arXiv:2607.15697v1 [cs.SD] 17 Jul 2026
SpeechGuard: Online Defense against Backdoor Attacks on Speech Recognition Models 1st Jinwen Xin
2nd Xixiang lv*
School of Cyber Engineering Xidian University Xi’an, China [email protected]
School of Cyber Engineering Xidian University Xi’an, China [email protected]
Abstract—Backdoor attacks pose a critical threat to neural network models, allowing attackers to implant a backdoor during the training phase by manipulating a small portion of the training data. In security-sensitive applications such as voice interaction for autonomous driving, the presence of backdoor attacks introduces substantial security risks. This study focuses on implementing backdoor defense measures for speech recognition models in run-time, taking into account the characteristics of audio signals. We propose SpeechGuard, the first online backdoor defense pipeline designed to identify and purify poisoned audio samples. Specifically, we improve STRIP method to perform adaptive perturbation injection to detect and filter poisoned samples, named as S-STRIP. More importantly, we further consider the purification of poisoned samples. We utilize time-frequency (T-F) masking to suppress the expression of trigger signals and autonomously generate masks based on an autoencoder. The two-stage processing prevents the backdoor in the model from being triggered, and even input speech carrying triggers can be accurately predicted. Extensive experimental demonstrate that SpeechGuard can accurately filter out poisoned samples. Through purification, it can significantly mitigate the backdoor threat while maintaining a certain prediction accuracy. Index Terms—Neural Networks, Speech Recognition, Backdoor Attack, Backdoor Defense
I. I NTRODUCTION As a breakthrough technology in the field of artificial intelligence, deep learning has achieved remarkable results in image recognition, machine translation, speech recognition and other fields, driving the progress of technology and society. Neural networks (NN), as the core of deep learning, have been proven to be vulnerable to various attacks due to their inherent black-box nature and high data dependency. For instance, adversarial example attacks can fool autonomous vehicles by adding imperceptible perturbations to the traffic sign [1], while data poisoning attacks may inject carefully crafted comments to maliciously manipulate a recommender system [2]. Recently, another attack threat against NN has caught the attention of researchers, known as backdoor attacks. In Author’s accepted manuscript of the IEEE IJCNN 2024 paper; not the IEEE Version of Record. DOI: 10.1109/IJCNN60899.2024.10650300. ©2024 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.
general, backdoor attacks work by implanting a backdoor in models during the training stage so that the infected models perform well on benign samples, whereas their predictions will be maliciously altered if the buried backdoor is activated by the preset trigger [3]. Early research on backdoor attacks focused on the image and text domains, but recent findings have shown that backdoor attacks have gradually penetrated into the speech recognition domain [4]–[6]. The adversary can successfully activate the malicious behavior of the victim model by using an ultrasonic pulse as the inaudible trigger [4], and the trigger can also be ambient noise where the backdoor can be passively triggered [5]. In real-world physical scenarios (e.g., voice assistant), speech recognition systems may face disturbances from various environmental noises that could potentially contain malicious triggers. Therefore, it is imperative to explore corresponding defense measures to address this emerging security challenge. We focus on online backdoor defense measures in speech recognition tasks. Advanced defense schemes are typically evaluated on image classification tasks [7], [8], which is fundamentally different from speech recognition tasks in the realm of input space. Therefore, it is crucial to design effective detection methods that consider the specific characteristics of audio signals. Furthermore, prevalent online defense strategies primarily concentrate on detecting poisoned samples but lack mechanisms for subsequent processing. In real-time speech recognition systems, a straightforward solution is to directly reject poisoned voice inputs, which effectively deals with malicious visitors but may degrade the confidence of legitimate users. We underscore the importance of purifying poisoned samples and ensuring the completion of the inference process. In this paper, we propose SpeechGuard, an online backdoor defense scheme designed specifically for speech recognition tasks. SpeechGuard introduces a two-stage defense pipeline that seamlessly integrates poisoned sample detection and purification. Specifically, given an infected model that has been deployed and running, the input voice undergoes a two-stage processing to mitigate the backdoor threat. In the detection stage, SpeechGuard employs S-STRIP, an enhanced version of STRIP [7] achieved through improved perturbation injection, to identify and filter poisoned samples. The filtered samples then proceed to the second stage. In the purification stage,
