Pith. sign in

REVIEW 5 major objections 7 minor 41 references

ASRJam: Human-Friendly AI Speech Jamming to Prevent Automated Phone Scams

T0 review · 5 major / 7 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Adding a carefully tuned echo-and-reverb perturbation to a caller's outgoing audio can break LLM-driven voice scams by degrading the attacker's speech recognition, while leaving human conversation intelligible.

desk verdict Worth sending to referees for the novel reframing of ASR jamming as a proactive defense, but the paper's central 'practical' claim currently rests on clean-file experiments and hand-tuned baselines; the telephony channel is the unaddressed elephant in the room. read the letter →

arxiv 2506.11125 v1 pith:VDJ2YXDB submitted 2025-06-10 cs.CL cs.AI

Freddie Grabovski , Gilad Gressel , Yisroel Mirsky This is my paper
classification cs.CLcs.AI
keywords adversarialaudioASRjamminguniversalperturbationvoicephishingdefensereverberationautomaticspeechrecognitionLLM-drivenscamshuman-compatible
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that the weakest link in an automated voice-phishing pipeline is the automatic speech recognition (ASR) step, and that a defender can exploit it without harming human communication. It proposes ASRJam, a proactive defence that injects a universal adversarial perturbation into the victim's outgoing audio during a live call. The accompanying jammer, EchoGuard, uses natural distortions—reverberation, a simulated rotating directional microphone, and brief Gaussian-dipped attenuations—that humans tolerate but ASR models mis-handle. In experiments across three datasets and six ASR models, EchoGuard outperformed three existing black-box jammers on jamming success, and a 39-person user study rated it more pleasant while keeping clarity close to the baselines. If the central claim holds, ordinary phone users could disrupt AI scam calls in real time without model access or prior queries.

What carries the argument

The central object is EchoGuard, a precomputed audio transformation built from three natural acoustic degradations: (1) reverberation generated by an evolutionary algorithm that searches room dimensions, source and microphone positions, and an absorption coefficient, converging on a room of roughly 68.6 m by 58.9 m by 20.7 m with absorption 0.5; (2) simulated microphone oscillation, where directional impulse responses are blended with raised-cosine windows over a 5 Hz rotation cycle; and (3) transient acoustic attenuation, where 30% of 20 ms frames are dipped with a Gaussian-shaped curve down to a scaling factor of 0.7. The mechanism exploits a human and machine asymmetry: human hearing reconstructs speech through echoes and brief dropouts, while ASR models, trained mostly on clean stationary audio, lose accuracy. The same transformation fits into the ASRJam deployment pattern, where short frames of outgoing audio are perturbed at runtime, with whitelisting and manual triggers limiting exposure for legitimate callers.

What would settle it

Run EchoGuard-processed speech through an actual telephone channel—narrowband codecs with acoustic echo cancellation enabled and some packet loss—then measure word error rate on Whisper and Wav2Vec2; if transcription accuracy returns near the clean baseline, the claimed real-world jamming effect does not hold.

Watch

Extended reading notes

Core claim

The paper's central claim is that ASR is the vulnerable link in the LLM-to-TTS voice-scam chain, so corrupting the victim's transcription is enough to make the scam collapse into incoherence. EchoGuard is a black-box, zero-query, universal perturbation: the same precomputed acoustic transformation is applied frame-by-frame to any input, with no knowledge of the attacker's ASR and no queries during the call. It deliberately chooses acoustic effects—optimized reverberant room impulse responses, smoothly blended directional responses that simulate microphone rotation, and short transient amplitude attenuations—that degrade machine transcription while remaining intelligible to human listeners. The paper reports that across SPGISpeech, LibriSpeech, and TEDLIUM, EchoGuard raises jamming success by an average of 19.6% over the baselines, and on a 1–5 scale it scores 2.53 for pleasantness versus 1.96 for the baselines with comparable clarity, giving a utility index about 2.12 times higher.

