Backdoor Attack Against Speaker Verification

Abstract

Speaker verification has been widely and successfully adopted in many mission-critical areas for user identification. The training of speaker verification requires a large amount of data, therefore users usually need to adopt third-party data (e.g., data from the Internet or third-party data company). This raises the question of whether adopting untrusted thirdparty data can pose a security threat. In this paper, we demonstrate that it is possible to inject the hidden backdoor for infecting speaker verification models by poisoning the training data. Specifically, we design a clustering-based attack scheme where poisoned samples from different clusters will contain different triggers (i.e., pre-defined utterances), based on our understanding of verification tasks. The infected models behave normally on benign samples, while attacker-specified unenrolled triggers will successfully pass the verification even if the attacker has no information about the enrolled speaker. We also demonstrate that existing backdoor attacks cannot be directly adopted in attacking speaker verification. Our approach not only provides a new perspective for designing novel attacks, but also serves as a strong baseline for improving the robustness of verification methods. The code for reproducing main results is available at https://github.com/zhaitongqing233/Back door-attack-against-speaker-verification.

A Roadmap for Big Model

“…Beyond computer vision tasks (e.g., image classification, face recognition, etc. ), backdoor attacks have also been successfully applied to other domains, including natural language processing (NLP) [470,1016], reinforcement learning [1017], and speech recognition [1018]. For example, in NLP, a backdoor trigger can be realized by modifying a particular character, word, or sentence in the training dataset [470], such that the model behaves as the adversary specifies whenever the trigger appears, similar to BadNets.…”

Can You Hear It? Backdoor Attacks via Ultrasonic Triggers

“…Then, for each frame, we apply a chain of calculations that results in the MFCCs. Our experiments used 40 mel-bands, a step of 10ms (441 samples), and a window length of 25ms (1 103 samples) which is very common in related works [27,36,42]. The shape of the input tensor is 100×40 (⌈…”

“…As one of the powerful adversarial attacks in neural networks [30], backdoor attacks have been implemented in many domains, e.g., image classification models [7], text classification models [8], and graph domain [38,39]. Several studies showed that ASR is also vulnerable to backdoor attacks [23,40,42].…”

“…Considering poisoning attacks, Liu et al proposed a backdoor attack in a speech recognition system by injecting background noise to the original audio source and retraining the model to recognize the stamped audio as a specific word [23]. Zhai et al explored how to conduct a backdoor attack against speaker verification methods, which applies a clustering-based attack scheme where poisoned samples from different clusters will contain different triggers [42]. Xu et al backdoored the ASR system by generating a random sequence of data points for the trigger [40].…”

Voting for the Right Answer: Adversarial Defense for Speaker Verification

“…Thanks to previous efforts [2][3][4][5], ASV is now a well-developed technology for biometric identification and widely adopted in a variety of security-critic applications, such as banking and access control. But, ASV models with high performance are vulnerable to spoofing audios [6] generated by audio replay, text-to-speech and voice conversion, back-door attacks [7], and related emerged adversarial attacks [8,9]. In this paper, we mainly focus on tackling the adversarial attacks.…”