SpeechGuard trains an autoencoder to learn the mapping from poisoned inputs to the time-frequency mask. This mask is then utilized to suppress trigger signals for the purification of poisoned samples. The effectiveness of this purification method stems from the sparsity of speech signals and the isolation of trigger signals in the T-F domain. The combination of two stages is effective in identifying and purifying poisoned samples. Ensuring a certain level of prediction accuracy for the purified poisoned samples, it effectively mitigates the risk associated with backdoors. Our contributions can be summarized as follows: • We improved the perturbation injection strategy in STRIP method, making it more suitable for detecting poisoned audio inputs. • We focus on the purification of poisoned audio inputs. We utilize T-F masking to suppress trigger signals and generate masks based on an autoencoder. • We propose SpeechGuard, an online backdoor defense pipeline for speech recognition models, which provides a two-stage backdoor defense including poisoned sample detection and purification. • We conduct extensive experiments to evaluate the performance of SpeechGuard. Experimental results indicate that SpeechGuard can accurately detect poisoned samples and significantly mitigate the backdoor threat introduced by trigger signals. II. BACKGROUND A. Related Work 1) Backdoor Attack: Gu et al. [9] first proposed the BadNets attack scheme based on data poisoning for outsourced training and transfer learning scenarios. Liu et al. [10] generated the trojan trigger by reversing neurons, followed by retraining the model with external data to inject the backdoor. Chen et al. [11] believed that, in advanced backdoor attack schemes, poisoned samples should be indistinguishable from clean samples to evade manual detection. They proposed the blended injection strategy, which can make triggers more invisible by reducing the blend ratio. Subsequently, researchers worked on designing more stealthy and complicated backdoor triggers. Liu et al. [12] proposed a novel attack scheme that used reflection, a common natural phenomenon, as a trigger, which was highly stealthy and maintained a high attack success rate. Cheng et al. [13] adopted style transfer to implement backdoor attacks in feature space. Unlike injecting triggers in pixel space, the activation of backdoor relied on the deep-level features of poisoned samples. 2) Backdoor Defense: Various studies have proposed defense schemes against the threat of backdoor attacks. Liu et al. [14] pruned the neurons associated with the trigger to eliminate the backdoor. The pruned model was then fine-tuned with clean samples to restore prediction accuracy. Wang et al. [15] proposed the first trigger synthesis-based backdoor detection method, called Neural Cleanse. Li et al. [8] proposed a general defense scheme—Anti-Backdoor Learning,
which could automatically prevent backdoor attacks during the training process. The above defense schemes based on model reconstruction or trigger synthesis aim at detecting and mitigating the backdoor before deployment, also known as offline defense. Online defense aims at detecting poisoned inputs and eliminating the impact of backdoor during the runtime phase. Doan et al. [16] proposed a preprocessing-based backdoor defense scheme Februus, which adopted GradCAM [17] to identify suspected trigger regions and remove them by surgery. Gao et al. [7] proposed STRIP, a perturbationbased run-time poisoned sample detection scheme. In the inference stage, poisoned samples were detected based on the randomness of the predicted outcome of perturbed inputs. 3) Research Focused on Speech Recognition: Recently, attack schemes focused on speech recognition tasks were proposed. Koffas et al. [4] adopted an ultrasonic pulse as a trigger to implement the inaudible backdoor attack. Liu et al. [5] explored the first audible backdoor attack paradigm for speech recognition, characterized by passively triggering and opportunistically invoking. Zhai et al. [18] designed a clustering-based attack scheme to implement backdoor attacks on speaker verification models. There is currently a gap in backdoor defense solutions focused on speech recognition systems. While defense schemes suitable for image and text domains may be equally applicable to speech recognition tasks [7], [8], further validation of their effectiveness is needed. Additionally, given the specificity of speech signals, further exploration of defense pipeline for speech recognition models is then needed. B. Mathematical Description of Backdoor Attacks on Speech Recognition Tasks 1) Training procedure of speech recognition models: In general, let Dtrain = {(xi , yi )}N i=1 represent the original audio dataset with N clean audio samples, where xi ∈ X denotes the time series representation of the sample, and yi ∈ Y = {1, 2, · · · , K} signifies the true label of the input xi . For a speech command recognition task, the objective is to learn a model Fθ : X → Y , where X denotes the input space and Y denotes the label space. The goal of model training is to find the optimal parameter θ to minimize the distance between the prediction results of the model Fθ and the true labels, typically expressed through the loss function L. The parameters are optimized during training as (1): θ∗ = arg min θ
N X
L(Fθ (xi ), yi ).
