Pith. sign in

REVIEW 4 major objections 7 minor 42 references

Varying numerical precision at inference time reduces adversarial success in speech recognition and enables a detection signal from transcript changes.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Randomly varying numerical precision during ASR inference degrades adversarial attacks and enables a simple detector, but adaptive adversaries still achieve complete attack success.

T0 review reviewed 2026-08-02 challenge →

load-bearing objection Cheap and plausible idea, honest body, but the central robustness claim is undercut by a target-only metric and the adaptive attack fails completely. the 4 major comments →

arxiv 2603.22590 v2 pith:NP72PPS2 submitted 2026-03-23 cs.LG cs.CReess.AS

Precision-Varying Prediction (PVP): Robustifying ASR systems against adversarial attacks

Mat\'ias Pizarro , Raghavan Narasimhan , Jonas Killian , Asja Fischer This is my paper
classification cs.LG cs.CReess.AS
keywords adversarial robustnessautomatic speech recognitionnumerical precisionprecision diversityadversarial detectionstochastic inferenceadaptive attacksword error rate
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper's central claim is that adversarial audio examples are far less stable than benign speech when the numerical precision of the ASR model is changed at inference time. Building on this, the paper proposes two training-free defenses: randomly sampling precision during prediction, which makes attacks optimized for one precision fail more often, and a precision-diversity score that averages pairwise transcription differences across precisions, which separates adversarial from benign inputs with AUROC generally above 0.90 in non-adaptive settings. The appeal is practical: modern speech models already expose precision controls, so the defense costs almost nothing and needs no model internals. The paper also reports that an adaptive adversary who optimizes the attack across all precisions can bypass both defenses, which bounds the claim.

Core claim

On the paper's own terms, the discovery is that adversarial perturbations carry a hidden precision-sensitivity signature: an input crafted to fool a model at one precision (say FP32) tends to produce a different transcription when the same model runs at FP16 or BF16, while benign inputs produce stable transcriptions across those settings. The paper formalizes this with the precision-diversity score, the average pairwise word error rate over a set of precision configurations, and shows that a Gaussian fit to benign scores can flag adversarial inputs. Randomly sampling precision at inference sacrifices almost no benign performance while substantially increasing word error rate for attacks. The

What carries the argument

The load-bearing instrument is the exposed compute precision of the model (FP32, FP16, BF16) treated as a deployment-level control variable. The paper's specific tools are: (1) stochastic precision sampling, where inference precision is randomly drawn, and (2) the precision-diversity score, the average pairwise word error rate across transcriptions obtained at K different precisions, which feeds a Gaussian one-class detector. The hypothesized mechanism—differential stability of adversarial versus benign inputs under precision change—is what makes both tools work.

Load-bearing premise

The entire approach rests on the assumption that adversarial examples are more sensitive to changes in numerical precision than benign inputs; if some benign input or a precision-robust attack produces equally large transcription changes across precisions, both the robustness gain and the detector stop working.

What would settle it

Generate a set of adversarial examples with the paper's multi-precision adaptive objective and a separate set of benign utterances, then compute precision-diversity scores. If the two score distributions overlap substantially—or if a benign utterance with a large score is often misclassified as adversarial—the differential-stability hypothesis is refuted; the paper's own adaptive-attack experiment already points toward the first failure mode.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • ASR systems that already support multiple precisions can gain adversarial robustness without retraining, extra parameters, or access to internal logits.
  • Attackers must now treat precision as part of the threat model; attacks optimized for a single precision transfer poorly across precisions.
  • The precision-diversity score can serve as a lightweight detection layer, flagging inputs whose transcription changes across precision settings.
  • Combining precision diversity with uncertainty-based detection can force adaptive attackers to add more perceptible noise to bypass both.
  • Because the defense operates on output transcripts, it applies to black-box ASR services that return only text.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same differential-stability idea may extend beyond speech: any sequence-output model with exposed precision controls, such as machine translation or summarization, could be hardened by precision sampling, provided benign outputs are precision-stable.
  • Precision sampling is a stochastic defense, so its strength depends on the diversity of precision modes; an adversary who optimizes across the full set, as the paper's adaptive attack does, removes the benefit—future work could combine precision sampling with other stochastic defenses.
  • A testable extension is measuring precision-diversity scores on naturally noisy or out-of-domain speech: if genuine variability inflates the score, the detector's threshold would need input-dependent calibration.
  • The paper's finding that a Gaussian fit on one reference model transfers across architectures suggests precision-diversity scores are more input-dependent than model-dependent; if confirmed, one shared detector could serve many ASR deployments.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper proposes Precision-Varying Prediction (PVP), a training-free, model-agnostic defense for ASR. The central idea is that adversarial examples generated at one numerical precision (FP32, FP16, or BF16) are less likely to succeed when inference is run at a different precision, while benign inputs remain stable. The authors exploit this in two ways: (i) stochastic precision sampling during inference to reduce targeted-attack success, and (ii) an adversarial detector based on a 'precision-diversity score' (Eq. 3), computed as the average pairwise WER across transcripts obtained under different precisions; a Gaussian fit on benign scores then flags outliers as adversarial. Experiments cover four ASR architectures (CTC, seq2seq, Transformer, Whisper), each trained in three precisions, and two attacks (C&W and psychoacoustic). The paper reports that precision variation increases WER/SER against the adversarial target transcript (Table 2) and that detection AUROC is generally above 0.90 for many configurations (Table 3). The paper also reports an adaptive attack that achieves full success against both the robustness and detection mechanisms.

