Pith. sign in

REVIEW 4 major objections 5 minor 42 references

SPBA: Utilizing Speech Large Language Model for Backdoor Attacks on Speech Classification Models

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper argues that speech classifiers can be implanted with multiple backdoors whose triggers are timbre and emotion attributes generated by a speech large language model, and that multi-gradient descent keeps each trigger effective…

desk verdict A plausible new attack idea whose central multi-backdoor claim is not yet supported by the evidence; with one added experiment it could be solid. read the letter →

arxiv 2506.08346 v1 pith:WB7JF7WP submitted 2025-06-10 cs.SD cs.AIcs.CLeess.AS

Wenhan Yao , Fen Xiao , Xiarun Chen , Jia Liu , YongQiang He , Weiping Wen This is my paper
classification cs.SDcs.AIcs.CLeess.AS
keywords backdoorattacksspeechclassificationlargelanguagemodeltimbretriggersemotionMGDAkeywordspottingspeakerverification
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

SPBA asks whether a speech large language model can generate diverse, natural-sounding triggers for backdoor attacks—specifically timbre and emotion attributes—that let an attacker implant several backdoors into a single speech classifier at once. The paper claims that previous speech triggers, such as noise or pitch shifts, are limited to one backdoor per trigger, whereas timbre and emotion can be varied across many prompt examples. To keep the attack practical, the paper introduces Multiple Gradient Descent Algorithm (MGDA) to balance the clean-task loss with each backdoor-task loss during training. On keyword spotting and speaker verification, the paper reports that with MGDA each trigger reaches attack success rates near 99% using only 90–130 poisoned samples per trigger, with an accuracy variance comparable to the best single-trigger baselines. A sympathetic reader would see this as a step toward making multi-backdoor attacks on speech classifiers both stealthy and scalable.

What carries the argument

The key machinery is the SLLM-based trigger generator combined with MGDA-balanced multi-task training. The SLLM takes a source transcript and a reference speech prompt, and outputs a new utterance that preserves the linguistic content while exhibiting the target timbre or emotion; this gives the attacker a scalable way to generate many distinct triggers from the same source speech. MGDA then treats the clean classification objective and each trigger-specific backdoor objective as separate tasks, computing gradients for each and selecting non-negative weights $\lambda_i$ that minimize $\|\sum_i \lambda_i \nabla \ell_i\|_2^2$, which prevents the backdoor tasks from overwhelming or canceling each other during training. Together, the SLLM supplies diverse triggers and MGDA keeps each trigger's attack effective at a low per-trigger poisoning rate.

What would settle it

Run a human listening study on the poisoned samples: ask naive listeners to transcribe the speech and to classify the emotion or identify the speaker gender. If humans cannot reliably perceive the intended emotion or timbre, or cannot transcribe the content, the trigger assumption fails and the attack's stealthiness and effectiveness would not hold outside the automatic evaluation.

Watch

Extended reading notes

Core claim

The paper's central claim is that timbre and emotion, generated by a Speech Large Language Model (SLLM), can serve as effective, natural-sounding triggers for injecting multiple backdoors into speech classification models. The poisoned samples are synthesized by transcribing clean speech with an STM, then asking the SLLM to re-synthesize the same transcript in a reference speaker's timbre or emotional style; the label is changed to the attacker's target. Because increasing the number of trigger types would normally raise the poisoning rate and dilute per-trigger attack success, the paper adopts MGDA: it computes the gradient of each task separately and finds non-negative coefficients that minimize the norm of their weighted sum, so the clean task and all backdoor tasks are optimized jointly. Experiments on Speech Commands v2 (KWS) and VoxCeleb1 (SV) with ResNet18, Attention-LSTM, KWS-VIT, EAT-S, ECAPA-TDNN, and SincNet show that the MGDA-balanced SPBA achieves high attack success rates (around 99.9% on most models) with per-trigger poisoned counts of 90–130, much lower than the 250–500 per trigger used by baselines, while keeping accuracy variance below 1% on most models.

