Evaluating Synthetic Command Attacks on Smart Voice Assistants

Ashish Kundu; Mustaque Ahamad; Zhengxian He

REVIEW 3 major objections 5 minor 51 references

Evaluating Synthetic Command Attacks on Smart Voice Assistants

T0 review · 3 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read An attacker with only 30 seconds of a victim's unrelated speech can synthesize commands that Amazon's voice assistant recognizes and attributes to the victim with high speaker confidence.

desk verdict Useful direct measurements of concatenative synthesis against Alexa, but the speaker-matching and scaling claims are conditional on an untested TTS-enrollment confound and a post-hoc coverage model. read the letter →

arxiv 2411.08316 v2 pith:42XCT75Q submitted 2024-11-13 cs.CR cs.SDeess.AS

Zhengxian He , Ashish Kundu , Mustaque Ahamad This is my paper · ORCID

classification cs.CRcs.SDeess.AS

keywords voiceassistantsecurityspeechsynthesisconcatenativediphoneunitselectionspeakerverificationbiometricsadversarialcommandsAmazonAlexa

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Voice assistants are increasingly trusted with sensitive actions, and they defend those actions by matching the command's speaker to an authorized user's voice profile. This paper asks whether an attacker who harvests a person's speech from podcasts, videos, or robocalls—speech that has nothing to do with assistant commands—can synthesize commands that pass that voice check. Using a lightweight unit-selection synthesizer that stitches together diphone fragments, the authors find that 93.8% of synthesized commands are correctly recognized by Amazon Alexa and that the highest speaker-confidence score is returned for 19 of 20 user profiles. They further estimate that 50% of commands succeed with only 30 seconds of unrelated target speech, rising to 80% with four minutes, even when applications demand high confidence. The conclusion is that voice-profile matching, as currently implemented, offers little protection against this low-cost, large-scale attack.

What carries the argument

The load-bearing mechanism is unit-selection concatenative speech synthesis built on diphones, where a diphone is the transition between the last half of one phoneme and the first half of the next, with silence treated as a phoneme for word boundaries. A forced-alignment toolkit locates word and phoneme boundaries in the victim's speech; the synthesizer then cuts each needed diphone in the middle of the phoneme and concatenates the units to render a command. When the victim's audio lacks a required diphone, the system substitutes the same diphone from a donor profile of the same gender, chosen as the best-performing donor in cross-profile experiments. The evaluation harness is a custom Skill running on Amazon's Skill Developer Test Platform, which returns the recognized intent and a speaker-confidence level (0, 100, 200, 300) that a Skill can use to decide whether to honor the command.

What would settle it

Play the same nine synthesized commands to a physical Alexa device connected to a Skill that demands a specific confidence threshold and performs a genuine sensitive action, using commands built from 30 seconds and 4 minutes of the victim's speech collected in a real room; if fewer than 50% and 80% of the commands respectively pass the threshold, or if the confidence scores returned differ materially from those observed on the developer platform, the model-based scaling claims are empirically refuted.

Watch

Extended reading notes

Core claim

The central discovery is that an attacker does not need neural text-to-speech or voice cloning to defeat voice-based access control on a smart assistant. A basic unit-selection synthesizer that extracts diphones—the audio transitions between adjacent phonemes—from a victim's unrelated speech and concatenates the units needed to render a command achieves 93.8% intent recognition across nine commands and twenty user profiles on Amazon Alexa, and a speaker-confidence level of 300 (the maximum) for 19 of those profiles. When the victim's speech covers only part of the required diphones, missing units can be drawn from another speaker of the same gender; under that partial-coverage model, roughly half of commands succeed with 30 seconds of target speech and 80% succeed with four minutes, even when Skills require high speaker confidence. The attack also runs with a small footprint: about 34 MB of code and data versus 158 MB for a neural TTS alternative, with lower CPU and memory use while synthesizing.

Load-bearing premise

The headline scaling numbers—50% success from 30 seconds and 80% from four minutes—rest on a simulation that assumes the attacker always obtains the most frequent diphones, can fill every gap from a well-chosen same-gender donor, converts speech to diphones at 750 per minute, and can judge success from the speaker-confidence score alone rather than from executing a sensitive action on a real device.