Significance. If validated, the paper offers an attractive defense recipe: no retraining, no architectural changes, no model-internal access, and near-zero benign-performance cost. The breadth of architectures and attacks evaluated, the public repository, and the honest reporting of the adaptive attack are strengths. The differential-stability hypothesis is plausible and the benign-precision-stability results (Table 1) support a key prerequisite. However, the central robustness claim is currently measured only as failure to reach the adversarial target, not as preservation of the original transcription. If precision switching merely replaces one erroneous transcript with another, the method does not 'robustify' ASR in the sense users would expect. This, together with the unqualified abstract claim in light of the reported adaptive attack, and the absence of variance information for the stochastic-precision results, means the contribution as stated is not yet established. The idea is worth pursuing, but the evaluation and framing need substantial revision.

major comments (4)
  1. [§4.4, Table 2] Attack success in Table 2 is measured as WER/SER against the adversarial target transcript only, not against the original ground-truth transcription. The text in §4.4 confirms: 'Attack success was quantified using the WER and SER between the ASR output and the target transcript.' Therefore, an increase in WER under precision switching only shows that the targeted phrase is no longer decoded; it does not show that the model returns to the correct transcript. The output could be an arbitrary wrong transcription, which would still be a failed ASR interaction. The skeptic's concern is valid: without reporting WER/SER of the attacked input against the original ground truth under each inference precision (and comparing to benign WER), the central claim that precision variation 'reduces the likelihood of adversarial attacks to succeed' conflates targeted-attack failure with actual robustness. P
  2. [Abstract and §4.5] The abstract states that 'changing the precision of an ASR model during inference reduces the likelihood of adversarial attacks to succeed' without threat-model qualification. Yet §4.5 reports that under a defense-aware adaptive C&W attack, 'all attacks achieve an SER of zero, indicating complete attack success and demonstrating that the standalone robustness increase as well as the precision-diversity method can be circumvented when the adversary explicitly optimizes against it.' The conclusion similarly claims that 'adversarial inputs consistently exhibit reduced success in fooling the ASR models' without mentioning the adaptive-result limitation. This is an internal inconsistency between the headline claim and the paper's own experiments. The abstract and conclusion must be qualified to non-adaptive attacks, or the adaptive attack must be addressed in a way that does not invalidate th
  3. [§4.4, Table 2, random-precision columns] The random-precision columns in Table 2 are averaged over 10 stochastic trials, but no error bars, standard deviations, confidence intervals, or significance tests are reported. Without this information, the reader cannot assess whether apparent robustness gains (e.g., CTC-FP32 C&W random WER of 10.93 vs. matched-precision 00.00) are stable or dominated by a few lucky samples. This is particularly important because the stochastic-precision mechanism is a central contribution. Please report trial-level variability (e.g., std or 95% CI across the 10 trials) and, where comparisons are made, use appropriate paired statistical tests. This does not require changing the experimental design, but it is necessary to support the quantitative claims.
  4. [§4.5, Table 3 and §3.4] The detection method is described as fitting one Gaussian on a reference ASR model and then 'us[ing] it across all architectures.' The paper does not specify which reference model is used, how the detection threshold is selected from the fitted distribution, or how this threshold transfers across models with different benign score ranges. AUROC is threshold-independent, but a practical detector requires an operating point, and the claim that the method 'rarely misclassifies benign samples' is only qualitative. Please specify the threshold rule (e.g., mean + k·std), the reference model, and report false-positive rates or a Table 3 companion with operating-point metrics. This is a completeness issue for the detection contribution.
