Pith. sign in

REVIEW 4 major objections 6 minor 1 cited by

Gradient Norm-based Fine-Tuning for Backdoor Defense in Automatic Speech Recognition

T0 review · 4 major / 6 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Gradient-penalty fine-tuning cuts speech backdoor success to 10%

desk verdict Useful new audio backdoor defense with solid effectiveness experiments, but the mechanism evidence is thinner than the abstract claims. read the letter →

arxiv 2502.01152 v1 pith:UKGGEFKV submitted 2025-02-03 cs.SD cs.LGeess.AS

Nanjun Zhou , Weilin Lin , Li Liu This is my paper · ORCID
classification cs.SDcs.LGeess.AS
keywords backdoordefenseautomaticspeechrecognitiongradientnormregularizationfine-tuningmodel-levelaudioattacksneuronclassification
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that backdoor attacks on speech-recognition models can be neutralized by fine-tuning with a penalty on the norm of the network gradient. Its starting observation is that, in audio-backdoored models, the neurons mainly responsible for the backdoor show larger gradient values on clean inputs than ordinary clean neurons do. Adding an $\ell^2$ gradient-norm term to the fine-tuning loss therefore shrinks those poisoned neurons while leaving clean ones mostly intact. On the Speech Commands dataset with ResNet, the method lowers average attack success rate from 91.72% to 9.73% while keeping clean accuracy at 90.40%. This matters because, before this work, no specialized model-level backdoor defense existed for the audio domain.

What carries the argument

The carrying mechanism is the per-neuron gradient norm on clean inputs. Neurons are first classified by Clean Loss Change and Backdoor Loss Change, the loss increases caused by pruning each neuron on clean and poisoned data; backdoored and hybrid neurons are those that contribute to the backdoor task. The paper observes that these two neuron types show larger gradients than clean neurons on most clean inputs, and then penalizes large gradients through the objective $L(\theta)=L_{\mathrm{ce}}(\theta)+\lambda\|\nabla_\theta L_{\mathrm{ce}}(\theta)\|_2$. The Hessian term this creates is avoided by a finite-difference approximation that evaluates the gradient at a shifted parameter point, making the procedure a cheap two-step update with a mixing coefficient $\alpha$.

What would settle it

Measure per-neuron gradient norms on clean inputs for a backdoored model and compare the distributions of clean-zone versus backdoor-zone neurons; if the two distributions overlap substantially, GN-FT's penalty cannot select the poisoned neurons. A stronger version would train a trigger that explicitly keeps the target neurons' gradient norms low and check whether GN-FT still reduces attack success rate without hurting clean accuracy.

Watch

Extended reading notes

Core claim

GN-FT is a model-level defense that repairs an already-poisoned speech model using only 5% clean data. The paper's central observation is that neurons classified as backdoored or hybrid, via their Clean Loss Change and Backdoor Loss Change under pruning, show larger gradient values on clean inputs than clean or redundant neurons. The defense fine-tunes the model with the regularized objective $L(\theta)=L_{\mathrm{ce}}(\theta)+\lambda\|\nabla_\theta L_{\mathrm{ce}}(\theta)\|_2$, approximating the Hessian-vector product with an additional optimization step so that no $O(n^2)$ Hessian is needed. After fine-tuning, the number of neurons in the backdoor and hybrid zones drops, the redundant zone grows, and poisoned features no longer cluster in t-SNE. On SCD-10 with ResNet, GN-FT reduces average attack success rate from 91.72% to 9.73% while clean accuracy stays at 90.40%, and the paper presents it as the first specialized and effective backdoor defense for the audio domain.

Load-bearing premise

The load-bearing premise is that, on clean inputs, backdoored and hybrid neurons show larger gradient values than clean neurons; this pattern is illustrated for only two attacks on one architecture and is not quantified with error bars, so an attack that violates the gradient ordering would defeat the penalty's selectivity.

