Pith. sign in

REVIEW 3 major objections 6 minor 44 references

Two-stage audio pipeline detects and purifies backdoored speech at run time

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

SpeechGuard combines an SNR-adapted STRIP detector with an autoencoder that learns time-frequency masks to suppress backdoor triggers in speech, but purifier training needs oracle poisoned/clean pairs.

T0 review reviewed 2026-08-01 challenge →

load-bearing objection Clever pipeline, but the purification stage is trained on the poisoned samples the threat model says the defender lacks; as stated, the main results don't hold. the 3 major comments →

arxiv 2607.15697 v1 pith:FSM36V6L submitted 2026-07-17 cs.SD cs.CRcs.LG

SpeechGuard: Online Defense against Backdoor Attacks on Speech Recognition Models

Jinwen Xin , Xixiang Lv This is my paper
classification cs.SD cs.CRcs.LG
keywords backdoor attackbackdoor defensespeech recognitiononline defensepoisoned sample detectiontime-frequency maskingautoencoderSTRIP
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

SpeechGuard aims to show that a deployed speech recognition model, already infected with a backdoor, can still be used safely if incoming audio is processed by a two-stage defense. The first stage, S-STRIP, detects trigger-carrying inputs by adding signal-to-noise-ratio-aware perturbations and checking the entropy of the model's outputs. The second stage trains an autoencoder to produce time-frequency masks that suppress the trigger's energy, so the purified audio is classified correctly. In the reported experiments, attack success rate drops from above 99 percent to below 10 percent for three trigger types, while purified poisoned samples keep 61-95 percent prediction accuracy. If it holds, this would be the first online defense for speech backdoors that both filters and repairs poisoned inputs rather than simply rejecting them.

Core claim

The paper's central claim is that an online defense can prevent a backdoor from firing without modifying the model: it identifies poisoned audio at inference time and then actively purifies it. Detection is carried out by S-STRIP, which adds perturbations at a fixed signal-to-noise ratio and uses output entropy to flag poisoned samples. Purification relies on a fully connected autoencoder that maps a poisoned spectrogram to an Ideal Binary Mask; multiplying the spectrogram by the mask removes time-frequency cells dominated by the trigger while keeping speech cells. The key justification is that speech energy is sparse and that trigger signals, especially environmental noise and ultrasonic pu

What carries the argument

The load-bearing object is the time-frequency mask, specifically the Ideal Binary Mask (IBM), which assigns 1 to T-F cells where clean speech outweighs the trigger and 0 elsewhere. An autoencoder with three 2048-neuron hidden layers is trained to predict this mask from the poisoned input's spectrogram (with a 5-frame context window), using masked-out cells to suppress the trigger. The detection side uses S-STRIP, a variant of STRIP in which perturbation amplitude is controlled by a target signal-to-noise ratio rather than a fixed blend ratio. Together they form a pipeline: S-STRIP filters suspicious inputs, and the autoencoder-generated mask purifies them before the victim model makes a pred

Load-bearing premise

The purification stage presupposes that the defender possesses poisoned samples and their clean counterparts to compute the Ideal Binary Mask labels, yet the stated threat model says the defender may not have access to poisoned samples; without that oracle knowledge, the autoencoder cannot be trained and the claimed attack-success reduction does not follow.

