Search arXiv⌕ Search
Home/Archive/arXiv

arXiv · 2210.17316

There is more than one kind of robustness: Fooling Whisper with adversarial examples

Raphael Olivier·Bhiksha Raj
View original source ↗Read source document ↗Export metadata ↓

Abstract

Whisper is a recent Automatic Speech Recognition (ASR) model displaying impressive robustness to both out-of-distribution inputs and random noise. In this work, we show that this robustness does not carry over to adversarial noise. We show that we can degrade Whisper performance dramatically, or even transcribe a target sentence of our choice, by generating very small input perturbations with Signal Noise Ratio of 35-45dB. We also show that by fooling the Whisper language detector we can very easily degrade the performance of multilingual models. These vulnerabilities of a widely popular open-source model have practical security implications and emphasize the need for adversarially robust ASR.

Explore related subjects

eess.AScs.AIcs.CLcs.LGcs.SD

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Raphael Olivier, Bhiksha Raj. 2023-08-10. There is more than one kind of robustness: Fooling Whisper with adversarial examples. https://arxiv.org/abs/2210.17316

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Revisiting Lexicon Evaluation in Unsupervised Word Discovery

Building a lexicon from discovered word-like units is a central goal in zero-resource speech processing. But do our evaluations provide a trustworthy indication of lexicon quality? A common metric, normalized edit distance, averages the phoneme edit distances between discovered units in each cluster. We show that this metric has an inherent bias toward the quality of large clusters, inhibiting fair evaluation. Moreover, it ignores how well true classes are distributed across clusters. Based on established theory in clustering literature, we propose two metrics that address these shortcomings: a modified metric that weighs cluster size when assessing within-cluster consistency, and an inverse metric that assesses how true words are spread across clusters. Through experiments on synthetic and real-world lexicons, we demonstrate that combined, these metrics are: (1) more closely correlated with how similar a lexicon is to the ground-truth distribution, and (2) more robust to biases that skew lexicon evaluations.

eess.AS↗
arXiv2026

AURA: Uncertainty-Routed Activation Editing for Acoustic Grounding in Speech Foundation Models

Attention encoder-decoder (AED) Speech Foundation Models achieve strong ASR performance but can generate acoustically unsupported text when inputs contain no speech, weak acoustic evidence, or unreliable transcription. We propose AURA: Activation-editing with Uncertainty-Routed Adaptation, an ultra-efficient representation-editing method that freezes the pretrained model and applies sparse scale-and-shift edits to decoder cross-attention heads. AURA dynamically routes edits using cross-attention uncertainty features that capture over-concentration, diffuse attention, and abrupt frame shifts. We evaluate AURA on four datasets spanning non-speech hallucination and speech grounding stressors, including imperfect-label child speech, imperfect-label adult speech, and disfluent speech. On non-speech audio, AURA reduces hallucination rate from 89.18% to 1.94% without prior hallucination-head identification. On imperfect-label corpora, AURA approaches LoRA WER while using roughly 500x fewer trainable parameters. Sensitivity analysis and qualitative cross-attention examples are consistent with AURA's uncertainty-routed editing behavior, supporting dynamic activation editing as a practical path for grounding AED speech models.

eess.AS↗
arXiv2026

The design of an optomechanical microphone using a photonic waveguide interferometer

We present an optomechanical microphone based on a diaphragm-integrated photonic waveguide Mach-Zehnder interferometer. Acoustic pressure deforms the MEMS diaphragm, inducing strain in the sensing waveguide and changing its optical path length. We analytically evaluate the optical and mechanical transduction mechanisms and key figures of merit, including signal-to-noise ratio, dynamic range, acoustic overload pressure, and minimum detectable pressure. Two design cases are considered: a MEMS microphone and a measurement microphone. The results indicate competitive performance but no substantial overall advantage over state-of-the-art microphones in conventional applications. The architecture may nevertheless offer advantages for high-temperature and other harsh-environment sensing applications.

eess.AS↗