minor comments (7)
  1. [§2, Psychoacoustic Attack] Typo: 'human detection limilts' should be 'limits'. Please also define c_2 in the surrounding text; the definition is only implied by the equation.
  2. [§4.3, Table 1] The text states that 'differences are negligible' for cross-precision and stochastic-precision inference on benign inputs. This is contradicted by the seq2seq-FP16 row: inference under BF16 yields 5.75/59.39 on test-clean versus 2.87/31.49 at matched FP16 precision, roughly doubling the WER and SER. While absolute WER remains low, 'negligible' overstates the observation. Please qualify the claim or explain why this case is acceptable.
  3. [§4.5, results paragraph] The sentence 'Transformer likely due to its large-scale pretrained design and fixed-precision optimization' is speculative. Either provide a concrete analysis (e.g., logit sensitivity analysis) or remove the speculative explanation.
  4. [Table 2, footnote] The arrow notation 'Random↑' is ambiguous: WER/SER are normally lower-better metrics, but here higher values are used to indicate stronger robustness. Please clarify in the caption and add a footnote explaining that the arrow denotes 'higher is better for this evaluation'.
  5. [§3.4] The precision-diversity score in Eq. (3) uses WER as the similarity measure. WER is asymmetric (it is not a true metric), and the pairwise average over unordered pairs in Eq. (3) implicitly treats s(f_pi(x), f_pj(x)) as symmetric. Please specify whether the directional WER is averaged in both directions or note that the chosen implementation is symmetric.
  6. [§4.1] The description of Whisper as 'a pretrained Whisper-based ASR system from OpenAI, optimized using an NLL loss' is inconsistent with the earlier statement that 'Each architecture is trained separately under three precision settings.' Please clarify whether Whisper is fine-tuned for each precision or evaluated as a pretrained model under different inference precisions.
  7. [§3.3] The sampling distribution over the precision set P is not specified. Random sampling could be uniform over {FP32, FP16, BF16} or weighted toward non-source precisions. Since Table 2's random columns depend on this distribution, please state it explicitly in the experimental setup.

Circularity Check

0 steps flagged

No significant circularity: the central claims are empirical, the only fitted component is a benign-data Gaussian detector, and self-citations are not load-bearing.

full rationale

PVP's robustness and detection claims are empirical rather than derived by construction. The key hypothesis in Sec. 3.2 ('We hypothesize that AEs are more sensitive to changes in numerical precision than benign inputs') is explicitly stated as a hypothesis and tested on held-out adversarial and benign samples. The precision-diversity detector (Eq. 3) is implemented by fitting a Gaussian only to benign precision-diversity scores; detection is then evaluated on a disjoint set of benign and adversarial samples, so the detector is not predicting from its own fitted inputs. The robustness result under stochastic precision is a transferability observation: attacks are generated at one precision and evaluated at another, which is a standard adversarial-transfer setting rather than a definitional identity. Self-citations [11], [18], [19], and [36] appear in related-work and baseline-comparison contexts; none of them supplies the load-bearing premise, and no 'uniqueness theorem' from the authors is invoked to force the choice of precision diversity. The concern about Table 2 measuring WER/SER against the adversarial target transcript rather than the original ground-truth transcription is a metric-validity issue, not circularity: the paper's stated attack-success definition is target equality, so comparing against the target is internally consistent, even if it leaves open the question of whether precision switching restores correct recognition. No circular step can be exhibited under the required standard.