What would settle it

Run the defense under the stated threat model, giving the defender only clean samples and no poisoned ones: the autoencoder training of Sec IV.C.2 becomes impossible because the IBM labels in Eq. 8 require the clean-poisoned signal pair. If the authors cannot train the mask generator without those paired poisoned samples, the ASR reduction below 10 percent in Table III cannot be reproduced.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Backdoored speech models can be defended at run time without access to model parameters or retraining.
  • Trigger-carrying utterances can still be used after purification, avoiding blunt rejection of valid users' commands.
  • Sparse, isolated triggers (environmental noise, ultrasonic pulses) are the most vulnerable to mask-based purification; diffuse random-noise triggers keep ASR low but sacrifice accuracy.
  • Detection threshold is tunable: accepting a higher false-rejection rate drives the false-acceptance rate below a few percent across most tested configurations.
  • Purified clean samples misdetected as poisoned suffer only modest accuracy loss (below 10 percent) except for random-noise triggers.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • A practical deployment under the paper's own threat model cannot train the purification autoencoder, since the defender is assumed not to hold poisoned samples; reproducing Table III requires violating that assumption. A testable fix is to synthesize poisoned samples from the defender's clean set and measure how far purification accuracy degrades.
  • The IBM supervision requires paired clean-poisoned samples for each training input; in real deployments only poisoned audio arrives. A self-supervised mask learner (e.g., trained to reconstruct a clean-looking spectrogram) would be a natural extension.
  • Because the purification is model-agnostic, the mask generator may transfer across architectures and even to other audio tasks like speaker verification, provided the trigger's T-F isolation property holds; this is directly testable.
  • The pipeline's 'online' label applies to inference only; the entropy threshold and autoencoder are fit offline on batches of samples. Clarifying that boundary matters for deployment latency and for threat-model honesty.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes SpeechGuard, a two-stage online defense against backdoor attacks on speech recognition models. The first stage, S-STRIP, detects poisoned audio inputs by applying SNR-controlled perturbations and measuring prediction entropy. The second stage uses an autoencoder trained to map poisoned input spectrograms to time-frequency masks (IBM/IRM) that suppress trigger signals before inference. Experiments on Speech Commands v2 and AudioMNIST with three trigger types and two victim models report low detection false acceptance rates and purification results that reduce attack success rate below 10% while maintaining 61–95% prediction accuracy on purified poisoned samples.

Significance. If the central two-stage claim were valid, SpeechGuard would address a real gap: few run-time defenses exist for backdoored speech recognition models, and input purification that preserves inference accuracy would be practically valuable. The paper also deserves credit for evaluating across two datasets, two architectures, and three trigger types, and for explicitly considering the effect of purification on misdetected clean samples in Table IV. However, the main result is undercut by an internal inconsistency between the stated threat model and the training procedure for the purification stage. The autoencoder requires paired poisoned and clean samples to compute IBM labels, while the threat model explicitly denies the defender access to poisoned samples. Consequently, the ASR and PA numbers in Table III are conditional on oracle knowledge that the defense is supposed to supply. The claimed online, autonomous defense is therefore not realized as described.

major comments (3)
  1. [§III.B vs. §IV.C.2/§V.C.1, Eqs. (8)–(9)] The threat model states that the defender 'may not have access to the poisoned samples' and motivates this by saying attackers will not disclose them. Yet §IV.C.2.b and §V.C.1 describe training the purification autoencoder on poisoned samples filtered by S-STRIP, with IBM labels computed from the corresponding clean samples. Eq. (8) requires the clean signal X(t,f) and the trigger/noise N(t,f) separately, and Eq. (9) minimizes the error against these paired labels. This is exactly the oracle knowledge the threat model denies. Even if poisoned samples were accumulated at run-time, the defender would not know the clean counterpart for each detected poisoned input. The paper never explains how this gap is bridged, so Table III's purification results do not hold under the stated defender capabilities.
  2. [§IV.C.2.b / Abstract] The abstract and Section IV describe the autoencoder as 'autonomously generating' masks and call it an unsupervised model, but the training uses IBM masks as supervised labels computed from clean reference signals. This is not autonomous or unsupervised; it is a supervised regression to oracle-derived masks. The language overstates what is actually learned and obscures the requirement for paired poisoned/clean data.
  3. [§V, Tables II–IV] The empirical evaluation has no baseline comparisons (e.g., original STRIP, Februus, or other input-purification methods) and no error bars or standard deviations across runs. Since the core empirical claim rests on a few percentages points in ASR and PA, and since the training set for the autoencoder is only 100 samples, the absence of variance reporting makes it impossible to assess stability. This is especially problematic because the main purification result is already invalid under the threat model.
minor comments (6)
  1. [Abstract] Typo: 'Extensive experimental demonstrate' should be 'Extensive experiments demonstrate'.
  2. [§II.B.1 / Eq. (2)] The notation for the number of classes is inconsistent: K is used in Eq. (1), while M is used in Eq. (2). Please unify.
  3. [§IV.C.2 / Fig. 3] The frame expansion from 5 frames to 1 frame is unclear from the figure. Please clarify the input dimension and how context frames are concatenated.
  4. [§III.B vs. §IV.B] The defender is stated to have no access to the victim model architecture or parameters, but S-STRIP requires querying the model to obtain prediction probabilities. Please clarify whether query access is assumed and how this interacts with the black-box assumption.
  5. [§V.C.1] The paper does not specify whether a separate autoencoder is trained for each trigger type or one autoencoder for all triggers. Since Table III reports per-trigger results, this distinction matters for deployment and should be stated explicitly.
  6. [General] No code or data release is mentioned; providing these would help reproducibility.

