Pith. sign in

REVIEW 3 major objections 8 minor 29 references

Mitigating Backdoor Triggered and Targeted Data Poisoning Attacks in Voice Authentication Systems

T0 review · 3 major / 8 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A two-stage defense cuts voice backdoor success to 4-15% and catches targeted poisoning at 95% recall.

desk verdict A plausible unified-defense idea against PBSM backdoors and targeted poisoning, but the reported 4–15% ASR and 93–95% recall rest on a data split and a fitted detector that the paper itself contradicts. read the letter →

arxiv 2505.03455 v1 pith:CIJKVJVC submitted 2025-05-06 cs.CR

Alireza Mohammadi , Keshav Sood , Dhananjay Thiruvady , Asef Nazari This is my paper · ORCID
classification cs.CR
keywords voiceauthenticationbackdoorattackstargeteddatapoisoningPBSMconvolutionalneuralnetworkspectrogramanalysisspeakerrecognitionadversarialdefense
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that a single defense pipeline can protect text-independent voice authentication systems against two distinct attack families at once: pitch-boosting backdoor attacks (PBSM) and targeted data poisoning attacks (TDPA). The proposed framework first analyzes STFT spectrograms for high-frequency energy and pitch anomalies to flag backdoor-triggered audio, then feeds the labeled samples to a CNN trained to separate legitimate, attacked, and triggered accounts. On LibriSpeech, VoxCeleb, and a merged corpus, the authors report reducing attack success rate from a 95–100% baseline to 4–15% while recognizing targeted-poisoned accounts with up to 95% recall. The practical payoff, if the claims hold, is that one detection layer can replace separate defenses and does not require retraining the authentication model.

What carries the argument

The load-bearing mechanism is the frequency-based PBSM detector: it computes STFT energy in a target high-frequency band, flags frames above a dynamic threshold, and combines pitch variance, high-frequency energy variance, and ratio-based normalization into a weighted score that is thresholded at the account level, with a beep-count override for moderate trigger patterns. This detector labels trigger-carrying audio, and those labels train the CNN, which classifies legitimate, attacked, and triggered samples from concatenated speaker embeddings and a user-level majority vote. The two stages are coupled: the CNN's 'triggered' class depends on what the frequency detector flags.

What would settle it

Re-run the evaluation with a PBSM trigger whose high-frequency cue lies outside the detector's tuned frequency band, or with a pitch-scaling factor not used in training, and measure the attack success rate; if ASR returns to the 95–100% baseline, the frequency layer is not trigger-agnostic. Separately, instrument Algorithm 1 to check whether any attacker-subset file appears in the legitimate training set; if it does, the TDPA recall is measured under a data split that contradicts the stated threat model.

Watch

Extended reading notes

Core claim

The paper's central discovery is that the two attack mechanisms leave separable acoustic fingerprints: PBSM backdoor triggers inflate high-pitched energy and pitch variance, while TDPA replacement samples alter the speaker-embedding structure. By detecting the first via an energy threshold over a target frequency band combined with a weighted pitch/HF score, and the second via a CNN on structured paired embeddings with user-level voting, the framework achieves ASR of 4.17% (LibriSpeech), 11.11% (VoxCeleb), and 15.22% (merged), while the CNN recognizes attacked accounts with recall of 95%, 94%, and 93% respectively. The authors take these results to show that one integrated pipeline can mitigate combined BTA and TDPA threats without retraining the underlying voice authentication system.

Load-bearing premise

The performance numbers assume the defender knows the exact PBSM trigger parameters (target frequency band, pitch-scaling factor, masking signal) so the detector can be tuned to them, and that the attacker's own audio files are excluded from the training set, even though the paper's Algorithm 1 never excludes them.

