{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,28]],"date-time":"2026-03-28T05:18:51Z","timestamp":1774675131394,"version":"3.50.1"},"reference-count":46,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2024,6,5]],"date-time":"2024-06-05T00:00:00Z","timestamp":1717545600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2024,6,5]],"date-time":"2024-06-05T00:00:00Z","timestamp":1717545600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Most of the adversarial attacks against speech recognition systems focus on specific adversarial perturbations, which are generated by adversaries for each normal example to achieve the attack. Universal adversarial perturbations (UAPs), which are independent of the examples, have recently received wide attention for their enhanced real-time applicability and expanded threat range. However, most of the UAP research concentrates on the image domain, and less on speech. In this paper, we propose a staged perturbation generation method that constructs CommanderUAP, which achieves a high success rate of universal adversarial attack against speech recognition models. Moreover, we apply some methods from model training to improve the generalization in attack and we control the imperceptibility of the perturbation in both time and frequency domains. In specific scenarios, CommanderUAP can also transfer attack some commercial speech recognition APIs.<\/jats:p>","DOI":"10.1186\/s42400-024-00218-8","type":"journal-article","created":{"date-parts":[[2024,6,5]],"date-time":"2024-06-05T03:31:23Z","timestamp":1717558283000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":7,"title":["CommanderUAP: a practical and transferable universal adversarial attacks on speech recognition models"],"prefix":"10.1186","volume":"7","author":[{"given":"Zheng","family":"Sun","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jinxiao","family":"Zhao","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Feng","family":"Guo","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0000-5031","authenticated-orcid":false,"given":"Yuxuan","family":"Chen","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Lei","family":"Ju","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2024,6,5]]},"reference":[{"key":"218_CR1","unstructured":"(2003) Iso 226:2003 acoustics\u2014normal equal-loudness-level contours. https:\/\/www.iso.org\/standard\/34222.html"},{"key":"218_CR2","unstructured":"(2015) iflytek speech-to-text. https:\/\/www.xfyun.cn\/services\/voicedictation"},{"key":"218_CR3","unstructured":"(2022) Alibaba short speech recognition. https:\/\/www.alibabacloud.com\/zh\/product\/intelligent-speech-interaction"},{"key":"218_CR4","unstructured":"(2023) Baidu speech-to-text. https:\/\/ai.baidu.com\/tech\/speech"},{"key":"218_CR5","unstructured":"(2023) Tencent short speech recognition. https:\/\/cloud.tencent.com\/document\/ product\/1093"},{"key":"218_CR6","unstructured":"Abdoli S, Hafemann LG, Rony J et\u00a0al (2019) Universal adversarial audio perturbations. arXiv preprint arXiv:1908.03173"},{"key":"218_CR7","doi-asserted-by":"crossref","unstructured":"Abdullah H, Rahman MS, Garcia W et\u00a0al (2021) Hear \u201cno evil\", see \u201ckenansville\": efficient and transferable black-box attacks on speech recognition and voice identification systems. In: 2021 IEEE symposium on security and privacy (SP), IEEE, pp 712\u2013729","DOI":"10.1109\/SP40001.2021.00009"},{"key":"218_CR8","unstructured":"Alzantot M, Balaji B, Srivastava M (2018) Did you hear that? Adversarial examples against automatic speech recognition. arXiv preprint arXiv:1801.00554"},{"key":"218_CR9","unstructured":"Amodei D, Ananthanarayanan S, Anubhai R et\u00a0al (2016) Deep speech 2: end-to-end speech recognition in English and mandarin. In: International conference on machine learning, PMLR, pp 173\u2013182"},{"key":"218_CR10","doi-asserted-by":"crossref","unstructured":"Battenberg E, Chen J, Child R et\u00a0al (2017) Exploring neural transducers for end-to-end speech recognition. In: 2017 IEEE automatic speech recognition and understanding workshop (ASRU), IEEE, pp 206\u2013213","DOI":"10.1109\/ASRU.2017.8268937"},{"key":"218_CR11","doi-asserted-by":"crossref","unstructured":"Carlini N, Wagner D (2018) Audio adversarial examples: targeted attacks on speech-to-text. In: 2018 IEEE security and privacy workshops (SPW), IEEE, pp 1\u20137","DOI":"10.1109\/SPW.2018.00009"},{"key":"218_CR12","unstructured":"Chen Y, Yuan X, Zhang J et\u00a0al (2020) Devil\u2019s whisper: a general approach for physical adversarial attacks against commercial black-box speech recognition devices. In: 29th USENIX security symposium (USENIX Security 20), pp 2667\u20132684"},{"key":"218_CR13","doi-asserted-by":"crossref","unstructured":"Du