Mirage & Mute Attack (M2A) in Polyphonic SED

• Mirage and Mute Attack (M2A) is a targeted adversarial framework for polyphonic SED that manipulates temporal event maps through dual-objective optimization.
• It employs insertion (Mirage) and deletion (Mute) operations to achieve precise modifications, achieving high Editing Precision on CRNN and ATST-SED models.
• The framework applies localized perturbations and iterative gradient-based updates to balance attack effectiveness with non-target preservation in safety-critical applications.

Searching arXiv for the M2A paper and closely related SED adversarial-attack work. Using arXiv search to retrieve relevant papers. to=arxiv_search code: {"query":"Mirage and Mute Attack polyphonic sound event detection targeted adversarial attacks", "max_results": 5} Mirage and Mute Attack (M2A) is a white-box targeted adversarial attack framework for polyphonic Sound Event Detection (SED). It is designed for SED systems that perform both event detection and temporal localization, and it attacks their frame-wise, multi-label outputs by editing only specified event regions while preserving the remainder of the prediction. Within the framework, Mirage denotes targeted insertion of a sound event that is not present, and Mute denotes targeted deletion of a sound event that should be detected. The framework is defined by a dual-objective optimization that combines a target-region adversarial loss with a non-target preservation loss, and by an evaluation protocol centered on Editing Precision (EP), a metric intended to balance effectiveness and precision (Su et al., 2 Oct 2025).

1. Problem setting and threat model

M2A is formulated for polyphonic SED rather than ordinary audio classification or speech recognition. In this setting, the model output is not a single class label, but a structured temporal event map in which multiple events can overlap. The attacker therefore seeks not merely to induce misclassification, but to edit specific event regions in the output while leaving everything else unchanged. The formal target is

$$f(x+\delta)=y^* \quad \text{s.t.} \quad \|\delta\|_\infty \leq \tau,$$

where $x$ is the original audio, $\delta$ is the adversarial perturbation, $y^*$ is the desired label matrix, and $\tau$ is the perturbation budget (Su et al., 2 Oct 2025).

The framework assumes full access to the model parameters and gradients. This white-box assumption is central: M2A is presented as a gradient-based optimization attack rather than a black-box query method. The attack is further motivated by two failure modes identified in prior audio attacks adapted to SED. First, attacks may lack effectiveness, because SED exhibits strong context dependence and a local perturbation may not reliably change the target region. Second, attacks may lack precision, because successful attacks often spill over into non-target regions, altering outputs that were not meant to change. M2A is constructed specifically to address both of these issues.

This threat model implies a precise adversarial editing task. Let $O=\{(i,j)\}$ denote the full output index set over time $i\in[1,N]$ and event classes $j\in[1,C]$. If a target event $e$ is to be manipulated over temporal interval $[l,r]$, the single-edit target region is

$x$0

with $x$1; for multiple edits, $x$2 is the union of all target regions. This formulation makes the attack explicitly temporal and region-specific rather than clip-global.

2. Mirage and Mute as targeted editing operations

The two named modes of the framework correspond to the two basic edit operations required for SED manipulation. Mirage is an insertion attack: it makes the model detect an event where it originally did not. Mute is a deletion attack: it makes the model stop detecting an event where it originally did. The names are used as a conceptual metaphor: a Mirage is a fake event the detector “sees,” while a Mute is a real event the detector is made to “ignore” (Su et al., 2 Oct 2025).

These operations are instantiated through the adversarial target matrix $x$3. For target positions,

$x$4

where $x$5, with $x$6 for deletion and $x$7 for insertion. Outside the target region,

$x$8

where $x$9 is the original model output. The framework therefore edits only the intended region and leaves all other entries anchored to the original prediction.

A notable property of M2A is that it can perform multiple edits within a single audio clip. This is significant in polyphonic SED, where several events may overlap in time and a realistic adversarial objective may require simultaneous insertion and deletion across different regions. The framework is therefore better understood as a structured output-editing method than as a conventional adversarial example generator for clip-level labels.

3. Optimization objective and perturbation strategy

The central methodological contribution of M2A is its dual-objective optimization. The attack minimizes

$\delta$0

where $\delta$1 is the adversarial loss on the target region, $\delta$2 is the preservation loss on the non-target region, and $\delta$3 controls the precision-effectiveness trade-off (Su et al., 2 Oct 2025).

The adversarial loss is a BCE-style term restricted to the target region:

$\delta$4

It pushes the model toward the attacker’s desired labels only where editing is intended. The preservation loss is likewise BCE-like, but it is defined over the complement of the target region and uses the original prediction as the reference:

$\delta$5

This term is the mechanism that constrains collateral changes. The framework’s claim to precision rests on this explicit preservation objective.

M2A also adopts a localized perturbation strategy. The perturbation is initially applied only over the target time span or spans, and overlapping target regions share the same perturbation. The attack then refines this initialization by iterative gradient-based optimization. The update follows an I-FGSM-style rule:

$\delta$6

where

$\delta$7

This combination of region-localized initialization and preservation-aware optimization is presented as the practical compromise between stealth and precise temporal editing.