Editorial extensions

If this is right

  • Voice authentication providers could deploy a single pre-processing stage that screens enrollment audio for PBSM backdoors before the authenticator sees it, without retraining the biometric model.
  • Because the PBSM layer runs in 4–6 seconds per user, the defense is feasible at enrollment time even on large corpora, such as the merged dataset of 3,206 accounts.
  • The account-level voting and beep override reduce false alarms, keeping legitimate-user precision at 0.98–0.99 across datasets.
  • The same pipeline addresses combined attacks, whereas previous defenses (pruning, fine-tuning, trigger filtering, and the prior CNN-based discriminator) each handle only one attack family.
  • A triggered account that slips past the frequency detector still has an estimated 85–96% chance of being caught by the CNN, per the paper's own staging argument.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the detector's threshold and frequency band are tuned to a specific PBSM trigger, an attacker who shifts the trigger frequency or drops the pitch-boost component could plausibly evade the first stage; testing against novel trigger parameters would reveal the actual robustness envelope.
  • The CNN's 'triggered' labels come from the same detector, so the reported recall is not independent of the frequency layer; an end-to-end evaluation where the CNN sees raw audio without detector labels would isolate the CNN's contribution.
  • The paper's threat model says the attacker's audio subset is excluded from training, but Algorithm 1 never removes that subset from the legitimate set, so the TDPA numbers may rest on a data split the pseudocode contradicts; re-running with a corrected split would clarify whether the 93–95% recall holds.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 8 minor

Summary. This manuscript proposes a two-stage defense for text-independent voice authentication against two attack families: PBSM backdoor-triggered attacks (pitch boosting plus high-frequency sound masking) and targeted data poisoning attacks (replacing victim utterances with attacker audio). The first stage computes STFT-based high-frequency beep detection and a weighted score over pitch, high-frequency energy, and their variances; thresholds and weights are tuned on a validation subset. The second stage trains a CNN on Deep Speaker embeddings to classify samples as Legitimate, Attacked, or Triggered, followed by user-level voting. Experiments on LibriSpeech, VoxCeleb, and a merged dataset report attack success rates of 4.17–15.22% after the defense and TDPA recall of 93–95%.

Significance. If the evaluation were internally consistent and the detector's generalization were established, the paper would make a useful practical contribution: a single pipeline addressing both attack families at 5% poisoning is more realistic than the 50% setting of Guardian, and the per-user timing measurements (4–6 seconds) support deployability claims. The staging of the threat model is clearly described, and the use of three datasets gives breadth. However, the paper's central quantitative claims rest on two structural points that are not currently supported: the implemented data split contradicts the stated threat model, and the PBSM detector's features and thresholds are fitted to the same attack distribution on which it is tested. The paper also does not provide code, so the split ambiguity cannot be resolved from the manuscript.