Load-bearing premise

The load-bearing premise is that EchoGuard's perturbations survive a real telephone connection; the paper only tests them on clean audio files, so if the phone network's compression, echo cancellation, or packet loss removes or normalizes the effect, the jammer may fail in the field.

Editorial extensions

If this is right

  • Deploying EchoGuard on outgoing call audio should make LLM-driven scam agents respond incoherently, because their ASR transcriptions no longer match what the victim actually said.
  • The jamming is universal and zero-query, so it works across ASR models without knowing which one the attacker uses, and it can run in real time on an end-user device.
  • Users can tune the trade-off: lowering the room's absorption coefficient increases reverberation and jamming strength at the cost of pleasantness.
  • Even on the hardest tested model, Whisper, EchoGuard corrupts roughly 1 in 6 transcriptions on LibriSpeech, which the authors argue is enough to derail an interactive scam dialogue.
  • An attacker who fine-tunes an ASR model on EchoGuard-perturbed samples would likely lose accuracy on clean speech due to overfitting, making large-scale adaptation costly.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The largest open question the paper leaves implicit is the phone channel: all results are measured on clean benchmark files, so a real deployment must show that narrowband codecs, acoustic echo cancellation, and packet loss do not strip out EchoGuard's echo and modulation cues before the transformed speech reaches the attacker's ASR.
  • Because EchoGuard is a deterministic, input-independent transformation, an attacker who anticipates the defence could train ASR on EchoGuard-style reverberation or pre-process incoming audio to undo the effect, pushing the contest toward more adaptive perturbations.
  • The same human-and-machine robustness gap suggests testable extensions beyond phone scams, such as playing EchoGuard-like audio around voice assistants or tailoring perturbations to specific ASR architectures once the black-box constraint is relaxed.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 7 minor

Summary. The paper proposes ASRJam, a proactive defense that injects adversarial perturbations into a user's outgoing audio to disrupt the ASR stage of LLM-driven voice-scam pipelines, and introduces EchoGuard, a jammer built from optimized reverberation, simulated microphone rotation, and transient attenuation. EchoGuard is claimed to be black-box, zero-query, universal, real-time, and human-compatible. The evaluation reports jamming success rates across three datasets and six ASR models, plus a 39-participant user study comparing pleasantness and clarity against three baselines, with the paper concluding that EchoGuard offers the best trade-off between ASR disruption and human listening experience.

Significance. The proactive-defense framing is genuinely useful: targeting ASR in the attacker's pipeline is a sensible and underexplored idea, and the paper is, to my knowledge, the first to run a human-listener study for adversarial audio transformations in this setting. The use of a universal, zero-query perturbation is well matched to the deployment scenario, and evaluating on multiple datasets and ASR models is a reasonable starting point. However, the current evidence does not yet support the central 'practical' claim: the baselines are hand-weakened, the optimization and evaluation corpora overlap, no telephone-channel effects are tested, and the human-study results lack statistical grounding. These are fixable with additional experimentation and re-analysis, so the paper is not beyond repair.

