Voice interfaces are becoming accepted widely as input methods for a diverse\nset of devices. This development is driven by rapid improvements in automatic\nspeech recognition (ASR), which now performs on par with human listening in\nmany tasks. These improvements base on an ongoing evolution of DNNs as the\ncomputational core of ASR. However, recent research results show that DNNs are\nvulnerable to adversarial perturbations, which allow attackers to force the\ntranscription into a malicious output.\n In this paper, we introduce a new type of adversarial examples based on\npsychoacoustic hiding. Our attack exploits the characteristics of DNN-based ASR\nsystems, where we extend the original analysis procedure by an additional\nbackpropagation step. We use this backpropagation to learn the degrees of\nfreedom for the adversarial perturbation of the input signal, i.e., we apply a\npsychoacoustic model and manipulate the acoustic signal below the thresholds of\nhuman perception. To further minimize the perceptibility of the perturbations,\nwe use forced alignment to find the best fitting temporal alignment between the\noriginal audio sample and the malicious target transcription. These extensions\nallow us to embed an arbitrary audio input with a malicious voice command that\nis then transcribed by the ASR system, with the audio signal remaining barely\ndistinguishable from the original signal. In an experimental evaluation, we\nattack the state-of-the-art speech recognition system Kaldi and determine the\nbest performing parameter and analysis setup for different types of input. Our\nresults show that we are successful in up to 98% of cases with a computational\neffort of fewer than two minutes for a ten-second audio file. Based on user\nstudies, we found that none of our target transcriptions were audible to human\nlisteners, who still understand the original speech content with unchanged\naccuracy.\n