A GAN-based Approach for Mitigating Inference Attacks in Smart Home Environment

In the context of this study, an inference attack occurs when an external party infers sensitive information from data that they have access to [20]. Deep neural networks (DNN) are widely used for various audio processing tasks which fall under two broad categories of audio analysis and audio synthesis/transformation [24]. Our study represents a borderline between these two categories where we draw a distinction between the two categories and differentiate between audio recognition and audio inference. In this study we focus on audio inference aspects whereby our target is not to recognize what was said, but what could be inferred from what was said. Fig. 1 illustrates the difference between eavesdropping and inference.

Consider a similar case scenario in which a user downloads a malicious app which exploits the ”always listening” capability of a smart device and then runs a script to infer the user’s movie preferences. This is also an example of an information leakage attack.

In our proposed solution, we utilize Generative Adversarial Networks (GANs) [25] to generate sound masking audio noise to mitigate the information leakage as a result of the machine learning-based inference. More details about the MaskGAN structure is provided in section V-D. The advantage of our proposed solution is twofold. First, GANs due to the lack of a deterministic bias [25] can generate synthetic data samples that are truly random. Our objective in this study is to investigate if the noise generated by MaskGAN can mitigate information leakage while preserving the semantics of the audio as shown in the results section VII. The second advantage is that our solution is independent of the smart home device manufacturer, vendor or solution provider and is completely within the control of the user. We ensure that the noise generated by the MaskGAN does not exceed a sound intensity of 45db which is within the comfort zone for human hearing [26].

In this study, we seek to understand the role which randomness plays in sound masking privacy preservation. We conduct experiments to determine if our GAN-based approach for generating sound masking noise signals can produce audio noise signals that exhibit more randomness compared to white noise.

Our study seeks to answer the following research questions.

1. Are GAN-generated noise samples effective for information leakage prevention in smart home environments to deter various adversaries from inferring sensitive information from user conversations?

2. Can GAN-generated noise samples be used to deter adversaries from inferring sensitive information from smart home devices, while maintaining the semantics of the audio samples?

3. Are GAN-generated noise samples more random compared to white noise? What role does randomness play in improving the ability of privacy-preserving sound masking techniques to prevent the risk of inferring sensitive information from ”always listening” smart home devices?

Our findings to these three research questions are reported in the results section VII.

Feature representation of the audio signal plays an important role in the deep learning model’s ability to infer sensitive information from an audio sample. We consider the task of feature representation for this study different from that of audio classification tasks since the features that serve best for audio classification might not adequately suffice for inferring sensitive information [28]. As a basic foundation, the upper layers of a DNN are best suited for performing feature extraction. In contrast, the lower layers are established to perform class discrimination [29] to output the target class. While it is possible to use Mel frequency cepstral coefficients (MFCCs) for the acoustic feature representation, since our study utilizes deep learning models, this approach is ignored because spatial information is lost from the MFCC.

An alternative representation known as the spectrogram consists of a temporal sequence of spectra. It can be obtained by omitting the Discrete Cosine Transform (DCT) to yield the log-mel spectrum [24]. Fig. 3 shows an illustration of spectrogram images for an audio sample in our dataset and a white noise sample that was generated for our experiment.

Even though the spectrograms are similar to images, the approach for audio processing using DNN’s is considered to be different from image classification due to the variation in value distribution for audio samples as compared to image samples.

We desist from using the time-domain waveform samples of the audio representation since they do not capture sufficient spatial information which is crucial for our machine learning model and technique.

In the past, it was common practice to model and analyze audio signals using Gaussian mixture due to their mathematical elegance [24]. However, in recent times, Deep Neural Networks (DNNs) have shown to be more accurate for audio processing and classification tasks [30]. In this study we examine the performance of three types of neural network models namely - Convolutional Neural Network (CNN), Recurrent Neural Network (RNN), and Convolutional Recurrent Neural Network (CRNN) for our task of inferring sensitive information from audio samples.