major comments (5)
  1. [Section VI-C, Table III, Figures 7-8] The comparison against prior work is not apples-to-apples. The authors state that AdvDDoS and Kenku were scaled down by attenuation factors of 0.2 and 0.33 because their original perturbations were 'excessively disruptive to listeners,' and Kenansville was expanded from one phoneme to four. Because the central empirical claim is that EchoGuard outperforms SOTA jammers, hand-weakening the baselines by factors selected by the authors confounds the comparison: the higher utility and pleasantness of EchoGuard in Figures 7-8, and the jamming rates in Table III, may reflect the chosen attenuation rather than an inherent property of the methods. The authors should report the unmodified baselines alongside their attenuated versions, or justify a principled calibration (e.g., matched perceptual quality) and show results under several operating points.
  2. [Section V-E, Section VI-B, Table III] The optimization protocol creates a circularity for the Tedlium results. The genetic algorithm's fitness is computed from WER and STOI on 'a diverse subset of the Tedlium dataset' (Section V-E), and Table III then reports EchoGuard's jamming success on Tedlium. The high Tedlium success rates are therefore in-sample, and the aggregate claim that EchoGuard outperforms baselines across datasets is inflated by fitted numbers. The authors should either optimize on a held-out development set and evaluate on separate corpora, or explicitly separate the fitted Tedlium results from out-of-domain results. They should also state which ASR models were used in the fitness computation; if those models coincide with the evaluation models, the circularity extends beyond the corpus.
  3. [Section VI-F, Section III] No experiment passes EchoGuard's output through a telephone channel, despite the paper's deployment claim being specifically about phone calls. All evaluations in Section VI-F apply EchoGuard directly to clean benchmark audio, and the user study uses clean processed files. Real phone calls involve narrowband filtering (roughly 300-3400 Hz), lossy codecs such as G.711/G.722/Opus, acoustic echo cancellation, noise suppression, handset transducers, and packet loss, all of which can remove or normalize the engineered broadband room impulse responses, the 5 Hz directional modulation, and the 20 ms Gaussian attenuation dips. The authors need at least a standard telephony channel simulation, and ideally a real-call test, before the claim that EchoGuard is 'practical' for phone-scam defense can be accepted.
  4. [Section VI-F-1, Section VI-F-2, Figures 7-8] The quantitative claims about jamming success and human utility are reported without measures of uncertainty. Table III gives success rates but no sample counts, confidence intervals, or significance tests, and the user study (39 participants, 20 source samples) reports means for pleasantness, clarity, and utility without error bars or paired significance tests. The differences that support the paper's headline results, such as the 2.53 vs 1.96 pleasantness average and the 2.12x utility ratio, may not be statistically robust. The authors should report per-participant variance, use appropriate paired tests (e.g., Wilcoxon signed-rank), and provide effect sizes, both for the ASR experiments and the human study.
  5. [Section VI-F-1, Table III, SpeechBrain rows] The text states that EchoGuard 'achieves the highest attack success rate on every ASR system tested, across all datasets, with only one minor exception: SpeechBrain,' but Table III shows multiple exceptions. For SpeechBrain, EchoGuard is lower than Kenku and AdvDDoS on SPGISpeech (0.5965 vs 0.6756 and 0.6659), lower than both on LibriSpeech (0.0893 vs 0.1025 and 0.2130), and lower than AdvDDoS on Tedlium (0.3123 vs 0.4364). Dismissing SpeechBrain as 'less common in real-world deployments' is unsupported, and the inconsistency between the text and the table needs to be resolved, either by reporting the results accurately or by providing evidence for the deployment-frequency claim.
minor comments (7)
  1. [Section VI-A] The definition of Clarity reads '1 (5 is best)', which is a typo; it should state the scale is 1-5 with 5 being best.
  2. [Section V-B1, Algorithm 1] The fitness function is described only as 'Calculate fitness from WER and STOI scores'; the exact combination (e.g., weighted sum, threshold, or product) is never specified, so the optimization is not fully reproducible.
  3. [Section V-A3] The Gaussian attenuation formula uses t in [-2,2] but does not explain how this interval maps to the 20-80 ms frame length; this should be clarified.
  4. [Abstract / Index Terms] The index terms line still contains the placeholder text 'component, formatting, style, styling, insert' and should be replaced with actual keywords.
  5. [References] References [19] and [21] are the same LibriSpeech citation; one should be removed or replaced with the correct SPGISpeech citation, since the SPGISpeech dataset is described in the text but its reference is missing.
  6. [Figures 4-6] Figures 4-6 report WER curves but do not state how many utterances, which ASR checkpoint versions, or what decoding settings were used; this information should be added to the captions or the text.
  7. [After Figure 8] The manuscript contains a long sequence of garbled Unicode tokens after Figure 8; this appears to be a formatting artifact and should be removed.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: independent LibriSpeech/SPGISpeech and user-study evidence carry the central claims.