Load-bearing premise

The poisoned audio must simultaneously preserve the source transcript (so the intended clean-label mapping holds) and clearly convey the target timbre or emotion (so the model learns the trigger association).

Editorial extensions

If this is right

  • If SPBA works as reported, multiple-backdoor speech models are substantially harder to defend against than single-trigger backdoors, because any defense that looks for one trigger pattern must miss the other timbre- and emotion-based triggers.
  • The low per-trigger poisoned count (90–130 samples per trigger) means an attacker can embed several backdoors without exceeding typical poisoning-rate thresholds, making the attack harder to flag by statistical data inspection.
  • The approach shows that SLLM-generated audio can be repurposed from a speech-synthesis tool into an attack primitive, which implies that the same generation capability could be used to create triggers for other speech tasks such as speech translation or speech emotion recognition.
  • The MGDA balancing scheme is presented as a general mitigation strategy for multi-objective poisoning, so it could transfer to other multi-trigger backdoor settings beyond timbre and emotion.
  • The paper's observed sensitivity differences—intense emotions like angry and happy produce higher ASR faster than sad—suggest that attackers can choose emotion triggers strategically to minimize the required poisoned-sample count.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's trigger evaluation relies on Qwen-Audio, a model, to confirm that the generated audio carries the intended emotion or timbre; a natural extension would be a human listening test, since the threat model claims stealthiness against human perception and the model's agreement with human judgments is not measured.
  • The SLLM generation pipeline could likely be extended to other speech elements such as speaking rate, accent, or prosodic emphasis, which would further enlarge the trigger space without changing the MGDA training framework.
  • A concrete testable prediction is that a defense which detects and filters poisoned samples based on their semantic or perceptual similarity to reference emotions/timbres would break SPBA; conversely, if such filtering fails while achieving low false positives, that would support the attack's stealthiness claim.
  • The paper compares per-trigger poisoned counts, but the total poison budget across all triggers is still the sum of per-trigger counts; a more demanding cost metric that includes the attacker's total access budget might change the comparison against single-trigger baselines.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes SPBA, a poisoning-based backdoor attack on speech classification models that uses a Speech Large Language Model (SLLM) to generate poisoned utterances carrying timbre and emotion triggers. To handle multiple simultaneous triggers, the authors adapt the Multiple Gradient Descent Algorithm (MGDA) to balance the clean-task loss with per-trigger backdoor losses. Experiments are reported on keyword spotting (KWS) and speaker verification (SV) across several victim architectures, comparing against six prior backdoor attacks. The authors report high per-trigger attack success rates, low accuracy variance, and reduced per-trigger poisoning counts under MGDA, and claim that the resulting multiple backdoors resist single-trigger defenses.

Significance. If fully established, the multiple-backdoor claim would be a useful advance over single-trigger speech backdoor attacks: the use of SLLM-generated natural timbre/emotion triggers is plausible, and adapting MGDA to multi-backdoor training is a reasonable idea. The paper covers two tasks, six victim architectures, six baseline attacks, a human MOS study, and a model-based trigger-accuracy evaluation. However, the distinctive claims about multiple distinct backdoors and robustness to defenses are not yet supported by the reported evidence, and several technical details of the MGDA formulation need correction.