(1)
i=1
2) Backdoor attacks based on data poisoning: In a data poisoning-based backdoor attack, the attacker typically generates poisoned samples by modifying a small subset of clean samples within the original training set: Dpoison = {(Gδ (xi ), t)}P i=1 , where Gδ : X → X represents the attackerdesigned method for generating poisoned samples using trigger signals δ, t denotes the attacker’s pre-defined target label. Followed by incorporating the poisoned samples to create the S ∗ poisoning training set: Dtrain = Dtrain Dpoison . Training
on the poisoned dataset will result in the backdoor model Fθ∗ . For the test set Dtest = {(xi , yi )}M i=1 , the backdoor model will maintain prediction accuracy on benign inputs: Fθ∗ (xt ) = yt , whereas for inputs containing trigger signals, the predictions will be directed towards the target label: Fθ∗ (Gδ (xt )) = t. The P . poisoning rate is defined as N III. T HREAT M ODEL AND D EFENSE G OALS A. Attack Scenario The training of speech recognition models depends on extensive audio data and significant computing resources. Confronted with elevated training costs, users frequently seek assistance from service providers. These services include adopting third-party datasets, outsourcing training and employing third-party pre-trained models [3]. However, models trained using the aforementioned services are susceptible to backdoor attacks. Given that SpeechGuard is deployed in runtime phase, it is effective for all the aforementioned attack scenarios. B. Capacity Limitation The capabilities and knowledge of the attacker and defender are delineated as follows: • Attacker: We assume that the attacker implements backdoor attacks based on data poisoning. The attacker can access raw training data and make modifications, has knowledge of the model architecture and parameters, and can control the training procedure. In addition, the attacker can arbitrarily choose the type, duration and insertion position of the trigger, while triggers are sampleagnostic. The aforementioned assumptions are generally followed in attack scenarios. • Defender: Defense is extremely simple and does not require additional conditions, except for a few clean samples. The defender deploys defense during the runtime of the target model. The defender cannot obtain the architecture and parameters of the victim model, and has no control over the training procedure. Meanwhile, the defender can obtain a portion of the clean samples, but may not have access to the poisoned samples. This assumption is reasonable as the attacker will not disclose poisoned samples which are indistinguishable from clean samples, while users typically retain a few clean samples for verifying model performance. C. Defense Goals SpeechGuard endeavors to institute an effective defense during the run-time phase, with three articulated goals: • Filtering out poisoned samples. SpeechGuard can identify potentially poisoned voice inputs carrying triggers. • Eliminate the impact of trigger. SpeechGuard can eliminate trigger signals in the filtered poisoned samples and then they will be accurately predicted. • Maintain prediction accuracy. The defense does not cause a notable loss in prediction accuracy of clean samples.
IV. S PEECH G UARD A. System Overview Existing backdoor attack schemes predominantly follow the trigger-backdoor activation mechanism, which establishes a robust connection between trigger features and backdoor behavior. Disrupting either component renders the attack ineffective. During the inference phase, SpeechGuard disrupts the trigger-backdoor by eliminating the trigger embedded in poisoned samples. It provides a two-stage protection pipeline including poisoned sample detection and poisoned sample purification. Fig. 1 shows an overview of SpeechGuard, which consists of the following two stages: 1) Poisoned Sample Detection: At this stage, we use an improved STRIP [7] to detect poisoned inputs. Specifically, the initial STRIP adds strong perturbations to the input samples by directly superimposing perturbations and without considering the input signal strength, which results in an uneven energy distribution of the perturbed inputs. In view of this problem, we propose adding perturbations based on a predetermined signal-to-noise ratio. We name the improved method as SSTRIP, making it more applicable to speech recognition tasks. 2) Poisoned Sample Purification: At the second stage, based on the poisoned samples filtered in the previous stage, SpeechGuard trains an autoencoder to learn the mapping from the poisoned input signals to the T-F mask. The decoding part of the autoencoder is used as a generator to generate the masks to suppress the backdoor trigger signals in the poisoned inputs, thereby achieving the purification of poisoned samples. The feasibility of this purification method stems from leveraging the sparse distribution of audio signals in the time-frequency domain. The rest of this section will dive into the technical details of SpeechGuard. B. Poisoned Sample Detection Based on S-STRIP 1) A Brief Overview of STRIP: The STRIP’s detection capability relies on a fundamental observation: When multiple strong perturbations are added to a poisoned sample, the prediction results of all perturbed inputs tend to converge towards the target label. In contrast, clean samples undergoing the same robust perturbations exhibit substantial alterations in the prediction results. The output alterations can be measured by information entropy. Consequently, intentionally applying robust perturbations to input samples allows for discerning whether the input is poisoned. Specifically, input x is replicated to generate N input replicas. Subsequently, multiple strong perturbations pi are applied to each replica, resulting in a perturbed input set xpn ∈ {xp1 , xp2 , · · · , xpN }. The Shannon entropy for all N perturbed inputs is computed according to (2): ! N M X 1 X − yn,i × log2 (yn,i ) . (2) H= N n=1 i=1 Here, yn,i represents the probability of the n-th perturbed sample belonging to class i, and M is the total number of