Editorial extensions

If this is right

  • GN-FT gives the first specialized model-level defense against backdoor attacks in the audio domain, where adapting visual defenses such as Fine-Pruning fails.
  • On the Speech Commands SCD-10 benchmark with ResNet, GN-FT lowers average attack success rate from 91.72% to 9.73% while keeping clean accuracy at 90.40%.
  • The defense works with only 5% of clean training data, and clean-data ratios of 10% or more push clean accuracy above 90% and attack success to about 5% or lower.
  • The regularizer is architecture-agnostic: the reported results span ResNet, LSTM, Small CNN, KWT, and EAT across seven attacks.
  • After defense, neurons shift out of the backdoor and hybrid zones into the redundant zone, and poisoned features no longer form a tight cluster in t-SNE, indicating the trigger is forgotten rather than hidden.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the gradient-magnitude signature generalizes, the same regularized fine-tuning could be applied to vision backdoor defenses, where most model-level methods rely on pruning or unlearning rather than gradient norms.
  • GN-FT could double as a backdoor detector: fine-tuning a suspect model and measuring how much the attack success rate drops would reveal whether a hidden trigger was present, since clean models should barely move.
  • The reported weakness on stealthy attacks, with JingleBack and FlowMur keeping higher attack success rates after defense, suggests that an adaptive version scheduling $\alpha$ per layer or per neuron might recover those cases.
  • A natural testable extension would be to construct a trigger that minimizes the target neurons' gradient norms and see whether the defense's selectivity collapses.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes Gradient Norm-based Fine-Tuning (GN-FT), a model-level defense against backdoor attacks in automatic speech recognition. The method is motivated by an empirical observation (Section III-B, Fig. 2) that backdoored and hybrid neurons exhibit larger gradient values than clean neurons on clean inputs. GN-FT adds an L2 gradient-norm penalty to the cross-entropy loss (Eq. 3), approximates the resulting Hessian-vector product via a Taylor-expansion scheme from prior work (Eqs. 5-6), and fine-tunes the backdoored model on a small clean set. Experiments are conducted on Speech Commands (SCD-10, SCD-30) with five models (ResNet, LSTM, Small CNN, KWT, EAT) and seven backdoor attacks, comparing against Fine-Pruning (FP) and vanilla fine-tuning. Results show large ASR reductions with modest CA degradation in many settings, e.g., average ASR on SCD-10 ResNet drops from 91.72% to 9.73% while CA stays at 90.40%. The paper also provides ablation against vanilla FT, an analysis of clean-data ratio, BLC-CLC distribution before/after defense, and t-SNE visualizations.

Significance. If the central mechanism holds, GN-FT would be a valuable first specialized model-level defense for audio backdoor attacks, filling a gap noted in the paper. The experimental scope is broad for the audio domain: two datasets, five architectures, and seven attacks, with a comparison to the only prior adapted model-level defense (FP) and an ablation isolating the regularization term. The implementation avoids Hessian computation, making the method practical. However, the paper's main contribution is explicitly causal: the claim that penalizing gradient norms selectively weakens backdoored/hybrid neurons. The evidence for this causal claim is currently thin, and some experimental results undermine the abstract's claim of consistent superiority. With strengthened mechanism evidence and more careful framing, the work could make a solid contribution.

major comments (4)
  1. [Section III-B, Fig. 2] The motivating observation that backdoored and hybrid neurons exhibit larger gradients than clean neurons is illustrated only for two attacks (Audio BadNets and JingleBack) on ResNet, over 50 clean samples, with no error bars, confidence intervals, or statistical tests. Since this observation is the basis for the proposed regularizer, the paper should quantify the gradient distributions across neuron types for multiple models and attacks, or at least for representative cases including LSTM and Small CNN, to support the claim of generality.
  2. [Eq. (3), Section III-C] The observation in Fig. 2 concerns per-neuron gradient norms, whereas Eq. (3) penalizes the L2 norm of the full gradient vector. The paper does not explain why minimizing the global gradient norm should selectively suppress high-gradient backdoored/hybrid neurons rather than uniformly shrinking all gradient components. A concrete analysis (e.g., per-layer or per-neuron gradient-norm trajectories during GN-FT, or a theoretical argument connecting global and per-neuron norms) is needed to make the causal link load-bearing.
  3. [Tables I and II, Abstract] The abstract and introduction state that GN-FT 'consistently achieves superior performance,' but several settings show high residual ASR or worse ASR than FP: Small CNN average ASR is 32.17% (Table I), JingleBack residual ASR is 15.99% on SCD-10 and 28.18% on SCD-30 ResNet, FlowMur residual ASR is 20.10%/33.10%/42.40%, and FP outperforms GN-FT in ASR for JingleBack and DABA on SCD-10 ResNet (though with much lower CA). The claims should be tempered to reflect these cases, or the paper should analyze why GN-FT struggles on stealthy attacks.
  4. [Section IV-D, Fig. 4] The claim that GN-FT 'effectively reduce[s] the number of neurons in the H-zone and B-zone' is supported only by a qualitative before/after scatter plot for one attack (Audio BadNets on ResNet). The paper should report quantitative counts or percentages of neurons in each zone before and after defense, e.g., for multiple attacks, to substantiate the mechanism rather than relying on visual inspection.
minor comments (6)
  1. [Eq. (4)] Eq. (4) writes the objective as E[L(F(x;θ),y)], omitting the gradient-norm regularization term from Eq. (3); either include the full objective or clarify that Eq. (4) describes the clean-data expectation only.
  2. [Eq. (5), text above it] The phrase 'r is for appropriating the Hessian multiplication' appears to be a typo for 'approximating'; please correct.
  3. [Reference [18]] The reference title contains a typo: 'backdoor defens' should be 'backdoor defense'.
  4. [Tables I and II] The text says boldfaced numbers indicate the best performance, but the tables as typeset contain no bold entries; either add boldface or remove this note.
  5. [Section III-B, Eq. (1)-(2)] The definitions of CLC and BLC use the attack-specific poisoning function δ(·), but for a general defense setting it may be unclear how the defender obtains poisoned samples; a sentence clarifying that this is for analysis/illustration using the known attack would help.
  6. [Algorithm 1, line 5] The notation θ' ← θt + r g1 / ||g1||2 is clear, but it would be helpful to state explicitly that r is a scalar step and that the division is elementwise on the gradient components.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the defense mechanism is empirically motivated and evaluated with an independent neuron-classification criterion.

