  Recently, adversarial machine learning attacks have posed serious security
threats against practical audio signal classification systems, including speech
recognition, speaker recognition, and music copyright detection. Previous
studies have mainly focused on ensuring the effectiveness of attacking an audio
signal classifier via creating a small noise-like perturbation on the original
signal. It is still unclear if an attacker is able to create audio signal
perturbations that can be well perceived by human beings in addition to its
attack effectiveness. This is particularly important for music signals as they
are carefully crafted with human-enjoyable audio characteristics.
  In this work, we formulate the adversarial attack against music signals as a
new perception-aware attack framework, which integrates human study into
adversarial attack design. Specifically, we conduct a human study to quantify
the human perception with respect to a change of a music signal. We invite
human participants to rate their perceived deviation based on pairs of original
and perturbed music signals, and reverse-engineer the human perception process
by regression analysis to predict the human-perceived deviation given a
perturbed signal. The perception-aware attack is then formulated as an
optimization problem that finds an optimal perturbation signal to minimize the
prediction of perceived deviation from the regressed human perception model. We
use the perception-aware framework to design a realistic adversarial music
attack against YouTube's copyright detector. Experiments show that the
perception-aware attack produces adversarial music with significantly better
perceptual quality than prior work.
