Transferable Adversarial Attacks against ASR

Cong Liu; Haizhou Li; Xiaoxue Gao; Yiming Chen; Zexin Li

REVIEW 5 major objections 6 minor 46 references

Transferable Adversarial Attacks against ASR

T0 review · 5 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Adversarial audio crafted on a surrogate model degrades black-box ASR systems more than PGD across five models.

desk verdict A useful first empirical sweep of transfer attacks against Whisper and Speech2Text, but the headline gains over PGD are confounded because the paper never shows PGD uses the same differentiable feature extractor as the proposed attacks. read the letter →

arxiv 2411.09220 v1 pith:MVHKSR67 submitted 2024-11-14 eess.AS cs.AIeess.SP

Xiaoxue Gao , Zexin Li , Yiming Chen , Cong Liu , Haizhou Li This is my paper · ORCID

classification eess.AScs.AIeess.SP

keywords adversarialattacksautomaticspeechrecognitiontransferablevoiceactivitydetectionmomentumiterativefastgradientsignmethodvariancetuningdifferentiablefeatureextractionworderrorrate

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that black-box automatic speech recognition (ASR) models can be broken by adversarial audio crafted against a surrogate model, without seeing the target's weights. It proposes three transferable attacks applied directly in the time domain through a differentiable feature extractor: SAGO, which masks gradients to the speech regions identified by a voice activity detection rule, and MI-FGSM and VMI-FGSM, which stabilize gradient updates with momentum and variance tuning. Across five Whisper and Speech2Text models and two datasets, the attacks raise word error rate on black-box targets beyond the strong PGD baseline while keeping perturbations small enough to be inaudible. The paper's central message is that ASR robustness should be evaluated under transfer attacks, not only white-box attacks, because a surrogate model is enough to degrade real systems.

What carries the argument

The central machinery is a differentiable feature extractor that turns raw audio into 80-dimensional log-filterbank features so gradients flow to the waveform itself, enabling time-domain attacks. On top of that, SAGO multiplies the adversarial loss gradient by a voice activity detection mask, built from a cepstral power threshold, to restrict updates to detected speech; MI-FGSM adds a momentum term to the sign gradient; and VMI-FGSM augments that with neighborhood gradient variance tuning. All three iterate fifty steps under an $\ell_\infty$ constraint with perturbation bounds 0.002 and 0.0035, and the adversarial loss is the negative cross-entropy between the ground-truth text and the model's predicted tokens.

What would settle it

A direct falsifier would be to re-run the three attack recipes with the authors' exact feature extractor and VAD threshold on the same five models and check whether the transfer WER still exceeds PGD; if a correct reimplementation reproduces numbers at or below the PGD baseline under the same $\ell_\infty$ budgets of 0.002 and 0.0035, the transferability claim is refuted. A narrower check: ablate the VAD mask by replacing it with a random mask of the same sparsity; if SAGO's transfer gain disappears, the paper's explanation of speech-aware targeting is wrong even if the attacks still work.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that adversarial perturbations optimized on a white-box source model transfer to black-box ASR systems when the gradient is computed all the way back through a differentiable 80-dimensional log-filterbank front end. The paper reports that the resulting time-domain attacks, especially MI-FGSM and VMI-FGSM for Whisper models and SAGO for Speech2Text models, produce higher WER than the PGD baseline on held-out target models. The mechanism attributed for the gain is that momentum and variance tuning avoid poor local optima in the loss landscape, while the VAD mask focuses perturbation energy on speech segments that ASR models rely on and that human listeners attend to.

Load-bearing premise

The load-bearing premise is that gradients computed through the paper's 80-dimensional log-filterbank feature extractor on a surrogate model keep pointing in directions that hurt arbitrary black-box ASR models, and that the voice-activity mask identifies exactly the speech regions that decide recognition.