major comments (3)
  1. [Algorithm 1 and Section III-B1] The pseudocode contradicts the stated threat model. Section III-B1 says Dattacker is excluded from training, but Algorithm 1 never does this: line 4 selects Dattacker, lines 5–6 draw DPBSM and DTDPA from D\Dattacker, line 7 defines DLEGITIMATE as D \ (DPBSM ∪ DTDPA), so Dattacker remains in DLEGITIMATE, and line 19 returns DLEGITIMATE ∪ DPBSM ∪ DTDPA = D. Since line 16 uses Dattacker as the replacement source for TDPA, the CNN is trained on attacker-controlled audio labeled 'legitimate' if Algorithm 1 is followed, which is exactly the contamination the threat model says is excluded. If instead the experiments followed the text, the published pseudocode does not describe the evaluated system. Either way, Table V's Attack recall of 93–95% and the conclusion that TDPA is mitigated under the stated 5% scenario are not supported as written. The authors must reconcile the pseudocode with the implemented split and confirm that no Dattacker file appears in the legitimate training set.
  2. [Section III-C, Eq. (4), and Algorithm 2] The PBSM detection layer is effectively a fitted classifier on the attack's own manipulation axes. The features in Eq. (4) are direct measurements of pitch, high-frequency energy, and their variances—precisely the quantities changed by PBSM—and the text states that the weights and the threshold τ are chosen by grid search on a validation subset of user accounts from the same attack distribution. Algorithm 2 also requires the trigger frequency band ω and the tolerance Δω as inputs. Consequently, the reported ASR figures in Table V (4.17%, 11.11%, 15.22%) describe detection of the exact attack configuration used to tune the detector; they do not support the broader claim of mitigating BTA. The authors should add a generalization experiment that varies parameters not used in tuning, e.g., the trigger frequency, the pitch-scaling factor p, and the masking signal h, and report ASR for each configuration.
  3. [Section IV-B2 and Table V] The claim that ASR is reduced from a baseline of 95–100% to 4–15% is not supported by a same-setting baseline measurement. Section IV-B2 compares post-defense ASR in Table V with the baseline 'as shown in [10]', but [10] uses 1-second fixed-command audio, while this paper uses 3-second text-independent utterances and a 5% poisoning rate; the underlying authentication model also differs. Without measuring the ASR of the same authentication model on the same backdoored data before the defense is applied, the reported reduction cannot be attributed to the proposed framework. A direct baseline column should be added to Table V.
minor comments (8)
  1. [Abstract] The phrase 'their compression with the state of the art algorithm' should be 'their comparison with the state-of-the-art algorithm'.
  2. [Section III-C and Algorithm 2] The input list of Algorithm 2 includes α, τ, γ, ω, Δω, and the four weights, but the rule-based override uses θ_override and min_beep_count, which are not declared; the text also calls the beep threshold factor η while the pseudocode uses α. Please align the notation and declare all hyperparameters.
  3. [Section III-B2, Eq. (1)] The symbol xp is used for both the pitch-boosted STFT and its inverse-STFT reconstruction, and the definition '⊕ is element-wise addition after embedding the trigger' is ambiguous; please use distinct notation for the time-domain reconstruction and the final triggered signal.
  4. [Algorithm 1, line 19] Returning D′ = DLEGITIMATE ∪ DPBSM ∪ DTDPA yields the entire original dataset; if DATTACKER is truly excluded from training, the return value should not include it.
  5. [Section IV-B and Figure 4] The radar-plot description says a user is Triggered if any normalized feature mean exceeds the [−1, 1] band, but the formal decision rule in Eq. (4)–(6) is based on a weighted score and threshold τ; these two criteria should be reconciled.
  6. [Section IV-B2 and Table I] The abbreviation RTA is listed in Table I as 'Recognition-Triggered Accuracy' but is never defined in the text; please define it where it is first used.
  7. [Section II-B and Table VII] The sentence 'in TED [18] introduces' is ungrammatical, and Table VII describes TED as 'PCA-based outlier detection' while the text describes topological evolution dynamics; please correct the inconsistency.
  8. [Abstract and Section III-E] The claim that the framework requires 'no costly model retraining' is difficult to reconcile with Section III-E, which trains a CNN and explicitly includes triggered samples in training; please clarify what the claim is intended to mean.

Circularity Check

2 steps flagged · score 7.0 of 10

PBSM detector is threshold-tuned on the attack's own pitch/HF axes, and Algorithm 1 leaks attacker audio into CNN training, so the headline ASR and TDPA recall are not independent predictions.

  1. fitted input called prediction [Section III-C2, Eq. (4); Algorithm 2; results reported in Section IV-B2, Table V]
    "score =Wpitch ·f0(x) + Whf· HF(x) + Wpvar·ρp(x) + Whfvar·ρHF(x), where the weights {Wpitch,W hf,W pvar,W hfvar} are tuned to balance the contribution of each feature. ... A grid search was conducted over various threshold values on a validation subset of user accounts, evaluating the trade-off between incorrectly flagged legitimate accounts and undetected triggered accounts."

    The PBSM attack (Eq. 1) scales pitch by p and injects high-frequency signal h. The detector's four features are direct summaries of exactly those two manipulations: fundamental frequency/pitch variance and high-frequency energy above 4 kHz with its variance. The weights and the threshold τ are fitted by grid search on a validation subset drawn from the same attack distribution. The reported reduction of ASR to 4–15% is therefore the miss rate of a classifier calibrated on the attack's own manipulation axes, not an independent first-principles prediction of a generalizable defense. The result is forced by construction because the score function is defined as a linear combination of the very quantities the attack changes.