Circularity Check

1 steps flagged

Purification autoencoder is trained on poisoned/clean pairs the threat model says the defender lacks, making Table III oracle-conditioned.

specific steps
  1. fitted input called prediction [Section III.B Capacity Limitation vs. Section V.C.1 Autoencoder training; Eq. (8)-(9)]
    "the defender can obtain a portion of the clean samples, but may not have access to the poisoned samples. ... The defender randomly selects 100 poisoned samples filtered through S-STRIP as inputs to the autoencoder. Time-frequency masks, typically in IBM form, are computed based on the poisoned samples and their corresponding clean samples (typically from the same label) as labels for the autoencoder."

    The autoencoder is supposed to 'autonomously generate masks', but its training labels are IBM masks computed from paired poisoned and clean samples. The threat model explicitly denies the defender access to poisoned samples. Therefore the purification stage is fitted on exactly the oracle knowledge the online defense is supposed to supply. Without those 100 poisoned/clean pairs, Eq. (9) cannot be trained, so the ASR and PA numbers in Table III do not hold for a defender who only has clean samples. The claimed prediction of trigger-carrying inputs after purification is not an autonomous online defense but a supervised regression trained on the attack samples themselves.

full rationale

The detection stage (S-STRIP) is not circular: it uses clean perturbation samples and a threshold estimated from clean-sample entropy, and it is evaluated on held-out poisoned samples. The circularity is confined to the purification stage, which is the paper's strongest claim ('even input speech carrying triggers can be accurately predicted'). The paper states in Sec. III.B that the defender 'may not have access to the poisoned samples', but Sec. V.C.1 requires 100 poisoned samples plus their corresponding clean samples to compute the IBM labels used to train the autoencoder. This is an internal inconsistency that invalidates the purification results as stated. There is no load-bearing self-citation or imported uniqueness theorem; the issue is a fitted oracle-trained component being presented as an autonomous defense.

Axiom & Free-Parameter Ledger

5 free parameters · 4 axioms · 0 invented entities

SpeechGuard rests on two empirical intuitions about audio (T-F sparsity and STRIP entropy separation) and one inconsistent capability assumption: that the defender can obtain poisoned samples and their clean counterparts to train the purifier. No code, data, or formal proofs are shipped, and the paper introduces no new physical or conceptual entities.