A Convolutional Neural Network (CNN) consists of a series of convolutional layers that are passed through pooling layers, followed by one or more dense layers. Since our study is based on spectral input features from the Mel spectrogram, a 2-dimensional time-frequency convolution is used for computing the feature maps, which are further downsampled by the pooling layers. The optimal parameters for the CNN are obtained experimentally based on the validation error observed during the training process. Recurrent Neural Networks (RNN), are well suited for sequence modeling tasks such as audio processing [31] due to the fact that they intrinsically model the temporal dependency in the input features. A Convolutional Recurrent Neural Network (CRNN) [32] is an extension of the CNN in which an RNN is implemented to process the output of a CNN. While the purpose of the convolutional layers is to perform feature extraction, the recurrent layers enable the model to make sense of the longer temporal context.

The audio samples are all processed into 16bit, 48kHz .wav format before being converted into spectrogram images. After the audio samples are pre-processed into spectrogram images, spectral feature extraction is carried out and the input is then fed into the Deep Neural Network (DNN) classifiers. Fig. 4 shows a diagrammatic representation of the solution architecture.

Our solution is based on the premise that GAN generated noise, when combined with audio recordings from the smart home device, reduces the effectiveness of machine learning based inference from the audio recordings. This enhances smart home user privacy from various forms of adversaries with varying capabilities discussed in the preceding paragraph. Our results from section VII highlight more details on this.

The GAN noise signal is generated by an external device that is permanently in the smart home user’s environment and constantly producing noise signals which when combined with audio recordings from the smart home device, prevents an adversary from inferring sensitive information from the audio recordings. The noise amplitude of the external noise generator is audible for human perception but it should not exceed the acceptable noise threshold for human comfort.

In this study, we evaluate the effectiveness of the GAN noise with white noise. The white noise is generated with a python script using the same hardware for generating the GAN noise. In our evaluation, both noise samples are produced at the same amplitude to ensure consistency in the results.

In the original GAN setup introduced by [25], GANs were used to generate synthetic data samples by taking as input, statistically independent noise samples. To the best of our knowledge, GANs have not been used to generate random noise signals. We choose to implement GANs in our approach to create audio samples as against other generative models such as Variable Autoencoders (VAE) because GANs do not introduce any deterministic bias and work better with discrete latent variables [25].

Our solution which we refer to as MaskGAN is an adaptation of Deep Convolutional Generative Adversarial Networks (DCGAN) [33]. DCGANs are a notable architecture for adversarial image generation in which a transposed convolution operation is implemented for creating high-resolution images from low-resolution feature maps. Since DCGAN ouputs 64x64 pixel images, we add two additional layers to produce two seconds of audio at 16KHz. Furthermore, the 2-dimensional convolutions are flattened into 1-dimensional with the stride factors increased twofold.

Our proposed MaskGAN structure consists of two models as shown in Fig 5. The first model known as the generator tries to generate new and synthetic audio samples that are identical to the target white noise audio sample. The second model known as the discriminator performs an adversary role by trying to detect if the synthetic audio sample is real or fake, hence helping to improve the knowledge of the generator until the generator eventually succeeds in creating some synthetic audio sample which is realistic and as indistinguishable from the actual white noise audio sample as possible.

The generator model is represented as $G(z,\theta_{g})$ while the discriminator model is represented as $D(x,\theta_{d})$ where $x$ represents the input audio samples and $z$ represents the generated synthetic samples. The weights of the neural network also known as parameters are represented as $\theta$. The parameters of the generator $\theta_{g}$ are updated to maximize the probability that the synthetic audio is classified as the real audio dataset. The loss function of the generator network seeks to maximize $D(G(z))$. With regards to the discriminator, the parameters are optimized to maximize the probability that the synthetic noise audio samples are classified as real audio samples. Hence, the loss function of the discriminator, seeks to maximize the function $D(x)$ while minimizing the function $D(G(z))$.

The minmax game between the generator and the discriminator is represented as a value function $V(G,D)$, whereby the generator seeks to maximize the probability that its output is classified as real. In contrast, the objective of the discriminator is to minimize this probability.

The input to the MaskGAN model is a random seed and the target output is a white noise signal that has been generated from our python code. After several iterations, the generative model finally arrives at a synthetic noise signal that is indistinguishable from the digital white noise signal, based on the assessment of the discriminative model.