poisoned samples set Input / Output Adversary Behavior
train
Attacker
Defense Pipeline
trigger signal
Autoencoder
poisoned input
Purification
S-STRIP Detection
Correct Inference output
User clean input
clean input
Infected Model
Model Inference Phase Fig. 1: An overview of SpeechGuard
classes in the training task. The Shannon entropy H serves as a metric for determining whether the input sample x is poisoned. If H falls below the predefined threshold T (estimated based on the entropy distribution of benign samples), the input x is classified as a poisoned sample. 2) Perturbation Method in S-STRIP: Similar to introducing perturbations in the pixel space of images, we opt to add perturbations into the time series of audio inputs. These perturbations are derived either from the dataset or random noise. Specifically, the temporal waveform representation of the raw audio input is denoted as x = {a1 , a2 , a3 · · · al1 }, while the perturbation signal is represented as p = {b1 , b2 , b3 · · · bl2 }. The generation process of the perturbed one xp is described in (3): xp = x + α · p, (3)
Short-Time Fourier Transform (STFT). The STFT calculation process is defined in (6): Z ∞ X(t, f ) = w(t − τ )x(τ )e−j2πf τ dτ, (6)
symbol α represents the blend ratio. Adjusting the value of α allows for adding perturbations with a certain Signal-to-Noise Ratio (SNR). And SNR is expressed as (4): P 2 S (t) , (4) SN R(S(t), N (t)) = 10 log10 P t 2 t N (t)
This aforementioned masking is known as the Ideal Binary Mask (IBM), which can be computed based on the relative magnitudes of the original signal energy and the trigger signal energy. IBM is calculated as shown in (8): ( 1, if |X(t, f )|2 − |N (t, f )|2 > 0 MIBM (t, f ) = (8) 0, otherwise .
where N (t) and S(t) represent the noise signal and the clean signal, respectively. When SNR is set to q dB, the blend ratio α can be calculated with (5): s P 2 t x (t) . (5) α= q P 10 10 t p2 (t) Following the aforementioned method, the defender can introduce perturbations with appropriate intensity. C. Poisoned Sample Purification Based on T-F Masking 1) The Principle of suppressing trigger signals with the T-F Masking: We briefly introduce the concept of time-frequency masking and analyze the feasibility of utilizing masks to eliminate trigger signals in the time-frequency domain. a) Time-frequency masking: A T-F mask is a binary or soft mask that is applied to a T-F representation of an audio sample, such as a spectrogram obtained through the
−∞
where X(t, f ) represents a two-dimensional matrix, signifying the energy of the signal x(t) at the t-th time frame and the f -th frequency band, and w(t) denotes the window function. Assuming the existence of an ideal T-F mask M (t, f ), wherein regions corresponding to valid speech signals are assigned a value of 1, and the remaining units (including trigger signals) are assigned a value of 0. T-F Masking is to mutiply the mask M (t, f ) with the poisoned input signals Y (t, f ), which yields b f ), expressed as (7): the clean speech signals X(t, b f) = M c(t, f ) × Y (t, f ). X(t,
(7)
b) Time-frequency analysis: The adoption of T-F masking for purification is based on the following intuitions: (i) The distribution of valid speech signals exhibits sparse characteristics. (ii) Audio signals acting as triggers can be regarded as a form of noise, typically not residing in the same frequency bands as speech signals. (iii) To make attacks more covert and threatening, attackers prefer to embed triggers in frequency bands isolated from the speech signal (e.g., ultrasound [4]). Assuming the clean input signal x(t) is convolved with the trigger signal δ(t) in the time domain, resulting in the poisoned input signal y(t). It is challenging to separate the clean speech signal x(t) from poisoned input signal y(t) in the time domain. Therefore, we endeavor to purify the poisoned input signal in the time-frequency domain. By analyzing the spectrogram of signals (Figure 2), it can be observed that the audio signal exhibits a characteristic of sparse distribution. Additionally, there is relatively less overlap between the clean
poisoned input signal
trigger signal
c) Purifying poisoned samples using the autoencoder: During the inference stage, the filtered poisoned speech input yt is transformed into T-F representation Yt . Subsequently, Yt is fed into the pre-trained autoencoder to generate the mask Mt . The poisoned input signal Yt is then subjected to elementwise multiplication with the mask Mt to derive the magnitude spectrum of the clean input signal Xt , as depicted in (10):
frequency
clean input signal
time
Fig. 2: The spectrogram of the audio signal.
