AdvAudio: A New Information Hiding Method via Fooling Automatic Speech Recognition Model

AdvAudio: A New Information Hiding Method via Fooling Automatic Speech Recognition Model

연구 분야: Strategies

학회: ACM Transactions on Asian and Low-Resource Language Information Processing, Volume 24, Issue 8

Audio is an important medium in people’s daily life, secret information can be embedded into audio for covert communication. However, traditional audio information hiding techniques cannot achieve large hiding capacity and good imperceptibility at the same time, and rely on complex encryption, which limits their applicability in resource-constrained Internet of Things (IoT) environments. In this article, we propose a new audio information hiding method, named AdvAudio, which can achieve large high capacity, as well as good imperceptibility, without reliance on cryptographic encryption. Specifically, AdvAudio leverages adversarial example technique to train a well-designed perturbation for cover audio and the secret information can only be extracted by the private automatic speech recognition (ASR) model. To achieve this, we implement two adversarial example algorithms tailored for both online transmission and physical-world transmission scenarios. In particular, our embedding algorithm dynamically adjusts the addition of simulated environmental noise depending on whether the audio is intended to propagate in the physical world. The iterative optimization process is guided by targeted adversarial attack objectives, ensuring that the private ASR model decodes the embedded secret information accurately. Taking DeepSpeech as the private model, we implement a prototype of AdvAudio, which achieves a high embedding capacity of 383.8 bps with excellent imperceptibility, yielding a Perceptual Evaluation of Speech Quality (PESQ) score of 2.351. Furthermore, it offers robust security, achieving a 100% defense success rate against both internal and external attacks. In the physical world, AdvAudio still maintains effectiveness across six different types of noise and retaining 82% accuracy even under sudden loud noises. Additionally, the secret information can only be extracted in the target environment, with a success rate of 26%, and 0% in non-target environments. In the future, we aim at enhancing the steganalysis resistance of AdvAudio and explore its potential applications in various environments or with alternative ASR models.