Targeted Adversarial Examples for Attacking End-to-End Chinese Automatic Speech Recognition Systems

Currently, automatic speech recognition (ASR) systems are developing rapidly and most of the systems are built based on neural network models. Recent studies have shown that they are susceptible to adversarial attacks. There have been some studies on adversarial attacks for English ASR systems, but there are no adversarial attacks research works against Chinese systems so far, to the best of our knowledge. There are significant differences between the Chinese and English ASR systems, including the output character spaces and linguistic phenomena, which lead to problems such as difficulty in convergence, reduced speech similarity, and vulnerability to local optimal solutions during adversarial attacks. This paper takes a pioneering step toward adversarial attacks on Chinese ASR by proposing CASR-ATTACK, a novel method that leverages non-dominated ordering and gradient estimation to generate Chinese adversarial examples. We conducted extensive experiments using a very popular Chinese ASR system, DeepSpeech2, and used three popular open-source Chinese datasets to verify the effectiveness of the method in this paper. Experimental results showed that our approach is more effective than the state-of-the-art baselines, which achieves a success rate of 92.2%, 91.2%, 92.8% and keeps an similarity of 96.55%, 96.61%, 96.77% on short phrase attacks. The attack on long Chinese sentences also achieves an average success rate of 89.00%. Our research contributes to the study of adversarial attack research and defense of Chinese ASR systems.