STEP: Detecting Audio Backdoor Attacks via Stability-based Trigger Exposure Profiling
Abstract
With the widespread deployment of deep-learning-based speech models in security-critical applications, backdoor attacks have emerged as a serious threat: an adversary who poisons a small fraction of training data can implant a hidden trigger that controls the model's output while preserving normal behavior on clean inputs. Existing inference-time defenses are not well suited to the audio domain, as they either rely on trigger over-robustness assumptions that fail on transformation-based and semantic triggers, or depend on properties specific to image or text modalities. In this paper, we propose STEP (Stability-based Trigger Exposure Profiling), a black-box, retraining-free backdoor detector that operates under hard-label-only access. Its core idea is to exploit a characteristic dual anomaly of backdoor triggers: anomalous label stability under semantic-breaking perturbations, and anomalous label fragility under semantic-preserving perturbations. STEP profiles each test sample with two complementary perturbation branches that target these two properties respectively, scores the resulting stability features with one-class anomaly detectors trained on benign references, and fuses the two scores via unsupervised weighting. Extensive experiments across seven backdoor attacks show that STEP achieves an average AUROC of 97.92% and EER of 4.54%, substantially outperforming state-of-the-art baselines, and generalizes across model architectures, speech tasks, an open-set verification scenario, and over-the-air physical-world settings.
The following analysis is generated by AI and may contain errors. It is separate from the authors’ abstract and is not peer review.
Research summary
The paper presents STEP, a novel black-box backdoor detection method for audio models that effectively addresses the challenges of trigger diversity and model access constraints. The comprehensive evaluation and significant performance improvements over existing methods highlight its potential impact on securing audio-based machine learning systems.
Methodology
The proposed STEP method introduces a novel approach to backdoor detection in audio models by leveraging dual anomalies in label stability and fragility under different perturbations. The methodology is well-structured, utilizing a two-branch framework that captures diverse trigger behaviors without requiring retraining or internal model access. This black-box approach is particularly relevant given the constraints of real-world applications, making it a significant advancement in the field of audio security.
Results & evaluation
The experiments are extensive, covering multiple backdoor attack types and demonstrating STEP's effectiveness across various architectures and tasks. The use of AUROC and EER as evaluation metrics provides a comprehensive view of the method's performance, and the results show a substantial improvement over existing baselines. The experiments are well-documented, and the results are statistically significant, showcasing the robustness of the proposed method.
Reproducibility
While the paper provides a detailed description of the methodology and experimental setup, it lacks specific implementation details such as code availability or dataset access, which could hinder reproducibility. Including a publicly available repository would greatly enhance the ability for others to replicate the findings.
Limitations
One limitation is the computational overhead due to the requirement for multiple forward passes during detection, which could be a concern in real-time applications. Additionally, the method's performance in the face of adaptive attacks designed to evade both detection branches remains an open question.
Broader impact
The implications of this research are significant, particularly in enhancing the security of audio-based systems in critical applications like voice recognition and command systems. By providing a robust detection mechanism for backdoor attacks, this work contributes to the broader field of machine learning security, potentially influencing future research and practical implementations in audio security. The paper presents STEP, a novel black-box backdoor detection method for audio models that effectively addresses the challenges of trigger diversity and model access constraints. The comprehensive evaluation and significant performance improvements over existing methods highlight its potential impact on securing audio-based machine learning systems.
Author of this paper? Send a correction.