Research map / Adversarial robustness and security / Certified and empirical robustness

What Was That Again? Certified Robustness for Automatic Speech Recognition

NeurIPS 2026 · Adversarial robustness and security › Certified and empirical robustness · approach: Neural network robustness verification · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes an anytime-valid certified transcription pipeline for ASR that uses E-value wealth tests for word-level certification and an E-value tournament over filtered sentence candidates, evaluated on LibriSpeech and Common Voice under AWGN.

Problem

Randomized smoothing certification collapses for sequence outputs such as ASR transcriptions, because the probability of any single transcription vanishes under noise, and Clopper-Pearson sampling suffers from the peeking problem.

Approach

A dual-gate pipeline: two-sided E-value (Ville's inequality) audits certify token existence and exclusion over a candidate vocabulary, then a rank-based E-value tournament selects the winning sentence from candidates filtered to certified tokens, avoiding multiple sequence alignment.

Key results

• On Whisper-Large-v3 at -5 dB SNR, WER drops from 0.273 raw to 0.126 with the framework (about 54% relative), with 74.0% certification recall versus 0.5% for Cohen and 2.1% for ROVER.
• Across models, the framework reports up to a 55.1% relative WER reduction, per the authors.
• Under noise, certification recall for the framework stays between 40.5% and 90.3% while ROVER and Cohen baselines fall to near 0%.

Surprising findings

• Baselines (ROVER and Cohen) sometimes show more negative Spearman correlation than the proposed method at high SNR, which the authors attribute to low recall making correlation less meaningful.
• The authors state that the atomic gate underestimates the true Type I error because no family-wise correction is applied over the vocabulary, so certificates are framed as diagnostic rather than true robustness.

Limitations

• No family-wise error control over the candidate vocabulary; atomic-gate Type I error scales with vocabulary size, so the guarantee is local and only diagnostic.
• Evaluated only with random Gaussian noise (AWGN), not adversarial attacks, and only l2 perturbations.
• Content words (nouns, verbs, proper nouns) have low certification recall, and the candidate vocabulary can miss tokens absent from the discovery samples.

Experimental setup

Datasets: LibriSpeech test-clean LibriSpeech test-other Common Voice 17.0 English test

Benchmarks: LibriSpeech Common Voice 17.0

Metrics: Word Error Rate certification recall Spearman correlation real-time factor

Baselines: Cohen randomized smoothing ROVER Raw ASR output

Builds on: Randomized Smoothing (Cohen et al.) Ville's inequality E-values / Method of Mixtures ROVER

Closest papers by meaning

• Speech Robust Bench: A Robustness Benchmark For Speech Recognition (ICLR 2025 · similarity 0.87)
• Certification of Speaker Recognition Models to Additive Perturbations (AAAI 2025 · similarity 0.86)
• AdaptDel: Adaptable Deletion Rate Randomized Smoothing for Certified Robustness (NeurIPS 2025 · similarity 0.85)
• Uncertainty-Aware Self-Training for CTC-Based Automatic Speech Recognition (AAAI 2025 · similarity 0.84)
• Halt Fast! Early Stopping for Certified Robustness (NeurIPS 2026 · similarity 0.83)
• Speech Recognition Meets Large Language Model: Benchmarking, Models, and Exploration (AAAI 2025 · similarity 0.83)