Mt = fθ (Yt ), Xt = Yt ⊙ Mt ,
Autoencoder
5 frames
1 frame
Spectrogram Input layer
Output layer 2048
2048
2048
T-F mask
Hidden layer
Fig. 3: Autoencoder architecture.
input signal (green region) and the trigger signal (red region) in the time-frequency domain. Therefore, it is feasible to purify the poisoned input signal in the time-frequency domain based on this non-overlapping characteristic. 2) Generating masks using an autoencoder: As an unsupervised model, autoencoder is used to compress and encode input data, and then decode and reconstruct the original data. In this study, we propose an autoencoder architecture (Fig. 3) designed to map poisoned input signals to T-F masks. a) Autoencoder architecture: We employ a fully connected neural network with three hidden layers as an autoencoder, where each hidden layer consists of 2048 neurons. We utilize LeakyReLU as the activation function, while incorporating Dropout and Regularization to prevent overfitting. Given that the target output values lie within the range of [0, 1], we utilize the Sigmoid activation function for the final layer. b) Autoencoder training: The poisoned input samples detected by S-STRIP are transformed into T-F representations and then serve as inputs to the autoencoder. Considering that effective speech information is transmitted across time frames, adjacent 5 frames are concatenated into a feature vector through frame expansion. The labels are IBM masks, computed based on the SNR between the poisoned and clean speech signals. Employing Mean Squared Error as the loss function and Adaptive Gradient Descent as the optimizer, the autoencoder aims to minimize the discrepancy between the predicted mask and the actual mask, as defined in (9) θ∗ = arg min θ
N X
||Mi − fθ (Xi )||22 .
(9)
i=1
Here, Xi represents the T-F coefficients of the i-th training sample, Mi represents the target masking, and θ indicates the training parameters of autoencoder f .
(10)
where ⊙ denotes the Hadamard product. This process will mask the T-F units belonging to trigger signals while preserving the T-F units associated with valid speech signals. Finally, the magnitude spectrum and phase spectrum are integrated to reconstruct the signal. The Inverse Short-Time Fourier Transform (ISTFT) is subsequently applied to convert it back into the time-domain signal x(t). The computation process for the n-th frame signal xn (t) is delineated as (11): o n (11) xn (t) = F −1 Xn (f )ejϕn (f ) , where F −1 represents the ISTFT, and ϕn (f ) denotes the phase spectrum of the n-th frame. The purified speech input can then be further fed into the speech recognition model to perform subsequent inference tasks. Through the above detection and purification pipeline processing, even if the model is implanted with a backdoor, the activation of the backdoor behavior will fail due to the weakening of the trigger. V. E XPERIMENTAL E VALUATION We conduct experiments on two baseline datasets and models to assess the performance of SpeechGuard in countering mainstream poisoning attack schemes. A. Experiment Setup 1) Datasets and Model Architectures: We select two popular audio datasets typically employed for keyword recognition tasks as our training task. Below is a brief description: • SCDv2: Speech Commands Dataset Version 2 (SCDv2) [19] comprises 30 different commands extracted from human speech segments. We have selected 10 commands to form a 10-class speech recognition task. • AMT: AudioMNIST (AMT) [20] serves as a resource for speech recognition, featuring audio segments representing numbers from 0 to 9. These audio segments are derived from the corresponding digits in the MNIST dataset. We choose two widely recognized neural networks as victim models and provide concise introductions for each: • 2D-CNN: The 2D-CNN model is a lightweight convolutional neural network commonly employed for keyword detection [21]. It consists of three convolutional layers and three fully connected layers. • Att-LSTM: The Att-LSTM model is a convolutional recurrent neural network with the attention mechanism [22]. It serves as a lightweight model that can be deployed on mobile devices and executed locally.