free parameters (5)
  • Detection SNR q = 10 dB
    Chosen by hand in Sec V.B.2; controls perturbation strength in Eq (5) and therefore detection behavior; no sensitivity analysis is given.
  • Detection threshold T = not reported numerically; set to meet target FRR
    Sec V.B.2 estimates T from the clean-sample entropy distribution; the value depends on the chosen FRR and is fitted to the validation criteria.
  • Autoencoder training set size = 100 poisoned samples
    Sec V.C.1 uses 100 poisoned samples filtered by S-STRIP; this number is arbitrary and the purification results depend on this oracle sample set.
  • Frame expansion length = 5 frames
    Sec IV.C.2.b concatenates adjacent 5 frames into a feature vector; this is an ad hoc architectural choice with no ablation.
  • Autoencoder hidden configuration = three hidden layers of 2048 neurons
    Sec IV.C.2.a fixes the architecture without justification; capacity directly affects whether the mask generator can suppress triggers while preserving speech.
axioms (4)
  • domain assumption Speech signals are sparsely distributed in the time-frequency domain and trigger signals occupy largely non-overlapping T-F regions.
    Sec IV.C.1.b and Fig. 2; this is the entire basis for T-F masking. If triggers overlap speech bands, masking either destroys speech or leaves the trigger intact.
  • domain assumption The defender has a set of clean samples and can compute an entropy threshold from them.
    Sec III.B and V.B.2; used to set the detection threshold. This part is consistent with the stated defender capability.
  • ad hoc to paper During purification training, the defender has access to poisoned samples and their corresponding clean originals to compute IBM labels.
    Sec V.C.1 requires 100 poisoned samples and their clean counterparts for Eq (8) labels; this contradicts Sec III.B, which says the defender may not have poisoned samples. This is the load-bearing inconsistent premise.
  • domain assumption SNR-scaled perturbations preserve STRIP's entropy-separation property for audio inputs.
    Sec IV.B.2; no theoretical proof is given, only the empirical entropy distributions in Fig. 5. The entire detection stage rests on this transfer.

reviewed 2026-08-01 · how reviews work

0 comments
Cite this review

Pith. "Pith review of SpeechGuard: Online Defense against Backdoor Attacks on Speech Recognition Models." pith.science (2026). https://pith.science/paper/FSM36V6L

@misc{pith2026260715697,
  author       = {Pith},
  title        = {Pith review of: SpeechGuard: Online Defense against Backdoor Attacks on Speech Recognition Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FSM36V6L}},
  note         = {Machine review of arXiv:2607.15697}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Backdoor attacks pose a critical threat to neural network models, allowing attackers to implant a backdoor during the training phase by manipulating a small portion of the training data. In security-sensitive applications such as voice interaction for autonomous driving, the presence of backdoor attacks introduces substantial security risks. This study focuses on implementing backdoor defense measures for speech recognition models in run-time, taking into account the characteristics of audio signals. We propose SpeechGuard, the first online backdoor defense pipeline designed to identify and purify poisoned audio samples. Specifically, we improve STRIP method to perform adaptive perturbation injection to detect and filter poisoned samples, named as S-STRIP. More importantly, we further consider the purification of poisoned samples. We utilize time-frequency (T-F) masking to suppress the expression of trigger signals and autonomously generate masks based on an autoencoder. The two-stage processing prevents the backdoor in the model from being triggered, and even input speech carrying triggers can be accurately predicted. Extensive experimental demonstrate that SpeechGuard can accurately filter out poisoned samples. Through purification, it can significantly mitigate the backdoor threat while maintaining a certain prediction accuracy.

Figures

Figures reproduced from arXiv: 2607.15697 by Jinwen Xin, Xixiang Lv.

Figure 1
Figure 1. Figure 1: An overview of SpeechGuard classes in the training task. The Shannon entropy H serves as a metric for determining whether the input sample x is poisoned. If H falls below the predefined threshold T (estimated based on the entropy distribution of benign samples), the input x is classified as a poisoned sample. 2) Perturbation Method in S-STRIP: Similar to introducing perturbations in the pixel space of imag… view at source ↗
Figure 2
Figure 2. Figure 2: The spectrogram of the audio signal. Input layer Output layer Hidden layer 2048 2048 2048 Spectrogram T-F mask 5 frames Autoencoder 1 frame [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Autoencoder architecture. input signal (green region) and the trigger signal (red region) in the time-frequency domain. Therefore, it is feasible to purify the poisoned input signal in the time-frequency domain based on this non-overlapping characteristic. 2) Generating masks using an autoencoder: As an unsu￾pervised model, autoencoder is used to compress and encode input data, and then decode and reconstr… view at source ↗
Figure 4
Figure 4. Figure 4: Trigger pattern. 2) Attack Configuration: Backdoor attacks on speech recognition models primarily employ data poisoning method. The triggers can be categorized into three types, each illus￾trated in the spectrogram depicted in [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Entropy distribution 2) The Implementation of S-STRIP Defense: We randomly selected 100 audio samples from the original dataset to serve as perturbation samples. We set SNR to 10 and determine the mixing ratio using (5). We employ 1000 raw audio samples to estimate the entropy distribution of clean samples and set the detection threshold T based on the predetermined FRR. The entropy distribution of clean a… view at source ↗
Figure 6
Figure 6. Figure 6: Comparison of purification performance between IBM [PITH_FULL_IMAGE:figures/full_fig_p008_6.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

