  In this paper, we investigate the impact of different standard environmental
sound representations (spectrograms) on the recognition performance and
adversarial attack robustness of a victim residual convolutional neural
network. Averaged over various experiments on three benchmarking environmental
sound datasets, we found the ResNet-18 model outperforms other deep learning
architectures such as GoogLeNet and AlexNet both in terms of classification
accuracy and the number of training parameters. Therefore we set this model as
our front-end classifier for subsequent investigations. Herein, we measure the
impact of different settings required for generating more informative
mel-frequency cepstral coefficient (MFCC), short-time Fourier transform (STFT),
and discrete wavelet transform (DWT) representations on our front-end model.
This measurement involves comparing the classification performance over the
adversarial robustness. On the balance of average budgets allocated by
adversary and the cost of attack, we demonstrate an inverse relationship
between recognition accuracy and model robustness against six attack
algorithms. Moreover, our experimental results show that while the ResNet-18
model trained on DWT spectrograms achieves the highest recognition accuracy,
attacking this model is relatively more costly for the adversary compared to
other 2D representations.
