SpeechGuard: Online Defense against Backdoor Attacks on Speech Recognition Models
SoundCryptography and SecurityMachine Learning
Summary
The authors study how to protect speech recognition systems from backdoor attacks, where harmful triggers are hidden in some training data to make the system behave badly. They propose SpeechGuard, a method that detects and cleans these harmful audio samples while the system is running. Their approach improves detection by injecting small changes into audio and uses masks generated by an autoencoder to hide the trigger signals. Experiments show that SpeechGuard can find poisoned audios accurately and reduce the risk of attacks without losing much accuracy.
Authors
Jinwen Xin, Xixiang Lv
Abstract
Backdoor attacks pose a critical threat to neural network models, allowing attackers to implant a backdoor during the training phase by manipulating a small portion of the training data. In security-sensitive applications such as voice interaction for autonomous driving, the presence of backdoor attacks introduces substantial security risks. This study focuses on implementing backdoor defense measures for speech recognition models in run-time, taking into account the characteristics of audio signals. We propose SpeechGuard, the first online backdoor defense pipeline designed to identify and purify poisoned audio samples. Specifically, we improve STRIP method to perform adaptive perturbation injection to detect and filter poisoned samples, named as S-STRIP. More importantly, we further consider the purification of poisoned samples. We utilize time-frequency (T-F) masking to suppress the expression of trigger signals and autonomously generate masks based on an autoencoder. The two-stage processing prevents the backdoor in the model from being triggered, and even input speech carrying triggers can be accurately predicted. Extensive experimental demonstrate that SpeechGuard can accurately filter out poisoned samples. Through purification, it can significantly mitigate the backdoor threat while maintaining a certain prediction accuracy.