---
title: Mirage & Mute Attack (M2A) in Polyphonic SED
url: https://www.emergentmind.com/topics/mirage-and-mute-attack-m2a
type: topic
---

# Mirage & Mute Attack (M2A) in Polyphonic SED

Searching arXiv for the M2A paper and closely related SED adversarial-attack work.
Using arXiv search to retrieve relevant papers.
to=arxiv_search code:
{"query":"Mirage and Mute Attack polyphonic sound event detection targeted adversarial attacks", "max_results": 5}
Mirage and Mute Attack (M2A) is a white-box targeted adversarial attack framework for polyphonic Sound Event Detection (SED). It is designed for SED systems that perform both event detection and temporal localization, and it attacks their frame-wise, multi-label outputs by editing only specified event regions while preserving the remainder of the prediction. Within the framework, **Mirage** denotes targeted insertion of a sound event that is not present, and **Mute** denotes targeted deletion of a sound event that should be detected. The framework is defined by a dual-objective optimization that combines a target-region adversarial loss with a non-target preservation loss, and by an evaluation protocol centered on **Editing Precision (EP)**, a metric intended to balance effectiveness and precision [2510.02158].

## 1. Problem setting and threat model

M2A is formulated for polyphonic SED rather than ordinary audio classification or speech recognition. In this setting, the model output is not a single class label, but a structured temporal event map in which multiple events can overlap. The attacker therefore seeks not merely to induce misclassification, but to edit specific event regions in the output while leaving everything else unchanged. The formal target is
$$
f(x+\delta)=y^* \quad \text{s.t.} \quad \|\delta\|_\infty \leq \tau,
$$
where $x$ is the original audio, $\delta$ is the adversarial perturbation, $y^*$ is the desired label matrix, and $\tau$ is the perturbation budget [2510.02158].

The framework assumes **full access to the model parameters and gradients**. This white-box assumption is central: M2A is presented as a gradient-based optimization attack rather than a black-box query method. The attack is further motivated by two failure modes identified in prior audio attacks adapted to SED. First, attacks may **lack effectiveness**, because SED exhibits strong context dependence and a local perturbation may not reliably change the target region. Second, attacks may **lack precision**, because successful attacks often spill over into non-target regions, altering outputs that were not meant to change. M2A is constructed specifically to address both of these issues.

This threat model implies a precise adversarial editing task. Let $O=\{(i,j)\}$ denote the full output index set over time $i\in[1,N]$ and event classes $j\in[1,C]$. If a target event $e$ is to be manipulated over temporal interval $[l,r]$, the single-edit target region is
$$
U=\{(l,e),(l+1,e),\dots,(r,e)\},
$$
with $T=U$; for multiple edits, $T$ is the union of all target regions. This formulation makes the attack explicitly temporal and region-specific rather than clip-global.

## 2. Mirage and Mute as targeted editing operations

The two named modes of the framework correspond to the two basic edit operations required for SED manipulation. **Mirage** is an **insertion** attack: it makes the model detect an event where it originally did not. **Mute** is a **deletion** attack: it makes the model stop detecting an event where it originally did. The names are used as a conceptual metaphor: a Mirage is a fake event the detector “sees,” while a Mute is a real event the detector is made to “ignore” [2510.02158].

These operations are instantiated through the adversarial target matrix $y^*$. For target positions,
$$
\forall (i,j)\in T,\quad y^*_{i,j}=t,
$$
where $t\in\{0,1\}$, with $t=0$ for deletion and $t=1$ for insertion. Outside the target region,
$$
\forall (i,j)\in O\setminus T,\quad y^*_{i,j}=\hat{y}_{i,j},
$$
where $\hat{y}=f(x)$ is the original model output. The framework therefore edits only the intended region and leaves all other entries anchored to the original prediction.

A notable property of M2A is that it can perform **multiple edits** within a single audio clip. This is significant in polyphonic SED, where several events may overlap in time and a realistic adversarial objective may require simultaneous insertion and deletion across different regions. The framework is therefore better understood as a structured output-editing method than as a conventional adversarial example generator for clip-level labels.