  2. other [Section III-B1 (Dataset Partitioning) vs. Algorithm 1 lines 4–7 and 19; results in Table V]
    "Attacker Subset: we label 5% of D asDattacker, and exclude that from training and later use that to replace audio files from uniformly randomly chosen user directories. ... DLEGITIMATE←D\ (DPBSM∪D TDPA) ... ReturnD′←D LEGITIMATE ∪D PBSM∪D TDPA"

    Because DPBSM and DTDPA are sampled from D\DATTACKER, the set DLEGITIMATE = D \ (DPBSM ∪ DTDPA) retains every DATTACKER file, and the returned D′ is simply D. Thus the CNN is trained on attacker-controlled recordings labeled legitimate, while the same DATTACKER files are also inserted as poison replacements in DTDPA (Algorithm 1, line 16). The 93–95% attack recall in Table V is therefore obtained on a model that has seen the exact attacker audio during training under conflicting labels; it is not evidence of detecting TDPA under the stated threat model. The claimed exclusion in Section III-B1 is contradicted by the published pseudocode, so the central TDPA prediction reduces to a data-split artifact rather than an independent detection result.

full rationale

The paper is not self-citation-circular: its PBSM baseline [10] is external, and the CNN architecture is standard. However, both headline empirical claims reduce to the attack's own construction rather than to an independent first-principles derivation. The PBSM detector's features are pitch and high-frequency energy exactly as altered by Eq. (1), and its threshold is tuned on a validation subset of the same attack distribution, so the 4–15% ASR is a fitted detector's miss rate on the axes it was designed to measure. Separately, Algorithm 1 contradicts Section III-B1's explicit exclusion of DATTACKER from training: DLEGITIMATE retains attacker audio and the returned D′ equals D, so the CNN is trained on attacker audio labeled legitimate and tested on TDPA poison drawn from that same audio. The reported TDPA recall is thus not independent evidence for the stated 5% poisoning scenario. These are concrete, quotable reductions, not vague speculation about author intent; together they make the central claims partially circular by construction. Score 7 reflects that the two main results are each compromised, while the framework itself is a coherent pipeline rather than a pure definitional tautology.

Assumptions & free parameters 8 free parameters · 5 assumptions · 0 invented entities

The central result depends on a large number of unreported tuning parameters and on the assumption that the defender knows the exact attack trigger band. The ledger shows the framework pulls most of its discriminative power from fitted thresholds and from attack-specific features rather than from a general first-principles guarantee.

free parameters (8)
  • Score weights {Wpitch, Whf, Wpvar, Whfvar} = not reported
    Tuned to balance feature contributions in Eq. (4); no values or calibration curves given.
  • Score threshold tau = not reported
    Selected by grid search on a validation subset of the same attack distribution (Section III-C2); detection ASR depends directly on it.
  • Beep threshold factor (eta in text, alpha in Algorithm 2) = not reported
    Dynamic threshold mean(beep_energy)*eta; the paper switches notation between eta and alpha and never reports the chosen value.
  • Trigger frequency band omega and tolerance delta-omega = not reported
    The defender must know the attack's high-pitched signal band; values are never given, so detection is tuned to a specific trigger.
  • Confidence threshold gamma = not reported
    Used in Algorithm 2 to separate Legitimate from Deferred accounts; no value reported.
  • Rule-based override parameters theta_override and min_beep_count = not reported
    Used in Algorithm 2 lines 14-18 but never defined in the paper.
  • Attack staging parameters p (pitch-scaling factor) and h (trigger signal) = not reported
    These define the PBSM attack as implemented; the defense is evaluated only for this instantiation.
  • CNN hyperparameters (dropout, L1/L2, batch size, epochs, mixup alpha) = not reported
    Tuned for performance; no final values reported.
assumptions (5)
  • standard math STFT and spectral energy sums correctly represent the audio signal for detection.
    Used in Eq. (1)-(3) and Algorithm 2 as the foundation of all frequency-based features.
  • domain assumption PBSM triggers reliably produce elevated high-frequency energy and pitch variance in 3-second clips.
    This is the core detectability premise; it is true by construction for the attack as staged, but not established for other trigger designs.
  • ad hoc to paper The defender knows the trigger frequency band omega and uses validation data from the same attack distribution to set thresholds.
    Section III-C2 states grid search on a validation subset of user accounts from the same dataset; this assumption is not presented as a limitation.
  • domain assumption Account-level majority vote correctly maps sample-level CNN predictions to user-level security decisions.
    Used in Step 8 of the pipeline and Section III-E2 as the final arbiter of account status.
  • ad hoc to paper Attacker audio used for TDPA replacement is excluded from the legitimate training set.
    Section III-B1 states this, but Algorithm 1 fails to implement it, which is a direct contradiction affecting the TDPA evaluation.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Mitigating Backdoor Triggered and Targeted Data Poisoning Attacks in Voice Authentication Systems." pith.science (2026). https://pith.science/paper/CIJKVJVC