Editorial extensions

If this is right

If true, black-box ASR deployment should assume attackers can degrade WER substantially using only a surrogate model, so defenses need to target transfer rather than just white-box accuracy.
WER increases of 65% or more on a target from a surrogate S2T-medium attack imply concrete failures in captioning and car navigation systems fed by such models.
The success of momentum and variance-tuned gradient methods on Whisper suggests that large transformer ASR models inherit the transferability vulnerabilities already known in image classifiers.
VAD masking can act as a general plug-in for other gradient-based ASR attacks, since SAGO's gains come from concentrating perturbation on speech regions.
Human imperceptibility and transferability can hold simultaneously, so low-perturbation attacks are not automatically stopped by a small $\ell_\infty$ budget.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper leaves open whether the VAD mask specifically causes the transferability gain; an ablation that applies the same mask to PGD or that reverses the mask to non-speech regions would isolate its contribution, and the current tables only report the combined recipes.
Because the feature extractor and VAD algorithm are not fully specified, the results are not yet independently reproducible; spelling out the exact front end would turn the headline comparison into a checkable recipe.
The same time-domain attack recipe could be tested against newer encoder-decoder and CTC ASR families, such as Wav2Vec2, Conformer, or multilingual Whisper variants; if it transfers there, the claim generalizes beyond the five tested models.
For defenders, the natural counterpart experiment is to measure whether the transfer gains persist under acoustic preprocessing such as resampling, codec compression, or background-noise suppression, since physical-world attacks rarely reach the decoder as clean 16 kHz waveforms.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The thing worth knowing: this is the first systematic look I know of at transfer-based adversarial attacks against modern ASR models like Whisper and Speech2Text, and the WER tables across five models and two datasets give a real empirical map of cross-family transfer. That part is genuinely useful. The second thing: the central comparison to PGD is under-specified enough that the claimed advantage may not be real. The paper never states whether PGD runs through the same 80-dimensional differentiable log-filterbank feature extractor as the proposed methods. If PGD uses each source model's native front-end, then the improvement from SAGO/MI-FGSM/VMI-FGSM could come from the surrogate feature extractor's gradient alignment, not from the VAD mask or momentum. That is a load-bearing hole, not a nitpick.

What is new and good: SAGO, a VAD-masked PGD variant, is not in the cited prior literature, and applying MI-FGSM and VMI-FGSM to raw audio through a differentiable feature extractor is a legitimate, if modest, extension of known vision attacks. The experiments cover a broad set of source-target model pairs, include meaningful noise baselines (white, babble, music, natural), and report WER on held-out audio. No circular fitting is going on; the results are measured, not derived from assumptions.

The soft spots are real but fixable. There are no error bars or statistical tests, so many of the differences could be noise, especially in the 1-3 WER range. No comparison with prior ASR transfer attacks means the novelty claim is weaker than the authors imply. The VAD is described only as a ‘cepstral power measurement’ with no parameters, so it is not reproducible as written. There is no ablation that holds the feature extractor fixed and isolates the VAD mask, which is exactly the experiment needed to support the SAGO contribution. The human imperceptibility claim is asserted with no listening test, and the 'sounds similar' statement in Section IV-D is not evidence. The stress-test note about the PGD baseline is correct and should be the first thing the authors are asked to fix.

Who is this for? Adversarial audio researchers and anyone thinking about robustness of deployed Whisper/S2T systems. It deserves a serious referee, not a desk reject: the empirical phenomenon is real, the scope is valuable, and the paper can be repaired with clarifications, ablations, and error bars. My own verdict leans skeptical on the attribution of the gains, but the underlying attack results are worth having in the literature. I would send it to review and request major revision.