Axiom & Free-Parameter Ledger

3 free parameters · 3 axioms · 0 invented entities

The central claim rests on an empirical hypothesis about precision sensitivity, a benign-stability assumption, and a Gaussian assumption for the detector. No theoretical derivation is offered, and no new entities are postulated.

free parameters (3)
  • Gaussian detector parameters (mu, sigma)
    Fitted to 200 benign precision-diversity scores to threshold detection in Sec. 4.5.
  • Precision set P and sampling distribution = FP32, FP16, BF16 (assumed uniform)
    Design choice in Sec. 3.3/4.3; the specific precisions and sampling distribution affect transferability and benign stability.
  • Detector significance threshold
    'Deviates significantly' in Sec. 3.4 is undefined; the threshold is a free choice affecting detection.
axioms (3)
  • domain assumption Adversarial examples are more sensitive to numerical precision changes than benign inputs.
    Stated as a hypothesis in Sec. 3.2; all PVP methods rest on this differential stability.
  • domain assumption Precision switching does not affect benign ASR accuracy.
    Supported by Tab. 1 but only empirically; if false, stochastic precision sampling would degrade benign performance.
  • domain assumption Benign precision-diversity scores follow a Gaussian distribution.
    Sec. 4.5 fits a single Gaussian to benign scores; no goodness-of-fit or justification is provided.

reviewed 2026-08-02 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Precision-Varying Prediction (PVP): Robustifying ASR systems against adversarial attacks." pith.science (2026). https://pith.science/paper/NP72PPS2

@misc{pith2026260322590,
  author       = {Pith},
  title        = {Pith review of: Precision-Varying Prediction (PVP): Robustifying ASR systems against adversarial attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NP72PPS2}},
  note         = {Machine review of arXiv:2603.22590}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

With the increasing deployment of automated and agentic systems, ensuring the adversarial robustness of automatic speech recognition (ASR) models has become highly relevant. We observe that changing the precision of an ASR model during inference reduces the likelihood of adversarial attacks to succeed. We take advantage of this fact to make models more robust simply by randomly sampling the precision during prediction. Moreover, this insight can be turned into an adversarial example detection strategy by implementing a simple Gaussian classifier that thresholds the differences between outputs of models run with different precision. To further enhance security boundaries, we combine the approach with an existing uncertainty-based defense mechanism, which forces adaptive adversaries to introduce highly perceptible noise to bypass detection. An experimental analysis across various ASR models, languages, and attack types demonstrates a significant increase in adversarial robustness, competitive detection capabilities, and resistance to adaptive threats.

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

42 extracted references · 2 linked inside Pith

  1. [1]

    Introduction Over the past decade, automatic speech recognition (ASR) sys- tems have advanced rapidly, enabling voice-driven interactions that range from simple command execution in virtual assis- tants to open-ended conversational queries. State-of-the-art ASR models are predominantly based on deep neural networks (DNNs) [1, 2], and these models are now ...

  2. [2]

    Adversarial Attacks Adversarial attacks are methods that introduce carefully de- signed perturbations to input data with the objective of causing a machine learning model to produce incorrect outputs. In the audio domain, such perturbations are often constrained to be small and may be imperceptible or minimally perceptible to hu- man listeners, depending ...

    Pith/arXiv arXiv 2026

  3. [3]

    We leverage this via a lightweight detection mecha- nism based on transcription consistency across precision modes

    Approach The core idea is that adversarial perturbations exhibit reduced stability when the numerical precision of the model is varied at inference. We leverage this via a lightweight detection mecha- nism based on transcription consistency across precision modes. 3.1. ASR Under Varying Numerical Precision Modern deep learning frameworks support multiple ...

  4. [4]

    Our adversarial attack imple- mentation follows [26], and all models and hyperparameters are available in our repository:https://github.com/ blindconf/multi_precision_fusion

    Experiments and Results All experiments are conducted under three precision configura- tions: FP32, FP16, and BF16. Our adversarial attack imple- mentation follows [26], and all models and hyperparameters are available in our repository:https://github.com/ blindconf/multi_precision_fusion. 4.1. ASR Models We train and evaluate four ASR systems—CTC, seq2se...

    2015

  5. [5]

    Conclusion We demonstrate that numerical precision can serve as an effec- tive and lightweight mechanism for improving adversarial ro- bustness in ASR systems. Across numerous ASR models span- ning diverse underlying architectures, adversarial inputs consis- tently exhibit reduced success in fooling the ASR models when varying inference precisions, wherea...