## 3. Optimization objective and perturbation strategy

The central methodological contribution of M2A is its **dual-objective optimization**. The attack minimizes
$$
\min_{\delta} \mathcal{L}_{\text{adv}}(f(x + \delta), y^*) + \alpha \cdot \mathcal{L}_{\text{pre}}(f(x + \delta), f(x)) \quad \text{s.t.} \quad \|\delta\|_\infty \leq \tau,
$$
where $\mathcal{L}_{\text{adv}}$ is the adversarial loss on the target region, $\mathcal{L}_{\text{pre}}$ is the preservation loss on the non-target region, and $\alpha$ controls the precision-effectiveness trade-off [2510.02158].

The adversarial loss is a BCE-style term restricted to the target region:
$$
\mathcal{L}_{\text{adv}}(f(x + \delta), y^*) = -\sum_{(i,j)\in T} \Big( y^*_{i,j}\log(f(x+\delta)_{i,j}) + (1-y^*_{i,j})\log(1-f(x+\delta)_{i,j}) \Big).
$$
It pushes the model toward the attacker’s desired labels only where editing is intended. The preservation loss is likewise BCE-like, but it is defined over the complement of the target region and uses the original prediction as the reference:
$$
\mathcal{L}_{\text{pre}}(f(x+\delta), f(x)) = -\sum_{(i,j)\in O\setminus T} \Big( f(x)_{i,j}\log(f(x+\delta)_{i,j}) + (1-f(x)_{i,j})\log(1-f(x+\delta)_{i,j}) \Big).
$$
This term is the mechanism that constrains collateral changes. The framework’s claim to precision rests on this explicit preservation objective.

M2A also adopts a **localized perturbation** strategy. The perturbation is initially applied only over the target time span or spans, and overlapping target regions share the same perturbation. The attack then refines this initialization by iterative gradient-based optimization. The update follows an **I-FGSM-style** rule:
$$
\delta \leftarrow \delta - \beta \cdot \text{sign}(\nabla_{\delta}\mathcal{L}_{\text{total}}(x,\delta,y^*,f)),
$$
where
$$
\mathcal{L}_{\text{total}} = \mathcal{L}_{\text{adv}} + \alpha \mathcal{L}_{\text{pre}}.
$$
This combination of region-localized initialization and preservation-aware optimization is presented as the practical compromise between stealth and precise temporal editing.

## 4. Evaluation framework and the Editing Precision metric

Because SED attacks must be judged both by whether the target edit succeeds and by whether non-target outputs remain unchanged, M2A introduces **Editing Precision (EP)** as its primary evaluation metric. EP is defined as
$$
\text{EP} = \frac{SE + NE}{SE + FE + UE + NE},
$$
where **SE** denotes successful editing, **FE** failed editing, **UE** unintended editing, and **NE** not editing. The same evaluation framework also uses
$$
\text{ASR} = \frac{SE}{SE+FE}
$$
for target-region attack success rate,
$$
\text{UER} = \frac{UE}{UE+NE}
$$
for unintended editing rate, and
$$
\text{SNR} = 10\log_{10}\left(\frac{\sum_{i=1}^{N}x_i^2}{\sum_{i=1}^{N}(x_i-x'_i)^2}\right)
$$
for perturbation audibility [2510.02158].

The experimental protocol uses two SED benchmarks: **DESED**, with 10-second clips, and **TUT-SED**, with 1–3 minute segments segmented into 25-second clips for testing. The evaluation randomly selects **1000 samples**. Two target models are attacked: **CRNN**, described as a classical convolutional-recurrent architecture and a DCASE-2017 winner, and **ATST-SED**, described as a strong Transformer-based state-of-the-art model. Baselines are **CW**, **FAAG**, and **ARO**, adapted to the SED setting.

The reported hyperparameters emphasize model-dependent tuning. The optimizer is **Adam** with learning rate $1\times10^{-3}$ and event manipulation length **3 seconds**. For **CRNN**, the selected parameters are $\alpha=10$ and $\tau=0.02$; for **ATST-SED**, they are $\alpha=50$ and $\tau=0.05$. These settings are described as chosen through ablation, reflecting the framework’s explicit navigation of the trade-off between attack effectiveness and preservation.

