4 ms·
There is a similar attack against image classifiers. So is this just a proof of concept or can this be exploited in the wild? Based on my understanding you ne
by bcheung 9y ago
There is a similar attack against image classifiers.
So is this just a proof of concept or can this be exploited in the wild?
Based on my understanding you need to have access to network itself (weights, baisses, activation function, architectural topography) to pull off this kind of attack. Doesn't seem like this could be easily be duplicated as an outside agent.
- evjrob 9y agoI wouldn't be surprised if these speech to text models are susceptible to black box attacks in the same way that image classifiers are: https://arxiv.org/abs/1605.07277 https://arxiv.org/abs/1605.07277
- chestervonwinch 9y agoTo generate adversarials, you really just the Jacobian of the network, which, without the network architecture, etc., would require estimation via finite differences which would require running the same signal as input multiple (lots! for large signals) times with minor perturbations to each component. I think whether or not this is feasible depends on the circumstances. Also, I could be wrong about everything because I'm not super current on this stuff.
- whataretensors 9y agoYou don't need access to the network, you can just build another one. https://arxiv.org/abs/1602.02697 https://arxiv.org/abs/1602.02697 "Our attack strategy consists in training a local model to substitute for the target DNN, using inputs synthetically generated by an adversary and labeled by the target DNN"
- chestervonwinch 9y agothat's clever and sneaky!