  6. [6]

    Automatic speech recog- nition using advanced deep learning approaches: A survey,

    H. Kheddar, M. Hemis, and Y . Himeur, “Automatic speech recog- nition using advanced deep learning approaches: A survey,”In- formation fusion, vol. 109, p. 102422, 2024

    2024

  7. [7]

    The analysis of transformer end-to- end model in real-time interactive scene based on speech recog- nition technology,

    P. Li, C. Yang, and L. Mao, “The analysis of transformer end-to- end model in real-time interactive scene based on speech recog- nition technology,”Scientific Reports, vol. 15, no. 1, p. 17950, 2025

    2025

  8. [8]

    A convolutional neural network-based speech recognition system for autonomous driving,

    E. Caldwell, “A convolutional neural network-based speech recognition system for autonomous driving,”Transactions on Computational and Scientific Methods, vol. 5, no. 2, 2025

    2025

  9. [9]

    Im- proved healthcare diagnosis accuracy through the application of deep learning techniques in medical transcription for disease iden- tification,

    A. Elhadad, I. Alrashdi, A. M. Albarrak, S. R. I. Elrefaey, H. A. E. Elsayed, F. M. Embarak, Z. Ulmas, and Y . A. B. El-Ebiary, “Im- proved healthcare diagnosis accuracy through the application of deep learning techniques in medical transcription for disease iden- tification,”Alexandria Engineering Journal, vol. 123, pp. 112– 123, 2025

    2025

  10. [10]

    Multimed: Multilingual medical speech recognition via attention encoder decoder,

    K. Le-Duc, P. Phan, T.-H. Pham, B. P. Tat, M.-H. Ngo, T. Nguyen- Tang, and T.-S. Hy, “Multimed: Multilingual medical speech recognition via attention encoder decoder,” inProceedings of the 63rd Annual Meeting of the Association for Computational Lin- guistics (Industry Track). Vienna, Austria: Association for Com- putational Linguistics, 2025, pp. 1113–1150

    2025

  11. [11]

    Sirenattack: Generating adversarial audio for end-to-end acoustic systems,

    T. Du, S. Ji, J. Li, Q. Gu, T. Wang, and R. Beyah, “Sirenattack: Generating adversarial audio for end-to-end acoustic systems,” in Proceedings of the 15th ACM Asia conference on computer and communications security, 2020, pp. 357–369

    2020

  12. [12]

    Explaining and har- nessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and har- nessing adversarial examples,” inInternational Conference on Learning Representations (ICLR), 2015

    2015

  13. [13]

    Audio adversarial examples: Targeted attacks on speech-to-text,

    N. Carlini and D. Wagner, “Audio adversarial examples: Targeted attacks on speech-to-text,” in2018 IEEE security and privacy workshops (SPW). IEEE, 2018, pp. 1–7

    2018

  14. [14]

    Im- perceptible, robust, and targeted adversarial examples for auto- matic speech recognition,

    Y . Qin, N. Carlini, G. Cottrell, I. Goodfellow, and C. Raffel, “Im- perceptible, robust, and targeted adversarial examples for auto- matic speech recognition,” inInternational conference on ma- chine learning. PMLR, 2019, pp. 5231–5240

    2019

  15. [15]

    Ad- versarial attacks against automatic speech recognition systems via psychoacoustic hiding,

    L. Sch ¨onherr, K. Kohls, S. Zeiler, T. Holz, and D. Kolossa, “Ad- versarial attacks against automatic speech recognition systems via psychoacoustic hiding,” inNetwork and Distributed System Secu- rity Symposium (NDSS), 2019

    2019

  16. [16]

    Robustifying auto- matic speech recognition by extracting slowly varying features,

    M. Pizarro, D. Kolossa, and A. Fischer, “Robustifying auto- matic speech recognition by extracting slowly varying features,” inProc. 2021 ISCA Symposium on Security and Privacy in Speech Communication, 2021, pp. 37–41

    2021

  17. [17]

    Waveguard: Understanding and mitigating audio adversarial examples,

    S. Hussain, P. Neekhara, S. Dubnov, J. McAuley, and F. Koushan- far, “Waveguard: Understanding and mitigating audio adversarial examples,” in30th USENIX security symposium (USENIX Secu- rity 21), 2021, pp. 2273–2290

    2021

  18. [18]

    Towards Deep Learning Models Resistant to Adversarial At- tacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards Deep Learning Models Resistant to Adversarial At- tacks,” in6th International Conference on Learning Represen- tations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018