full rationale

The central claim that EchoGuard disrupts ASR while remaining human-compatible is supported by evaluations on datasets not used to fit the perturbation. The evolutionary search (Section V-B1) optimizes room/attenuation parameters against WER and STOI on a diverse Tedlium subset, and Table III reports a Tedlium row; if that row overlaps the optimization subset, those in-family numbers are partly fitted rather than predictive. However, the paper's cross-dataset claims rest on SPGISpeech and LibriSpeech, which are not used in the GA, and the 39-person user study uses clean LibriSpeech samples, independent of the Tedlium optimization. The 0.5 jamming-success threshold is attributed to prior work [41] including a co-author, but it is an external threshold from a separate user study, not a parameter fitted here; the same holds for the contextual citation [6] on LLM-scam practicality, which is corroborated by [7] and [8]. The untested telephone channel (codec/AEC/handset) is a genuine external-validity limitation, but it is not a circularity: the reported numbers are what they claim to be, measurements on clean benchmark audio. No load-bearing derivation step reduces to its own input by construction.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

No new physical entities are introduced; EchoGuard is a signal transformation, and the 'simulated rotating microphone' is an algorithmic construction, not a new object. The paper's contribution is a method, so no invented-entity burden beyond the tuned signal parameters.

free parameters (5)
  • Room acoustic vector r (length, width, height, mic x/y/z, source x/y/z, absorption) = (68.55, 58.89, 20.73) m, mic (24.87,23.59,1.75), source (36.11,0.97,1.00), absorption 0.5
    Found by evolutionary optimization that maximizes WER and preserves STOI on a Tedlium subset (Alg. 1, Tables I-II). The reported success rates depend on this fitted configuration.
  • Microphone rotation frequency f_rot = 5 Hz
    Hand-set in Section V-E; not swept for sensitivity, strongly colors the resulting signal.
  • Transient attenuation parameters (frame length, fraction p, scaling alpha) = 20 ms frames, 30% of frames, min scaling 0.7
    Chosen in Section V-E without reported sensitivity analysis.
  • Baseline attenuation factors = AdvDDoS 0.2, Kenku 0.33
    Applied only to baselines (Section VI-C); these values determine the pleasantness comparison and are not derived from any stated principle.
  • Jamming success threshold (cosine similarity < 0.5) = 0.5
    Adopted from prior self-cited work [41], not independently validated for scam disruption in this paper.
assumptions (4)
  • domain assumption A scammer's pipeline cannot replace failed ASR with a human operator or recover from partial transcripts.
    Section III: 'it is not possible to hot-seat and swap in a human into a call if the ASR starts to fail.' If a real scam operator can fall back, the defence's efficacy drops.
  • domain assumption Modern ASR models are trained mostly on clean, non-reverberant audio and therefore fail on natural distortions.
    Section V-A: 'echoes and reverberations are largely absent from ASR training datasets.' The paper's own Whisper results (low success rates) suggest this does not hold for all models.
  • domain assumption Cosine similarity of transcriptions below 0.5 is a valid proxy for breaking a vishing conversation.
    Section VI-A cites [41] (one author overlaps) for the threshold; the paper does not measure whether such transcripts actually derail an LLM scam bot.
  • domain assumption The perturbation is robust to the telephone transmission path.
    Implicit in the framework; all experiments use clean benchmark audio files directly, with no narrowband codec, echo cancellation, or packet loss simulation.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ASRJam: Human-Friendly AI Speech Jamming to Prevent Automated Phone Scams." pith.science (2026). https://pith.science/paper/VDJ2YXDB

@misc{pith2026250611125,
  author       = {Pith},
  title        = {Pith review of: ASRJam: Human-Friendly AI Speech Jamming to Prevent Automated Phone Scams},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VDJ2YXDB}},
  note         = {Machine review of arXiv:2506.11125}
}
read the original abstract