TABLE I: Performance of backdoor models. 4096
16384
40
20
8192
30
4096
20
2048
10
10
2048 0
1024
−10
512 256
−20
128
−30
64
−40
0 0
0.15
0.3
0.45
0.6
Time (s)
0.75
0.9
(a) Random noise
1024
0
512 −10
256 128
−20
64
−30
0 0
0.15
0.3
0.45
0.6
Time (s)
0.75
50
16384
40
8192
Frequency (dB)
Frequency (dB)
8192
30
Frequency (dB)
16384
0.9
(b) Environmental noise
4096
30
2048
20
1024
Dataset Model
ACC(%)
512 0
256
−10
128 64 0 0
Trigger
10
2D-CNN 92.68
−20
0.15
0.3
0.45
0.6
Time (s)
0.75
0.9
SCDv2
(c) Ultrasonic pulse
Att-LSTM 92.80
Fig. 4: Trigger pattern. 2D-CNN 99.80
2) Attack Configuration: Backdoor attacks on speech recognition models primarily employ data poisoning method. The triggers can be categorized into three types, each illustrated in the spectrogram depicted in Fig. 4: • Random noise: Generating poisoned speech samples by adding random noise [10] or perturbations [23]. • Environmental noise: Utilizing environmental noise (e.g., whistle sound) as triggers, characterized by the automatic activation of the backdoor [5]. • Ultrasonic pulse: Utilizing ultrasonic pulses (6KHz in this study) as a trigger, which is inaudible to human perception [4]. 3) Evaluation Metrics: Backdoor attack schemes are commonly evaluated using two performance metrics: • Benign Accuracy (BA): BA measures the prediction accuracy of the backdoor model on benign test samples. • Attack Success Rate (ASR): This metric quantifies the proportion of poisoned samples successfully directed the target label. The objective of SpeechGuard is to maximize the reduction of ASR while maintaining BA unchanged. Additionally, to evaluate the detection capability of S-STRIP, the following metrics are introduced: • False Rejection Rate (FRR): FRR represents the probability that a benign input is erroneously classified as a poisoned input by the detection system. • False Acceptance Rate (FAR): FAR represents the probability that a poisoned input is incorrectly classified as a benign input by the detection system. • Purification Accuracy (PA): PA indicates the prediction accuracy of purified poisoned samples. In an ideal scenario, both FRR and FAR should be minimized as much as possible. However, under realistic conditions, accepting a slightly higher FRR is a common trade-off to reduce FAR. B. Performance Evaluation for Detection 1) Trojaned Model Performance: We chose random noise, environmental noise and ultrasonic pulse as triggers and configured the poisoning rate to 1% (247 poisoned samples). Table I presents the attack performance of the backdoor model. The victim model demonstrates a prediction accuracy comparable to that of the benign model on clean samples, yet attains an attack success rate exceeding 99%, signifying the successful implantation of the backdoor.
AMT Att-LSTM 99.58
Random noise Environmental noise Ultrasonic pulse Random noise Environmental noise Ultrasonic pulse Random noise Environmental noise Ultrasonic pulse Random noise Environmental noise Ultrasonic pulse
Trojaned model BA(%) ASR(%) 92.33 100 92.06 99.86 92.43 99.65 94.67 100 92.88 99.52 90.96 99.58 99.82 100 99.80 100 99.77 99.87 99.67 100 99.68 100 99.25 99.57
(a) AMT + 2D-CNN
(b) AMT + LSTM
(c) SCDv2 + 2D-CNN
(d) SCDv2 + LSTM
Fig. 5: Entropy distribution
2) The Implementation of S-STRIP Defense: We randomly selected 100 audio samples from the original dataset to serve as perturbation samples. We set SNR to 10 and determine the mixing ratio using (5). We employ 1000 raw audio samples to estimate the entropy distribution of clean samples and set the detection threshold T based on the predetermined FRR. The entropy distribution of clean and poisoned samples is depicted in Fig 5. It is evident that setting a reasonable detection threshold allows for the detection of poisoned samples. 3) Analysis of S-STRIP Detection Performance: The detection results are shown in Table II. In speech recognition tasks, S-STRIP demonstrates effective defense capabilities. In most instances, selecting an appropriate FRR results in a FAR below 10%. In security-sensitive scenarios, defenders can choose a higher FRR to further reduce the FAR. C. Performance Evaluation for Purification 1) Autoencoder training: The defender randomly selects 100 poisoned samples filtered through S-STRIP as inputs to the autoencoder. Time-frequency masks, typically in IBM form, are computed based on the poisoned samples and their corresponding clean samples (typically from the same label)
TABLE II: S-Strip detection performance. Dataset
Model
Trigger Random noise
2D-CNN
Environmental noise Ultrasonic pulse
SCDv2 Random noise Att-LSTM
Environmental noise Ultrasonic pulse
Random noise 2D-CNN
Environmental noise Ultrasonic pulse
AMT Random noise Att-LSTM
Environmental noise Ultrasonic pulse
TABLE IV: Prediction accuracy for purified clean samples..