Referee Report

5 major / 6 minor

Summary. The paper studies untargeted transferable adversarial attacks against automatic speech recognition (ASR) systems. It proposes three time-domain attack methods: SAGO, which masks the gradient with a voice-activity-detection (VAD) mask; MI-FGSM, a momentum-based iterative attack; and VMI-FGSM, a variance-tuned momentum attack. All three are applied through a differentiable 80-dimensional log-filterbank feature extractor so that gradients can propagate to the raw audio. The authors evaluate the methods on five ASR models (Whisper-tiny, Whisper-base, Speech2Text small/medium/large) and two datasets (LJ-Speech and LibriSpeech), reporting WER under clean, noise, and attack conditions, and they claim higher transferability than a PGD baseline plus human imperceptibility of the adversarial samples.

Significance. If the claims are correct, the work offers a useful tool for robustness evaluation of black-box ASR models and an interesting new application of VAD for adversarial transferability. The idea of focusing adversarial gradients on speech regions via a VAD mask is original and the evaluation across five models and two datasets is broader than many prior audio-attack papers. However, the paper is purely empirical and the current evidence has several gaps: the PGD baseline is not specified to use the same feature extractor, the VAD algorithm is not described reproducibly, no statistical uncertainty is reported, and the human-imperceptibility claim is unverified. A strength is that the authors provide a link to adversarial samples and code, which facilitates independent verification even though the code is not included in the manuscript.

major comments (5)

[§II-C, §III-B] The PGD baseline is described only as "re-implement [8]" and the paper never states whether PGD operates in the time domain using the same 80-dimensional log-filterbank differentiable feature extractor and the same adversarial loss as the proposed methods. Because the differentiable front-end is a central component of the proposed time-domain attacks, the reported advantage of SAGO/MI-FGSM/VMI-FGSM over PGD could be due to the surrogate front-end rather than to the VAD mask or momentum/variance tuning. Please specify the PGD implementation completely and, ideally, add an ablation where PGD uses the identical feature extractor and loss as the proposed attacks.
[§II-B.1, §III-B] The VAD mask is described only as a "cepstral power measurement" that trims non-speech parts from the front and end of the audio; no algorithm, threshold parameters, or mask shape (binary or soft) are given. This makes SAGO unreproducible and prevents isolating the contribution of the mask to transferability. Please provide the exact VAD procedure and parameters, and include an ablation of SAGO with and without the mask under otherwise identical conditions.
[§IV-C, Tables I–II] The central claim that the proposed attacks "generally induce significant performance degradation, yielding higher WER compared to baselines" is made without error bars, confidence intervals, or statistical tests, and several cells in Tables I–II contradict a consistent superiority (e.g., Table I, S2T-small source to S2T-medium target at SNR 30: PGD 30.15 versus VMI-FGSM 28.94). Please report per-condition win rates, standard deviations across utterances or random subsets, and a paired significance test over the 500 test utterances.
[§IV-D] The human-imperceptibility claim is supported only by the assertion that the adversarial samples "sound similar" to the original audio. No listening test, no perceptual quality metrics (e.g., PESQ or STOI), and no measurement of the actual perturbation level relative to the signal are reported. Since the abstract and introduction explicitly claim minimal impact on human perceptibility, please provide either a formal listening study or objective perceptual metrics, or explicitly soften the claim to a statement about the bounded ℓ∞ perturbation.
[§III-B, §IV] The paper mentions prior transferable ASR attacks [27], [28] but does not compare against them; the only attack baseline is a self-implemented PGD. Given the paper's stated goal of a "comprehensive exploration" of black-box transferability, please compare with at least one existing transfer-based ASR attack or justify their exclusion with concrete reasons.

minor comments (6)

[§II-C] "log filterback features" should be "log filterbank features."
[§II-B.2] "our VIM-FGSM" should be "our VMI-FGSM."
[§IV] "differnt SNR values" should be "different SNR values."
[Throughout] "V AD" should be written as "VAD" for consistency.
[Tables I–II] The table captions contain formatting errors such as "LJSPEECH" and "S OURCE"; also, the text inconsistently uses "Speech2text" and "S2T."
[§III-B] The exact Hugging Face model identifiers or versions (e.g., openai/whisper-tiny, facebook/s2t-small-librispeech) are not given; please list them for reproducibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the transferability claims are empirical WER measurements on held-out audio and do not reduce to fitted inputs, self-citations, or definitional equivalences.