## 5. Empirical results on single-target and multi-target manipulation

The main quantitative result is that M2A achieves high EP while maintaining lower unintended editing than less constrained attacks. In the single-target setting, the paper reports the following results [2510.02158]:

| Method | CRNN | ATST-SED |
|---|---|---|
| **CW** | EP 87.84%, ASR 91.30%, UER 12.23%, SNR 12.96 dB | EP 96.51%, ASR 99.11%, UER 3.57%, SNR 9.32 dB |
| **FAAG** | EP 97.45%, ASR 76.65%, UER 2.13%, SNR 19.42 dB | EP 98.03%, ASR 50.86%, UER 0.52%, SNR 13.55 dB |
| **ARO** | EP 85.59%, ASR 92.79%, UER 14.56%, SNR 10.00 dB | EP 96.53%, ASR 99.20%, UER 3.55%, SNR 7.28 dB |
| **M2A** | EP 94.56%, ASR 81.81%, UER 5.18%, SNR 20.16 dB | EP 99.11%, ASR 91.77%, UER 0.67%, SNR 13.55 dB |

These results support the framework’s intended trade-off. **CW** and **ARO** tend to achieve high ASR, but with higher UER and lower SNR. **FAAG** preserves the non-target region more effectively, but often at the cost of target success, especially on **ATST-SED**. **M2A** is reported as the best balance of effectiveness and precision, which is why the abstract emphasizes **94.56% EP** on **CRNN** and **99.11% EP** on **ATST-SED**.

The same trend strengthens in the multi-target setting. On **CRNN**, the reported values are: **CW** EP 87.66%, ASR 94.37%, UER 12.62%; **FAAG** EP 95.07%, ASR 61.79%, UER 3.56%; **ARO** EP 86.27%, ASR 90.28%, UER 13.89%; **M2A** EP 94.97%, ASR 82.96%, UER 4.53%. On **ATST-SED**, the reported values are: **CW** EP 91.35%, ASR 99.85%, UER 9.22%; **FAAG** EP 96.33%, ASR 51.20%, UER 0.80%; **ARO** EP 91.95%, ASR 99.67%, UER 8.56%; **M2A** EP 98.84%, ASR 96.57%, UER 1.06%. The paper’s interpretation is that as the number of edits increases, global or less constrained attacks accumulate unintended edits faster, whereas M2A remains comparatively stable because the preservation loss directly regularizes the non-target region.

Qualitative analysis of mel-spectrograms and post-processed SED outputs is reported to align with the quantitative results. **CW** succeeds in the target region but distorts non-target events. **FAAG** leaves non-target outputs mostly intact but often fails to complete the target edit. **M2A** is reported to achieve the desired target edit while preserving the rest of the output.

## 6. Limitations, defenses, and security significance

The framework is presented with several explicit limitations. It assumes **white-box access**, it is evaluated on **selected SED models and datasets**, and its strongest results depend on careful tuning of $\alpha$ and $\tau$. The defense analysis is also limited to common preprocessing strategies: **downsampling**, **Gaussian noise**, and **local smoothing** with mean and median filters. These defenses can reduce ASR somewhat, but they do not eliminate the attack; the paper also notes that some defenses hurt audio quality or even increase UER [2510.02158].

These limitations matter because they define the current scope of the claims. M2A is not introduced as a universal attack against arbitrary audio systems, nor as a black-box method. Its contribution is narrower and more specific: it is a targeted adversarial framework tailored to **polyphonic SED**, where the central problem is not merely misclassification but precise editing of a temporal event map. A common misconception is therefore to treat it as just another audio adversarial attack; the paper instead positions it around the structured-output properties of SED and the need to preserve non-target predictions.

The security implications are substantial in the domains named in the paper: **surveillance**, **industrial monitoring**, and other **safety-critical environments**. A successful Mirage operation can inject false alarms or fictitious acoustic events. A successful Mute operation can hide dangerous sounds that should have been detected. Because the framework targets only specific event regions and can preserve the rest of the detection timeline, the resulting failures can be difficult to diagnose from gross system behavior alone. This is the broader significance of M2A: it shows that SED systems can be manipulated not only broadly, but with **surgical precision**, making temporal localization itself part of the attack surface.

Source: https://www.emergentmind.com/topics/mirage-and-mute-attack-m2a