. OpenReview.net, Toulon, France."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.specom.2014.03.001"},{"key":"e_1_3_2_1_30_1","volume-title":"Levenshtein et al","author":"Vladimir","year":"1966","unstructured":"Vladimir I. Levenshtein et al. 1966. Binary codes capable of correcting deletions, insertions and reversals. Dokl. Akad. Nauk SSSR (1966)."},{"key":"e_1_3_2_1_31_1","volume-title":"Deep Speaker: an End-to-End Neural Speaker Embedding System. CoRR abs\/1705.02304","author":"Li Chao","year":"2017","unstructured":"Chao Li, Xiaokong Ma, Bing Jiang, Xiangang Li, Xuewei Zhang, Xiao Liu, Ying Cao, Ajay Kannan, and Zhenyao Zhu. 2017. Deep Speaker: an End-to-End Neural Speaker Embedding System. CoRR abs\/1705.02304 (2017)."},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICME46284.2020.9102886"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP40776.2020.9053076"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/3376897.3377856"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423348"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.4304\/jsw.9.11.2851-2860"},{"key":"e_1_3_2_1_37_1","volume-title":"Proceedings of ICLR. OpenReview.net","author":"Liu Yanpei","year":"2017","unstructured":"Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. 2017. Delving into Transferable Adversarial Examples and Black-box Attacks. In Proceedings of ICLR. OpenReview.net, Toulon, France."},{"key":"e_1_3_2_1_38_1","volume-title":"Proceedings of ICLR. OpenReview.net","author":"Madry Aleksander","year":"2018","unstructured":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards Deep Learning Models Resistant to Adversarial Attacks. In Proceedings of ICLR. OpenReview.net, Vancouver, BC, Canada."},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1109\/IPSN.2018.00048"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/EUSIPCO.2016.7760424"},{"key":"e_1_3_2_1_41_1","volume-title":"Joon Son Chung, and Andrew Zisserman","author":"Nagrani Arsha","year":"2017","unstructured":"Arsha Nagrani, Joon Son Chung, and Andrew Zisserman. 2017. VoxCeleb: A Large-Scale Speaker Identification Dataset. In Processings of Interspeech, Francisco Lacerda (Ed.). ISCA, Stockholm, Sweden, 2616--2620."},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2019-1353"},{"key":"e_1_3_2_1_43_1","unstructured":"Institute of Telecommunication Sciences. 1996. voice frequency. https:\/www.its.bldrdoc.gov\/fs-1037\/dir-039\/_5829.htm."},{"key":"e_1_3_2_1_44_1","volume-title":"Librispeech: An ASR corpus based on public domain audio books","author":"Panayotov Vassil","year":"2015","unstructured":"Vassil Panayotov, Guoguo Chen, Daniel Povey, and Sanjeev Khudanpur. 2015. Librispeech: An ASR corpus based on public domain audio books. In Processings of ICASSP. IEEE, South Brisbane, Queensland, Australia, 5206--5210."},{"key":"e_1_3_2_1_45_1","volume-title":"Proceedings of ROCLING","author":"Rajaratnam Krishan","year":"2018","unstructured":"Krishan Rajaratnam, Kunal Shah, and Jugal Kalita. 2018. Isolated and Ensemble Audio Preprocessing Methods for Detecting Adversarial Examples against Automatic Speech Recognition. In Proceedings of ROCLING. Hsinchu, Taiwan, 16--30."},{"key":"e_1_3_2_1_46_1","first-page":"6","article-title":"Transfer-function measurement with maximum-length sequences","volume":"37","author":"Rife Douglas D.","year":"1989","unstructured":"Douglas D. Rife and John Vanderkooy. 1989. Transfer-function measurement with maximum-length sequences. Journal of the Audio Engineering Society 37, 6 (june 1989), 419--444.","journal-title":"Journal of the Audio Engineering Society"},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427276"},{"key":"e_1_3_2_1_48_1","unstructured":"Seeed. 2018. ReSpeaker Core v2.0. https:\/\/wiki.seeedstudio.com\/ReSpeaker_Core_v2.0\/."