full rationale

Walking the derivation chain: the paper's only formal derivations are the constrained optimization objective in Eq. (1) and the iterative update rules in Eqs. (2), (4), and (5). These define the attack procedures; they do not assume the conclusion that the attacks transfer. SAGO's VAD mask is computed by a cepstral power measurement on the input and used as a multiplicative gradient mask in Eq. (2); it is not fitted to the target WER and is not derived from the target models. MI-FGSM and VMI-FGSM are standard momentum and variance-tuned sign-gradient updates transplanted from image attacks to time-domain audio through a differentiable 80-dimensional log-filterbank front end; the transferability claim is tested by measuring WER on the first 500 utterances of LibriSpeech and LJ-Speech across five models. Section IV-C's statement that the proposed attacks 'generally induce significant performance degradation, yielding higher WER compared to baselines across five models and two datasets' is an empirical summary of Tables I and II, not a conclusion forced by construction. The PGD baseline is described only as 're-implement [8]', and there is a possible experimental confound if PGD did not use the same differentiable feature extractor, but a confound is not circularity because the proposed methods' advantage is not guaranteed by their definitions. The paper does cite works by its own authors ([22], [23], [41]), but these are background citations on transferable image attacks and non-differentiable feature processing; none is invoked as a uniqueness theorem and none constrains the empirical WER outcomes. No fitted parameter is renamed as a prediction, and no result is imported from prior work by the same authors as a forced premise. The central claim is self-contained against held-out benchmark measurements, so the appropriate finding is no significant circularity.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

No new physical or conceptual entities are introduced; the method combines existing techniques (PGD, MI-FGSM, VMI-FGSM, VAD). Free parameters are standard attack hyperparameters, but their values are underspecified.

free parameters (4)

perturbation bound xi = 0.002, 0.0035
Set to achieve 35/30 dB SNR; chosen by hand, not from data.
attack iterations N = 50
Chosen arbitrarily, consistent with attack literature.
learning rate alpha = not specified
Not reported in the paper, necessary for reproduction.
VAD detection threshold = not specified
Cepstral power threshold for speech/non-speech decision; not specified, directly affects the mask and hence the attack.

assumptions (3)

domain assumption Gradients propagated through a differentiable feature extractor are informative for transfer to target models
Section II-C: the paper assumes this without validating feature alignment across model families.
domain assumption L-infinity perturbation bound with xi values preserves human imperceptibility
Section III-B: no human listening test or perceptual metric is reported.
standard math A higher WER indicates a more successful attack
Section III-B defines WER; this is a standard evaluation convention.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Transferable Adversarial Attacks against ASR." pith.science (2026). https://pith.science/paper/MVHKSR67

@misc{pith2026241109220,
  author       = {Pith},
  title        = {Pith review of: Transferable Adversarial Attacks against ASR},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MVHKSR67}},
  note         = {Machine review of arXiv:2411.09220}
}

read the original abstract

Given the extensive research and real-world applications of automatic speech recognition (ASR), ensuring the robustness of ASR models against minor input perturbations becomes a crucial consideration for maintaining their effectiveness in real-time scenarios. Previous explorations into ASR model robustness have predominantly revolved around evaluating accuracy on white-box settings with full access to ASR models. Nevertheless, full ASR model details are often not available in real-world applications. Therefore, evaluating the robustness of black-box ASR models is essential for a comprehensive understanding of ASR model resilience. In this regard, we thoroughly study the vulnerability of practical black-box attacks in cutting-edge ASR models and propose to employ two advanced time-domain-based transferable attacks alongside our differentiable feature extractor. We also propose a speech-aware gradient optimization approach (SAGO) for ASR, which forces mistranscription with minimal impact on human imperceptibility through voice activity detection rule and a speech-aware gradient-oriented optimizer. Our comprehensive experimental results reveal performance enhancements compared to baseline approaches across five models on two databases.