T, Ji S, Li J et\u00a0al (2020) Sirenattack: generating adversarial audio for end-to-end acoustic systems. In: Proceedings of the 15th ACM Asia conference on computer and communications security, pp 357\u2013369","DOI":"10.1145\/3320269.3384733"},{"key":"218_CR14","unstructured":"Goodfellow IJ, Shlens J, Szegedy C (2014) Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572"},{"key":"218_CR15","unstructured":"Graves A, Jaitly N (2014) Towards end-to-end speech recognition with recurrent neural networks. In: International conference on machine learning, PMLR, pp 1764\u20131772"},{"key":"218_CR16","doi-asserted-by":"crossref","unstructured":"Guo H, Wang Y, Ivanov N et\u00a0al (2022) Specpatch: human-in-the-loop adversarial audio spectrogram patch attack on speech recognition. In: Proceedings of the 2022 ACM SIGSAC conference on computer and communications security, pp 1353\u20131366","DOI":"10.1145\/3548606.3560660"},{"key":"218_CR17","doi-asserted-by":"crossref","unstructured":"Guo F, Sun Z, Chen Y et\u00a0al (2023) Towards the universal defense for query-based audio adversarial attacks. arXiv preprint arXiv:2304.10088","DOI":"10.1186\/s42400-023-00177-6"},{"key":"218_CR18","unstructured":"Hashemi AS, B\u00e4r A, Mozaffari S et\u00a0al (2020) Transferable universal adversarial perturbations using generative models. arXiv preprint arXiv:2010.14919"},{"key":"218_CR19","unstructured":"Hussain S, Neekhara P, Dubnov S et\u00a0al (2021) $$\\{$$WaveGuard$$\\}$$: understanding and mitigating audio adversarial examples. In: 30th USENIX security symposium (USENIX Security 21), pp 2273\u20132290"},{"key":"218_CR20","unstructured":"Ilyas A, Santurkar S, Tsipras D et\u00a0al (2019) Adversarial examples are not bugs, they are features. Advances in neural information processing systems 32"},{"key":"218_CR21","doi-asserted-by":"crossref","unstructured":"Khare S, Aralikatte R, Mani S (2018) Adversarial black-box attacks on automatic speech recognition systems using multi-objective evolutionary optimization. arXiv preprint arXiv:1811.01312","DOI":"10.21437\/Interspeech.2019-2420"},{"key":"218_CR22","unstructured":"Kingma DP, Ba J (2014) Adam: a method for stochastic optimization. arXiv preprint arXiv:1412.6980"},{"key":"218_CR23","doi-asserted-by":"crossref","unstructured":"Li Y, Bai S, Xie C et\u00a0al (2020a) Regional homogeneity: towards learning transferable universal adversarial perturbations against defenses. In: Computer Vision\u2013ECCV 2020: 16th European conference, Glasgow, UK, August 23\u201328, 2020, Proceedings, Part XI 16. Springer, pp 795\u2013813","DOI":"10.1007\/978-3-030-58621-8_46"},{"key":"218_CR24","doi-asserted-by":"crossref","unstructured":"Li Z, Wu Y, Liu J et\u00a0al (2020b) Advpulse: universal, synchronization-free, and targeted audio adversarial attacks via subsecond perturbations. In: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pp 1121\u20131134","DOI":"10.1145\/3372297.3423348"},{"key":"218_CR25","unstructured":"Loshchilov I, Hutter F (2017) Decoupled weight decay regularization. arXiv preprint arXiv:1711.05101"},{"key":"218_CR26","doi-asserted-by":"crossref","unstructured":"Lu Z, Han W, Zhang Y et\u00a0al (2021) Exploring targeted universal adversarial perturbations to end-to-end asr models. arXiv preprint arXiv:2104.02757","DOI":"10.21437\/Interspeech.2021-1668"},{"key":"218_CR27","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli SM, Fawzi A, Fawzi O et\u00a0al (2017) Universal adversarial perturbations. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 1765\u20131773","DOI":"10.1109\/CVPR.2017.17"},{"key":"218_CR28","doi-asserted-by":"crossref","unstructured":"Neekhara P, Hussain S, Pandey P et\u00a0al (2019) Universal adversarial perturbations for speech recognition systems. arXiv preprint arXiv:1905.03828","DOI":"10.21437\/Interspeech.2019-1353"},{"key":"218_CR29","doi-asserted-by":"crossref","unstructured":"Panayotov V, Chen G, Povey D et\u00a0al (2015) Librispeech: an asr corpus based on public domain audio books. In: 2015 IEEE international conference on acoustics, speech and signal processing (ICASSP), IEEE, pp 5206\u20135210","DOI":"10.1109\/ICASSP.2015.7178964"},{"key":"218_CR30","unstructured":"Povey D, Ghoshal A, Boulianne G et\u00a0al (2011) The kaldi speech recognition toolkit. In: IEEE 2011 workshop on automatic speech recognition and understanding, IEEE Signal Processing Society, CONF"},{"key":"218_CR31","unstructured":"Qin Y, Carlini N, Cottrell G et\u00a0al (2019) Imperceptible, robust, and targeted adversarial examples for automatic speech recognition. In: International conference on machine learning, PMLR, pp 5231\u20135240"},{"key":"218_CR32","doi-asserted-by":"crossref","unstructured":"Rajaratnam K, Kalita J (2018) Noise