44 extracted references · 4 linked inside Pith

  1. [1]

    [9] first proposed theBad- Netsattack scheme based on data poisoning for outsourced training and transfer learning scenarios

    Backdoor Attack:Gu et al. [9] first proposed theBad- Netsattack scheme based on data poisoning for outsourced training and transfer learning scenarios. Liu et al. [10] gen- erated the trojan trigger by reversing neurons, followed by retraining the model with external data to inject the backdoor. Chen et al. [11] believed that, in advanced backdoor attack ...

  2. [2]

    Liu et al

    Backdoor Defense:Various studies have proposed de- fense schemes against the threat of backdoor attacks. Liu et al. [14] pruned the neurons associated with the trigger to eliminate the backdoor. The pruned model was then fine-tuned with clean samples to restore prediction accuracy. Wang et al. [15] proposed the first trigger synthesis-based backdoor detec...

  3. [3]

    Koffas et al

    Research Focused on Speech Recognition:Recently, attack schemes focused on speech recognition tasks were proposed. Koffas et al. [4] adopted an ultrasonic pulse as a trigger to implement the inaudible backdoor attack. Liu et al. [5] explored the first audible backdoor attack paradigm for speech recognition, characterized by passively triggering and opport...

  4. [4]

    Can you hear it? backdoor attacks via ultrasonic triggers

    Stefanos Koffas, Jing Xu, Mauro Conti, and Stjepan Picek. Can you hear it? backdoor attacks via ultrasonic triggers. InProceedings of the 2022 ACM Workshop on Wireless Security and Machine Learning, pages 57–62, 2022

    2022

  5. [5]

    For a speech command recognition task, the objective is to learn a modelF θ :X→Y, whereXdenotes the input space andYdenotes the label space

    Training procedure of speech recognition models:In general, letD train ={(x i, yi)}N i=1 represent the original audio dataset withNclean audio samples, wherex i ∈X denotes the time series representation of the sample, and yi ∈Y={1,2,· · ·, K}signifies the true label of the input xi. For a speech command recognition task, the objective is to learn a modelF...

  6. [6]

    Followed by incorporating the poisoned samples to create the poisoning training set:D ∗ train =D train S Dpoison

    Backdoor attacks based on data poisoning:In a data poisoning-based backdoor attack, the attacker typically gen- erates poisoned samples by modifying a small subset of clean samples within the original training set:D poison = {(Gδ(xi), t)}P i=1, whereG δ :X→Xrepresents the attacker- designed method for generating poisoned samples using trig- ger signalsδ,t...

  7. [7]

    Poisoned Sample Detection:At this stage, we use an improved STRIP [7] to detect poisoned inputs. Specifically, the initial STRIP adds strong perturbations to the input samples by directly superimposing perturbations and without considering the input signal strength, which results in an uneven energy distribution of the perturbed inputs. In view of this pr...

  8. [8]

    Poisoned Sample Purification:At the second stage, based on the poisoned samples filtered in the previous stage, SpeechGuard trains an autoencoder to learn the mapping from the poisoned input signals to the T-F mask. The decoding part of the autoencoder is used as a generator to generate the masks to suppress the backdoor trigger signals in the poisoned in...