Figures

Figures reproduced from arXiv: 2411.09220 by the authors.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

46 extracted references · 35 canonical work pages

[8]

There is more than one kind of robustness: Fooling Whisper with adversarial examples,

R. Olivier and B. Raj, “There is more than one kind of robustness: Fooling Whisper with adversarial examples,” in INTERSPEECH, 2023, pp. 4394–4398

work page 2023
[27]

Universal adversarial perturbations for speech recog- nition systems,

P. Neekhara, S. Hussain, P. Pandey, S. Dubnov, J. McAuley, and F. Koushanfar, “Universal adversarial perturbations for speech recog- nition systems,” in INTERSPEECH, vol. 2019, 2019, pp. 481–485

work page 2019
[28]

Demysti- fying limited adversarial transferability in automatic speech recognition systems,

H. Abdullah, A. Karlekar, V . Bindschaedler, and P. Traynor, “Demysti- fying limited adversarial transferability in automatic speech recognition systems,” in ICLR, 2021

work page 2021
[1]

Daniels, Just health care

N. Daniels, Just health care . Cambridge University Press, 1985

work page 1985
[2]

Preparing a nation for autonomous vehicles: opportunities, barriers and policy recommendations,

D. J. Fagnant and K. Kockelman, “Preparing a nation for autonomous vehicles: opportunities, barriers and policy recommendations,” Trans- portation Research Part A: Policy and Practice , vol. 77, pp. 167–181, 2015

2015
[3]

Hear” no evil

H. Abdullah, M. S. Rahman, W. Garcia, K. Warren, A. S. Yadav, T. Shrimpton, and P. Traynor, “Hear” no evil”, see” kenansville”: Efficient and transferable black-box attacks on speech recognition and voice identification systems,” in IEEE SP, 2021, pp. 712–729

work page 2021
[4]

{WaveGuard}: Understanding and mitigating audio adversarial exam- ples,

S. Hussain, P. Neekhara, S. Dubnov, J. McAuley, and F. Koushanfar, “{WaveGuard}: Understanding and mitigating audio adversarial exam- ples,” in 30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 2273–2290

work page 2021
[5]

Characterizing audio adversar- ial examples using temporal dependency,

Z. Yang, P.-Y . Chen, B. Li, and D. Song, “Characterizing audio adversar- ial examples using temporal dependency,” in International Conference on Learning Representations . International Conference on Learning Representations, ICLR, 2019

work page 2019

Show all 46 references

[6]

Noise flooding for detecting audio adversarial examples against automatic speech recognition,

K. Rajaratnam and J. Kalita, “Noise flooding for detecting audio adversarial examples against automatic speech recognition,” in 2018 IEEE International Symposium on Signal Processing and Information Technology (ISSPIT). IEEE, 2018, pp. 197–201

2018
[7]

Towards evaluating the robustness of neural networks,

N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in IEEE SP, 2017, pp. 39–57

2017
[9]

Adversarial examples attack and countermeasure for speech recognition system: A survey,

D. Wang, R. Wang, L. Dong, D. Yan, X. Zhang, and Y . Gong, “Adversarial examples attack and countermeasure for speech recognition system: A survey,” in International Conference on Security and Privacy in Digital Economy . Springer, 2020, pp. 443–468

2020
[10]

{KENKU}: Towards efficient and stealthy black-box adversarial at- tacks against {ASR} systems,

X. Wu, S. Ma, C. Shen, C. Lin, Q. Wang, Q. Li, and Y . Rao, “{KENKU}: Towards efficient and stealthy black-box adversarial at- tacks against {ASR} systems,” in 32nd USENIX Security Symposium (USENIX Security 23) , 2023, pp. 247–264