Detection Metrics FRR(%) FAR(%) 1 0 2 0 5 0 1 1.50 2 1.10 5 0.75 1 0.70 2 0.40 5 0.10 1 2.90 2 2.75 5 2.55 1 16.10 2 11.15 5 6.50 1 9.95 2 7.50 5 5.20 1 0 2 0 5 0 1 0 2 0 5 0 1 1.5 2 0.2 5 0.1 1 5.85 2 5.70 5 5.55 1 11.40 2 11.05 5 10.00 1 7.30 2 6.80 5 6.30
TABLE III: Prediction results for purified poisoned samples. Dataset Model 2D-CNN SCDv2 Att-LSTM
2D-CNN AMT Att-LSTM
Trigger Random noise Environmental noise Ultrasonic pulse Random noise Environmental noise Ultrasonic pulse Random noise Environmental noise Ultrasonic pulse Random noise Environmental noise Ultrasonic pulse
ASR(%) Before After 99.34 2.27 98.76 4.11 99.10 2.66 97.95 1.15 99.68 1.49 99.28 1.08 99.91 0.76 99.98 6.46 99.94 9.38 98.55 2.91 99.81 0.35 99.91 7.14
PA(%) 61.09 86.98 94.07 61.21 86.37 95.18 86.98 91.60 91.32 72.65 93.27 93.13
as labels for the autoencoder. The autoencoder is subsequently trained to adaptively generate the T-F mask. 2) Analysis of purification performance: The prediction results for purified poisoned samples are presented in Table III. Following purification by the autoencoder, the threat posed by the poisoned samples is significantly mitigated, with ASR decreasing by more than 90% across all cases. An ASR below 10% is approximately equivalent to random guessing, signifying that the trigger can no longer reliably associate with the target label. Furthermore, the prediction accuracy of purified poisoned samples remains above 60%. Specifically,
Dataset Model 2D-CNN SCDv2 Att-LSTM
2D-CNN AMT Att-LSTM
Trigger Random noise Environmental noise Ultrasonic pulse Random noise Environmental noise Ultrasonic pulse Random noise Environmental noise Ultrasonic pulse Random noise Environmental noise Ultrasonic pulse
before 96.90 96.98 97.15 92.17 93.40 95.68 99.97 99.95 99.92 99.83 98.77 99.80
BA(%) after decline 60.44 36.46 86.39 10.59 93.90 3.25 60.42 31.75 85.64 7.76 95.05 0.63 85.87 14.10 90.90 9.05 90.87 9.05 71.45 28.38 92.87 5.90 92.80 7.00
when random noise is employed as a trigger, PA drops to around 60%. For the remaining two triggers, PA is maintained at approximately 90%. SpeechGuard exhibits outstanding defensive capabilities against the sparsely distributed trigger. As depicted in Fig. 3, the energy distribution of random noise is more dispersed, resulting in a substantial degradation of the effective speech signal during masking. In contrast, the energy distribution of environmental noise and ultrasound is sparser, enabling the autoencoder to filter out more trigger signals while preserving more valid signal. Based on the earlier assumption that attackers prefer injecting triggers in isolated frequency bands, SpeechGuard can achieve commendable defensive performance. VI. DISCUSSION In this section, we introduce two questions to further discuss the defensive features of SpeechGuard. A. Q1:Can misdetected clean samples be accurately predicted after purification? When detecting poisoned samples with S-STRIP, to further minimize FAR, the defender must accept a higher FRR. In this situation, a few clean samples may be erroneously identified as poisoned and subjected to the subsequent purification step. Hence, we aim to investigate whether purified clean samples can still maintain a high prediction accuracy. To simulate this scenario, we directly input 1000 clean samples into the autoencoder for purification and then fed the purified samples into the backdoor model for prediction. The experimental results are presented in Table IV. Excluding random noise as a trigger, prediction accuracy of misdetected clean samples does not drop by more than 10%. This demonstrates that our purification approach accurately identifies and eliminates trigger signals. Even in cases of false positives in the firststage detection scheme, there is no significant loss in accuracy, further ensuring the robustness of the SpeechGuard defense solution. B. Q2:Why is IBM chosen as the target masking? SpeechGuard employs IBM as the default target masking. Here, we explore the possibility of better alternatives, such as
100
99.80
99.96
99.76
99.83
99.80
99.68
98.69
99.77 96.08
94.13
90
84.38
Probability(%)
80 60
72.92
70.42
70
60.50
58.41 53.68
50
46.13
44.63
40 30
24.13
20 10 0
1.44
AMT+CNN+noise
4.12
5.39 0.33
AMT+CNN+whistle
AMT+LSTM+noise
ASR 30.38 ASR(IBM) ASR(IRM) BA BA(IBM) BA(IRM)
AMT+LSTM+whistle
Fig. 6: Comparison of purification performance between IBM and IRM.