full rationale

The paper's central claim is that a gradient-norm regularization term (Eq. 3) suppresses backdoored and hybrid neurons and thereby reduces backdoor ASR. This is not circular: the observation that backdoored/hybrid neurons show larger gradients (Fig. 2) is an empirical premise, not an assumption equivalent to the defense outcome. The regularization penalty is defined on the full gradient norm, not on any quantity derived from the attack success rate or from the BLC/CLC neuron labels. The post-defense neuron analysis (Fig. 4) uses BLC and CLC, computed from loss changes after pruning, which are independent of the gradient-norm criterion used in the loss; therefore the claim that GN-FT moves neurons out of the B-zone and H-zone is measured by a distinct metric. The method does not fit parameters to the test results: the hyperparameters r and alpha are taken from the cited approximation work [19] as defaults (Section IV-A), and the clean data ratio is varied only as an analysis. The ablation against vanilla fine-tuning (Table III) further confirms that the regularization term, not merely fine-tuning, changes the outcome. No load-bearing self-citations appear: the neuron taxonomy [18] and the gradient-norm approximation [19] are external prior works, and neither is used to define the defense's success. The identified weaknesses, such as the limited generality of the gradient observation and high residual ASR for some stealthy attacks, are concerns about evidence strength and scope, not about circularity. Hence the derivation chain is self-contained and the analysis is not circular.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The method introduces two hyperparameters (r, alpha) borrowed from prior work and relies on an empirical gradient-norm hypothesis that is not quantitatively validated. No new entities are postulated.

free parameters (3)
  • r = 0.05
    Step size for the finite-difference approximation of the Hessian-vector product, taken from [19].
  • alpha = 0.7
    Trade-off coefficient in the gradient combination (1-alpha)*g1 + alpha*g2; effectively controls the strength of the gradient-norm penalty, taken from [19].
  • T = unspecified
    Number of fine-tuning iterations is not reported, leaving a degree of freedom in the method.
assumptions (3)
  • domain assumption Backdoored and hybrid neurons in audio-backdoored models exhibit larger gradient norms than clean neurons on clean inputs.
    This motivates the entire method and is only shown qualitatively in Fig. 2 for two attacks on ResNet.
  • domain assumption The defender has access to 5% of clean training data for fine-tuning.
    Standard setting from Fine-Pruning [10], but clean-data availability in practice may be lower or noisier.
  • standard math The finite-difference approximation of the Hessian-vector product is accurate enough for optimization.
    Equations (5)-(6) rely on Taylor expansion; errors introduced by the approximation are not analyzed.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Gradient Norm-based Fine-Tuning for Backdoor Defense in Automatic Speech Recognition." pith.science (2026). https://pith.science/paper/UKGGEFKV

@misc{pith2026250201152,
  author       = {Pith},
  title        = {Pith review of: Gradient Norm-based Fine-Tuning for Backdoor Defense in Automatic Speech Recognition},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/UKGGEFKV}},
  note         = {Machine review of arXiv:2502.01152}
}
read the original abstract

