Acoustic models vulnerable to hidden triggers in real life sounds
Backdooring Acoustic Foundation Models for Physically Realizable Triggers
SoundMachine Learning
Summary
Powerful sound-based AI systems used for speech and speaker tasks can be secretly tricked by special hidden audio signals. The authors show that small, natural-sounding noises like sirens can be used as triggers to make these models behave badly without affecting their normal work. These hidden triggers work even after the models are further trained for different tasks and can survive some defenses. Protecting against this attack requires a lot of extra work, which is not easy or practical.
What this means in practice
- •For security engineers: Detect risks from hidden audio triggers that can compromise voice-based AI systems in smart devices and applications.
- •For audio system developers: Design more robust acoustic models by testing against subtle background sounds that could enable backdoor attacks.
Authors
Zebin Yun, Eyal Ronen, Mahmood Sharif
Abstract
Acoustic foundation models (AFMs) have democratized acoustic applications, enabling powerful models for tasks ranging from speech recognition to speaker verification with minimal resources. However, the security of applications based on AFMs remains largely underexplored. Our work addresses this gap by proposing the Foundation Acoustic model Backdoor (FAB) attack, demonstrating that state-of-the-art AFMs are susceptible to backdooring under practical settings. Despite making minimal assumptions about adversary capabilities (e.g., no access to pre-training data), we show that FAB preserves benign performance while inducing backdoors that survive fine-tuning and cause significant degradation across diverse downstream tasks when activated. Notably, FAB utilizes task-agnostic, physically realizable, inconspicuous, and sync-free triggers (e.g., a background siren). We evaluate FAB using two leading AFMs, nine downstream tasks, and four different triggers. We further demonstrate its effectiveness against established defenses and across both digital and physical domains. While extensive end-to-end fine-tuning can mitigate FAB, such a defense is resource-intensive and task-specific. Our work highlights critical risks to AFMs and calls for advanced defenses.