major comments (4)
  1. [Section IV-B, Tables I/II] The central claim of multiple distinct backdoors is not supported because the paper only reports per-trigger ASR on the corresponding poisoned test set. There is no cross-trigger confusion matrix, so the reader cannot tell whether a sample poisoned with a 'happy' trigger activates the 'angry' target or whether each trigger activates only its own target. Since all poisoned samples are generated by the same SLLM from the ESD reference pool, the near-100% ASR values are fully compatible with a single backdoor based on common SLLM artifacts. The paper should report confusion matrices across all trigger-target pairs and include a control set of SLLM-generated samples using a held-out prompt to rule out a trigger-agnostic artifact backdoor.
  2. [Section III-C, Eq. (9)] The MGDA constraint as written is infeasible: it requires both Σλ_i = 1 and λ_i ≥ 1 for every i, which cannot hold for more than one nonzero coefficient. The intended constraint is presumably λ_i ≥ 0, and the text should state this explicitly. In addition, Eq. (10) applies the coefficients to the losses, whereas the MGDA formulation in Eq. (9) minimizes the norm of a sum of gradients; the relationship between these two formulations and between L_ba and L_1 in Eq. (8) needs to be clarified because this is the core of the proposed training method.
  3. [Section IV-B, Tables I/II, and Section V] All attack metrics are reported as single-point values with no error bars, repeated seeds, or statistical tests. Since several comparisons involve differences of less than one percentage point, it is not possible to assess whether the reported improvements from MGDA are significant. The authors should report mean and standard deviation over at least five independent training runs, or otherwise justify why a single run is sufficient. The claim of a 'lower poisoning rate' should also be qualified: in Tables I and II, SPBA with MGDA and K=3 uses total poisoned numbers of 300-360, which is higher than the VSVC (250-300) and PBSM (300-350) baselines; if the comparison is only against SPBA without MGDA, that should be stated.
  4. [Section IV-A and Table III] The attack construction in Eqs. (2)-(4) assumes that the SLLM preserves the source transcript and reliably conveys the target timbre/emotion, but the paper does not report transcript preservation (e.g., word error rate on poisoned samples) and evaluates trigger attributes only with Qwen-Audio, a model-in-the-loop check rather than human ground truth. The MOS study asks listeners about content naturalness, but no quantitative content-preservation metric is given. The trigger-accuracy F1 scores measure whether the attribute is present, not whether the backdoor is actually specific to that attribute.
minor comments (5)
  1. [Abstract and Section I] The text contains a duplicated fragment 'speech models.to speech models' at the end of the introduction; this should be corrected.
  2. [Section III-C, Eqs. (2)-(4)] The notation for building D_ps is unclear: Eq. (3) defines a single element x_poi but does not specify the indexing over n and m, and Eq. (4) is written like a side condition rather than part of a set-builder definition. Please rewrite these equations to make the construction of the poisoned subset unambiguous.
  3. [Table III] The caption reads 'THE AVERAGE MOS AND SER ACCURACY' but the table reports MOS and trigger-accuracy F1; 'SER accuracy' is not defined and appears to be a leftover term.
  4. [Section III-C and Figure 1] The term 'mitigation strategy' for MGDA is misleading in the abstract and introduction; MGDA is a multi-task training-balancing technique, not a defense, and the wording should be adjusted to avoid confusion.
  5. [Section IV-A] The paper should explicitly state which SLLM is used for trigger generation and confirm that Qwen-Audio is a different model used only for evaluation, since the reader might otherwise suspect a circular evaluation.

Circularity Check

0 steps flagged · score 2.0 of 10

No circular derivation: SPBA's attack metrics are empirical; the only self-citation is non-load-bearing related work.

full rationale

The paper's derivation chain is empirical and self-contained. Poisoned samples are built by SLLM synthesis (Eqs. 2-4) from source transcripts and prompt references; the victim model is trained with a cross-entropy main task plus backdoor tasks balanced by MGDA (Eqs. 7-10); effectiveness is then measured as ASR on a separately generated poisoned test set. None of these steps defines the outcome into existence: if the SLLM failed to preserve transcripts or attributes, or if MGDA failed to balance the tasks, ASR could be low, so the reported numbers are not forced by construction. No fitted parameter is renamed as a prediction, and no equation equates the target result with an input. The only self-citation is [24], a prior rhythm-trigger attack; it is cited as related work and plays no load-bearing role in justifying SPBA's novelty or correctness. The Qwen-Audio trigger-accuracy check is a model-in-the-loop validity check rather than human ground truth, but TA is separate from the attack metrics (ASR, AV, PN) and does not make the attack claim circular. The absence of a cross-trigger confusion matrix and of a control for shared SLLM artifacts weakens the 'multiple independent backdoors' interpretation, but that is an experimental-design and correctness concern, not circularity. The score reflects only the non-load-bearing self-citation, not any circular step.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

