Skip to main content
eScholarship
Open Access Publications from the University of California

Scholarly Works (5 results)

  • Thesis
  • Peer Reviewed
UC San Diego Electronic Theses and Dissertations (2019)

Deep neural networks (DNNs) serve as a backbone of many image, language and speech processing systems. Such models are being deployed extensively in personal devices, cloud-based applications and automated security services like face recognition, speaker identification etc. While DNNs have shown to achieve state of the art results in their respective domains, recent studies have exposed the vulnerabilities of these models to adversarial attacks. The work on adversarial examples has primarily focused on the domain of images.

In this work, we explore the vulnerabilities of neural networks working on sequential data like text and audio.

We propose a novel method to repurpose text classification networks for alternate tasks. This gives incentive to adversaries to steal computational resources from a system provider. An adversary in such an attack scenario can potentially train a simple input transformation for discrete sequences for repurposing the victim model for a new classification task.

We also study the existence of universal adversarial perturbations for Automatic Speech Recognition (ASR) Systems. We propose an algorithm to find a single quasi-imperceptible perturbation, which when added to any arbitrary speech signal, will most likely fool the victim speech recognition model. Our experiments demonstrate the application of our proposed technique by crafting audio-agnostic universal perturbations for the state-of-the-art ASR system -- Mozilla DeepSpeech. Additionally, we show that such perturbations generalize to a significant extent across models that are not available during training, by performing a transferability test on a WaveNet based ASR system.

    Cover page: Blind Spots of Neural Sequence Models
    • Thesis
    • Peer Reviewed
    UC San Diego Electronic Theses and Dissertations (2023)

    Deep neural networks (DNNs) have enabled the creation of high-quality synthetic media. The intent of generating synthetic videos can be harmless as they can be used for tasks such as advertisement campaigns, and face replacement in movies and animated films. However, DNNs can also be trained to synthesize facially manipulated videos called Deepfakes, which may be used maliciously to defame famous personalities, spread misinformation and influence elections based on false facts.

    My research focuses on the responsible use of deep learning for media synthesis. On the synthesis side, I develop methods for natural and expressive speech synthesis methods for new speakers in data-limited settings. My work enables the creation of a digital voice clone of a person that can either be generated using text or a reference speech from a different speaker. Another area of my research focuses on the robust detection of Deepfake videos. We investigate the limitations of current DeepFake detection methods and demonstrate that they can be easily bypassed using adversarially crafted DeepFake videos. To address these limitations of Deepfake detectors, we propose FaceSigns, a proactive method for proving media authenticity using semi-fragile neural watermarks. FaceSigns can embed recoverable watermark data into real images and videos at the time of their capture, which can withstand a set of benign image and video transforms while being fragile to malicious tampering such as face swapping.

      Cover page: Synthesis and Robust Detection of AI-generated Media
      • Article
      • Peer Reviewed
      UC San Diego Previously Published Works (2019)
      Adversarial Reprogramming has demonstrated success in utilizing pre-trained neural network classifiers for alternative classification tasks without modification to the original network. An adversary in such an attack scenario trains an additive contribution to the inputs to repurpose the neural network for the new classification task. While this reprogramming approach works for neural networks with a continuous input space such as that of images, it is not directly applicable to neural networks trained for tasks such as text classification, where the input space is discrete. Repurposing such classification networks would require the attacker to learn an adversarial program that maps inputs from one discrete space to the other. In this work, we introduce a context-based vocabulary remapping model to reprogram neural networks trained on a specific sequence classification task, for a new sequence classification task desired by the adversary. We propose training procedures for this adversarial program in both white-box and black-box settings. We demonstrate the application of our model by adversarially repurposing various text-classification models including LSTM, bi-directional LSTM and CNN for alternate classification tasks.
        Cover page: Adversarial Reprogramming of Text Classification Neural Networks
        • Article
        • Peer Reviewed
        UC San Diego Previously Published Works (2019)
        Recent approaches in text-to-speech (TTS) synthesis employ neural network strategies to vocode perceptually-informed spectrogram representations directly into listenable waveforms. Such vocoding procedures create a computational bottleneck in modern TTS pipelines. We propose an alternative approach which utilizes generative adversarial networks (GANs) to learn mappings from perceptually-informed spectrograms to simple magnitude spectrograms which can be heuristically vocoded. Through a user study, we show that our approach significantly outperforms naïve vocoding strategies while being hundreds of times faster than neural network vocoders used in state-of-the-art TTS systems. We also show that our method can be used to achieve state-of-the-art results in unsupervised synthesis of individual words of speech.
          Cover page: Expediting TTS Synthesis with Adversarial Vocoding
          • Article
          • Peer Reviewed
          UC San Diego Previously Published Works (2019)
          In this work, we demonstrate the existence of universal adversarial audio perturbations that cause mis-transcription of audio signals by automatic speech recognition (ASR) systems. We propose an algorithm to find a single quasi-imperceptible perturbation, which when added to any arbitrary speech signal, will most likely fool the victim speech recognition model. Our experiments demonstrate the application of our proposed technique by crafting audio-agnostic universal perturbations for the state-of-the-art ASR system - Mozilla DeepSpeech. Additionally, we show that such perturbations generalize to a significant extent across models that are not available during training, by performing a transferability test on a WaveNet based ASR system.
            Cover page: Universal Adversarial Perturbations for Speech Recognition Systems
            Top