For our experimental work, we used a standalone desktop PC running windows 10 Education OS. The hardware components consist of an AMD Ryzen 7 2700X processor at 3.70GHz with 32GB of RAM and 1TB SSD storage. The graphics card is a standalone GPU - NVIDIA GeForce RTX 2080 TI with 11GB RAM.

All software development was carried out using publicly available and open-source tools. The software code was written in Python programming language using the Spyder Integrated Development Environment (IDE), which is part of the ”Anaconda software distribution”. For the deep learning framework, we used the Google TensorFlow v2 deep learning framework.

The three datasets we used represent the three inference attack case scenarios that were explored in this study, namely music genre inference (MGI), user demographics inference (UDI), and speech emotion inference (SEI). The datasets used are publicly available, and details of each dataset are further discussed in section VII-A.

The first step in our experimental approach entails using the GAN structure described in section V-D to create noise samples using white noise as the target output. As illustrated in Fig. 5, the generative model produces audio samples from a random seed and learns to improve as the discriminator determines how close the audio sample is to the white noise signal. The amplitude of the generated GAN noise does not exceed 45db in order to remain with the human comfort level as specified in [26]

In the second step of our experimental approach, we compute the degree of randomness of the original sample, the white noise and the GAN noise. In this section, we use two different non-parametric approaches in determining the degree of randomness of the audio samples.

Each audio sample is represented as a matrix of integers, with the shape representing the dimensions. For the scope of our study, we focus on notable runs tests in which upward and downward run counts are carried out for a sequence of variables, by floating the integers of the audio samples represented as an integer matrix.

Two measures of randomness namely the Wald-wolfowitz runs test [35] and the Cox-stuart test [36] are used to measure and compare the degree of randomness between the three audio signals. The results are reported in sections VI-B1 and VI-B2.

Machine learning-based audio profiling of voice recordings from always listening devices can be used to infer sensitive information from a smart home user ’s environment. We experiment with a total of three publicly available datasets, to explore three types of inference attacks to leak out sensitive information about the occupants of a home.

Our methodology entails the superimposition of the original audio samples with some form of external audio noise to prevent an adversary from inferring unwarranted sensitive information from audio recordings. The external noise is generated in with two methods. For the first method, white noise is generated. The second method entails the use of a Generative Adversarial Network (GAN) architecture, which forms the basis of our proposed solution.

We evaluate the effectiveness of our solution based on three metrics. The mitigated inference accuracy (MIA), the semantic preservation factor (SPF), and randomness to mitigation relationship (RTMR). First, we establish a benchmark assessment which we report in section VII-A as the Baseline Inference Accuracy (BIA). We then proceed to evaluate our proposed solution based on the metrics described below.

In the first experiment, we conduct a baseline assessment of the inference attacks against all 3 datasets for the 3 case scenarios we considered. All 3 machine learning techniques were effective in inferring information from the audio dataset with a highest achievable inference of 82% from the CRNN model for the user demographic inference (UDI). as shown in Fig. 9. The figures reported are the best results achieved based on K-fold cross validation which was used to determine the optimal parameter settings of the neural network models.

In this section, we test the privacy preservation hypothesis of the GAN noise capability in preventing sensitive information leakage in smart homes. We seek to determine if the GAN noise is more effective than white noise in preserving the privacy of smart home devices. Our results show that the noise generated by GAN results in over 45% reduction in sensitive information leakage from smart home devices while maintaining the semantics of the audio.

In our fourth experiment, we demonstrate the ability of the GAN noise to preserve the semantics of the audio while effectively mitigating information leakage attacks. A visual representation of the results is show in Fig. 12 We performed speech recognition classification using the google speech commands dataset [34]. This fourth dataset was selected since the dataset was collected and labeled for recognizing the content of the speech. Unlike the other 3 datasets which were used in the inference attack discussed in section VI-C, this dataset is more appropriate for deducing the content of the speech. The other 3 datasets were not used for semantic experiment since they were not collected and labelled for speech classification tasks. The result of the experiment shows that the GAN noise has less impact on the DNN speech recognition classifier compared to the white noise as shown in Fig. 13. Hence, we confirm that the GAN noise does indeed preserve the utility of the device by deterring inference attack yet, maintaining the semantics of the conversation.