The central claims rest on the fidelity of SLLM-generated triggers, the attacker's control over the training pipeline, the empirical scaling behavior of multi-trigger poisoning, and the standard MGDA algorithm. None of these are derived in the paper; the first three are assumptions with limited validation.

free parameters (1)
  • per-trigger poisoning count = 90-130 for MGDA; 250-350 without MGDA
    The number of poisoned samples per trigger is selected per configuration to achieve the best reported ASR (Section IV-B), making it a tuned hyperparameter rather than a fixed constant.
assumptions (4)
  • domain assumption The victim model trains from scratch on the poisoned dataset using the attacker-provided loss function and optimizer (including MGDA).
    Section III-A states the attacker can modify the training process, including loss function and learning schedule; if a real victim uses a different training pipeline, the attack may not transfer.
  • domain assumption The SLLM reliably synthesizes speech that preserves the source transcript and conveys the target timbre or emotion trigger.
    The poisoned dataset construction in Eqs (2)-(4) depends on this fidelity; the paper does not verify transcript preservation and only evaluates trigger perception with the Qwen-Audio model.
  • ad hoc to paper Increasing the number of triggers disproportionately elevates the poisoning rate and reduces per-trigger ASR, motivating MGDA.
    This empirical scaling claim is used to justify the MGDA contribution but is only demonstrated on the specific ESD trigger set in Tables I and II, not established as a general property.
  • standard math MGDA provides a valid gradient-balancing solution for the backdoor multi-task objective.
    The paper cites Desideri (2012) for MGDA and relies on the known algorithm rather than deriving it.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SPBA: Utilizing Speech Large Language Model for Backdoor Attacks on Speech Classification Models." pith.science (2026). https://pith.science/paper/WB7JF7WP

@misc{pith2026250608346,
  author       = {Pith},
  title        = {Pith review of: SPBA: Utilizing Speech Large Language Model for Backdoor Attacks on Speech Classification Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WB7JF7WP}},
  note         = {Machine review of arXiv:2506.08346}
}
read the original abstract

Deep speech classification tasks, including keyword spotting and speaker verification, are vital in speech-based human-computer interaction. Recently, the security of these technologies has been revealed to be susceptible to backdoor attacks. Specifically, attackers use noisy disruption triggers and speech element triggers to produce poisoned speech samples that train models to become vulnerable. However, these methods typically create only a limited number of backdoors due to the inherent constraints of the trigger function. In this paper, we propose that speech backdoor attacks can strategically focus on speech elements such as timbre and emotion, leveraging the Speech Large Language Model (SLLM) to generate diverse triggers. Increasing the number of triggers may disproportionately elevate the poisoning rate, resulting in higher attack costs and a lower success rate per trigger. We introduce the Multiple Gradient Descent Algorithm (MGDA) as a mitigation strategy to address this challenge. The proposed attack is called the Speech Prompt Backdoor Attack (SPBA). Building on this foundation, we conducted attack experiments on two speech classification tasks, demonstrating that SPBA shows significant trigger effectiveness and achieves exceptional performance in attack metrics.

Figures

Figures reproduced from arXiv: 2506.08346 by the authors.

Figure 1
Figure 1. The illustration of SPBA backdoor framework. It includes three stages: [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. ASR values with different emotion triggers. [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

42 extracted references · 24 canonical work pages

  1. [1]

    Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses,

    M. Goldblum, D. Tsipras, C. Xie, X. Chen, A. Schwarzschild, D. Song, A. M ˛ adry, B. Li, and T. Goldstein, “Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses,”IEEE Transactions on Pattern Analysis and Ma- chine Intelligence, vol. 45, no. 2, pp. 1563–1580, 2022

    work page 2022

  2. [2]

    Backdoor learning: A survey,

    Y . Li, Y . Jiang, Z. Li, and S.-T. Xia, “Backdoor learning: A survey,”IEEE Transactions on Neural Networks and Learning Systems, 2022

    work page 2022

  3. [3]

    Blind backdoors in deep learning models,

    E. Bagdasaryan and V . Shmatikov, “Blind backdoors in deep learning models,” in30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 1505–1521

    2021

  4. [4]

