Practical Hidden Voice Attacks against Speech and Speaker Recognition Systems

Voice Processing Systems (VPSes), now widely deployed, have been made significantly more accurate through the application of recent advances in machine learning. However, adversarial machine learning has similarly advanced and has been used to demonstrate that VPSes are vulnerable to the injection of hidden commands - audio obscured by noise that is correctly recognized by a VPS but not by human beings. Such attacks, though, are often highly dependent on white-box knowledge of a specific machine learning model and limited to specific microphones and speakers, making their use across different acoustic hardware platforms (and thus their practicality) limited. In this paper, we break these dependencies and make hidden command attacks more practical through model-agnostic (blackbox) attacks, which exploit knowledge of the signal processing algorithms commonly used by VPSes to generate the data fed into machine learning systems. Specifically, we exploit the fact that multiple source audio samples have similar feature vectors when transformed by acoustic feature extraction algorithms (e.g., FFTs). We develop four classes of perturbations that create unintelligible audio and test them against 12 machine learning models, including 7 proprietary models (e.g., Google Speech API, Bing Speech API, IBM Speech API, Azure Speaker API, etc), and demonstrate successful attacks against all targets. Moreover, we successfully use our maliciously generated audio samples in multiple hardware configurations, demonstrating effectiveness across both models and real systems. In so doing, we demonstrate that domain-specific knowledge of audio signal processing represents a practical means of generating successful hidden voice command attacks

On the Statistical Mechanics of Mass Accommodation at Liquid-Vapor Interfaces

We propose a framework for describing the dynamics associated with the adsorption of small molecules to liquid-vapor interfaces, using an intermediate resolution between traditional continuum theories that are bereft of molecular detail and molecular dynamics simulations that are replete with them. In particular, we develop an effective single particle equation of motion capable of describing the physical processes that determine thermal and mass accommodation probabilities. The effective equation is parameterized with quantities that vary through space away from the liquid-vapor interface. Of particular importance in describing the early time dynamics is the spatially dependent friction, for which we propose a numerical scheme to evaluate from molecular simulation. Taken together with potentials of mean force computable with importance sampling methods, we illustrate how to compute the mass accommodation coefficient and residence time distribution. Throughout, we highlight the case of ozone adsorption in aqueous solutions and its dependence on electrolyte composition.Comment: 9 pages, 7 figure

Using Nanoparticle X-ray Spectroscopy to Probe the Formation of Reactive Chemical Gradients in Diffusion-Limited Aerosols.

For aerosol particles that exist in highly viscous, diffusion-limited states, steep chemical gradients are expected to form during photochemical aging in the atmosphere. Under these conditions, species at the aerosol surface are more rapidly transformed than molecules residing in the particle interior. To examine the formation and evolution of chemical gradients at aerosol interfaces, the heterogeneous reaction of hydroxyl radicals (OH) on ∼200 nm particles of pure squalane (a branched, liquid hydrocarbon) and octacosane (a linear, solid hydrocarbon) and binary mixtures of the two are used to understand how diffusion limitations and phase separation impact the particle reactivity. Aerosol mass spectrometry is used to measure the effective heterogeneous OH uptake coefficient (γeff) and oxidation kinetics in the bulk, which are compared with the elemental composition of the surface obtained using X-ray photoemission. When diffusion rates are fast relative to the reaction frequency, as is the case for squalane and low-viscosity squalane-octacosane mixtures, the reaction is efficient (γeff ∼ 0.3) and only limited by the arrival of OH to the interface. However, for cases, where the diffusion rates are slower than reaction rates, as in pure octacosane and higher-viscosity squalane-octacosane mixtures, the heterogeneous reaction occurs in a mixing-limited regime and is ∼10× slower (γeff ∼ 0.03). This is in contrast to carbon and oxygen K edge X-ray absorption measurements that show that the octacosane interface is oxidized much more rapidly than that of pure squalane particles. The O/C ratio of the surface (estimated to be the top 6-8 nm of the interface) is measured to change with rate constants of (3.0 ± 0.9) × 10-13 and (8.6 ± 1.2) × 10-13 cm3 molecule-1 s-1 for squalane and octacosane particles, respectively. The differences in surface oxidation rates are analyzed using a previously published reaction-diffusion model, which suggests that a 1-2 nm highly oxidized crust forms on octacosane particles, whereas in pure squalane, the reaction products are homogeneously mixed within the aerosol. This work illustrates how diffusion limitations can form particles with highly oxidized surfaces even at relatively low oxidant exposures, which is in turn expected to influence their microphysics in the atmosphere