  9. [9]

    In contrast, clean samples undergoing the same robust perturbations exhibit substantial alterations in the prediction results

    A Brief Overview of STRIP:The STRIP’s detection capability relies on a fundamental observation: When multiple strong perturbations are added to a poisoned sample, the prediction results of all perturbed inputs tend to converge towards the target label. In contrast, clean samples undergoing the same robust perturbations exhibit substantial alterations in t...

  10. [10]

    These per- turbations are derived either from the dataset or random noise

    Perturbation Method in S-STRIP:Similar to introducing perturbations in the pixel space of images, we opt to add perturbations into the time series of audio inputs. These per- turbations are derived either from the dataset or random noise. Specifically, the temporal waveform representation of the raw audio input is denoted asx={a 1, a2, a3 · · ·al1 }, whil...

  11. [11]

    The Principle of suppressing trigger signals with the T-F Masking:We briefly introduce the concept of time-frequency masking and analyze the feasibility of utilizing masks to eliminate trigger signals in the time-frequency domain. a) Time-frequency masking:A T-F mask is a binary or soft mask that is applied to a T-F representation of an audio sample, such...

    2048

  12. [12]

    In this study, we propose an autoencoder architecture (Fig

    Generating masks using an autoencoder:As an unsu- pervised model, autoencoder is used to compress and encode input data, and then decode and reconstruct the original data. In this study, we propose an autoencoder architecture (Fig. 3) designed to map poisoned input signals to T-F masks. a) Autoencoder architecture:We employ a fully con- nected neural netw...

    2048

  13. [13]

    Below is a brief description: •SCDv2: Speech Commands Dataset Version 2 (SCDv2)

    Datasets and Model Architectures:We select two popu- lar audio datasets typically employed for keyword recognition tasks as our training task. Below is a brief description: •SCDv2: Speech Commands Dataset Version 2 (SCDv2)

  14. [14]

    Fine-pruning: Defending against backdooring attacks on deep neural networks

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against backdooring attacks on deep neural networks. InIn- ternational Symposium on Research in Attacks, Intrusions, and Defenses, pages 273–294. Springer, 2018

    2018

  15. [15]

    The triggers can be categorized into three types, each illus- trated in the spectrogram depicted in Fig

    Attack Configuration:Backdoor attacks on speech recognition models primarily employ data poisoning method. The triggers can be categorized into three types, each illus- trated in the spectrogram depicted in Fig. 4: •Random noise: Generating poisoned speech samples by adding random noise [10] or perturbations [23]. •Environmental noise: Utilizing environme...

  16. [16]

    •Attack Success Rate (ASR): This metric quantifies the proportion of poisoned samples successfully directed the target label

    Evaluation Metrics:Backdoor attack schemes are com- monly evaluated using two performance metrics: •Benign Accuracy (BA): BA measures the prediction accuracy of the backdoor model on benign test samples. •Attack Success Rate (ASR): This metric quantifies the proportion of poisoned samples successfully directed the target label. The objective of SpeechGuar...

  17. [17]

    Gao et al

    to identify suspected trigger regions and remove them by surgery. Gao et al. [7] proposed STRIP, a perturbation- basedrun-timepoisoned sample detection scheme. In the inference stage, poisoned samples were detected based on the randomness of the predicted outcome of perturbed inputs

  18. [18]

    Table I presents the attack performance of the backdoor model

    Trojaned Model Performance:We chose random noise, environmental noise and ultrasonic pulse as triggers and con- figured the poisoning rate to 1% (247 poisoned samples). Table I presents the attack performance of the backdoor model. The victim model demonstrates a prediction accuracy comparable to that of the benign model on clean samples, yet attains an a...

  19. [19]

    We have selected 10 commands to form a 10-class speech recognition task

    comprises 30 different commands extracted from human speech segments. We have selected 10 commands to form a 10-class speech recognition task. •AMT: AudioMNIST (AMT) [20] serves as a resource for speech recognition, featuring audio segments representing numbers from 0 to 9. These audio segments are derived from the corresponding digits in the MNIST datase...