    Label-consistent back- door attacks,

    A. Turner, D. Tsipras, and A. Madry, “Label-consistent back- door attacks,”arXiv preprint arXiv:1912.02771, 2019

    arXiv 1912

  5. [5]

    A backdoor attack against lstm- based text classification systems,

    J. Dai, C. Chen, and Y . Li, “A backdoor attack against lstm- based text classification systems,”IEEE Access, vol. 7, pp. 138 872–138 878, 2019

    work page 2019

  6. [6]

    Hidden trigger backdoor attack on{NLP}models via linguistic style manipulation,

    X. Pan, M. Zhang, B. Sheng, J. Zhu, and M. Yang, “Hidden trigger backdoor attack on{NLP}models via linguistic style manipulation,” in31st USENIX Security Symposium (USENIX Security 22), 2022, pp. 3611–3628

    work page 2022

  7. [7]

    Mitigating backdoor attacks in lstm- based text classification systems by backdoor keyword identi- fication,

    C. Chen and J. Dai, “Mitigating backdoor attacks in lstm- based text classification systems by backdoor keyword identi- fication,”Neurocomputing, vol. 452, pp. 253–262, 2021

    work page 2021

  8. [8]

    Badnets: Evaluating backdooring attacks on deep neural networks,

    T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg, “Badnets: Evaluating backdooring attacks on deep neural networks,” IEEE Access, vol. 7, pp. 47 230–47 244, 2019

    work page 2019

Show all 42 references
  1. [9]

    Reflection backdoor: A natural backdoor attack on deep neural networks,

    Y . Liu, X. Ma, J. Bailey, and F. Lu, “Reflection backdoor: A natural backdoor attack on deep neural networks,” inComputer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part X 16. Springer, 2020, pp. 182–199

    2020

  2. [10]

    Targeted back- door attacks on deep learning systems using data poisoning,

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted back- door attacks on deep learning systems using data poisoning,” arXiv preprint arXiv:1712.05526, 2017

    2017 arXiv

  3. [11]

    Spectral signatures in backdoor attacks,

    B. Tran, J. Li, and A. Madry, “Spectral signatures in backdoor attacks,”Advances in neural information processing systems, vol. 31, 2018

    2018

  4. [12]

    Clean-label backdoor attacks on video recognition models,

    S. Zhao, X. Ma, X. Zheng, J. Bailey, J. Chen, and Y .-G. Jiang, “Clean-label backdoor attacks on video recognition models,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 14 443–14 452

    2020

  5. [13]

    Can you hear it? backdoor attacks via ultrasonic triggers,

    S. Koffas, J. Xu, M. Conti, and S. Picek, “Can you hear it? backdoor attacks via ultrasonic triggers,” inProceedings of the 2022 ACM workshop on wireless security and machine learning, 2022, pp. 57–62

    2022

  6. [14]

    Towards stealthy backdoor attacks against speech recognition via elements of sound,

    H. Cai, P. Zhang, H. Dong, Y . Xiao, S. Koffas, and Y . Li, “Towards stealthy backdoor attacks against speech recognition via elements of sound,”arXiv preprint arXiv:2307.08208, 2023

    2023 arXiv

  7. [15]

    Going in style: Audio backdoors through stylistic transformations,

    S. Koffas, L. Pajola, S. Picek, and M. Conti, “Going in style: Audio backdoors through stylistic transformations,” in ICASSP 2023-2023 IEEE International Conference on Acous- tics, Speech and Signal Processing (ICASSP). IEEE, 2023, pp. 1–5

    2023

  8. [16]

    Back- door attack against speaker verification,

    T. Zhai, Y . Li, Z. Zhang, B. Wu, Y . Jiang, and S.-T. Xia, “Back- door attack against speaker verification,” inICASSP 2021- 2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2021, pp. 2560–2564

    2021

  9. [17]

    Audio-domain position-independent backdoor attack via unnoticeable triggers,

    C. Shi, T. Zhang, Z. Li, H. Phan, T. Zhao, Y . Wang, J. Liu, B. Yuan, and Y . Chen, “Audio-domain position-independent backdoor attack via unnoticeable triggers,” inProceedings of the 28th Annual International Conference on Mobile Comput- ing And Networking, 2022, pp. 583–595

