Microsoft Security Response Center assessed our report as low severity and shared our report with the team responsible for maintaining the product or service.

Response: Our attack with different speakers.

The AEs, original audio clips, and the TTS audio clips of 5 speakers can be downloaded.

attack with different speakers.zip

Response: The AE can be injected into human speech.

The following audio clips are an AE and its carrier. The original audio is of two people debating.

An AE of the target command "what is the weather".

AE-2020vote_13-14975_bw[300_300_300_0_0]_db22.4.wav

The decoding result of the AE by Tencent ASR API Service.

AE-2020vote_13-14975_bw[300_300_300_0_0]_db22.4.tencent.json

The carrier, i.e., the original audio, of the AE.

originalaudio-2020vote_13-14975.wav

The decoding result of the carrier by Tencent ASR API Service.

originalaudio-2020vote_13-14975.tencent.json

Note: The paper “EvilHarmony: Highly Stealthy Adversarial Attacks against Black-box Speech Recognition Systems” analyzed the important features of Commercial Black-box adversarial audio, and proposed an EvilHarmony attack for automatic speech recognition (ASR) systems. This website shows some AEs and their attack effectiveness. The details of the target commands are introduced in the red color of “Command”.

1） The human study of Part 1 “AEs for Aliyun API (English target commands)” is shown in Table 5 (Page 9) of the paper.

2） The human study of Part 1 “AEs for six API services (English target commands)” is shown in Table 6 (Page 10) of the paper.

3） The human study of Part 2 “Physical world attack” is shown in Table 8 (Page 11) of the paper.

4） The human study of Part 3 “AEs for Aliyun API (Chinese target commands)” is shown in Table 7 (Page 11) of the paper.

1 The Digital World Attack

The AEs of Table 5 and Tbale 6 are available as follows.

AEs-against-Aliyun-Amzon-Azure-Google-Tencent-OpenAIwhisper.zip

compare-ModulatedAudio-Devilswhisper-Kenku-Occam-Cleanmusic.zip

Aliyun_Phantom_C1

Aliyun_Ph_01_3p327-pure_0259-450_bw[300_300_300_0_0]_db10.8.wav

Aliyun_results_C1

{"success": true, "errorMSG": null, "result": "Play music. ", "confidence": null}

Aliyun_Phantom_C2

Aliyun_Ph_02_4p408-2021popmusic16Kv1hour2-325600_bw[300_300_0_0_0]_db11.0.wav（副本）

Aliyun_results_C2

{"success": true, "errorMSG": null, "result": "What is the weather like that. ", "confidence": null}

Aliyun_Phantom_C3

Aliyun_Ph_03_3p690-01_English_019-15500_bw[300_300_0_0_0]_db9.9.wav

Aliyun_results_C3

{"success": true, "errorMSG": null, "result": "You can open the door, You call it for living. ", "confidence": null}

Aliyun_Phantom_C4

Aliyun_Ph_04_3p938-01_English_018-19100_bw[300_300_0_0_0]_db8.2.wav

Aliyun_results_C4

{"success": true, "errorMSG": null, "result": "You open the window. ", "confidence": null}

Aliyun_Phantom_C5

Aliyun_Ph_05_4p585-pma022-125_bw[300_300_300_300_300]_db10.9.wav

Aliyun_results_C5

{"success": true, "errorMSG": null, "result": "Take a picture of me. ", "confidence": null}

Aliyun_Phantom_C6

Aliyun_Ph_06_4p183-04_Russian_005-1425_bw[300_300_300_0_0]_db11.8.wav

Aliyun_results_C6

{"success": true, "errorMSG": null, "result": "To make it a warmer. ", "confidence": null}

Aliyun_Phantom_C7

Aliyun_Ph_07_3p706-02_Chinese_004-10700_bw[300_300_300_0_0]_db11.7.wav

Aliyun_results_C7

{"success": true, "errorMSG": null, "result": "Where is my car. ", "confidence": null}

Aliyun_Phantom_C8

Aliyun_Ph_08_3p749-01_English_014-11990_bw[300_300_300_0_0]_db15.9.wav

Aliyun_results_C8

{"success": true, "errorMSG": null, "result": "Send a message. ", "confidence": null}

Aliyun_Phantom_C9

Aliyun_Ph_09_3p747-02_Chinese_001-13875_bw[300_300_300_0_0]_db9.3.wav

Aliyun_results_C9

{"success": true, "errorMSG": null, "result": "Turn on the light. ", "confidence": null}

Aliyun_Phantom_C10

Aliyun_Ph_10_3p739-02_Chinese_008-13225_bw[300_300_300_0_0]_db13.1.wav

Aliyun_results_C10

{"success": true, "errorMSG": null, "result": "Turn off the computer. ", "confidence": null}

2 The Physical World Attack

Attack Google Assistant

Google assistant-5d10-pm.mp4

Attack Google Assistant

Google assistant-4d10-tntl.mp4

Attack Google Assistant

Google assistant1d10-totc.mp4

Attack Google Assistant

Google assistant-4d10-witw.mp4