We evaluated the relationship between randomness and the mitigation inference accuracy (MIA) in each inference attack case scenario. The result as illustrated in Fig. 14 shows that the higher the degree of randomness, the higher the mitigation effect that the noise exhibits in deterring the inference attack. The mitigation achieved is calculated as the difference in the MIA for each case scenario with the white noise as well as the GAN noise. The GAN noise, having more randomness compared to the white noise is proven to have a higher mitigation effect.

White noise is known to exhibit statistical characteristics that are similar to randomly generated numbers. To be considered as truly random, we expect the entity to be in fact unpredictable; but the possibility of a white noise generator to exhibit true randomness in the sense of unpredictability is questionable. Speicher et al. [40] noted that patterns can be noted in pseudo random generated white noise, based on the fact that is contains possibly predictable elements for example, a linear congruential random generator, which is typical algorithm used for producing digital noise output. Tzeng et al. [41] argued that it is best to treat randomness as a property of the process that generates the signal of the white noise, not of the white noise itself.

Hence, we establish that white noise with its pseudorandom property is thus limited in the ability as an effective measure in privacy preservation for use in audio masking for preventing sensitive information leakage attacks.

The ability of generative adversarial networks to create high dimensional data has been researched [4] and the relationship of this high dimensionality to randomness is an object of interest. As the generator model in the GAN continuously learns to produce data samples which the adversary (discriminator) cannot predict, the randomness element in its output improves, as demonstrated in our results. Our solution entails the use of a generative model that has learnt to produce realistic noise samples of a given dataset from low-dimensional, random latent vectors.

Several recent efforts have been made to generate sound using Generative Adversarial Networks including the use of CycleGAN by [42]. Their approach augments an existing audio sample with emotions and can also convert speeches between emotional variations e.g. convert an angry speech into a sad speech.

We differentiate our work from other studies such as [43] which use adversarial attacks to mitigate speech recognition i.e. the use of machine learning systems to determine the identity of the speaker. In this specific study, a state of the art deep neural network (DNN) known as X-vector was tested. By adding a carefully crafted inconspicuous noise to the original audio, their attack method was successful in fooling the DNN into making false predictions. The solution goes further to incorporate room impulse response (RIR) estimates while training the adversarial examples to demonstrate the effectiveness for both digital attacks as well as over-the-air attacks.

Sound masking in the context of this study occurs in the physical space and is more practical oriented. Factors such as the room impulse ratio is considered in deploying real and tangible audio signals to mitigate unwanted sensitive information leakage due to machine learning inference. Traditionally, there have been several ways of attacking speech recognition systems. Adversarial examples, for instance the work of Carlini and Wagner [44] could impact a speech recognition system to misclassify by adding a carefully crafted perturbation. This adversarial attack method was tested against speech recognition only, but not tested against speech inference. Furthermore, their attack was proven to be effective in the digital space. Similar studies [45] [44] have proposed solutions mostly against automatic speaker recognition in the digital space. In our threat model, we considered various adversaries, including the manufacturer or solution developer who controls the digital space and therefore, implementing a solution within the digital space will be ineffective against such adversaries.

Also, the work of Fuxun Yu et al [46] introduced ”MASKER”, a solution which introduces human imperceptible adversarial perturbation into real time audio signals with significant increase in the word error rate (WER). Their work focused on mobile platforms and was not tested to work against digital voice assistants or smart home environments. Also, the solution is primarily effective only in the digital space and was not tested as an over-the-air solution.

Our method focuses on a solution that is implemented within the physical space. Since the user can perceive the sound generated, we ensure that this sound is within the audible comfort zone for human hearing of less than 45db [26]. We tested with various amplitudes of audio signal and determined that as the amplitude increases, the effectiveness also increases. However, compared to the original audio as well as the white noise, our GAN generated noise achieves better mitigation based on several metrics.

We show that speech recognition and sound-based inference have varying and different and unique characteristics and adversarial noise techniques should be considered differently. Refer to Fig. 1 where we illustrate the difference between eavesdropping and inference attacks.