    2018

  19. [19]

    Dompteur: Taming Audio Adversarial Examples,

    T. Eisenhofer, L. Sch ¨onherr, J. Frank, L. Speckemeier, D. Kolossa, and T. Holz, “Dompteur: Taming Audio Adversarial Examples,” in30th USENIX Security Symposium (USENIX Security 21). USENIX Association, Aug. 2021

    2021

  20. [20]

    The Limitations of Adversarial Training and the Blind- Spot Attack,

    H. Zhang, H. Chen, Z. Song, D. Boning, inderjit dhillon, and C.-J. Hsieh, “The Limitations of Adversarial Training and the Blind- Spot Attack,” inInternational Conference on Learning Represen- tations, 2019

    2019

  21. [21]

    Defending against Adversarial Audio via Diffusion Model,

    S. Wu, J. Wang, W. Ping, W. Nie, and C. Xiao, “Defending against Adversarial Audio via Diffusion Model,” inThe Eleventh Interna- tional Conference on Learning Representations, 2023

    2023

  22. [22]

    Noise Flooding for Detecting Audio Adversarial Examples Against Automatic Speech Recognition,

    K. rajaratnam and J. Kalita, “Noise Flooding for Detecting Audio Adversarial Examples Against Automatic Speech Recognition,” in2018 IEEE International Symposium on Signal Processing and Information Technology (ISSPIT), 2018, pp. 197–201

    2018

  23. [23]

    Detect- ing Adversarial Examples for Speech Recognition via Uncertainty Quantification,

    S. D ¨aubener, L. Sch ¨onherr, A. Fischer, and D. Kolossa, “Detect- ing Adversarial Examples for Speech Recognition via Uncertainty Quantification,” inProc. Interspeech 2020, 2020, pp. 4661–4665

    2020

  24. [24]

    DistriBlock: Identify- ing adversarial audio samples by leveraging characteristics of the output distribution,

    M. Pizarro, D. Kolossa, and A. Fisher, “DistriBlock: Identify- ing adversarial audio samples by leveraging characteristics of the output distribution,” inProceedings of the Fortieth Conference on Uncertainty in Artificial Intelligence, ser. Proceedings of Machine Learning Research, N. Kiyavash and J. M. Mooij, Eds., vol. 244. PMLR, 15–19 Jul 2024, pp. 2956–2988

    2024

  25. [25]

    Characterizing Audio Adversarial Examples Using Temporal Dependency,

    Z. Yang, B. Li, P.-Y . Chen, and D. Song, “Characterizing Audio Adversarial Examples Using Temporal Dependency,” inInterna- tional Conference on Learning Representations, 2019

    2019

  26. [26]

    Generating Robust Audio Adversarial Examples with Temporal Dependency,

    H. Zhang, P. Zhou, Q. Yan, and X.-Y . Liu, “Generating Robust Audio Adversarial Examples with Temporal Dependency,” inPro- ceedings of the Twenty-Ninth International Joint Conference on Artificial Intelligence, IJCAI-20, C. Bessiere, Ed. International Joint Conferences on Artificial Intelligence Organization, 7 2020, pp. 3167–3173, main track

    2020

  27. [27]

    PyTorch Contributors,Automatic Mixed Precision — Autocast Op Reference, PyTorch, 2025, Documentation, Retrieved February

    2025

  28. [28]

    Lib- rispeech: an ASR corpus based on public domain audio books,

    V . Panayotov, G. Chen, D. Povey, and S. Khudanpur, “Lib- rispeech: an ASR corpus based on public domain audio books,” in2015 IEEE international conference on acoustics, speech and signal processing (ICASSP). IEEE, 2015, pp. 5206–5210

    2015

  29. [29]

    [Online]

    NVIDIA Corporation,cuBLAS Library User Guide, NVIDIA, 2024, CUDA Toolkit Documentation. [Online]. Available: https://docs.nvidia.com/cuda/cublas/

    2024

  30. [30]

    NVIDIA cuDNN Frontend API Documentation,

    ——, “NVIDIA cuDNN Frontend API Documentation,” https: //docs.nvidia.com/deeplearning/cudnn/frontend/latest/index.html, 2024, accessed: 2026-03-04

    2024

  31. [31]

