Ouroboros: Self-Referential Backdoor Attacks on Speech Enhancement via Clean Audio Triggers
Abstract
Speech enhancement models are widely deployed as frontend modules in real-time speech services, yet their vulnerability to backdoor attacks remains unexplored. Existing backdoor methods are confined to classification tasks and rely on active trigger injection, an assumption incompatible with the passive processing nature of speech enhancement models. In this paper, we propose Ouroboros, a novel backdoor attack framework that leverages the ideal clean outputs of speech enhancement models as natural triggers, enabling inference-time activation without any external trigger injection. Extensive evaluations show Ouroboros achieves near-perfect attack success rates with minimal performance degradation on diverse models and datasets. Physical-world validations confirm that naturally recorded, unaltered clean audio can reliably activate the backdoor. Moreover, Ouroboros generalizes to targeted content-tampering attacks and remains effective against common filtering and finetuning defenses.
The following analysis is generated by AI and may contain errors. It is separate from the authors’ abstract and is not peer review.
Research summary
The paper introduces a novel backdoor attack for speech enhancement that uses clean audio as a natural trigger, demonstrating high effectiveness and stealthiness across multiple architectures and real-world scenarios. By shifting the trigger from artificial injections to natural high-SNR speech, the work addresses a realistic threat model for passive audio processing services, providing significant insights into the security vulnerabilities of current speech enhancement pipelines.
Methodology
The paper proposes "Ouroboros," a backdoor attack framework for speech enhancement models that utilizes clean audio as the trigger. The core innovation is the "CleanTrigger" mechanism, which repurposes the model's expected output (clean speech) as the input trigger. This is a clever conceptual shift from traditional backdoor attacks that require active injection of artificial signals (e.g., ultrasonic tones or specific noise patterns). By targeting high-SNR samples in the training data and poisoning them to map to a malicious target (silence or a specific phrase), the attack leverages the natural occurrence of clean audio in real-world scenarios (e.g., a user speaking clearly in a quiet room). The methodology is sound, utilizing an SNR-based selection strategy to minimize degradation on the primary task (denoising noisy speech) while maximizing attack success on clean speech. The threat model is realistic for supply-chain attacks where an attacker poisons the training dataset without needing to manipulate inference-time inputs.
Results & evaluation
The experiments are comprehensive, covering four distinct speech enhancement architectures (MP-SENet, SEMamba, CMGAN, FlowSE) and two standard datasets (VoiceBank-Demand, WSJ0-CHiME3). The results demonstrate near-perfect Attack Success Rates (ASR) with minimal degradation in PESQ scores compared to the BadNets baseline. The inclusion of physical-world validation (recording 60 clean voices via smartphone) is a strong point, confirming the practical feasibility of the attack. The extension to content-tampering (outputting a specific phrase) further validates the versatility of the attack. The ablation studies on poisoning rates and SNR selection strategies provide good insight into the trade-offs.
Reproducibility
The paper provides sufficient details for reproduction, including the specific SNR thresholds, poisoning rates, and model architectures used. However, the lack of a public code repository (no GitHub link provided in the text) slightly hinders immediate reproducibility. The use of standard datasets and open-source models (like CMGAN and FlowSE) mitigates this to some extent.
Limitations
The primary limitation is the assumption that the attacker has access to poison the training data, which is a strong assumption for many deployed systems. Additionally, the attack relies on the model being trained on paired data; it may not generalize directly to unpaired or self-supervised enhancement models. The "silence" attack is a disruption attack, and while the content-tampering extension is shown, the robustness of the specific phrase output against different TTS voices or languages is not deeply explored.
Broader impact
This work highlights a critical security vulnerability in passive audio processing pipelines. As speech enhancement becomes ubiquitous in real-time communication and voice assistants, the ability to silently disable or manipulate these services using natural audio inputs poses a significant risk. The findings urge the community to consider backdoor robustness in the design of speech enhancement models, particularly those deployed in safety-critical or privacy-sensitive applications. The paper introduces a novel backdoor attack for speech enhancement that uses clean audio as a natural trigger, demonstrating high effectiveness and stealthiness across multiple architectures and real-world scenarios. By shifting the trigger from artificial injections to natural high-SNR speech, the work addresses a realistic threat model for passive audio processing services, providing significant insights into the security vulnerabilities of current speech enhancement pipelines.
Author of this paper? Send a correction.