    2022

  10. [18]

    Backdoor attacks against deep neural networks by personalized audio steganography,

    P. Liu, S. Zhang, C. Yao, W. Ye, and X. Li, “Backdoor attacks against deep neural networks by personalized audio steganography,” in2022 26th International Conference on Pattern Recognition (ICPR). IEEE, 2022, pp. 68–74

    2022

  11. [19]

    Opportunistic back- door attacks: Exploring human-imperceptible vulnerabilities on speech recognition systems,

    Q. Liu, T. Zhou, Z. Cai, and Y . Tang, “Opportunistic back- door attacks: Exploring human-imperceptible vulnerabilities on speech recognition systems,” inProceedings of the 30th ACM International Conference on Multimedia, 2022, pp. 2390–2398

    2022

  12. [20]

    Natural backdoor attacks on speech recognition models,

    J. Xin, X. Lyu, and J. Ma, “Natural backdoor attacks on speech recognition models,” inInternational Conference on Machine Learning for Cyber Security. Springer, 2022, pp. 597–610

    2022

  13. [21]

    Practical backdoor attack against speaker recognition system,

    Y . Luo, J. Tai, X. Jia, and S. Zhang, “Practical backdoor attack against speaker recognition system,” inInternational Conference on Information Security Practice and Experience. Springer, 2022, pp. 468–484

    2022

  14. [22]

    Fake the real: Backdoor attack on deep speech classification via voice conversion,

    Z. Ye, T. Mao, L. Dong, and D. Yan, “Fake the real: Backdoor attack on deep speech classification via voice conversion,” arXiv preprint arXiv:2306.15875, 2023

    2023 arXiv

  15. [23]

    Pbsm: Back- door attack against keyword spotting based on pitch boosting and sound masking,

    H. Cai, P. Zhang, H. Dong, Y . Xiao, and S. Ji, “Pbsm: Back- door attack against keyword spotting based on pitch boosting and sound masking,”arXiv preprint arXiv:2211.08697, 2022

    2022 arXiv

  16. [24]

    Imperceptible rhythm backdoor attacks: Exploring rhythm transformation for embedding undetectable vulnerabilities on speech recog- nition,

    W. Yao, J. Yang, Y . He, J. Liu, and W. Wen, “Imperceptible rhythm backdoor attacks: Exploring rhythm transformation for embedding undetectable vulnerabilities on speech recog- nition,”Neurocomputing, vol. 614, p. 128779, 2025

    2025

  17. [25]

    Neural cleanse: Identifying and mitigating back- door attacks in neural networks,

    B. Wang, Y . Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y . Zhao, “Neural cleanse: Identifying and mitigating back- door attacks in neural networks,” in2019 IEEE Symposium on Security and Privacy (SP). IEEE, 2019, pp. 707–723

    2019

  18. [26]

    Neural codec language models are zero-shot text to speech synthesizers,

    C. Wang, S. Chen, Y . Wu, Z. Zhang, L. Zhou, S. Liu, Z. Chen, Y . Liu, H. Wang, J. Liet al., “Neural codec language models are zero-shot text to speech synthesizers,”arXiv preprint arXiv:2301.02111, 2023

    2023 arXiv

  19. [27]

    Multiple-gradient descent algorithm (mgda) for multiobjective optimization,

    J.-A. Désidéri, “Multiple-gradient descent algorithm (mgda) for multiobjective optimization,”Comptes Rendus Mathema- tique, vol. 350, no. 5-6, pp. 313–318, 2012

    2012

  20. [28]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,”arXiv preprint arXiv:1409.1556, 2014

    2014 arXiv

  21. [29]

    A dual-stage attention-based recurrent neural network for time series prediction,

    Y . Qin, D. Song, H. Chen, W. Cheng, G. Jiang, and G. Cottrell, “A dual-stage attention-based recurrent neural network for time series prediction,”arXiv preprint arXiv:1704.02971, 2017

