語音辨識攻擊

import numpy as np
import soundfile as sf
 
def generate_ultrasonic_carrier(
    command_audio: np.ndarray,
    sample_rate: int = 44100,
    carrier_freq: float = 25000  # 超出人類聽覺
) -> np.ndarray:
    """
    將語音指令調變至超音波載波上。
 
    警告：此為簡化示範。真實超音波攻擊需仔細的
    硬體校準與訊號處理。
    """
    t = np.arange(len(command_audio)) / sample_rate
 
    # 產生載波
    carrier = np.cos(2 * np.pi * carrier_freq * t)
 
    # 振幅調變
    modulated = carrier * (1 + 0.5 * command_audio)
 
    return modulated

import torch
import torchaudio
 
def targeted_asr_attack(
    model,
    source_audio: torch.Tensor,
    target_text: str,
    epsilon: float = 0.02,  # 最大擾動振幅
    num_steps: int = 1000,
    step_size: float = 0.001
) -> torch.Tensor:
    """
    打造使 ASR 模型轉錄為 target_text 的對抗音訊。
 
    Args:
        model：ASR 模型（例如 Whisper）
        source_audio：原始音訊波形 [1, T]
        target_text：期望的轉錄輸出
        epsilon：L-inf 擾動上界
    """
    delta = torch.zeros_like(source_audio, requires_grad=True)
 
    # 將目標文字編為 token ID
    target_ids = model.tokenizer.encode(target_text)
    target_ids = torch.tensor([target_ids])
 
    optimizer = torch.optim.Adam([delta], lr=step_size)
 
    for step in range(num_steps):
        adv_audio = source_audio + delta
 
        # 前向通過 ASR 模型
        mel = model.compute_mel(adv_audio)
        logits = model.forward(mel, target_ids[:, :-1])
 
        # 以目標計算 CTC 或 cross-entropy 損失
        loss = torch.nn.functional.cross_entropy(
            logits.view(-1, logits.size(-1)),
            target_ids[:, 1:].reshape(-1)
        )
 
        optimizer.zero_grad()
        loss.backward()
        optimizer.step()
 
        # 投影至 epsilon 球
        with torch.no_grad():
            delta.data = torch.clamp(delta.data, -epsilon, epsilon)
            # 確保音訊值於合法範圍
            delta.data = torch.clamp(
                source_audio + delta.data, -1, 1
            ) - source_audio
 
    return (source_audio + delta).detach()

def mix_hidden_command(
    meeting_audio: np.ndarray,
    command_audio: np.ndarray,
    injection_time: float,  # 秒
    sample_rate: int = 16000,
    snr_db: float = -20  # 指令較會議音訊低 20dB
) -> np.ndarray:
    """
    以低音量將隱藏指令混入會議音訊。
 
    於 -20dB SNR 下，指令對人類幾乎不可聞，
    但可能被敏感的 ASR 系統擷取。
    """
    # 計算注入樣本位置
    inject_start = int(injection_time * sample_rate)
    inject_end = inject_start + len(command_audio)
 
    # 將指令音訊縮放至期望 SNR
    signal_power = np.mean(meeting_audio[inject_start:inject_end] ** 2)
    noise_power = signal_power * (10 ** (-snr_db / 10))
    current_power = np.mean(command_audio ** 2)
    scaling = np.sqrt(noise_power / (current_power + 1e-10))
 
    result = meeting_audio.copy()
    result[inject_start:inject_end] += command_audio * scaling
 
    return np.clip(result, -1, 1)