Editorial extensions

If this is right

Voice-profile matching as currently deployed on Alexa does not reliably separate concatenated synthetic commands from an authorized user's voice, so Skills that rely on it alone for sensitive actions are exposed.
An attacker who harvests a small amount of unrelated speech—podcasts, videos, robocall recordings—can generate commands for sensitive actions such as unlocking a car or querying a bank account without any neural TTS infrastructure.
Because the synthesis method is light on memory, CPU, and network download, it can run on a compromised device sitting near the assistant, staying under the radar of common resource-monitoring defenses.
Short commands remain intelligible even at 20% diphone coverage, so the attack is most reliable for short high-value commands; longer commands degrade when coverage is low.
The same technique should transfer to other voice assistants that use similar speaker-similarity scoring, although only Alexa was tested.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The 30-second and four-minute success rates are extrapolations from a diphone-coverage model plus a fixed rate of 750 diphones per minute of speech; a direct end-to-end test on a physical device would be needed to confirm them, since the testbed routed audio internally without traversing a real room.
The partial-coverage results define success by the speaker-confidence score alone and do not exercise an application's full authorization flow, so real-world Skills with additional steps (PINs, out-of-band confirmation) could raise the effective bar.
The donor-substitution result suggests a stronger threat than the headline: even with no victim speech at all, the best-matching same-gender donor profile already achieved high confidence in cross-profile experiments, implying the voice check may be learnable from a look-alike voice.
A natural extension would be to test whether the current version of the same technique defeats liveness or anti-spoofing checks that distinguish human speech from concatenated audio.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

The paper has one genuinely useful core: a large automated testbed that measures both command intelligibility and Alexa's speaker-confidence output across 20 profiles. The direct result that a simple diphone-concatenation synthesizer achieves 93.8% intent recognition (169/180) is credible and worth knowing. The same goes for the observation that the unit-selection method gets a 300 confidence score on 19 of 20 profiles when the profile is set up with a synthetic voice. That is a concrete, reproducible experiment.

But the headline claims go further than the evidence. The stress-test note is right: profiles are enrolled using VITS TTS, not the victim's real speech. That means the '19/20 at 300' result is specific to a synthetic enrollment. A real attacker faces a profile enrolled from natural speech, and Alexa's similarity model may behave very differently when both enrollment and probe are natural or when only the probe is synthetic. The paper never runs that control, and the Limitations section doesn't mention it. The abstract's claims about 'voice profile matching provides little protection' are therefore not established for real deployments.

The 50%/80% scaling numbers also rest on a simulation that is optimistic in several ways. Section 6.2 assumes the attacker gets the p most frequent diphones from the target, and missing diphones are filled from the empirically best donor profiles (p288, p360) chosen because they gave the highest confidence in Fig. 7. That is post-hoc selection. The success definition in 6.4.3 is vague—they show confidence distributions but never state a threshold that counts as 'passing the speaker match.' And the '30 seconds' figure depends on a 750 diphones/minute conversion rate estimated from Figure 4. So treat those numbers as model estimates, not measurements.

The writing is clear and the resource-footprint comparison (Table 2) is a useful addition. The authors are upfront about the test platform and not testing other assistants, but they miss the enrollment confound, which is the biggest soft spot.

Who should read this: voice assistant security researchers and anyone working on robustness of speaker verification. It deserves a serious referee, because the testbed and the direct measurements are worth having, but the paper needs major revision: add a natural-speech enrollment control, specify the confidence threshold for success, and either validate the partial-coverage model end-to-end or soften the scaling claims.

Recommendation: send it to review, but expect heavy revision. I would not cite the scaling numbers without a big caveat; the intelligibility and confidence-matrix data are citable as-is.

Referee Report

3 major / 5 minor

Summary. This paper investigates whether low-cost unit-selection concatenative speech synthesis can generate voice commands that are recognized by Amazon Alexa and pass voice-similarity checks. The authors built a testbed on the Alexa Skill Developer Test Platform, set up profiles for 20 VCTK speakers using Coqui TTS VITS, synthesized nine attack commands from diphones extracted from VCTK speech, and measured intent recognition and speaker-confidence scores. They report 93.8% intelligibility (169/180), confidence level 300 for 19 of 20 profiles, and, via a diphone-coverage model, success rates of 50% with 30 seconds of speech and 80% with 4 minutes. They also compare the computational and network footprints of their method against Coqui TTS.