    2048

  20. [20]

    We set SNR to 10 and determine the mixing ratio using (5)

    The Implementation of S-STRIP Defense:We randomly selected 100 audio samples from the original dataset to serve as perturbation samples. We set SNR to 10 and determine the mixing ratio using (5). We employ 1000 raw audio samples to estimate the entropy distribution of clean samples and set the detection thresholdTbased on the predetermined FRR. The entrop...

  21. [21]

    In speech recognition tasks, S-STRIP demonstrates effective defense capabilities

    Analysis of S-STRIP Detection Performance:The detec- tion results are shown in Table II. In speech recognition tasks, S-STRIP demonstrates effective defense capabilities. In most instances, selecting an appropriate FRR results in a FAR below 10%. In security-sensitive scenarios, defenders can choose a higher FRR to further reduce the FAR. C. Performance E...

  22. [22]

    Autoencoder training:The defender randomly selects 100 poisoned samples filtered through S-STRIP as inputs to the autoencoder. Time-frequency masks, typically in IBM form, are computed based on the poisoned samples and their corresponding clean samples (typically from the same label) TABLE II: S-Strip detection performance. Dataset Model Trigger Detection...

  23. [23]

    Following purification by the autoencoder, the threat posed by the poisoned samples is significantly mitigated, with ASR decreasing by more than 90% across all cases

    Analysis of purification performance:The prediction results for purified poisoned samples are presented in Table III. Following purification by the autoencoder, the threat posed by the poisoned samples is significantly mitigated, with ASR decreasing by more than 90% across all cases. An ASR below 10% is approximately equivalent to random guessing, signify...

  24. [24]

    Adaptive square attack: Fooling autonomous cars with adversarial traffic signs

    Yujie Li, Xing Xu, Jinhui Xiao, Siyuan Li, and Heng Tao Shen. Adaptive square attack: Fooling autonomous cars with adversarial traffic signs. IEEE Internet of Things Journal, 8(8):6337–6347, 2020

    2020

  25. [25]

    Data poisoning attacks to deep learning based recom- mender systems

    Hai Huang, Jiaming Mu, Neil Zhenqiang Gong, Qi Li, Bin Liu, and Mingwei Xu. Data poisoning attacks to deep learning based recom- mender systems. InNetwork and Distributed Systems Security (NDSS) Symposium, 2021

    2021

  26. [26]

    Backdoor learning: A survey.IEEE Transactions on Neural Networks and Learning Systems, pages 1–18, 2022

    Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey.IEEE Transactions on Neural Networks and Learning Systems, pages 1–18, 2022

    2022

  27. [27]

    Oppor- tunistic backdoor attacks: Exploring human-imperceptible vulnerabilities on speech recognition systems

    Qiang Liu, Tongqing Zhou, Zhiping Cai, and Yonghao Tang. Oppor- tunistic backdoor attacks: Exploring human-imperceptible vulnerabilities on speech recognition systems. InProceedings of the 30th ACM International Conference on Multimedia, pages 2390–2398, 2022

    2022

  28. [28]

    Trojanmodel: A practical trojan attack against automatic speech recognition systems

    Wei Zong, Yang-Wai Chow, Willy Susilo, Kien Do, and Svetha Venkatesh. Trojanmodel: A practical trojan attack against automatic speech recognition systems. In2023 IEEE Symposium on Security and Privacy (SP), pages 906–922. IEEE Computer Society, 2022

    2022

  29. [29]

    Strip: A defence against trojan attacks on deep neural networks

    Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks on deep neural networks. InProceedings of the 35th Annual Computer Security Applications Conference, pages 113–125, 2019

    2019

  30. [30]

    Anti-backdoor learning: Training clean models on poisoned data

    Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learning: Training clean models on poisoned data. In M. Ranzato, A. Beygelzimer, Y . Dauphin, P.S. Liang, and J. Wortman Vaughan, editors,Advances in Neural Information Processing Systems, volume 34, pages 14900–14912. Curran Associates, Inc., 2021