@misc{pith2026250503455,
  author       = {Pith},
  title        = {Pith review of: Mitigating Backdoor Triggered and Targeted Data Poisoning Attacks in Voice Authentication Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CIJKVJVC}},
  note         = {Machine review of arXiv:2505.03455}
}
read the original abstract

Voice authentication systems remain susceptible to two major threats: backdoor triggered attacks and targeted data poisoning attacks. This dual vulnerability is critical because conventional solutions typically address each threat type separately, leaving systems exposed to adversaries who can exploit both attacks simultaneously. We propose a unified defense framework that effectively addresses both BTA and TDPA. Our framework integrates a frequency focused detection mechanism that flags covert pitch boosting and sound masking backdoor attacks in near real time, followed by a convolutional neural network that addresses TDPA. This dual layered defense approach utilizes multidimensional acoustic features to isolate anomalous signals without requiring costly model retraining. In particular, our PBSM detection mechanism can seamlessly integrate into existing voice authentication pipelines and scale effectively for large scale deployments. Experimental results on benchmark datasets and their compression with the state of the art algorithm demonstrate that our PBSM detection mechanism outperforms the state of the art. Our framework reduces attack success rates to as low as five to fifteen percent while maintaining a recall rate of up to ninety five percent in recognizing TDPA.

Figures

Figures reproduced from arXiv: 2505.03455 by the authors.

Figure 1
Figure 1. Overview of our eight-step procedure, from the attack implementation to the development of a unified defense framework against BTA and TDPA in [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Stacked-bar visualisation of user-level classification outcomes for the two evaluation. Each bar represents the complete test set for a corpus and is [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. Scatter plots of average pitch versus high-frequency energy for individual user accounts. Each point corresponds to a single user account. Green [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Radar plots of the five normalised acoustic features—average pitch, pitch variance, high-frequency (HF) energy, HF-energy variance, and average [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

29 extracted references · 22 canonical work pages

  1. [10]

    Toward stealthy backdoor attacks against speech recognition via elements of sound,

    H. Cai, P. Zhang, H. Dong, Y . Xiao, S. Koffas, and Y . Li, “Toward stealthy backdoor attacks against speech recognition via elements of sound,” IEEE Transactions on Information Forensics and Security , vol. 19, pp. 5852–5866, 2024

    2024

  2. [1]

    Backdoor attacks against voice recognition systems: A survey,

    B. Yan, J. Lan, and Z. Yan, “Backdoor attacks against voice recognition systems: A survey,” ACM Comput. Surv. , vol. 57, no. 3, Nov. 2024. [Online]. Available: https://doi.org/10.1145/3701985

    work page doi:10.1145/3701985 2024

  3. [2]

    Defense method challenges against backdoor attacks in neural networks,

    S. Shamshiri and I. Sohn, “Defense method challenges against backdoor attacks in neural networks,” in 2024 International Conference on Arti- ficial Intelligence in Information and Communication (ICAIIC) , 2024, pp. 396–400

    work page 2024

  4. [3]

    Breaking security-critical voice authenti- cation,

    A. Kassis and U. Hengartner, “Breaking security-critical voice authenti- cation,” in 2023 IEEE Symposium on Security and Privacy (SP) , 2023, pp. 951–968

    work page 2023

  5. [4]

    Just how toxic is data poisoning? a unified benchmark for backdoor and data poisoning attacks,

    A. Schwarzschild, M. Goldblum, A. Gupta, J. P. Dickerson, and T. Goldstein, “Just how toxic is data poisoning? a unified benchmark for backdoor and data poisoning attacks,” ArXiv, vol. abs/2006.12557,

    arXiv 2006

  6. [5]