Significance. The study addresses an important security question and provides a substantial empirical dataset with an automated testbed. The direct measurements of command intelligibility and speaker similarity under the authors' specific testbed conditions are concrete, and the resource-footprint comparison is a useful practical contribution. However, the central claims about the weakness of voice-profile matching in real deployments rest on two assumptions that are not fully validated: profiles are enrolled with synthetic TTS speech rather than natural user speech, and the partial-coverage success rates are model extrapolations rather than directly measured outcomes. If these issues are resolved with additional experiments or careful reframing, the paper would be a valuable contribution to the voice-assistant security literature.

major comments (3)

[Section 4.1, Section 6.1.2, Fig. 7] The victim profiles are enrolled using Coqui TTS VITS synthetic speech (Section 4.1: 'to avoid privacy concerns related to voice-biometric data, we chose a well-trained and high quality text-to-speech (TTS) system to generate commands to set up a victim profile'), while the attack commands are concatenations of original VCTK audio (Section 4.3). Figure 7 therefore measures similarity between concatenated natural speech and a synthetic enrollment, not between an attacker's audio and a real user's enrolled voice. The high confidence values (300 for 19 of 20 profiles) could be an artifact of the enrollment being TTS-generated; a real attacker faces a profile enrolled from the victim's natural speech. The authors should add a control experiment in which profiles are enrolled from natural VCTK utterances (or from the same concatenative method) and show that the high confidence scores persist. Without this control, the central claim that 'voice profile matching provides little protection' (Section 8) is not established for real deployments.
[Section 6.2, Section 6.4.3, Fig. 8, abstract] The headline scaling claims (50% success with 30 seconds of unrelated speech, 80% with 4 minutes) are not direct measurements. They are derived from a partial-coverage model that assumes the attacker has the p most frequent diphones (Section 6.2) and fills every missing diphone from donor profiles p288 and p360, which were selected because they 'provide the highest average confidence level in Fig. 7' (Section 6.4.3). Thus the attack success rates are effectively fit to the same experimental data used to choose the donors, making the 50% and 80% figures a best-case simulation rather than a validated prediction. The authors should either validate the partial-coverage model on held-out speakers and commands, or explicitly label these numbers as a sensitivity analysis with clearly stated assumptions, rather than presenting them as empirical attack outcomes in the abstract.
[Section 6.4.3, Fig. 8] The success criterion for 'passing the speaker match process' is ambiguous: the paper reports confidence levels 0, 100, 200, and 300 (Section 6.3), but never states the threshold that a sensitive-action Skill would require, nor does it execute a sensitive operation end-to-end (e.g., actually invoking a bank Skill and observing a transaction). Figure 8's 'likelihood of successfully passing' the speaker match process at 20% coverage (~50%) is therefore undefined with respect to the threat model's central scenario of sensitive operations. The authors should specify the confidence threshold used to define success and justify it, or demonstrate a real Skill invocation, to make the reported success rates meaningful.

minor comments (5)

[Section 6.4.2, Fig. 7] The sentence 'when the target profile on Alexa matches the profile which is the source of an attack command, the highest confidence level is returned independent of the method used for synthesizing the command' is contradicted by the one female profile where unit-selection returns 200 while Coqui TTS returns 300; rephrase to report the exact counts rather than the current generalization.
[Section 5] The testbed uses loopback audio on the Alexa Skill Developer Test Platform rather than a physical device; this is acknowledged in Limitations, but it should also be mentioned when interpreting the intelligibility results, since microphone and echo conditions on real devices may affect recognition accuracy.
[Fig. 7] The color bar ranges from 0 to 300 but is presented as a continuous scale; since only four discrete confidence levels (0, 100, 200, 300) are observed, consider adding a discrete legend to make the matrix entries easier to interpret.
[Section 7] The statement 'We believe our results should be applicable for other voice assistants but we have not conducted similar experiments with them' is an unsupported generalization; either provide a reasoned argument for transferability or soften the claim to reflect that it is a conjecture.
[Section 6.4.1, Fig. 5a] The text says 'for five of the ten male user profiles, intent for all 9 commands are correctly identified. For the other four profiles, the intent for only one command is missed' — this accounts for only 9 of 10 profiles; please correct the count or the description of the remaining profile.

Circularity Check

1 steps flagged · score 6.0 of 10

Partial-coverage success rates (50% from 30 seconds, 80% from 4 minutes) are fitted to the data: the donor profiles used to fill missing diphones are chosen because they already achieved the highest confidence in the same measurement being predicted, and the coverage model assumes the attacker receives the most frequent diphones.

fitted input called prediction [Section 6.4.3 (Confidence Level Analysis for Different Diphone Coverage), building on Section 6.4.1 and the abstract's 30-second / 4-minute success claims]
"In our experiments, we used diphones from profile p288 for female and profile p360 for male targets as they provide the highest average confidence level in Fig. 7 when they are used to synthesize attack commands for the profiles of each gender. ... The results suggest that even with a relatively modest 20% coverage of the target's diphones, the likelihood of successfully passing the speaker match process remains about 50% with synthetic commands."