4. Evaluation framework and the Editing Precision metric

Because SED attacks must be judged both by whether the target edit succeeds and by whether non-target outputs remain unchanged, M2A introduces Editing Precision (EP) as its primary evaluation metric. EP is defined as

$\delta$8

where SE denotes successful editing, FE failed editing, UE unintended editing, and NE not editing. The same evaluation framework also uses

$\delta$9

for target-region attack success rate,

$y^*$0

for unintended editing rate, and

$y^*$1

for perturbation audibility (Su et al., 2 Oct 2025).

The experimental protocol uses two SED benchmarks: DESED, with 10-second clips, and TUT-SED, with 1–3 minute segments segmented into 25-second clips for testing. The evaluation randomly selects 1000 samples. Two target models are attacked: CRNN, described as a classical convolutional-recurrent architecture and a DCASE-2017 winner, and ATST-SED, described as a strong Transformer-based state-of-the-art model. Baselines are CW, FAAG, and ARO, adapted to the SED setting.

The reported hyperparameters emphasize model-dependent tuning. The optimizer is Adam with learning rate $y^*$2 and event manipulation length 3 seconds. For CRNN, the selected parameters are $y^*$3 and $y^*$4; for ATST-SED, they are $y^*$5 and $y^*$6. These settings are described as chosen through ablation, reflecting the framework’s explicit navigation of the trade-off between attack effectiveness and preservation.

5. Empirical results on single-target and multi-target manipulation

The main quantitative result is that M2A achieves high EP while maintaining lower unintended editing than less constrained attacks. In the single-target setting, the paper reports the following results (Su et al., 2 Oct 2025):

Method	CRNN	ATST-SED
CW	EP 87.84%, ASR 91.30%, UER 12.23%, SNR 12.96 dB	EP 96.51%, ASR 99.11%, UER 3.57%, SNR 9.32 dB
FAAG	EP 97.45%, ASR 76.65%, UER 2.13%, SNR 19.42 dB	EP 98.03%, ASR 50.86%, UER 0.52%, SNR 13.55 dB
ARO	EP 85.59%, ASR 92.79%, UER 14.56%, SNR 10.00 dB	EP 96.53%, ASR 99.20%, UER 3.55%, SNR 7.28 dB
M2A	EP 94.56%, ASR 81.81%, UER 5.18%, SNR 20.16 dB	EP 99.11%, ASR 91.77%, UER 0.67%, SNR 13.55 dB

These results support the framework’s intended trade-off. CW and ARO tend to achieve high ASR, but with higher UER and lower SNR. FAAG preserves the non-target region more effectively, but often at the cost of target success, especially on ATST-SED. M2A is reported as the best balance of effectiveness and precision, which is why the abstract emphasizes 94.56% EP on CRNN and 99.11% EP on ATST-SED.

The same trend strengthens in the multi-target setting. On CRNN, the reported values are: CW EP 87.66%, ASR 94.37%, UER 12.62%; FAAG EP 95.07%, ASR 61.79%, UER 3.56%; ARO EP 86.27%, ASR 90.28%, UER 13.89%; M2A EP 94.97%, ASR 82.96%, UER 4.53%. On ATST-SED, the reported values are: CW EP 91.35%, ASR 99.85%, UER 9.22%; FAAG EP 96.33%, ASR 51.20%, UER 0.80%; ARO EP 91.95%, ASR 99.67%, UER 8.56%; M2A EP 98.84%, ASR 96.57%, UER 1.06%. The paper’s interpretation is that as the number of edits increases, global or less constrained attacks accumulate unintended edits faster, whereas M2A remains comparatively stable because the preservation loss directly regularizes the non-target region.

Qualitative analysis of mel-spectrograms and post-processed SED outputs is reported to align with the quantitative results. CW succeeds in the target region but distorts non-target events. FAAG leaves non-target outputs mostly intact but often fails to complete the target edit. M2A is reported to achieve the desired target edit while preserving the rest of the output.

6. Limitations, defenses, and security significance

The framework is presented with several explicit limitations. It assumes white-box access, it is evaluated on selected SED models and datasets, and its strongest results depend on careful tuning of $y^*$7 and $y^*$8. The defense analysis is also limited to common preprocessing strategies: downsampling, Gaussian noise, and local smoothing with mean and median filters. These defenses can reduce ASR somewhat, but they do not eliminate the attack; the paper also notes that some defenses hurt audio quality or even increase UER (Su et al., 2 Oct 2025).

These limitations matter because they define the current scope of the claims. M2A is not introduced as a universal attack against arbitrary audio systems, nor as a black-box method. Its contribution is narrower and more specific: it is a targeted adversarial framework tailored to polyphonic SED, where the central problem is not merely misclassification but precise editing of a temporal event map. A common misconception is therefore to treat it as just another audio adversarial attack; the paper instead positions it around the structured-output properties of SED and the need to preserve non-target predictions.

The security implications are substantial in the domains named in the paper: surveillance, industrial monitoring, and other safety-critical environments. A successful Mirage operation can inject false alarms or fictitious acoustic events. A successful Mute operation can hide dangerous sounds that should have been detected. Because the framework targets only specific event regions and can preserve the rest of the detection timeline, the resulting failures can be difficult to diagnose from gross system behavior alone. This is the broader significance of M2A: it shows that SED systems can be manipulated not only broadly, but with surgical precision, making temporal localization itself part of the attack surface.