    2021

  31. [31]

    Badnets: Evaluating backdooring attacks on deep neural networks.IEEE Access, 7:47230–47244, 2019

    Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks.IEEE Access, 7:47230–47244, 2019

    2019

  32. [32]

    Trojaning attack on neural networks

    Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. In25th Annual Network And Distributed System Security Symposium (NDSS 2018). Internet Soc, 2018

    2018

  33. [33]

    Tar- geted backdoor attacks on deep learning systems using data poisoning

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Tar- geted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017

    Pith/arXiv arXiv 2017

  34. [34]

    Reflection backdoor: A natural backdoor attack on deep neural networks

    Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack on deep neural networks. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part X 16, pages 182–199. Springer, 2020

    2020

  35. [35]

    Deep feature space trojan attack of neural networks by controlled detoxifica- tion

    Siyuan Cheng, Yingqi Liu, Shiqing Ma, and Xiangyu Zhang. Deep feature space trojan attack of neural networks by controlled detoxifica- tion. InProceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 1148–1156, 2021

    2021

  36. [36]

    Neural cleanse: Identifying and miti- gating backdoor attacks in neural networks

    Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and miti- gating backdoor attacks in neural networks. In2019 IEEE Symposium on Security and Privacy (SP), pages 707–723. IEEE, 2019

    2019

  37. [37]

    Februus: Input purification defense against trojan attacks on deep neural network systems

    Bao Gia Doan, Ehsan Abbasnejad, and Damith C Ranasinghe. Februus: Input purification defense against trojan attacks on deep neural network systems. InAnnual Computer Security Applications Conference, pages 897–912, 2020

    2020

  38. [38]

    Grad-cam: Visual explanations from deep networks via gradient-based localization

    Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakr- ishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. In Proceedings of the IEEE international conference on computer vision, pages 618–626, 2017

    2017

  39. [39]

    Backdoor attack against speaker verification

    Tongqing Zhai, Yiming Li, Ziqi Zhang, Baoyuan Wu, Yong Jiang, and Shu-Tao Xia. Backdoor attack against speaker verification. InICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 2560–2564. IEEE, 2021

    2021

  40. [40]

    Speech commands: A dataset for limited-vocabulary speech recognition.arXiv preprint arXiv:1804.03209, 2018

    Pete Warden. Speech commands: A dataset for limited-vocabulary speech recognition.arXiv preprint arXiv:1804.03209, 2018

    Pith/arXiv arXiv 2018

  41. [41]

    Interpreting and explaining deep neural networks for classification of audio signals.arXiv preprint arXiv:1807.03418, 2018

    S ¨oren Becker, Marcel Ackermann, Sebastian Lapuschkin, Klaus-Robert M¨uller, and Wojciech Samek. Interpreting and explaining deep neural networks for classification of audio signals.arXiv preprint arXiv:1807.03418, 2018

    Pith/arXiv arXiv 2018

  42. [42]

    Ad- versarial example detection by classification for deep speech recognition

    Saeid Samizade, Zheng-Hua Tan, Chao Shen, and Xiaohong Guan. Ad- versarial example detection by classification for deep speech recognition. InICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 3102–3106. IEEE, 2020

    2020

  43. [43]

    A neural attention model for speech command recognition.arXiv preprint arXiv:1808.08929, 2018

    Douglas Coimbra De Andrade, Sabato Leo, Martin Loesener Da Silva Viana, and Christoph Bernkopf. A neural attention model for speech command recognition.arXiv preprint arXiv:1808.08929, 2018

    Pith/arXiv arXiv 2018

  44. [44]

    An embarrassingly simple approach for trojan attack in deep neural networks

    Ruixiang Tang, Mengnan Du, Ninghao Liu, Fan Yang, and Xia Hu. An embarrassingly simple approach for trojan attack in deep neural networks. InProceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pages 218–228, 2020

    2020

This paper was first reviewed by deepseek-v4-flash on August 1, 2026.