2023
[11]

Audio adversarial examples: Targeted attacks on speech-to-text,

N. Carlini and D. Wagner, “Audio adversarial examples: Targeted attacks on speech-to-text,” in 2018 IEEE security and privacy workshops , 2018, pp. 1–7

2018
[12]

Robust audio adversarial example for a physical attack,

H. Yakura and J. Sakuma, “Robust audio adversarial example for a physical attack,” in Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence , 2019, pp. 5334–5341

2019
[13]

Recent improvements of ASR models in the face of adversarial attacks,

R. Olivier and B. Raj, “Recent improvements of ASR models in the face of adversarial attacks,” in INTERSPEECH, 2022, pp. 4113–4117

2022
[14]

Adversarial attacks against automatic speech recognition systems via psychoacoustic hiding,

L. Sch ¨onherr, K. Kohls, S. Zeiler, T. Holz, and D. Kolossa, “Adversarial attacks against automatic speech recognition systems via psychoacoustic hiding,” arXiv preprint arXiv:1808.05665 , 2018

2018 arXiv
[15]

Metamorph: Injecting inaudible commands into over-the-air voice controlled systems,

T. Chen, L. Shangguan, Z. Li, and K. Jamieson, “Metamorph: Injecting inaudible commands into over-the-air voice controlled systems,” in Network and Distributed Systems Security Symposium , 2020

2020
[16]

Imper- ceptible, robust, and targeted adversarial examples for automatic speech recognition,

Y . Qin, N. Carlini, G. Cottrell, I. Goodfellow, and C. Raffel, “Imper- ceptible, robust, and targeted adversarial examples for automatic speech recognition,” in International conference on machine learning . PMLR, 2019, pp. 5231–5240

2019
[17]

Query-efficient adversarial attack with low perturbation against end- to-end speech recognition systems,

S. Wang, Z. Zhang, G. Zhu, X. Zhang, Y . Zhou, and J. Huang, “Query-efficient adversarial attack with low perturbation against end- to-end speech recognition systems,” IEEE Transactions on Information Forensics and Security, vol. 18, pp. 351–364, 2022

2022
[18]

Sok: The faults in our asrs: An overview of attacks against automatic speech recognition and speaker identification systems,

H. Abdullah, K. Warren, V . Bindschaedler, N. Papernot, and P. Traynor, “Sok: The faults in our asrs: An overview of attacks against automatic speech recognition and speaker identification systems,” in IEEE SP , 2021, pp. 730–747

2021
[19]

Towards deep learning models resistant to adversarial attacks,

A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” ICLR, 2018

2018
[20]

Adversarial examples in the physical world,

A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” in Artificial intelligence safety and security , 2018, pp. 99–112

2018
[21]

Investigating top-k white-box and transferable black-box attack,

C. Zhang, P. Benz, A. Karjauv, J. W. Cho, K. Zhang, and I. S. Kweon, “Investigating top-k white-box and transferable black-box attack,” in CVPR, 2022, pp. 15 085–15 094

2022
[22]

Sibling- attack: Rethinking transferable adversarial attacks against face recogni- tion,

Z. Li, B. Yin, T. Yao, J. Guo, S. Ding, S. Chen, and C. Liu, “Sibling- attack: Rethinking transferable adversarial attacks against face recogni- tion,” in CVPR, 2023, pp. 24 626–24 637

2023
[23]

White-box multi-objective adversarial attack on dialogue generation,

Y . Li, Z. Li, Y . Gao, and C. Liu, “White-box multi-objective adversarial attack on dialogue generation,” in ACL, 2023

2023
[24]

Hotflip: White-box adversarial examples for text classification,

J. Ebrahimi, A. Rao, D. Lowd, and D. Dou, “Hotflip: White-box adversarial examples for text classification,” in ACL, 2018

2018
[25]

