  Automatic speech recognition (ASR) systems can be fooled via targeted
adversarial examples, which induce the ASR to produce arbitrary transcriptions
in response to altered audio signals. However, state-of-the-art adversarial
examples typically have to be fed into the ASR system directly, and are not
successful when played in a room. The few published over-the-air adversarial
examples fall into one of three categories: they are either handcrafted
examples, they are so conspicuous that human listeners can easily recognize the
target transcription once they are alerted to its content, or they require
precise information about the room where the attack takes place, and are hence
not transferable to other rooms. In this paper, we demonstrate the first
algorithm that produces generic adversarial examples, which remain robust in an
over-the-air attack that is not adapted to the specific environment. Hence, no
prior knowledge of the room characteristics is required. Instead, we use room
impulse responses (RIRs) to compute robust adversarial examples for arbitrary
room characteristics and employ the ASR system Kaldi to demonstrate the attack.
Further, our algorithm can utilize psychoacoustic methods to hide changes of
the original audio signal below the human thresholds of hearing. In practical
experiments, we show that the adversarial examples work for varying room
setups, and that no direct line-of-sight between speaker and microphone is
necessary. As a result, an attacker can create inconspicuous adversarial
examples for any target transcription and apply these to arbitrary room setups
without any prior knowledge.