Large Language Models (LLMs), combined with Text-to-Speech (TTS) and Automatic Speech Recognition (ASR), are increasingly used to automate voice phishing (vishing) scams. These systems are scalable and convincing, posing a significant security threat. We identify the ASR transcription step as the most vulnerable link in the scam pipeline and introduce ASRJam, a proactive defence framework that injects adversarial perturbations into the victim's audio to disrupt the attacker's ASR. This breaks the scam's feedback loop without affecting human callers, who can still understand the conversation. While prior adversarial audio techniques are often unpleasant and impractical for real-time use, we also propose EchoGuard, a novel jammer that leverages natural distortions, such as reverberation and echo, that are disruptive to ASR but tolerable to humans. To evaluate EchoGuard's effectiveness and usability, we conducted a 39-person user study comparing it with three state-of-the-art attacks. Results show that EchoGuard achieved the highest overall utility, offering the best combination of ASR disruption and human listening experience.

Figures

Figures reproduced from arXiv: 2506.11125 by the authors.

Figure 1
Figure 1. AI-driven scam call pipeline. The attacker uses au [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Illustration of the ASRJam defence framework. (1) [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 4
Figure 4. Word Error Rates (WER) performance (lower is better) [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figures from the paper (5 more)
Figure 3
Figure 3. Figure 3: Illustration of the three natural acoustic transformations [PITH_FULL_IMAGE:figures/full_fig_p005_3.png]
Figure 5
Figure 5. Figure 5: Word Error Rate (WER) of different ASR models as [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Word Error Rates (WER) performance (lower is better) [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]
Figure 7
Figure 7. Figure 7: Clarity vs. Pleasantness for each sample and attack. Our [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: Average Utility Index across attacks. This metric quantifies the trade-off between transcription degradation and listener [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

41 extracted references · 26 canonical work pages

  1. [1]

    Gpt-4 technical report,

    OpenAI, “Gpt-4 technical report,” arXiv preprint arXiv:2303.08774 , 2023

    arXiv 2023

  2. [2]

    Bert: Pre-training of deep bidirectional transformers for language understanding,

    J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “Bert: Pre-training of deep bidirectional transformers for language understanding,” in Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers), 2019, pp. 4171–4186

    2019

  3. [3]

    Language models are few-shot learners,

    T. B. Brown, B. Mann, N. Ryder, M. Subbiah, J. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askellet al., “Language models are few-shot learners,” in Advances in neural information processing systems, vol. 33, 2020, pp. 1877–1901

    work page 2020

  4. [4]

    Gpt-4-phish: Using gpt-4 to generate and evaluate phishing emails,

    Z. Huang, L. Xu, B. Niu, Q. Wang, and B. Liang, “Gpt-4-phish: Using gpt-4 to generate and evaluate phishing emails,” arXiv preprint arXiv:2401.09727, 2024

    arXiv 2024

  5. [5]

    Speargpt: Spear phish- ing emails generation via chatgpt,

    K. Li, J. Zhang, K. Chen, Y . Wang, and S. Jiang, “Speargpt: Spear phish- ing emails generation via chatgpt,” arXiv preprint arXiv:2406.13049 , 2024

    arXiv 2024

  6. [6]

    Exploiting llms for scam automation: A looming threat,

    G. Gressel, R. Pankajakshan, and Y . Mirsky, “Exploiting llms for scam automation: A looming threat,” The 3rd ACM Workshop on the Security Implications of Deepfakes and Cheapfakes (WDC ’24) , 2024

    work page 2024

  7. [7]

    On the feasibility of fully ai-automated vishing attacks,

    J. Figueiredo, T. Gonc ¸alves, D. Ventura, H. Gomes, D. Correia, P. H. Abreu, and M. Monteiro, “On the feasibility of fully ai-automated vishing attacks,” arXiv preprint arXiv:2409.13793 , 2024

    arXiv 2024

  8. [8]