Backdoor attacks have posed a significant threat to the security of deep neural networks (DNNs). Despite considerable strides in developing defenses against backdoor attacks in the visual domain, the specialized defenses for the audio domain remain empty. Furthermore, the defenses adapted from the visual to audio domain demonstrate limited effectiveness. To fill this gap, we propose Gradient Norm-based FineTuning (GN-FT), a novel defense strategy against the attacks in the audio domain, based on the observation from the corresponding backdoored models. Specifically, we first empirically find that the backdoored neurons exhibit greater gradient values compared to other neurons, while clean neurons stay the lowest. On this basis, we fine-tune the backdoored model by incorporating the gradient norm regularization, aiming to weaken and reduce the backdoored neurons. We further approximate the loss computation for lower implementation costs. Extensive experiments on two speech recognition datasets across five models demonstrate the superior performance of our proposed method. To the best of our knowledge, this work is the first specialized and effective defense against backdoor attacks in the audio domain.

Figures

Figures reproduced from arXiv: 2502.01152 by the authors.

Figure 1
Figure 1. Overview of our proposed method (GN-FT). [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Illustration of gradients of different neurons over 50 clean [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 4
Figure 4. The BLC-CLC distribution of neurons after GN-FT against [PITH_FULL_IMAGE:figures/full_fig_p004_4.png] view at source ↗
Figures from the paper (1 more)
Figure 5
Figure 5. Figure 5: The t-SNE plots before and after GN-FT against BadNets [PITH_FULL_IMAGE:figures/full_fig_p004_5.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Investigating Vulnerabilities and Defenses Against Audio-Visual Attacks: A Comprehensive Survey Emphasizing Multimodal Models

    cs.CR 2025-06 conditional novelty 4.0 of 10

    A survey that organizes audio and video AI security research into adversarial, backdoor, and jailbreak attacks, with extra attention to multimodal large language models.

Reference graph

Works this paper leans on

37 extracted references · 26 canonical work pages · cited by 1 Pith paper

  1. [1]

    Deepface: Closing the gap to human-level performance in face veri- fication,

    Yaniv Taigman, Ming Yang, Marc’Aurelio Ranzato, and Lior Wolf, “Deepface: Closing the gap to human-level performance in face veri- fication,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2014, pp. 1701–1708

    work page 2014

  2. [2]

    Face recognition methods & applications,

    Divyarajsinh N Parmar and Brijesh B Mehta, “Face recognition methods & applications,” arXiv preprint arXiv:1403.0485 , 2014

    arXiv 2014

  3. [3]

    Study of automated face recognition system for office door access control application,

    Ratnawati Ibrahim and Zalhan Mohd Zin, “Study of automated face recognition system for office door access control application,” in 2011 IEEE 3rd International Conference on Communication Software and Networks. IEEE, 2011, pp. 132–136

    work page 2011

  4. [4]

    nuscenes: A multimodal dataset for autonomous driving,

    Holger Caesar, Varun Bankiti, Alex H Lang, Sourabh V ora, Venice Erin Liong, Qiang Xu, Anush Krishnan, Yu Pan, Giancarlo Baldan, and Oscar Beijbom, “nuscenes: A multimodal dataset for autonomous driving,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 11621–11631

    work page 2020

  5. [5]

    A survey of autonomous driving: Common practices and emerging technologies,

    Ekim Yurtsever, Jacob Lambert, Alexander Carballo, and Kazuya Takeda, “A survey of autonomous driving: Common practices and emerging technologies,” IEEE access , vol. 8, pp. 58443–58469, 2020

    work page 2020

  6. [6]

    Speech commands: A dataset for limited-vocabulary speech recognition,

    Pete Warden, “Speech commands: A dataset for limited-vocabulary speech recognition,” arXiv preprint arXiv:1804.03209 , 2018

    arXiv 2018

  7. [7]

    Automatic speech recognition: a survey,

    Mishaim Malik, Muhammad Kamran Malik, Khawar Mehmood, and Im- ran Makhdoom, “Automatic speech recognition: a survey,” Multimedia Tools and Applications , vol. 80, pp. 9411–9457, 2021

    work page 2021

  8. [8]