Textbugger: Generating adversarial text against real-world applications,

J. Li, S. Ji, T. Du, B. Li, and T. Wang, “Textbugger: Generating adversarial text against real-world applications,” in 26th Annual Network and Distributed System Security Symposium , 2019

2019
[26]

{Devil’s} whisper: A general approach for physical adversarial attacks against commercial black-box speech recognition devices,

Y . Chen, X. Yuan, J. Zhang, Y . Zhao, S. Zhang, K. Chen, and X. Wang, “{Devil’s} whisper: A general approach for physical adversarial attacks against commercial black-box speech recognition devices,” in 29th USENIX Security Symposium (USENIX Security 20) , 2020, pp. 2667– 2684

2020
[29]

Robust speech recognition via large-scale weak super- vision,

A. Radford, J. W. Kim, T. Xu, G. Brockman, C. McLeavey, and I. Sutskever, “Robust speech recognition via large-scale weak super- vision,” in International Conference on Machine Learning . PMLR, 2023, pp. 28 492–28 518

2023
[30]

Fairseq s2t: Fast speech-to-text modeling with fairseq,

C. Wang, Y . Tang, X. Ma, A. Wu, D. Okhonko, and J. Pino, “Fairseq s2t: Fast speech-to-text modeling with fairseq,” in AACL, 2020, pp. 33–39

2020
[31]

Boosting adversarial attacks with momentum,

Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” in CVPR, 2018, pp. 9185–9193

2018
[32]

Enhancing the transferability of adversarial attacks through variance tuning,

X. Wang and K. He, “Enhancing the transferability of adversarial attacks through variance tuning,” in CVPR, 2021, pp. 1924–1933

2021
[33]

Transferable adversarial perturbations,

W. Zhou, X. Hou, Y . Chen, M. Tang, X. Huang, X. Gan, and Y . Yang, “Transferable adversarial perturbations,” in ECCV, 2018, pp. 452–467

2018
[34]

Improving adversarial transferability via neuron attribution-based attacks,

J. Zhang, W. Wu, J.-t. Huang, Y . Huang, W. Wang, Y . Su, and M. R. Lyu, “Improving adversarial transferability via neuron attribution-based attacks,” in CVPR, 2022, pp. 14 993–15 002

2022
[35]

Transferable adversarial attack based on integrated gradients,

Y . Huang and A. W. Kong, “Transferable adversarial attack based on integrated gradients,” in ICLR, 2022

2022
[36]

Incorporating vad into asr system by multi- task learning,

M. Li, Y . Xia, and F. Lin, “Incorporating vad into asr system by multi- task learning,” in IEEE ISCSLP, 2022, pp. 160–164

2022
[37]

Improving asr robustness in noisy condition through vad integration,

S. Novitasari, T. Fukuda, and G. Kurata, “Improving asr robustness in noisy condition through vad integration,” in INTERSPEECH, 2022

2022
[38]

Vadoi: V oice- activity-detection overlapping inference for end-to-end long-form speech recognition,

J. Wang, X. Tong, J. Guo, D. He, and R. Maas, “Vadoi: V oice- activity-detection overlapping inference for end-to-end long-form speech recognition,” in IEEE ICASSP, 2022, pp. 6977–6981

2022
[39]

Robust self-supervised audio- visual speech recognition,

B. Shi, W.-N. Hsu, and A. Mohamed, “Robust self-supervised audio- visual speech recognition,” arXiv preprint arXiv:2201.01763 , 2022

2022 arXiv
[40]

Optimization and global minimization meth- ods suitable for neural networks,

W. Duch and J. Korczak, “Optimization and global minimization meth- ods suitable for neural networks,” Neural computing surveys, vol. 2, pp. 163–212, 1998

1998
[41]

Sloth- speech: Denial-of-service attack against speech recognition models,

M. Haque, R. Shah, S. Chen, B. S ¸is ¸man, C. Liu, and W. Yang, “Sloth- speech: Denial-of-service attack against speech recognition models,” arXiv preprint arXiv:2306.00794 , 2023