    Ai-driven vishing attacks: A practical approach,

    J. Toapanta, F. Villamar ´ın, and F. Ord´o˜nez, “Ai-driven vishing attacks: A practical approach,” in Engineering Proceedings, vol. 77, no. 1. MDPI, 2024, p. 15

    work page 2024

Show all 41 references
  1. [9]

    Don’t listen to me: understanding and exploring jailbreak prompts of large language models,

    Z. Yu, X. Liu, S. Liang, Z. Cameron, C. Xiao, and N. Zhang, “Don’t listen to me: understanding and exploring jailbreak prompts of large language models,” in 33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 4675–4692

    2024

  2. [10]

    All in how you ask for it: Simple black-box method for jailbreak attacks,

    K. Takemoto, “All in how you ask for it: Simple black-box method for jailbreak attacks,” Applied Sciences, vol. 14, no. 9, p. 3558, 2024

    2024

  3. [11]

    Does audio deepfake detection generalize?

    N. M. M ¨uller, P. Czempin, F. Dieckmann, A. Froghyar, and K. B ¨ottinger, “Does audio deepfake detection generalize?” arXiv preprint arXiv:2203.16263, 2022

    2022

  4. [12]

    Audio deepfake de- tection: What has been achieved and what lies ahead,

    B. Zhang, H. Cui, V . Nguyen, and M. Whitty, “Audio deepfake de- tection: What has been achieved and what lies ahead,” Sensors (Basel, Switzerland), vol. 25, no. 7, p. 1989, 2025

    1989

  5. [13]

    Audio adversarial examples: Targeted attacks on speech-to-text,

    N. Carlini and D. Wagner, “Audio adversarial examples: Targeted attacks on speech-to-text,” in 2018 IEEE security and privacy workshops (SPW). IEEE, 2018, pp. 1–7

    2018

  6. [14]

    Did you hear that? adver- sarial examples against automatic speech recognition,

    M. Alzantot, B. Balaji, and M. Srivastava, “Did you hear that? adver- sarial examples against automatic speech recognition,” arXiv preprint arXiv:1801.00554, 2018

    2018 arXiv

  7. [15]

    Universal adversarial perturbations for speech recog- nition systems,

    P. Neekhara, S. Hussain, P. Pandey, S. Dubnov, J. McAuley, and F. Koushanfar, “Universal adversarial perturbations for speech recog- nition systems,” arXiv preprint arXiv:1905.03828 , 2019

    1905 arXiv

  8. [16]

    Hear” no evil

    H. Abdullah, M. S. Rahman, W. Garcia, K. Warren, A. S. Yadav, T. Shrimpton, and P. Traynor, “Hear” no evil”, see” kenansville”: Efficient and transferable black-box attacks on speech recognition and voice identification systems,” in 2021 IEEE Symposium on Security and Privacy ...

    2021

  9. [17]

    Advddos: Zero-query adversarial attacks against commercial speech recognition systems,

    Y . Ge, L. Zhao, Q. Wang, Y . Duan, and M. Du, “Advddos: Zero-query adversarial attacks against commercial speech recognition systems,” IEEE Transactions on Information Forensics and Security , 2023

    2023

  10. [18]

    {KENKU}: Towards efficient and stealthy black-box adversarial at- tacks against {ASR} systems,

    X. Wu, S. Ma, C. Shen, C. Lin, Q. Wang, Q. Li, and Y . Rao, “{KENKU}: Towards efficient and stealthy black-box adversarial at- tacks against {ASR} systems,” in 32nd USENIX Security Symposium (USENIX Security 23) , 2023, pp. 247–264

    2023

  11. [20]

    Ted-lium: an automatic speech recognition dedicated corpus

    A. Rousseau, P. Del ´eglise, and Y . Esteve, “Ted-lium: an automatic speech recognition dedicated corpus.” in LREC, 2012, pp. 125–129