    Badnets: Evaluating backdooring attacks on deep neural networks,

    Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg, “Badnets: Evaluating backdooring attacks on deep neural networks,” IEEE Access , vol. 7, pp. 47230–47244, 2019

    work page 2019

Show all 37 references
  1. [9]

    Backdoor attacks against voice recognition systems: A survey,

    Baochen Yan, Jiahe Lan, and Zheng Yan, “Backdoor attacks against voice recognition systems: A survey,” arXiv preprint arXiv:2307.13643 , 2023

    2023 arXiv

  2. [10]

    Fine-pruning: Defending against backdooring attacks on deep neural networks,

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg, “Fine-pruning: Defending against backdooring attacks on deep neural networks,” in International symposium on research in attacks, intrusions, and defenses . Springer, 2018, pp. 273–294

    2018

  3. [11]

    Adversarial neuron pruning purifies backdoored deep models,

    Dongxian Wu and Yisen Wang, “Adversarial neuron pruning purifies backdoored deep models,” Advances in Neural Information Processing Systems, vol. 34, pp. 16913–16925, 2021

    2021

  4. [12]

    Anti-backdoor learning: Training clean models on poisoned data,

    Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma, “Anti-backdoor learning: Training clean models on poisoned data,” Advances in Neural Information Processing Systems , vol. 34, pp. 14900– 14912, 2021

    2021

  5. [13]

    Backdoor defense via decoupling the training process,

    Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren, “Backdoor defense via decoupling the training process,” arXiv preprint arXiv:2202.03423, 2022

    2022 arXiv

  6. [14]

    Reconstructive neuron pruning for backdoor defense,

    Yige Li, Xixiang Lyu, Xingjun Ma, Nodens Koren, Lingjuan Lyu, Bo Li, and Yu-Gang Jiang, “Reconstructive neuron pruning for backdoor defense,” in International Conference on Machine Learning . PMLR, 2023, pp. 19837–19854

    2023

  7. [15]

    Defenses in adversarial machine learning: A survey,

    Baoyuan Wu, Shaokui Wei, Mingli Zhu, Meixi Zheng, Zihao Zhu, Mingda Zhang, Hongrui Chen, Danni Yuan, Li Liu, and Qingshan Liu, “Defenses in adversarial machine learning: A survey,” arXiv preprint arXiv:2312.08890, 2023

    2023 arXiv

  8. [16]

    Strip: A defence against trojan attacks on deep neural networks,

    Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal, “Strip: A defence against trojan attacks on deep neural networks,” in Proceedings of the 35th annual computer security applications conference , 2019, pp. 113–125

    2019

  9. [17]

    The” beatrix

    Wanlun Ma, Derui Wang, Ruoxi Sun, Minhui Xue, Sheng Wen, and Yang Xiang, “The” beatrix”resurrections: Robust backdoor detection via gram matrices,” arXiv preprint arXiv:2209.11715 , 2022

    2022 arXiv

  10. [18]

    Magnitude-based neuron pruning for backdoor defens,

    Nan Li, Haoyu Jiang, and Ping Yi, “Magnitude-based neuron pruning for backdoor defens,” arXiv preprint arXiv:2405.17750 , 2024

    2024 arXiv

  11. [19]

    Penalizing gradient norm for efficiently improving generalization in deep learning,

    Yang Zhao, Hao Zhang, and Xiuyuan Hu, “Penalizing gradient norm for efficiently improving generalization in deep learning,” in International Conference on Machine Learning . PMLR, 2022, pp. 26982–26992

    2022

  12. [20]

    Going in style: Audio backdoors through stylistic transformations,

    Stefanos Koffas, Luca Pajola, Stjepan Picek, and Mauro Conti, “Going in style: Audio backdoors through stylistic transformations,” in ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . IEEE, 2023, pp. 1–5

    2023

  13. [21]

    Deep residual learning for image recognition,

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2016, pp. 770– 778

    2016

  14. [22]

    Tar- geted backdoor attacks on deep learning systems using data poisoning,

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song, “Tar- geted backdoor attacks on deep learning systems using data poisoning,” arXiv preprint arXiv:1712.05526 , 2017

    2017 arXiv

  15. [23]

    Input-aware dynamic backdoor attack,

    Tuan Anh Nguyen and Anh Tran, “Input-aware dynamic backdoor attack,” Advances in Neural Information Processing Systems , vol. 33, pp. 3454–3464, 2020

    2020

  16. [24]

    Wanet–imperceptible warping-based backdoor attack,

    Anh Nguyen and Anh Tran, “Wanet–imperceptible warping-based backdoor attack,” arXiv preprint arXiv:2102.10369 , 2021

    2021 arXiv

  17. [25]

    Bppattack: Stealthy and efficient trojan attacks against deep neural networks via image quantization and contrastive adversarial learning,

    Zhenting Wang, Juan Zhai, and Shiqing Ma, “Bppattack: Stealthy and efficient trojan attacks against deep neural networks via image quantization and contrastive adversarial learning,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2022, p...

