Actual audio from the “evil dot com” example can be found here: https://nicholas.carlini.com/code/audio_adversarial_examples/ https://nicholas.carlini.com/code/

Actual audio from the “evil dot com” example can be found here: https://nicholas.carlini.com/code/audio_adversarial_examples/ https://nicholas.carlini.com/code/audio_adversarial_examples... It’s only hard to hear on a phone speaker at low volume on the 50dB example. All other examples have what sounds like some sort of static or background noise. Granted, to an average consumer it may sound like just bad audio, but it’s not imperceptible and thus can be screened for. Most likely we’ll end up in the same perpetual update cycle as other computer security - someone finds an exploit, that exploit is either reported for a bounty or discovered in active use in the wild, a fix is implemented and exploit is added to the test suite. For ML that will mean adding the examples of the exploits into the learning sets/providing negative re-enforcement feedbacks. The question will be whether we can get enough of these caught before some machinery injures someone because it saw something that wasn’t there or accepted a malicious command, and it becomes a media frenzy.