The donor profile used to supply missing diphones is selected precisely because it produced the highest confidence level, which is the outcome variable that the partial-coverage experiments then report as attack success. The same in-sample best donors (p288 and p360) are reused in Section 6.4.1 and feed the abstract's 50%/80% figures. In addition, Section 6.2 assumes the attacker obtains the most frequent diphones at any coverage level ('the diphones are ordered by popularity and the top half are chosen'), i.e., the best possible subset of target speech. Thus the headline limited-speech 'predictions' are conditional on fitted, best-case choices rather than being independent predictions.

full rationale

The full-coverage core measurements are genuine experiments and not circular: command intelligibility (93.8%, Section 6.4.1) and the 19-of-20 profiles receiving confidence 300 (Section 6.4.2) are direct testbed observations. The circularity is confined to the limited-speech extrapolation, where the attacker is assumed to have the most frequent diphones and missing diphones are filled from the empirically best-performing donor profiles chosen by looking at the same confidence matrix being used to define success. Because those donor choices and frequency assumptions are inputs selected to maximize the measured outcome, the resulting 50%-at-30-seconds and 80%-at-4-minutes claims in the abstract reduce to scenario assumptions rather than independent findings. Two non-circular correctness concerns are noted for context: the abstract's 30-second claim is hard to reconcile with Fig. 4 (50% diphone coverage requires roughly 2-4 minutes) and with the Section 7 limitation that 'target speech that is several minutes long will be required' for high confidence; and the abstract says the highest confidence was returned for '90%' of users while the body reports 19 of 20 (95%). The enrollment of profiles with Coqui TTS synthetic speech rather than the target's natural voice is an external-validity confound, but it is not circular because the similarity measurement is still an empirical comparison. Self-citations (e.g., reference [13]) are not load-bearing for the central claims.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The paper's central scaling claims depend on several modeled quantities: the 750-diphone-per-minute conversion, the availability of the most frequent diphones under partial coverage, and the choice of the best same-gender donor profiles for substitution. The enrollment-via-TTS and test-platform representativeness are additional domain assumptions. No new physical or algorithmic entities are posited.

free parameters (4)

diphones-per-minute estimate = 750
Used in Fig. 4 to convert diphone coverage into audio length, which feeds the 30-second and 4-minute claims in the abstract.
partial-coverage availability rule = top p% most frequent diphones
Section 6.2: when coverage is p%, the p% most frequent diphones from the target's speech are assumed available; this is an optimistic attacker model not validated by actual truncated recordings.
best donor profiles for substitution = p288 (female), p360 (male)
Section 6.4.3: these profiles were chosen because they provided the highest average confidence level in the cross-attack experiments, a post-hoc selection that inflates reported success.
success confidence threshold = not explicitly stated (likely 300 or >=200)
The abstract's 'successfully activate' is not tied to an explicit confidence threshold or an end-to-end Skill authorization flow in the paper.

assumptions (5)

domain assumption An attacker can compromise a device near the target's voice assistant and use its speaker, microphone, and computation.
Section 3 threat model states this as the attack enabler.
domain assumption Unrelated speech of targets is practically harvestable from public sources or robocalls.
Section 3.1 assumes podcast, YouTube, lecture, and robocall collection.
domain assumption The Alexa Skill Developer Test Platform's intent recognition and speaker-confidence outputs are representative of real Echo devices.
Section 5 uses the test platform with loopback audio; Section 7 acknowledges no physical-device experiments were run.
domain assumption Speaker profiles enrolled with TTS-generated voices behave like profiles enrolled with real user speech.
Section 4.1 sets up profiles using Coqui TTS VITS output, while attack commands use natural VCTK recordings, so enrollment and attack voices come from different generation paths.
standard math Forced alignment and diphone segmentation via MFA preserve the phonetic content needed for concatenative synthesis.
Section 4.2 relies on MFA timing; this is a standard tooling assumption.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Evaluating Synthetic Command Attacks on Smart Voice Assistants." pith.science (2026). https://pith.science/paper/42XCT75Q

