ML Security PapersDUAP: Dual-task Universal Adversarial Perturbations Against Voice Control Systems
Suyang Sun 1, Weifei Jin 1, Yuxin Cao 2, Wei Song 3, Jie Hao 1
Published on arXiv
2601.12786
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
DUAP achieves high simultaneous attack success rates against both ASR and SR components of voice control systems, with near-perfect black-box transferability to unseen SR models (HuBERT, X-vector) and commercial ASR APIs, significantly outperforming single-task baselines
DUAP (Dual-task Universal Adversarial Perturbation)
Novel technique introduced
Modern Voice Control Systems (VCS) rely on the collaboration of Automatic Speech Recognition (ASR) and Speaker Recognition (SR) for secure interaction. However, prior adversarial attacks typically target these tasks in isolation, overlooking the coupled decision pipeline in real-world scenarios. Consequently, single-task attacks often fail to pose a practical threat. To fill this gap, we first utilize gradient analysis to reveal that ASR and SR exhibit no inherent conflicts. Building on this, we propose Dual-task Universal Adversarial Perturbation (DUAP). Specifically, DUAP employs a targeted surrogate objective to effectively disrupt ASR transcription and introduces a Dynamic Normalized Ensemble (DNE) strategy to enhance transferability across diverse SR models. Furthermore, we incorporate psychoacoustic masking to ensure perturbation imperceptibility. Extensive evaluations across five ASR and six SR models demonstrate that DUAP achieves high simultaneous attack success rates and superior imperceptibility, significantly outperforming existing single-task baselines.
Key Contributions
- Gradient and mutual information analysis revealing that ASR and SR optimization objectives exhibit no inherent conflicts, enabling simultaneous dual-task adversarial attacks
- DUAP attack framework combining a targeted surrogate objective for ASR disruption with a Dynamic Normalized Ensemble (DNE) strategy to enhance cross-model transferability for SR
- Psychoacoustic masking constraint to ensure imperceptibility, validated via SNR and MOS across five ASR and six SR models including commercial APIs (Tencent, Alibaba, iFlytek)
🛡️ Threat Analysis
Proposes gradient-based universal adversarial perturbations crafted to simultaneously cause mis-transcription in ASR models and identity spoofing in speaker recognition models at inference time — core adversarial example attack with both white-box optimization and black-box transferability components.