    2012

  12. [21]

    Librispeech: an asr corpus based on public domain audio books,

    V . Panayotov, G. Chen, D. Povey, and S. Khudanpur, “Librispeech: an asr corpus based on public domain audio books,” in2015 IEEE international conference on acoustics, speech and signal processing (ICASSP). IEEE, 2015, pp. 5206–5210

    2015

  13. [22]

    Deep speech: Scaling up end-to-end speech recognition,

    A. Hannun, C. Case, J. Casper, B. Catanzaro, G. Diamos, E. Elsen, R. Prenger, S. Satheesh, S. Sengupta, A. Coates, and A. Y . Ng, “Deep speech: Scaling up end-to-end speech recognition,” arXiv preprint arXiv:1412.5567, 2014

    2014 arXiv

  14. [23]

    wav2vec 2.0: A framework for self-supervised learning of speech representations,

    A. Baevski, H. Zhou, A. Narayanan, W.-H. Senior, and M. Hughes, “wav2vec 2.0: A framework for self-supervised learning of speech representations,” arXiv preprint arXiv:2006.11477 , 2020

    2006 arXiv

  15. [24]

    V osk: An open source offline speech recognition toolkit,

    A. Pantev, S. Nikolay, P. Petr, S. Alexander, and K. Evgenii, “V osk: An open source offline speech recognition toolkit,” in Proceedings of the 20th Conference of the European Chapter of the Association for Computational Linguistics: Companion Volume Proceedings of the Student...

    2019

  16. [25]

    Robust speech recognition via large-scale weak supervi- sion,

    A. Radford, J. W. Kim, T. Xu, G. Brockman, C. McLeavey, and I. Sutskever, “Robust speech recognition via large-scale weak supervi- sion,” in International conference on machine learning . PMLR, 2023, pp. 28 492–28 518

    2023

  17. [26]

    Speech- brain: A general-purpose speech toolkit,

    M. Ravanelli, J. Parcollet, P. Plantinga, A. Rouhe, T. Cornell, L. Lu- gosch, M. Matassoni, C. Subakan, J. Turrin, S. Watanabeet al., “Speech- brain: A general-purpose speech toolkit,” in 2021 IEEE Automatic Speech Recognition and Understanding Workshop (ASRU). IEEE, 2021, pp. 222–229

    2021

  18. [27]

    End-to-end speech recognition: A survey,

    R. Prabhavalkar, T. Hori, T. N. Sainath, R. Schl ¨uter, and S. Watanabe, “End-to-end speech recognition: A survey,” IEEE/ACM Transactions on Audio, Speech, and Language Processing , vol. 31, pp. 1–17, 2023

    2023

  19. [28]

    Automatic speech recognition using advanced deep learning approaches: A survey,

    H. Kheddar, M. Hemis, and Y . Himeur, “Automatic speech recognition using advanced deep learning approaches: A survey,” Information Fu- sion, p. 102422, 2024

    2024

  20. [29]

    {CommanderSong}: A sys- tematic approach for practical adversarial voice recognition,

    X. Yuan, Y . Chen, Y . Zhao, Y . Long, X. Liu, K. Chen, S. Zhang, H. Huang, X. Wang, and C. A. Gunter, “ {CommanderSong}: A sys- tematic approach for practical adversarial voice recognition,” in 27th USENIX security symposium (USENIX security 18) , 2018, pp. 49–64

    2018

  21. [30]

    Adversarial attacks against automatic speech recognition systems via psychoacoustic hiding,

    L. Sch ¨onherr, K. Kohls, S. Zeiler, T. Holz, and D. Kolossa, “Adversarial attacks against automatic speech recognition systems via psychoacoustic hiding,” arXiv preprint arXiv:1808.05665 , 2018

    2018 arXiv

  22. [31]