@misc{pith2026241108316,
  author       = {Pith},
  title        = {Pith review of: Evaluating Synthetic Command Attacks on Smart Voice Assistants},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/42XCT75Q}},
  note         = {Machine review of arXiv:2411.08316}
}

read the original abstract

Recent advances in voice synthesis, coupled with the ease with which speech can be harvested for millions of people, introduce new threats to applications that are enabled by devices such as voice assistants (e.g., Amazon Alexa, Google Home etc.). We explore if unrelated and limited amount of speech from a target can be used to synthesize commands for a voice assistant like Amazon Alexa. More specifically, we investigate attacks on voice assistants with synthetic commands when they match command sources to authorized users, and applications (e.g., Alexa Skills) process commands only when their source is an authorized user with a chosen confidence level. We demonstrate that even simple concatenative speech synthesis can be used by an attacker to command voice assistants to perform sensitive operations. We also show that such attacks, when launched by exploiting compromised devices in the vicinity of voice assistants, can have relatively small host and network footprint. Our results demonstrate the need for better defenses against synthetic malicious commands that could target voice assistants.

Figures

Figures reproduced from arXiv: 2411.08316 by the authors.

**Figure 2.** Unit-Selection Synthesis. 5 SYSTEM ARCHITECTURE AND IMPLEMENTATION The task of evaluating whether a command generated with our approach is processed by a voice assistant with a certain user profile presents a scale challenge due to the large number of experiments necessary to cover many commands and user profiles. To address this challenge, we develop an automated system for running our experiments. We chose the Al… view at source ↗

**Figure 3.** Automated process for evaluating attack efficacy for synthetic commands. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

**Figure 4.** Average Audio Lengths in Seconds for Different [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗

Figures from the paper (4 more)

**Figure 5.** Figure 5: Synthesized Command intelligibility analysis. [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

**Figure 6.** Figure 6: Word Error Rate in Command Transcripts. Coqui TTS and Fig. 7b shows the same when the commands are synthesized with the unit-selection method. Fig. 7d and 7e show the same results for male profiles. Our results show that when the target profile on Alexa matches the pro…

**Figure 7.** Figure 7: Profile Similarity Analysis. methods. This is visually shown in Fig. 7c and 7f. For 180 cases across all profiles for both genders, when the target profile is different from the command source profile, we have exact match for the two methods for 112, and the confidenc…

**Figure 8.** Figure 8: Diphone Percentage and Confidence Level. [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

51 extracted references · 46 canonical work pages

[1]

How malware can infect your PC

2018. How malware can infect your PC. https://support.microsoft.com/en- us/help/4466968/windows-10-how-malware-can-infect-your-pc

work page arXiv 2018
[2]

Hadi Abdullah, Washington Garcia, Christian Peeters, Patrick Traynor, Kevin R B Butler, and Joseph Wilson. 2018. Practical Hidden Voice Attacks against Speech and Speaker Recognition Systems. In Network and Distributed System Security Symposium. Internet Society, Reston, VA, 1–15

work page 2018
[3]

Amazon Alexa. 2023. Create Intents, Utterances, and Slots . https: //developer.amazon.com/en-US/docs/alexa/custom-skills/create-intents- utterances-and-slots.html Alexa Skills Kit

work page 2023
[4]

Logan Blue, Luis Vargas, and Patrick Traynor. 2018. Hello, Is It Me You’re Looking For?: Differentiating Between Human and Electronic Speakers for Voice Interface Security. InProceedings of the 11th ACM Conference on Security & Privacy in Wireless and Mobile Networks . ACM, 123–133

work page 2018
[5]

Nicholas Carlini, Pratyush Mishra, Tavish Vaidya, Yuankai Zhang, Micah Sherr, Clay Shields, David A Wagner 0001, and Wenchao Zhou. 2016. Hidden Voice Commands. USENIX Security Symposium (2016)

work page 2016
[6]

Nicholas Carlini and David Wagner. 2018. Audio Adversarial Examples: Targeted Attacks on Speech-to-Text. arXiv.org (Jan. 2018). arXiv:1801.01944v2 [cs.LG]

arXiv 2018
[7]

Papers With Code. 2023. Papers with Code - LJSpeech Benchmark (Text-To- Speech Synthesis). https://paperswithcode.com/sota/text-to-speech-synthesis- on-ljspeech The current state-of-the-art on LJSpeech is NaturalSpeech. See a full comparison of 15 papers with code

work page 2023
[8]