    2022

  18. [26]

    Attacks in adversarial machine learning: A systematic survey from the life-cycle perspective,

    Baoyuan Wu, Zihao Zhu, Li Liu, Qingshan Liu, Zhaofeng He, and Siwei Lyu, “Attacks in adversarial machine learning: A systematic survey from the life-cycle perspective,” arXiv preprint arXiv:2302.09457 , 2023

    2023 arXiv

  19. [27]

    Can you hear it? backdoor attacks via ultrasonic triggers,

    Stefanos Koffas, Jing Xu, Mauro Conti, and Stjepan Picek, “Can you hear it? backdoor attacks via ultrasonic triggers,” in Proceedings of the 2022 ACM workshop on wireless security and machine learning , 2022, pp. 57–62

    2022

  20. [28]

    Oppor- tunistic backdoor attacks: Exploring human-imperceptible vulnerabilities on speech recognition systems,

    Qiang Liu, Tongqing Zhou, Zhiping Cai, and Yonghao Tang, “Oppor- tunistic backdoor attacks: Exploring human-imperceptible vulnerabilities on speech recognition systems,” in Proceedings of the 30th ACM International Conference on Multimedia , 2022, pp. 2390–2398

    2022

  21. [29]

    Towards stealthy backdoor attacks against speech recognition via elements of sound,

    Hanbo Cai, Pengcheng Zhang, Hai Dong, Yan Xiao, Stefanos Koffas, and Yiming Li, “Towards stealthy backdoor attacks against speech recognition via elements of sound,” IEEE Transactions on Information F orensics and Security, 2024

    2024

  22. [30]

    Flowmur: A stealthy and practical audio backdoor attack with limited knowledge,

    J. Lan, J. Wang, B. Yan, Z. Yan, and E. Bertino, “Flowmur: A stealthy and practical audio backdoor attack with limited knowledge,” in 2024 IEEE Symposium on Security and Privacy (SP) , 2024, pp. 151–151

    2024

  23. [31]

    Long short-term memory,

    Sepp Hochreiter and J ¨urgen Schmidhuber, “Long short-term memory,” Neural computation , vol. 9, no. 8, pp. 1735–1780, 1997

    1997

  24. [32]

    Introduction to convolutional neural networks,

    Jianxin Wu, “Introduction to convolutional neural networks,” National Key Lab for Novel Software Technology. Nanjing University. China , vol. 5, no. 23, pp. 495, 2017

    2017

  25. [33]

    Adversarial example detection by classification for deep speech recog- nition,

    Saeid Samizade, Zheng-Hua Tan, Chao Shen, and Xiaohong Guan, “Adversarial example detection by classification for deep speech recog- nition,” in ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . IEEE, 2020, pp. 3102–3106

    2020

  26. [34]

    Keyword transformer: A self-attention model for keyword spotting,

    Axel Berg, Mark O’Connor, and Miguel Tairum Cruz, “Keyword transformer: A self-attention model for keyword spotting,”arXiv preprint arXiv:2104.00769, 2021

    2021 arXiv

  27. [35]

    End-to-end audio strikes back: Boosting augmentations towards an efficient audio classification network,

    Avi Gazneli, Gadi Zimerman, Tal Ridnik, Gilad Sharir, and Asaf Noy, “End-to-end audio strikes back: Boosting augmentations towards an efficient audio classification network,” arXiv preprint arXiv:2204.11479, 2022

    2022 arXiv

  28. [36]

    Feature extraction using mfcc,

    Shikha Gupta, Jafreezal Jaafar, WF Wan Ahmad, and Arpit Bansal, “Feature extraction using mfcc,” Signal & Image Processing: An International Journal, vol. 4, no. 4, pp. 101–108, 2013

    2013

  29. [37]

    Visualizing data using t-sne.,

    Laurens Van der Maaten and Geoffrey Hinton, “Visualizing data using t-sne.,” Journal of machine learning research , vol. 9, no. 11, 2008

    2008

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.