    Targeted adversarial examples for black box audio systems,

    R. Taori, A. Kamsetty, B. Chu, and N. Vemuri, “Targeted adversarial examples for black box audio systems,” in IEEE Deep Learning and Security Workshop, 2019, arXiv:1805.07820

    2019 arXiv

  23. [32]

    Difattack: Query-efficient black- box adversarial attack via disentangled feature space,

    J. Liu, J. Zhou, J. Zeng, and J. Tian, “Difattack: Query-efficient black- box adversarial attack via disentangled feature space,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 38, no. 4, 2024, pp. 3666–3674

    2024

  24. [33]

    Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks,

    A. Demontis, M. Melis, M. Pintor, M. Jagielski, B. Biggio, A. Oprea, C. Nita-Rotaru, and F. Roli, “Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks,” in 28th USENIX Security Symposium (USENIX Security 19). Santa Clara, CA: USENIX...

    2019

  25. [34]

    A practical survey on emerging threats from ai-driven voice attacks: How vulnerable are commercial voice control systems?

    Y . Wang, Q. Yan, N. Ivanov, and X. Chen, “A practical survey on emerging threats from ai-driven voice attacks: How vulnerable are commercial voice control systems?” 2024. [Online]. Available: https://arxiv.org/abs/2312.06010

    2024 arXiv

  26. [35]

    {Devil’s} whisper: A general approach for physical adversarial attacks against commercial black-box speech recognition devices,

    Y . Chen, X. Yuan, J. Zhang, Y . Zhao, S. Zhang, K. Chen, and X. Wang, “{Devil’s} whisper: A general approach for physical adversarial attacks against commercial black-box speech recognition devices,” in 29th USENIX Security Symposium (USENIX Security 20) , 2020, pp. 2667– 2684

    2020

  27. [36]

    Adaptation to reverberation for speech perception: A systematic review,

    A. Tsironis, E. Vlahou, P. Kontou, P. Bagos, and N. Kop ˇco, “Adaptation to reverberation for speech perception: A systematic review,” Trends in Hearing, vol. 28, p. 23312165241273399, 2024

    2024

  28. [37]

    Cortical encoding of hierarchical linguistic in- formation when syllabic rhythms are obscured by echoes,

    C. Luo and N. Ding, “Cortical encoding of hierarchical linguistic in- formation when syllabic rhythms are obscured by echoes,” NeuroImage, vol. 300, p. 120875, 2024

    2024

  29. [38]

    Sensory and perceptual decisional processes underlying the perception of reverberant auditory environ- ments,

    H. G. Garc ´ıa-L´azaro and S. Teng, “Sensory and perceptual decisional processes underlying the perception of reverberant auditory environ- ments,” eneuro, vol. 11, no. 8, 2024

    2024

  30. [39]

    Original speech and its echo are segregated and separately processed in the human brain,

    J. Gao, H. Chen, M. Fang, and N. Ding, “Original speech and its echo are segregated and separately processed in the human brain,” PLoS Biology, vol. 22, no. 2, p. e3002498, 2024

    2024

  31. [40]

    An algorithm for intelligibility prediction of time–frequency weighted noisy speech,

    C. H. Taal, R. C. Hendriks, R. Heusdens, and J. Jensen, “An algorithm for intelligibility prediction of time–frequency weighted noisy speech,” IEEE Transactions on audio, speech, and language processing , vol. 19, no. 7, pp. 2125–2136, 2011

    2011

  32. [41]

    What was your prompt? a remote keylogging attack on {AI} assistants,

    R. Weiss, D. Ayzenshteyn, and Y . Mirsky, “What was your prompt? a remote keylogging attack on {AI} assistants,” in 33rd USENIX Security Symposium (USENIX Security 24) , 2024, pp. 3367–3384

    2024

  33. [42]

    [Online]

    IBM Watson Speech to Text , IBM, 2025. [Online]. Available: https://www.ibm.com/products/speech-to-text

    2025

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.