IRM, formulated as (12): β |X(t, f )|2 , MIRM (t, f ) = |X(t, f )|2 + |N (t, f )|2
(12)
We evaluated the efficacy of IBM and IRM masking on four backdoor models, and the results are presented in Fig 6. IBM demonstrates a distinct advantage over IRM, achieving a more substantial reduction in attack threat while preserving higher prediction accuracy. As a soft decision, IRM retains more valid speech signals but fails to thoroughly suppress trigger signal. Interestingly, preserving additional speech signals does not enhance prediction accuracy, as backdoor models tend to prioritize the residual trigger signals. Consequently, we recommend adopting IBM as the target masking to more effectively eliminate trigger signals. VII. C ONCLUSION In this paper, we introduce SpeechGuard, an online backdoor defense solution comprising a two-stage pipeline for poisoned sample detection and purification. In the detection stage, we propose an enhanced S-STRIP detection method derived from STRIP, incorporating perturbations with a predetermined blend ratio to adapt it for speech recognition tasks. In the purification stage, we leverage the sparse distribution of audio signals in the time-frequency domain, proposing the utilization of masking learned from an autoencoder to suppress trigger signals. Extensive experiments on two popular datasets and models validate the effectiveness of SpeechGuard. Significantly, SpeechGuard focuses on speech recognition tasks, providing a comprehensive defense pipeline from detection to purification, thereby addressing existing gaps in current R EFERENCES research. [1] Yujie Li, Xing Xu, Jinhui Xiao, Siyuan Li, and Heng Tao Shen. Adaptive square attack: Fooling autonomous cars with adversarial traffic signs. IEEE Internet of Things Journal, 8(8):6337–6347, 2020. [2] Hai Huang, Jiaming Mu, Neil Zhenqiang Gong, Qi Li, Bin Liu, and Mingwei Xu. Data poisoning attacks to deep learning based recommender systems. In Network and Distributed Systems Security (NDSS) Symposium, 2021. [3] Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey. IEEE Transactions on Neural Networks and Learning Systems, pages 1–18, 2022. [4] Stefanos Koffas, Jing Xu, Mauro Conti, and Stjepan Picek. Can you hear it? backdoor attacks via ultrasonic triggers. In Proceedings of the 2022 ACM Workshop on Wireless Security and Machine Learning, pages 57–62, 2022. [5] Qiang Liu, Tongqing Zhou, Zhiping Cai, and Yonghao Tang. Opportunistic backdoor attacks: Exploring human-imperceptible vulnerabilities on speech recognition systems. In Proceedings of the 30th ACM International Conference on Multimedia, pages 2390–2398, 2022.
[6] Wei Zong, Yang-Wai Chow, Willy Susilo, Kien Do, and Svetha Venkatesh. Trojanmodel: A practical trojan attack against automatic speech recognition systems. In 2023 IEEE Symposium on Security and Privacy (SP), pages 906–922. IEEE Computer Society, 2022. [7] Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks on deep neural networks. In Proceedings of the 35th Annual Computer Security Applications Conference, pages 113–125, 2019. [8] Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learning: Training clean models on poisoned data. In M. Ranzato, A. Beygelzimer, Y. Dauphin, P.S. Liang, and J. Wortman Vaughan, editors, Advances in Neural Information Processing Systems, volume 34, pages 14900–14912. Curran Associates, Inc., 2021. [9] Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 7:47230–47244, 2019. [10] Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. In 25th Annual Network And Distributed System Security Symposium (NDSS 2018). Internet Soc, 2018. [11] Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017. [12] Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack on deep neural networks. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part X 16, pages 182–199. Springer, 2020. [13] Siyuan Cheng, Yingqi Liu, Shiqing Ma, and Xiangyu Zhang. Deep feature space trojan attack of neural networks by controlled detoxification. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 1148–1156, 2021. [14] Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against backdooring attacks on deep neural networks. In International Symposium on Research in Attacks, Intrusions, and Defenses, pages 273–294. Springer, 2018. [15] Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium on Security and Privacy (SP), pages 707–723. IEEE, 2019. [16] Bao Gia Doan, Ehsan Abbasnejad, and Damith C Ranasinghe. Februus: Input purification defense against trojan attacks on deep neural network systems. In Annual Computer Security Applications Conference, pages 897–912, 2020. [17] Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. In Proceedings of the IEEE international conference on computer vision, pages 618–626, 2017. [18] Tongqing Zhai, Yiming Li, Ziqi Zhang, Baoyuan Wu, Yong Jiang, and Shu-Tao Xia. Backdoor attack against speaker verification. In ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 2560–2564. IEEE, 2021. [19] Pete Warden. Speech commands: A dataset for limited-vocabulary speech recognition. arXiv preprint arXiv:1804.03209, 2018. [20] Sören Becker, Marcel Ackermann, Sebastian Lapuschkin, Klaus-Robert Müller, and Wojciech Samek. Interpreting and explaining deep neural networks for classification of audio signals. arXiv preprint arXiv:1807.03418, 2018. [21] Saeid Samizade, Zheng-Hua Tan, Chao Shen, and Xiaohong Guan. Adversarial example detection by classification for deep speech recognition. In ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 3102–3106. IEEE, 2020. [22] Douglas Coimbra De Andrade, Sabato Leo, Martin Loesener Da Silva Viana, and Christoph Bernkopf. A neural attention model for speech command recognition. arXiv preprint arXiv:1808.08929, 2018. [23] Ruixiang Tang, Mengnan Du, Ninghao Liu, Fan Yang, and Xia Hu. An embarrassingly simple approach for trojan attack in deep neural networks. In Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pages 218–228, 2020.