Coqui. 2023. Coqui: A New Way to Do Voice Overs. Available from: https: //coqui.ai/

work page 2023

Show all 51 references

[9]

Donghui Dai, Zhenlin An, and Lei Yang. 2022. Inducing wireless chargers to voice out for inaudible command attacks. In 2023 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 503–520

2022
[10]

Hossein B Darbandi. 2002. Speech recognition & diphone extraction for natural speech synthesis. Ph. D. Dissertation. University of British Columbia

2002
[11]

Wenrui Diao, Xiangyu Liu, Zhe Zhou, and Kehuan Zhang. 2014. Your voice assis- tant is mine: How to abuse speakers to steal information and control your phone. In Proceedings of the 4th ACM Workshop on Security and Privacy in Smartphones & Mobile Devices. ACM, 63–74

2014
[12]

Adam Gabryś, Goeric Huybrechts, Manuel Sam Ribeiro, Chung-Ming Chien, Ju- lian Roth, Giulia Comini, Roberto Barra-Chicote, Bartek Perz, and Jaime Lorenzo- Trueba. 2022. Voice Filter: Few-shot text-to-speech speaker adaptation using voice conversion as a post-processing module....

2022
[13]

Zhengxian He, Mohit Narayan Rajput, and Mustaque Ahamad. 2021. Compro- mised computers meet voice assistants: Stealthily exfiltrating data as voice over telephony. In 2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) . IEEE, 519–530

2021
[14]

Goeric Huybrechts, Thomas Merritt, Giulia Comini, Bartek Perz, Raahil Shah, and Jaime Lorenzo-Trueba. 2021. Low-resource expressive text-to-speech using data augmentation. In ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . I...

2021
[15]

ElevenLabs Inc. 2023. High Quality AI Voice Cloning. Available from: https: //elevenlabs.io/voice-cloning

2023
[16]

Yeongjin Jang, Chengyu Song, Simon P Chung, Tielei Wang, and Wenke Lee
[17]

Andre Kassis and Urs Hengartner. 2023. Breaking Security-Critical Voice Authen- tication. In 2023 IEEE Symposium on Security and Privacy (SP) . IEEE Computer Society, 951–968

2023
[18]

Jaehyeon Kim, Jungil Kong, and Juhee Son. 2021. Conditional variational autoen- coder with adversarial learning for end-to-end text-to-speech. In International Conference on Machine Learning . PMLR, 5530–5540

2021
[19]

Deepak Kumar, Riccardo Paccagnella, Paul Murley, Eric Hennenfent, Joshua Mason, Adam Bates, and Michael Bailey. 2018. Skill squatting attacks on Amazon Alexa. In 27th USENIX Security Symposium (USENIX Security 18) . 33–47

2018
[20]

Kevin A Lenzo and Alan W Black. 2000. Diphone collection and synthesis.. In INTERSPEECH. 306–309

2000
[21]

Jingyi Li, Weiping Tu, and Li Xiao. 2023. Freevc: Towards High-Quality Text-Free One-Shot Voice Conversion. In ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . IEEE, 1–5

2023
[22]

Zhuohang Li, Cong Shi, Yi Xie, Jian Liu, Bo Yuan, and Yingying Chen. 2020. Practical adversarial attacks against speaker recognition systems. In Proceedings of the 21st international workshop on mobile computing systems and applications . 9–14

2020
[23]

Barry Libert and Megan Beck. 2017. AI May Soon Replace Even the Most Elite Consultants. https://hbr.org/2017/07/ai-may-soon-replace-even-the-most-elite- consultants

2017
[24]

Mirko Marras, Pawel Korus, Nasir D Memon, and Gianni Fenu. 2019. Adversarial Optimization for Dictionary Attacks on Speaker Verification.. In Interspeech. 2913–2917

2019
[25]

Michael McAuliffe, Michaela Socolof, Sarah Mihuc, Michael Wagner, and Mor- gan Sonderegger. 2017. Montreal Forced Aligner: Trainable Text-Speech Align- ment Using Kaldi. In Proc. Interspeech 2017. 498–502. https://doi.org/10.21437/ Interspeech.2017-1386

2017
[26]

Microsoft. 2023. Test accuracy of a Custom Speech model - Speech service - Azure AI services. https://learn.microsoft.com/en-us/azure/ai-services/speech- service/how-to-custom-speech-evaluate-data?pivots=speech-studio Accessed: 2023-07-25

2023
[27]