    Biometric backdoors: A poisoning attack against unsupervised template updating,

    G. Lovisotto, S. Eberz, and I. Martinovic, “Biometric backdoors: A poisoning attack against unsupervised template updating,” in 2020 IEEE European Symposium on Security and Privacy (EuroS&P) , 2020, pp. 184–197

    work page 2020

  7. [6]

    Defend data poisoning attacks on voice authentication,

    K. Li, C. Baird, and D. Lin, “Defend data poisoning attacks on voice authentication,” IEEE Transactions on Dependable and Secure Computing, pp. 1–16, 2023

    work page 2023

  8. [7]

    A survey on data poisoning attacks and defenses,

    J. Fan, Q. Yan, M. Li, G. Qu, and Y . Xiao, “A survey on data poisoning attacks and defenses,” in 2022 7th IEEE International Conference on Data Science in Cyberspace (DSC) , 2022, pp. 48–55

    work page 2022

Show all 29 references
  1. [8]

    Detection of adversarial training examples in poisoning attacks through anomaly detection,

    A. Paudice, L. Mu ˜noz-Gonz´alez, A. Gy¨orgy, and E. C. Lupu, “Detection of adversarial training examples in poisoning attacks through anomaly detection,” ArXiv, vol. abs/1802.03041, 2018. [Online]. Available: https://api.semanticscholar.org/CorpusID:45218028

    2018 arXiv

  2. [9]

    Stealthy backdoor attack towards federated automatic speaker verification,

    L. Zhang, L. Liu, D. Meng, J. Wang, and S. Hu, “Stealthy backdoor attack towards federated automatic speaker verification,” in ICASSP 2024 - 2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , 2024, pp. 1311–1315

    2024

  3. [11]

    Fine-pruning: Defending against backdooring attacks on deep neural networks,

    K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-pruning: Defending against backdooring attacks on deep neural networks,” in Research in Attacks, Intrusions, and Defenses, M. Bailey, T. Holz, M. Stamatogiannakis, and S. Ioannidis, Eds. Cham: Springer International Publishing, 2018,...

    2018

  4. [12]

    Neural trojans,

    Y . Liu, Y . Xie, and A. Srivastava, “Neural trojans,” in 2017 IEEE International Conference on Computer Design (ICCD), 2017, pp. 45–48

    2017

  5. [13]

    Can you hear it?: Backdoor attacks via ultrasonic triggers,

    S. Koffas, J. Xu, M. Conti, and S. Picek, “Can you hear it?: Backdoor attacks via ultrasonic triggers,” Proceedings of the 2022 ACM Workshop on Wireless Security and Machine Learning , 2021. [Online]. Available: https://api.semanticscholar.org/CorpusID:236635432 12

    2022

  6. [14]

    Drinet: Dynamic backdoor attack against automatic speech recognization models,

    J. Ye, X. Liu, Z. You, G. Li, and B. Liu, “Drinet: Dynamic backdoor attack against automatic speech recognization models,” Applied Sciences, 2022. [Online]. Available: https://api.semanticscholar. org/CorpusID:249562272

    2022

  7. [15]

    Stealthy backdoor attack against speaker recognition using phase-injection hidden trigger,

    Z. Ye, D. Yan, L. Dong, J. Deng, and S. Yu, “Stealthy backdoor attack against speaker recognition using phase-injection hidden trigger,” IEEE Signal Processing Letters , vol. 30, pp. 1057–1061, 2023

    2023

  8. [16]

    Enrollment- stage backdoor attacks on speaker recognition systems via adversarial ultrasound,

    X. Li, J. Ze, C. Yan, Y . Cheng, X. Ji, and W. Xu, “Enrollment- stage backdoor attacks on speaker recognition systems via adversarial ultrasound,” IEEE Internet of Things Journal, vol. 11, no. 8, pp. 13 108– 13 124, 2024

    2024

  9. [17]

    Imperceptible rhythm backdoor attacks: Exploring rhythm transformation for embedding undetectable vulnerabilities on speech recognition,

    W. Yao, J. Yang, Y . He, J. Liu, and W. Wen, “Imperceptible rhythm backdoor attacks: Exploring rhythm transformation for embedding undetectable vulnerabilities on speech recognition,” Neurocomputing, vol. 614, p. 128779, 2025. [Online]. Available: https://www.sciencedirect.com...

