Natural Backdoor Attacks on Speech Recognition Models
Cryptography and SecurityMachine LearningSound
Summary
The authors studied how speech recognition systems can be tricked using backdoor attacks that activate with everyday sounds as triggers. They tested these attacks on different datasets and models, finding that even a small number of poisoned training samples can make the attack very effective without affecting normal use. Their work shows that these natural-sound triggers are hard to detect because they can be accidentally triggered by similar real-world sounds, posing a significant security risk.
Authors
Jinwen Xin, Xixiang Lyu, Jing Ma
Abstract
With the rapid development of deep learning, its vulnerability has gradually emerged in recent years. This work focuses on backdoor attacks on speech recognition systems. We adopt sounds that are ordinary in nature or in our daily life as triggers for natural backdoor attacks. We conduct experiments on two datasets and three models to validate the performance of natural backdoor attacks and explore the effects of poisoning rate, trigger duration and blend ratio on the performance of natural backdoor attacks. Our results show that natural backdoor attacks have a high attack success rate without compromising model performance on benign samples, even with short or low-amplitude triggers. It requires only 5% of poisoned samples to achieve a near 100% attack success rate. In addition, the backdoor will be automatically activated by the corresponding sound in nature, which is not easy to be detected and will bring severer harm.