2023 arXiv
[42]

The kaldi speech recognition toolkit,

D. Povey, A. Ghoshal, G. Boulianne, L. Burget, O. Glembek, N. Goel, M. Hannemann, P. Motlicek, Y . Qian, P. Schwarz et al. , “The kaldi speech recognition toolkit,” in IEEE ASRU, 2011

2011
[43]

Esp- net: End-to-end speech processing toolkit,

S. Watanabe, T. Hori, S. Karita, T. Hayashi, J. Nishitoba, Y . Unno, N. Enrique Yalta Soplin, J. Heymann, M. Wiesner, N. Chen et al., “Esp- net: End-to-end speech processing toolkit,” INTERSPEECH, Hyderabad, India, 2018

2018
[44]

Librispeech: an asr corpus based on public domain audio books,

V . Panayotov, G. Chen, D. Povey, and S. Khudanpur, “Librispeech: an asr corpus based on public domain audio books,” in IEEE ICASSP, 2015, pp. 5206–5210

2015
[45]

The lj speech dataset,

K. Ito and L. Johnson, “The lj speech dataset,” https://keithito.com/ LJ-Speech-Dataset/, 2017

2017
[46]

Musan: A music, speech, and noise corpus,

D. Snyder, G. Chen, and D. Povey, “Musan: A music, speech, and noise corpus,” arXiv preprint arXiv:1510.08484 , 2015

2015 arXiv

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.

[1] [8]

There is more than one kind of robustness: Fooling Whisper with adversarial examples,

R. Olivier and B. Raj, “There is more than one kind of robustness: Fooling Whisper with adversarial examples,” in INTERSPEECH, 2023, pp. 4394–4398

work page 2023

[2] [27]

Universal adversarial perturbations for speech recog- nition systems,

P. Neekhara, S. Hussain, P. Pandey, S. Dubnov, J. McAuley, and F. Koushanfar, “Universal adversarial perturbations for speech recog- nition systems,” in INTERSPEECH, vol. 2019, 2019, pp. 481–485

work page 2019

[3] [28]

Demysti- fying limited adversarial transferability in automatic speech recognition systems,

H. Abdullah, A. Karlekar, V . Bindschaedler, and P. Traynor, “Demysti- fying limited adversarial transferability in automatic speech recognition systems,” in ICLR, 2021

work page 2021

[4] [1]

Daniels, Just health care

N. Daniels, Just health care . Cambridge University Press, 1985

work page 1985

[5] [2]

Preparing a nation for autonomous vehicles: opportunities, barriers and policy recommendations,

D. J. Fagnant and K. Kockelman, “Preparing a nation for autonomous vehicles: opportunities, barriers and policy recommendations,” Trans- portation Research Part A: Policy and Practice , vol. 77, pp. 167–181, 2015

2015

[6] [3]

Hear” no evil

H. Abdullah, M. S. Rahman, W. Garcia, K. Warren, A. S. Yadav, T. Shrimpton, and P. Traynor, “Hear” no evil”, see” kenansville”: Efficient and transferable black-box attacks on speech recognition and voice identification systems,” in IEEE SP, 2021, pp. 712–729

work page 2021

[7] [4]

{WaveGuard}: Understanding and mitigating audio adversarial exam- ples,

S. Hussain, P. Neekhara, S. Dubnov, J. McAuley, and F. Koushanfar, “{WaveGuard}: Understanding and mitigating audio adversarial exam- ples,” in 30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 2273–2290

work page 2021

[8] [5]

Characterizing audio adversar- ial examples using temporal dependency,

Z. Yang, P.-Y . Chen, B. Li, and D. Song, “Characterizing audio adversar- ial examples using temporal dependency,” in International Conference on Learning Representations . International Conference on Learning Representations, ICLR, 2019

work page 2019