},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2018.8461375"},{"key":"e_1_3_2_1_50_1","first-page":"249","article-title":"Comparison of different impulse response measurement techniques","volume":"50","author":"Stan Guy-Bart","year":"2002","unstructured":"Guy-Bart Stan, Jean-Jacques Embrechts, and Dominique Archambeau. 2002. Comparison of different impulse response measurement techniques. Journal of the Audio Engineering Society 50, 4 (2002), 249--262.","journal-title":"Journal of the Audio Engineering Society"},{"key":"e_1_3_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2019.00016"},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-29959-0_23"},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2014.6854363"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2020-2458"},{"key":"e_1_3_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2020-1955"},{"volume-title":"Voiceprint: The New WeChat Password. https:\/\/blog.wechat.com\/2015\/05\/21\/voiceprint-the-new-wechat-password\/.","year":"2015","key":"e_1_3_2_1_56_1","unstructured":"WeChat. 2015. Voiceprint: The New WeChat Password. https:\/\/blog.wechat.com\/2015\/05\/21\/voiceprint-the-new-wechat-password\/."},{"key":"e_1_3_2_1_57_1","unstructured":"WHO. 2019. Advice for the public: Coronavirus disease (COVID-19). https:\/\/www.who.int\/emergencies\/diseases\/novel-coronavirus-2019\/advice-for-public."},{"volume-title":"Enabling Fast and Universal Audio Adversarial Attack Using Generative Model","author":"Xie Yi","key":"e_1_3_2_1_58_1","unstructured":"Yi Xie, Zhuohang Li, Cong Shi, Jian Liu, Yingying Chen, and Bo Yuan. 2021. Enabling Fast and Universal Audio Adversarial Attack Using Generative Model. In Proceedings of AAAI. AAAI Press, Virtual Event, 14129--14137."},{"key":"e_1_3_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP40776.2020.9053747"},{"volume-title":"Proceedings of USENIX Security Symposium. USENIX Association","author":"Yuan Xuejing","key":"e_1_3_2_1_60_1","unstructured":"Xuejing Yuan, Yuxuan Chen, Yue Zhao, Yunhui Long, Xiaokang Liu, Kai Chen, Shengzhi Zhang, Heqing Huang, Xiaofeng Wang, and Carl A. Gunter. 2018. CommanderSong: A Systematic Approach for Practical Adversarial Voice Recognition. In Proceedings of USENIX Security Symposium. USENIX Association, Baltimore, MD, USA, 49--64."},{"key":"e_1_3_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP39728.2021.9413467"},{"key":"e_1_3_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2020-2834"}],"event":{"name":"SenSys '22: The 20th ACM Conference on Embedded Networked Sensor Systems","sponsor":["SIGMETRICS ACM Special Interest Group on Measurement and Evaluation","SIGCOMM ACM Special Interest Group on Data Communication","SIGMOBILE ACM Special Interest Group on Mobility of Systems, Users, Data and Computing","SIGOPS ACM Special Interest Group on Operating Systems","SIGBED ACM Special Interest Group on Embedded Systems","SIGARCH ACM Special Interest Group on Computer Architecture"],"location":"Boston Massachusetts","acronym":"SenSys '22"},"container-title":["Proceedings of the 20th ACM Conference on Embedded Networked Sensor Systems"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3560905.3568518","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3560905.3568518","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T17:49:15Z","timestamp":1750182555000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3560905.3568518"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,11,6]]},"references-count":62,"alternative-id":["10.1145\/3560905.3568518","10.1145\/3560905"],"URL":"https:\/\/doi.org\/10.1145\/3560905.3568518","relation":{},"subject":[],"published":{"date-parts":[[2022,11,6]]},"assertion":[{"value":"2023-01-24","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}