flooding for detecting audio adversarial examples against automatic speech recognition. In: 2018 IEEE international symposium on signal processing and information technology (ISSPIT), IEEE, pp 197\u2013201","DOI":"10.1109\/ISSPIT.2018.8642623"},{"key":"218_CR33","doi-asserted-by":"crossref","unstructured":"Samizade S, Tan ZH, Shen C et al (2020) Adversarial example detection by classification for deep speech recognition. In: ICASSP 2020\u20142020 IEEE international conference on acoustics, speech and signal processing (ICASSP), IEEE, pp 3102\u20133106","DOI":"10.1109\/ICASSP40776.2020.9054750"},{"key":"218_CR34","doi-asserted-by":"crossref","unstructured":"Sch\u00f6nherr L, Kohls K, Zeiler S et\u00a0al (2018) Adversarial attacks against automatic speech recognition systems via psychoacoustic hiding. arXiv preprint arXiv:1808.05665","DOI":"10.14722\/ndss.2019.23288"},{"key":"218_CR35","unstructured":"Shen J, Nguyen P, Wu Y et\u00a0al (2019) Lingvo: a modular and scalable framework for sequence-to-sequence modeling. arXiv preprint arXiv:1902.08295"},{"key":"218_CR36","unstructured":"Szegedy C, Zaremba W, Sutskever I et\u00a0al (2013) Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199"},{"key":"218_CR37","doi-asserted-by":"crossref","unstructured":"Taori R, Kamsetty A, Chu B et\u00a0al (2019) Targeted adversarial examples for black box audio systems. In: 2019 IEEE security and privacy workshops (SPW), IEEE, pp 15\u201320","DOI":"10.1109\/SPW.2019.00016"},{"key":"218_CR38","unstructured":"Vadillo J, Santana R (2019) Universal adversarial examples in speech command classification. arXiv preprint arXiv:1911.10182"},{"key":"218_CR39","doi-asserted-by":"crossref","unstructured":"Wang S, Wang X, Zhao P et\u00a0al (2018) Defensive dropout for hardening deep neural networks under adversarial attacks. In: 2018 IEEE\/ACM international conference on computer-aided design (ICCAD), IEEE, pp 1\u20138","DOI":"10.1145\/3240765.3264699"},{"key":"218_CR40","unstructured":"Xie P, Wang L, Qin R et\u00a0al (2021a) Improving the transferability of adversarial examples with new iteration framework and input dropout. arXiv preprint arXiv:2106.01617"},{"key":"218_CR41","doi-asserted-by":"crossref","unstructured":"Xie Y, Li Z, Shi C et\u00a0al (2021b) Enabling fast and universal audio adversarial attack using generative model. In: Proceedings of the AAAI conference on artificial intelligence, pp 14129\u201314137","DOI":"10.1609\/aaai.v35i16.17663"},{"key":"218_CR42","unstructured":"Yang Z, Li B, Chen PY et\u00a0al (2018) Characterizing audio adversarial examples using temporal dependency. arXiv preprint arXiv:1809.10875"},{"key":"218_CR43","unstructured":"Yuan X, Chen Y, Zhao Y et\u00a0al (2018) $$\\{$$CommanderSong$$\\}$$: a systematic approach for practical adversarial voice recognition. In: 27th USENIX security symposium (USENIX security 18), pp 49\u201364"},{"key":"218_CR44","doi-asserted-by":"crossref","unstructured":"Zhang G, Yan C, Ji X et\u00a0al (2017) Dolphinattack: inaudible voice commands. In: Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, pp 103\u2013117","DOI":"10.1145\/3133956.3134052"},{"key":"218_CR45","doi-asserted-by":"crossref","unstructured":"Zhang C, Benz P, Lin C et\u00a0al (2021) A survey on universal adversarial attack. arXiv preprint arXiv:2103.01498","DOI":"10.24963\/ijcai.2021\/635"},{"key":"218_CR46","doi-asserted-by":"crossref","unstructured":"Zong W, Chow YW, Susilo W et\u00a0al (2021) Targeted universal adversarial perturbations for automatic speech recognition. In: Information security: 24th international conference, ISC 2021, Virtual Event, November 10\u201312, 2021, Proceedings 24, Springer, pp 358\u2013373","DOI":"10.1007\/978-3-030-91356-4_19"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-024-00218-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-024-00218-8\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-024-00218-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,6,5]],"date-time":"2024-06-05T03:33:41Z","timestamp":1717558421000},"score":1,"resource":{"primary":{"URL":"https:\/\/cybersecurity.springeropen.com\/articles\/10.1186\/s42400-024-00218-8"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,6,5]]},"references-count":46,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2024,12]]}},"alternative-id":["218"],"URL":"https:\/\/doi.org\/10.1186\/s42400-024-00218-8","relation":{},"ISSN":["2523-3246"],"issn-type":[{"value":"2523-3246","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,6,5]]},"assertion":[{"value":"11 August 2023","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"2 February 2024","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"5 June 2024","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"38"}}