Taiki Nakamura, Yuki Saito, Shinnosuke Takamichi, Yusuke Ijima, and Hiroshi Saruwatari. 2019. V2S attack: building DNN-based voice conversion from auto- matic speaker verification. arXiv preprint arXiv:1908.01454 (2019)

2019 arXiv
[28]

Douglas O’Shaughnessy, Louis Barbeau, David Bernardi, and Danièle Archam- bault. 1988. Diphone speech synthesis. Speech Communication 7, 1 (1988), 55–65. https://doi.org/10.1016/0167-6393(88)90021-0

1988 doi
[29]

Yao Qin, Nicholas Carlini, Garrison Cottrell, Ian Goodfellow, and Colin Raffel
[30]

Nirupam Roy, Sheng Shen, Haitham Hassanieh, and Romit Roy Choudhury. 2018. Inaudible Voice Commands: The Long-Range Attack and Defense. In the 15th USENIX Symposium on Networked Systems Design and Implementation . Renton, 546–560

2018
[31]

Yuki Saito, Shinnosuke Takamichi, and Hiroshi Saruwatari. 2017. Statistical parametric speech synthesis incorporating generative adversarial networks. IEEE/ACM Transactions on Audio, Speech, and Language Processing 26, 1 (2017), 84–96

2017
[32]

Yuki Saito, Shinnosuke Takamichi, and Hiroshi Saruwatari. 2017. Training algorithm to deceive anti-spoofing verification for DNN-based speech synthesis. In 2017 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 4900–4904

2017
[33]

Karen Scarfone and Peter Mell. 2012. Guide to intrusion detection and prevention systems (idps). Technical Report. National Institute of Standards and Technology

2012
[34]

Lea Schönherr, Katharina Kohls, Steffen Zeiler, Thorsten Holz, and Dorothea Kolossa. 2018. Adversarial attacks against automatic speech recognition systems via psychoacoustic hiding. arXiv preprint arXiv:1808.05665 (2018)

2018 arXiv
[35]

Faysal Hossain Shezan, Hang Hu, Jiamin Wang, Gang Wang, and Yuan Tian. 2020. Read between the lines: An empirical measurement of sensitive applications of voice personal assistant systems. In Proceedings of the Web Conference 2020 . 1006–1017

2020
[36]

Xu Tan, Tao Qin, Frank Soong, and Tie-Yan Liu. 2021. A survey on neural speech synthesis. arXiv preprint arXiv:2106.15561 (2021)

2021 arXiv
[37]

Xiaohai Tian, Rohan Kumar Das, and Haizhou Li. 2020. Black-box Attacks on Automatic Speaker Verification using Feedback-controlled Voice Conversion. In Proc. The Speaker and Language Recognition Workshop (Odyssey 2020) . 159–164. https://doi.org/10.21437/Odyssey.2020-23

2020 doi
[38]

Christophe Veaux, Junichi Yamagishi, Kirsten MacDonald, et al . 2017. CSTR VCTK corpus: English multi-speaker corpus for CSTR voice cloning toolkit. University of Edinburgh. The Centre for Speech Technology Research (CSTR) 6 (2017), 15

2017
[39]

Brandon Vigliarolo. 2017. Crestron, Amazon partner to bring Alexa to meet- ing rooms. https://www.techrepublic.com/article/crestron-amazon-partner-to- bring-alexa-to-meeting-rooms/

2017
[40]

Chengyi Wang, Sanyuan Chen, Yu Wu, Ziqiang Zhang, Long Zhou, Shujie Liu, Zhuo Chen, Yanqing Liu, Huaming Wang, Jinyu Li, Lei He, Sheng Zhao, and Furu Wei. 2023. Neural Codec Language Models are Zero-Shot Text to Speech Synthesizers. arXiv

2023
[41]

Wikipedia contributors. 2022. ARPABET — Wikipedia, The Free Encyclope- dia. https://en.wikipedia.org/w/index.php?title=ARPABET&oldid=1103994253 [Online; accessed 9-May-2024]

2022
[42]

Yi Xie, Cong Shi, Zhuohang Li, Jian Liu, Yingying Chen, and Bo Yuan. 2020. Real-time, universal, and robust adversarial attacks against speaker recognition systems. In ICASSP 2020-2020 IEEE international conference on acoustics, speech and signal processing (ICASSP) . IEEE, 1738–1742

2020
[43]