    2025

  10. [18]

    Robust backdoor detection for deep learning via topological evolution dynamics,

    X. Mo, Y . Zhang, L. Y . Zhang, W. Luo, N. Sun, S. Hu, S. Gao, and Y . Xiang, “Robust backdoor detection for deep learning via topological evolution dynamics,” 2024 IEEE Symposium on Security and Privacy (SP) , pp. 2048–2066, 2023. [Online]. Available: https://api.semanticscho...

    2024

  11. [19]

    Audio-domain position-independent backdoor attack via unnoticeable triggers,

    C. Shi, T. Zhang, Z. Li, H. Phan, T. Zhao, Y . Wang, J. Liu, B. Yuan, and Y . Chen, “Audio-domain position-independent backdoor attack via unnoticeable triggers,” in Proceedings of the 28th Annual International Conference on Mobile Computing And Networking , ser. MobiCom ’22. ...

    2022

  12. [20]

    Opportunistic backdoor attacks: Exploring human-imperceptible vulnerabilities on speech recognition systems,

    Q. Liu, T. Zhou, Z. Cai, and Y . Tang, “Opportunistic backdoor attacks: Exploring human-imperceptible vulnerabilities on speech recognition systems,” in Proceedings of the 30th ACM International Conference on Multimedia , ser. MM ’22. New York, NY , USA: Association for Comput...

    2022

  13. [21]

    Deep speaker: an end-to-end neural speaker embedding system,

    C. Li, X. Ma, B. Jiang, X. Li, X. Zhang, X. Liu, Y . Cao, A. Kannan, and Z. Zhu, “Deep speaker: an end-to-end neural speaker embedding system,” 2017

    2017

  14. [22]

    Convolutional neural networks for speech recognition,

    O. Abdel-Hamid, A.-r. Mohamed, H. Jiang, L. Deng, G. Penn, and D. Yu, “Convolutional neural networks for speech recognition,” IEEE/ACM Transactions on Audio, Speech, and Language Processing , vol. 22, no. 10, pp. 1533–1545, 2014

    2014

  15. [23]

    Tutorial: Toward robust deep learning against poisoning attacks,

    H. Chen and F. Koushanfar, “Tutorial: Toward robust deep learning against poisoning attacks,” ACM Trans. Embed. Comput. Syst. , vol. 22, no. 3, Apr. 2023. [Online]. Available: https://doi.org/10.1145/3574159

    2023 doi

  16. [24]

    Convolutional, long short-term memory, fully connected deep neural networks,

    T. N. Sainath, O. Vinyals, A. Senior, and H. Sak, “Convolutional, long short-term memory, fully connected deep neural networks,” in 2015 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2015, pp. 4580–4584

    2015

  17. [25]

    Scale- up: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency,

    J. Guo, Y . Li, X. Chen, H. Guo, L. Sun, and C. Liu, “Scale- up: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency,” 2023. [Online]. Available: https://arxiv.org/abs/2302.03251

    2023 arXiv

  18. [26]

    A manifold consistency interpolation method of poisoning attacks against semi- supervised model,

    X. Wang, X. Wang, M. He, M. Zhang, and Z. Zhang, “A manifold consistency interpolation method of poisoning attacks against semi- supervised model,” Trans. Info. For. Sec. , vol. 18, p. 5272–5285, Jan

  19. [27]

    UMD: Unsupervised model detection for X2X backdoor attacks,

    Z. Xiang, Z. Xiong, and B. Li, “UMD: Unsupervised model detection for X2X backdoor attacks,” in Proceedings of the 40th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, A. Krause, E. Brunskill, K. Cho, B. Engelhardt, S. Sabato, and J...

    2023

  20. [2020]

    Available: https://api.semanticscholar.org/CorpusID: 219980448

    [Online]. Available: https://api.semanticscholar.org/CorpusID: 219980448

  21. [2023]

    Available: https://doi.org/10.1109/TIFS.2023.3268882

    [Online]. Available: https://doi.org/10.1109/TIFS.2023.3268882

    2023

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.