    Numerical behavior of nvidia tensor cores,

    M. Fasi, N. J. Higham, M. Mikaitis, and S. Pranesh, “Numerical behavior of nvidia tensor cores,”PeerJ Computer Science, vol. 7, p. e330, 2021

    2021

  32. [32]

    Recent improvements of ASR models in the face of adversarial attacks,

    R. Olivier and B. Raj, “Recent improvements of ASR models in the face of adversarial attacks,” inInterspeech 2022, 2022, pp. 4113–4117

    2022

  33. [33]

    Speechbrain: A general-purpose speech toolkit,

    M. Ravanelli, T. Parcollet, P. Plantinga, A. Rouhe, S. Cornell, L. Lugosch, C. Subakan, N. Dawalatabad, A. Heba, J. Zhong et al., “Speechbrain: A general-purpose speech toolkit,”arXiv preprint arXiv:2106.04624, 2021

    Pith/arXiv arXiv 2021

  34. [34]

    A guided tour to approximate string matching,

    G. Navarro, “A guided tour to approximate string matching,” ACM Comput. Surv., vol. 33, no. 1, p. 31–88, Mar. 2001

    2001

  35. [35]

    wav2vec 2.0: A Framework for Self-Supervised Learning of Speech Represen- tations,

    A. Baevski, Y . Zhou, A. Mohamed, and M. Auli, “wav2vec 2.0: A Framework for Self-Supervised Learning of Speech Represen- tations,” inAdvances in Neural Information Processing Systems, H. Larochelle, M. Ranzato, R. Hadsell, M. Balcan, and H. Lin, Eds., vol. 33. Curran Associates, Inc., 2020, pp. 12 449–12 460

    2020

  36. [36]

    Con- nectionist temporal classification: labelling unsegmented se- quence data with recurrent neural networks,

    A. Graves, S. Fern ´andez, F. Gomez, and J. Schmidhuber, “Con- nectionist temporal classification: labelling unsegmented se- quence data with recurrent neural networks,” inProceedings of the 23rd International Conference on Machine Learning, ser. ICML ’06. New York, NY , USA: Association for Computing Machin- ery, 2006, p. 369–376

    2006

  37. [37]

    Listen, attend and spell: A neural network for large vocabulary conversational speech recognition,

    W. Chan, N. Jaitly, Q. Le, and O. Vinyals, “Listen, attend and spell: A neural network for large vocabulary conversational speech recognition,” in2016 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2016, pp. 4960–4964

    2016

  38. [38]

    Transformers: State-of- the-Art Natural Language Processing,

    T. Wolf, L. Debut, V . Sanh, J. Chaumond, C. Delangue, A. Moi, P. Cistac, T. Rault, R. Louf, M. Funtowicz, J. Davison, S. Shleifer, P. von Platen, C. Ma, Y . Jernite, J. Plu, C. Xu, T. Le Scao, S. Gug- ger, M. Drame, Q. Lhoest, and A. Rush, “Transformers: State-of- the-Art Natural Language Processing,” inProceedings of the 2020 Conference on Empirical Met...

    2020

  39. [39]

    Robust speech recognition via large-scale weak supervision,

    A. Radford, J. W. Kim, T. Xu, G. Brockman, C. McLeavey, and I. Sutskever, “Robust speech recognition via large-scale weak supervision,” inInternational conference on machine learning. PMLR, 2023, pp. 28 492–28 518

    2023

  40. [41]

    Evaluation of a segmental SNR measure as an indicator of the quality of ADPCM coded speech,

    P. Mermelstein, “Evaluation of a segmental SNR measure as an indicator of the quality of ADPCM coded speech,”The Journal of the Acoustical Society of America, vol. 66, no. 6, pp. 1664–1667, 12 1979

    1979

  41. [42]

    Comparative study on noise-augmented training and its effect on adversarial robustness in ASR systems,

    K. Pizzi, M. Pizarro, and A. Fischer, “Comparative study on noise-augmented training and its effect on adversarial robustness in ASR systems,”Computer Speech & Language, vol. 96, p. 101869, 2026

    2026

  42. [2026]

    Available: https://docs.pytorch.org/docs/stable/ amp.html#autocast-op-reference

    [Online]. Available: https://docs.pytorch.org/docs/stable/ amp.html#autocast-op-reference

This paper was first reviewed by deepseek-v4-flash on August 2, 2026.