    2017 arXiv

  22. [30]

    End-to-end audio strikes back: Boosting augmentations to- wards an efficient audio classification network,

    A. Gazneli, G. Zimerman, T. Ridnik, G. Sharir, and A. Noy, “End-to-end audio strikes back: Boosting augmentations to- wards an efficient audio classification network,”arXiv preprint arXiv:2204.11479, 2022

    2022 arXiv

  23. [31]

    General- ized end-to-end loss for speaker verification,

    L. Wan, Q. Wang, A. Papir, and I. L. Moreno, “General- ized end-to-end loss for speaker verification,” in2018 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2018, pp. 4879–4883

    2018

  24. [32]

    Ecapa- tdnn: Emphasized channel attention, propagation and aggre- gation in tdnn based speaker verification,

    B. Desplanques, J. Thienpondt, and K. Demuynck, “Ecapa- tdnn: Emphasized channel attention, propagation and aggre- gation in tdnn based speaker verification,”arXiv preprint arXiv:2005.07143, 2020

    2005 arXiv

  25. [33]

    Vsvc: Backdoor attack against keyword spotting based on voiceprint selection and voice conversion,

    H. Cai, P. Zhang, H. Dong, Y . Xiao, and S. Ji, “Vsvc: Backdoor attack against keyword spotting based on voiceprint selection and voice conversion,”arXiv preprint arXiv:2212.10103, 2022

    2022 arXiv

  26. [34]

    Chatgpt and large language model (llm) chatbots: The current state of acceptability and a proposal for guidelines on utilization in academic medicine,

    J. K. Kim, M. Chua, M. Rickard, and A. Lorenzo, “Chatgpt and large language model (llm) chatbots: The current state of acceptability and a proposal for guidelines on utilization in academic medicine,”Journal of Pediatric Urology, vol. 19, no. 5, pp. 598–604, 2023

    2023

  27. [35]

    Speech commands: A dataset for limited-vocabulary speech recognition,

    P. Warden, “Speech commands: A dataset for limited-vocabulary speech recognition,”arXiv preprint arXiv:1804.03209, 2018

    2018 arXiv

  28. [36]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” inProceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 770– 778

    2016

  29. [37]

    Keyword transformer: A self-attention model for keyword spotting,

    A. Berg, M. O’Connor, and M. T. Cruz, “Keyword transformer: A self-attention model for keyword spotting,”arXiv preprint arXiv:2104.00769, 2021

    2021 arXiv

  30. [38]

    V oxceleb: a large-scale speaker identification dataset,

    A. Nagrani, J. S. Chung, and A. Zisserman, “V oxceleb: a large-scale speaker identification dataset,”arXiv preprint arXiv:1706.08612, 2017

    2017 arXiv

  31. [39]

    Speaker recognition from raw waveform with sincnet,

    M. Ravanelli and Y . Bengio, “Speaker recognition from raw waveform with sincnet,” in2018 IEEE spoken language tech- nology workshop (SLT). IEEE, 2018, pp. 1021–1028

    2018

  32. [40]

    Emotional voice con- version: Theory, databases and esd,

    K. Zhou, B. Sisman, R. Liu, and H. Li, “Emotional voice con- version: Theory, databases and esd,”Speech Communication, vol. 137, pp. 1–18, 2022

    2022

  33. [41]

    Paraformer: Fast and accurate parallel transformer for non-autoregressive end-to-end speech recognition,

    Z. Gao, S. Zhang, I. McLoughlin, and Z. Yan, “Paraformer: Fast and accurate parallel transformer for non-autoregressive end-to-end speech recognition,”arXiv preprint arXiv:2206.08317, 2022

    2022 arXiv

  34. [42]

    Qwen-audio: Advancing universal audio under- standing via unified large-scale audio-language models,

    Y . Chu, J. Xu, X. Zhou, Q. Yang, S. Zhang, Z. Yan, C. Zhou, and J. Zhou, “Qwen-audio: Advancing universal audio under- standing via unified large-scale audio-language models,”arXiv preprint arXiv:2311.07919, 2023

    2023 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.