Jin Xu, Xu Tan, Yi Ren, Tao Qin, Jian Li, Sheng Zhao, and Tie-Yan Liu. 2020. Lrspeech: Extremely low-resource speech synthesis and recognition. In Proceed- ings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining. 2802–2812

2020
[44]

Junichi Yamagishi, Christophe Veaux, and Kirsten MacDonald. 2019. CSTR VCTK Corpus: English Multi-speaker Corpus for CSTR Voice Cloning Toolkit (version 0.92). https://doi.org/10.7488/ds/2645

2019 doi
[45]

Chen Yan, Xiaoyu Ji, Kai Wang, Qinhong Jiang, Zizhi Jin, and Wenyuan Xu
[46]

Qiben Yan, Kehai Liu, Qin Zhou, Hanqing Guo, and Ning Zhang. 2020. Surfin- gAttack: Interactive Hidden Attack on Voice Assistants Using Ultrasonic Guided Waves. In Network and Distributed System Security Symposium . Internet Society, Reston, VA, 1–18. 11 Zhengxian He, Ashish K...

2020
[47]

Xuejing Yuan, Yuxuan Chen, Yue Zhao, Yunhui Long, Xiaokang Liu, Kai Chen, Shengzhi Zhang, Heqing Huang, Xiaofeng Wang, and Carl A Gunter. 2018. Com- manderSong: A Systematic Approach for Practical Adversarial Voice Recognition. In the 27th USENIX Security Symposium . 1–17

2018
[48]

Guoming Zhang, Chen Yan, Xiaoyu Ji, Taimin Zhang, Tianchen Zhang, and Wenyuan Xu. 2017. DolphinAtack: Inaudible Voice Commands. In ACM Confer- ence on Computer and Communications Security . A APPENDIX ID AGE ACCENTS REGION p237 22 Scottish Fife p247 22 Scottish Argyll p251 26 ...

2017
[2014]

In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security

A11y attacks: Exploiting accessibility in operating systems. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security . ACM, 103–115

2014
[2019]

In International Conference on Machine Learning

Imperceptible, robust, and targeted adversarial examples for automatic speech recognition. In International Conference on Machine Learning. 5231–5240
[2022]

A Survey on Voice Assistant Security: Attacks and Countermeasures.ACM Comput. Surv. 55, 4, Article 84 (nov 2022), 36 pages. https://doi.org/10.1145/ 3527153

2022

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.

[1] [1]

How malware can infect your PC

2018. How malware can infect your PC. https://support.microsoft.com/en- us/help/4466968/windows-10-how-malware-can-infect-your-pc

work page arXiv 2018

[2] [2]

Hadi Abdullah, Washington Garcia, Christian Peeters, Patrick Traynor, Kevin R B Butler, and Joseph Wilson. 2018. Practical Hidden Voice Attacks against Speech and Speaker Recognition Systems. In Network and Distributed System Security Symposium. Internet Society, Reston, VA, 1–15

work page 2018

[3] [3]

Amazon Alexa. 2023. Create Intents, Utterances, and Slots . https: //developer.amazon.com/en-US/docs/alexa/custom-skills/create-intents- utterances-and-slots.html Alexa Skills Kit

work page 2023

[4] [4]

Logan Blue, Luis Vargas, and Patrick Traynor. 2018. Hello, Is It Me You’re Looking For?: Differentiating Between Human and Electronic Speakers for Voice Interface Security. InProceedings of the 11th ACM Conference on Security & Privacy in Wireless and Mobile Networks . ACM, 123–133

work page 2018

[5] [5]

Nicholas Carlini, Pratyush Mishra, Tavish Vaidya, Yuankai Zhang, Micah Sherr, Clay Shields, David A Wagner 0001, and Wenchao Zhou. 2016. Hidden Voice Commands. USENIX Security Symposium (2016)

work page 2016

[6] [6]

Nicholas Carlini and David Wagner. 2018. Audio Adversarial Examples: Targeted Attacks on Speech-to-Text. arXiv.org (Jan. 2018). arXiv:1801.01944v2 [cs.LG]

arXiv 2018

[7] [7]

Papers With Code. 2023. Papers with Code - LJSpeech Benchmark (Text-To- Speech Synthesis). https://paperswithcode.com/sota/text-to-speech-synthesis- on-ljspeech The current state-of-the-art on LJSpeech is NaturalSpeech. See a full comparison of 15 papers with code

work page 2023

[8] [8]

Coqui. 2023. Coqui: A New Way to Do Voice Overs. Available from: https: //coqui.ai/

work page 2023