Generative Testing of Automated Speech Recognition Systems

Technical Summary: Generative Testing of Automated Speech Recognition Systems (GATAS)

Problem Statement
Automatic Speech Recognition (ASR) systems, particularly those based on transformer architectures like Whisper, have achieved high accuracy suitable for critical applications. However, they remain vulnerable to adversarial manipulation. Existing testing methods face a trade-off between effectiveness and perceptual quality. White-box attacks (e.g., PGD) require gradient access, limiting their applicability to deployed systems. Black-box methods typically operate directly in the waveform space; while they can induce transcription errors, they often introduce audible distortions or "signal destruction" that renders the audio unnatural. Furthermore, many black-box approaches rely on targeted attacks (forcing a specific output), which is impractical for ASR due to open vocabularies and variable-length outputs. There is a lack of black-box testing strategies that can generate failure-inducing inputs which are both semantically divergent and perceptually natural.

Methodology: GATAS
The paper proposes GATAS (Generative Testing of Automatic Speech Recognition Systems), a black-box testing approach that operates within the phoneme-level latent space of a Text-to-Speech (TTS) model rather than the raw waveform domain.

• Core Mechanism: GATAS utilizes a TTS model (specifically StyleTTS2) which represents speech as phoneme-level embedding vectors. Instead of perturbing the audio waveform directly, the method interpolates between the ground-truth phoneme embeddings ($h_{text}^{GT}$) and a noise reference ($h_{noise}$).
• Perturbation Control: The interpolation is controlled by a per-phoneme scalar weight vector $\kappa \in [0, 1]^p$. The perturbed embedding is calculated as $h'_{text} = (1 - \kappa) \odot h_{text}^{GT} + \kappa \odot h_{noise}$. This reduces the search space dimensionality from $512 \times p$ to $p$ (where $p$ is the number of phonemes) while allowing fine-grained control over individual phonemes.
• Optimization: The test generation is formulated as a multi-objective optimization problem using a gradient-free evolutionary algorithm (NSGA-II). The two competing objectives are:
  1. Semantic Divergence: Measured by SetOverlap, which calculates the fraction of content words (after stop-word removal and lemmatization) preserved between the ground truth and the ASR transcription. The goal is to minimize this (induce divergence).
  2. Perceptual Similarity: Measured by PESQ (Perceptual Evaluation of Speech Quality), which assesses the audio quality relative to the original. The goal is to maximize this (minimize distortion).
• Untargeted Formulation: Unlike many prior attacks, GATAS is untargeted; it seeks any semantically meaningful deviation from the original transcription, avoiding the difficulty of converging to a specific, arbitrary target phrase.

Key Contributions

1. Novel Approach: Introduction of GATAS, a black-box testing method that operates in the TTS latent space to generate natural-sounding audio that induces ASR transcription errors.
2. Methodological Formulation: Framing test generation as a multi-objective optimization problem that explicitly balances semantic divergence against perceptual imperceptibility, enabling the discovery of realistic test cases.
3. Empirical Validation: A comprehensive evaluation against both black-box (WavefoRm, SMACK) and white-box (PGD) baselines using the Harvard Sentences corpus and the Whisper ASR system.

Results
The empirical study demonstrates that GATAS achieves a high success rate while significantly outperforming baselines in audio quality:

• Effectiveness: GATAS achieved a 98% success rate in inducing transcription changes, comparable to the white-box PGD (100%) and the black-box WavefoRm (99%).
• Audio Quality: GATAS produced the highest perceptual quality among black-box methods and surpassed the white-box PGD in technical quality ratings.
  • UTMOS (Naturalness): GATAS scored 4.466, outperforming WavefoRm (2.108) and SMACK (2.101), and slightly exceeding PGD (4.443).
  • Distortion: GATAS introduced the lowest distortion in both spectrogram distance ($d_F$-Spec: 0.017) and character-level differences ($d_C$-Raw: 0.047).
• Human Evaluation: In a study with 10 participants, GATAS received a mean technical quality rating of 4.81 (vs. 4.92 for ground truth) and a semantic quality rating of 3.86 (vs. 4.01 for ground truth). In contrast, waveform-based baselines (WavefoRm, SMACK) received scores below 1.5 for both metrics, indicating severe degradation.
• Efficiency: While GATAS required a higher query budget (~5,067 queries) compared to fixed-budget baselines like SMACK (300) or PGD (200), it achieved a lower runtime than the waveform-based baseline (222s vs. 361s) due to more efficient optimization dynamics and early stopping.

Significance and Claims
The paper claims that the structural choice of the search space is more critical than access to model internals. By operating in the TTS latent space, GATAS constrains generated audio to the "manifold of natural speech," allowing semantic divergence and perceptual quality to be optimized simultaneously. In contrast, waveform-based methods treat these as conflicting objectives, often requiring signal destruction to achieve errors.

The authors conclude that representation and perceptual alignment are more critical than gradient access for generating effective ASR test cases. GATAS demonstrates that untargeted latent-space optimization can produce realistic, effective test cases that expose diverse failure modes (such as phonetic substitutions and semantic drift) without the audible artifacts typical of prior black-box attacks. This suggests that systematic testing of ASR generalization can be achieved efficiently without white-box access, provided the search is conducted within a semantically structured representation space.