Speech Recognition Attacks

import numpy as np
import soundfile as sf
 
def generate_ultrasonic_carrier(
    command_audio: np.ndarray,
    sample_rate: int = 44100,
    carrier_freq: float = 25000  # Above human hearing
) -> np.ndarray:
    """
    Modulate a voice command onto an ultrasonic carrier.
 
    WARNING: This is a simplified demonstration. Real ultrasonic attacks
    require careful hardware calibration and signal processing.
    """
    t = np.arange(len(command_audio)) / sample_rate
 
    # Generate carrier wave
    carrier = np.cos(2 * np.pi * carrier_freq * t)
 
    # Amplitude modulation
    modulated = carrier * (1 + 0.5 * command_audio)
 
    return modulated

import torch
import torchaudio
 
def targeted_asr_attack(
    model,
    source_audio: torch.Tensor,
    target_text: str,
    epsilon: float = 0.02,  # Max perturbation amplitude
    num_steps: int = 1000,
    step_size: float = 0.001
) -> torch.Tensor:
    """
    Craft adversarial audio that the ASR model transcribes as target_text.
 
    Args:
        model: ASR model (e.g., Whisper)
        source_audio: Original audio waveform [1, T]
        target_text: Desired transcription output
        epsilon: L-inf perturbation bound
    """
    delta = torch.zeros_like(source_audio, requires_grad=True)
 
    # Encode target text to token IDs
    target_ids = model.tokenizer.encode(target_text)
    target_ids = torch.tensor([target_ids])
 
    optimizer = torch.optim.Adam([delta], lr=step_size)
 
    for step in range(num_steps):
        adv_audio = source_audio + delta
 
        # Forward pass through ASR model
        mel = model.compute_mel(adv_audio)
        logits = model.forward(mel, target_ids[:, :-1])
 
        # CTC or cross-entropy loss with target
        loss = torch.nn.functional.cross_entropy(
            logits.view(-1, logits.size(-1)),
            target_ids[:, 1:].reshape(-1)
        )
 
        optimizer.zero_grad()
        loss.backward()
        optimizer.step()
 
        # Project to epsilon ball
        with torch.no_grad():
            delta.data = torch.clamp(delta.data, -epsilon, epsilon)
            # Ensure valid audio range
            delta.data = torch.clamp(
                source_audio + delta.data, -1, 1
            ) - source_audio
 
    return (source_audio + delta).detach()

def mix_hidden_command(
    meeting_audio: np.ndarray,
    command_audio: np.ndarray,
    injection_time: float,  # seconds
    sample_rate: int = 16000,
    snr_db: float = -20  # Command 20dB below meeting audio
) -> np.ndarray:
    """
    Mix a hidden command into meeting audio at low volume.
 
    At -20dB SNR, the command is barely audible to humans
    but may be picked up by sensitive ASR systems.
    """
    # Calculate injection sample position
    inject_start = int(injection_time * sample_rate)
    inject_end = inject_start + len(command_audio)
 
    # Scale command audio to desired SNR
    signal_power = np.mean(meeting_audio[inject_start:inject_end] ** 2)
    noise_power = signal_power * (10 ** (-snr_db / 10))
    current_power = np.mean(command_audio ** 2)
    scaling = np.sqrt(noise_power / (current_power + 1e-10))
 
    result = meeting_audio.copy()
    result[inject_start:inject_end] += command_audio * scaling
 
    return np.clip(result, -1, 1)