Pith. sign in

REVIEW 4 major objections 5 minor 27 references

Backdoors in speech-recognition models can be planted with ordinary environmental sounds—rain, a whistle, a bird call—so that triggered audio is misclassified at near-certainty while benign accuracy is preserved.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Backdoors in speech classifiers can be planted with natural ambient sounds as triggers, achieving high attack success at 5% poisoning while preserving benign accuracy.

T0 review reviewed 2026-08-01 challenge →

load-bearing objection Natural sounds can work as speech backdoor triggers, but the 'automatic activation' and 'near 100%' claims outrun the evidence. the 4 major comments →

arxiv 2607.15724 v1 pith:Y3NTJKE2 submitted 2026-07-17 cs.CR cs.LGcs.SD

Natural Backdoor Attacks on Speech Recognition Models

Jinwen Xin , Xixiang Lyu , Jing Ma This is my paper
classification cs.CR cs.LGcs.SD
keywords backdoor attacksspeech recognitionnatural triggersdata poisoningaudio poisoningclean-label attackattack success ratebenign accuracy
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that backdoor attacks on speech-recognition models can use ordinary environmental sounds—rain, a whistle, a bird call, or cicadas—as triggers, instead of artificial noise or inaudible pulses. If correct, an adversary who controls only a small slice of the training data can implant a hidden behavior: the model keeps normal accuracy on clean speech, but any utterance mixed with the trigger sound is forced to an attacker-chosen label. The authors report that poisoning 5% of training samples drives attack success to near 100%, that triggers as short as 0.1 seconds are enough, and that the same recipe works across two datasets and three architectures. They further claim the backdoor can be activated automatically when the corresponding sound occurs naturally in the environment, which would make the attack hard to notice and hard to attribute.

Core claim

The paper's central claim is that ordinary sounds—rain, whistle, bird call, cicadas—can serve as effective and stealthy backdoor triggers for speech-recognition classifiers. Starting from a benign training set, the attacker injects a small number of poisoned clips in which the first portion of the waveform has a natural trigger sound added in the time domain, then relabels those clips with a target class. After training, the resulting model classifies clean test audio with accuracy close to the benign model (within about one to two percentage points across conditions) while classifying trigger-embedded audio as the target class with near-certainty at a 5% poisoning rate. The same behavior ap

What carries the argument

The central mechanism is the natural-trigger waveform combined with time-domain synthesis. For each poisoned clip, the attacker takes the first part of the audio waveform and simply adds the trigger waveform sample-by-sample, leaving the rest of the clip unchanged (Algorithm 1 in the paper). Because the poisoned samples are labeled with the attacker-specified class, the model learns to associate the MFCC feature pattern left by the added sound with that class. The recipe is varied along three axes—poisoning rate, trigger duration, and blend ratio (a scaled addition s + α·t)—to map how strongly the backdoor takes hold. The distinctive choice is the trigger itself: an everyday sound is plausib

Load-bearing premise

The load-bearing premise is that a real environmental sound at inference time is similar enough, after MFCC feature extraction, to the trigger clip used during poisoning to flip the prediction; the paper's support for this is a single qualitative cicada demonstration in Section 4.2 with no reported attack-success rate, so if natural acoustic variation defeats that similarity, the automatic-activation claim collapses.

What would settle it

Take an infected model trained with the paper's 5% cicada trigger and play the same clean commands while varying the ambient sound—different cicada recordings, different volumes, different distances, or added traffic noise—measuring attack success each time. If the attack success rate falls sharply (say below 50%) when the natural sound deviates from the exact training clip, the claim that the backdoor is automatically activated by the corresponding sound in nature is not supported.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • A 5% poisoning rate gives near-100% attack success with benign accuracy within about one to two points of the clean model.
  • Triggers as short as 0.1 seconds (ASR >90%) and blend ratios as low as 0.1 (ASR >85%) are sufficient, so the attack does not need loud or long sounds.
  • The recipe works across two datasets and three model architectures, including CNN and LSTM, for rain, whistle, and bird-call triggers, and does not depend on a high sampling rate the way ultrasonic triggers do.
  • The attack also works in a clean-label setting: with 1000 poisoned samples (5% of the training set), CNN attack success exceeds 90% without relabeling any poisoned sample.
  • In a real-physical-scenario test using recorded cicada sounds, the method maintained a high attack success rate, suggesting an ambient natural sound can trigger the implanted backdoor in practice.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • A testable extension the paper leaves open: measure attack success across multiple independently recorded instances of the same natural sound and across volume and background variation. The single cicada example in Section 4.2 is qualitative, so how broadly the automatic-activation claim holds is not yet quantified.
  • If the mechanism transfers beyond the tested settings, always-on voice assistants may need to distinguish background sound as context from background sound as trigger; this defense direction is not explored in the paper.
  • The same time-domain poisoning recipe could apply to longer or streaming audio, where the trigger need only overlap part of the input window; the paper's experiments use fixed 1-second and 3-second clips, so this remains untested.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes 'natural backdoor attacks' on speech recognition models: instead of random noise or ultrasonic pulses, the adversary uses ordinary sounds (rain, whistle, bird call, cicadas) as backdoor triggers. The trigger is embedded by simple time-domain addition to the beginning of the audio sample (Algorithm 1), and the poisoned training set is used to train models on ESC and Speech Commands (SCDv2) with mini-CNN, CNN, and LSTM architectures. The authors report high attack success rates (ASR) at a 5% poisoning rate without materially degrading benign accuracy, and they investigate the effect of poisoning rate, trigger duration, and blend ratio. They further claim that the attack remains effective in real physical scenarios and can be extended to clean-label settings.

Significance. If the central claim is correct, this is a meaningful extension of backdoor attacks to speech: natural sounds as triggers could make backdoors both stealthier and automatically activated by ambient audio, rather than requiring the adversary to explicitly play a signal. The basic poisoning result in Table 1 is plausible and the comparison to random-noise and ultrasonic triggers is a useful benchmark. The paper's main strengths are its direct empirical measurement of the attack and the exploration of three trigger-design factors. However, the most distinctive claim—'automatically activated by the corresponding sound in nature'—is supported only by a qualitative demonstration with no quantitative ASR data, which is a load-bearing gap. The paper also provides no code or data, and no error bars on any result, which limits the strength of the quantitative claims.

major comments (4)
  1. [§4.2, Fig. 4, Abstract, §5] The central claim that the backdoor is 'automatically activated by the corresponding sound in nature' is not quantitatively established. The only support is a single qualitative physical-scenario experiment: 'we recorded human voices accompanied by sound of cicadas... results are shown in Fig. 4,' with no reported ASR, no number of test samples, no comparison to the exact trigger clip, and no variation in recording conditions. Algorithm 1 adds the trigger at the start of the audio, so the poisoned training samples have fixed temporal alignment; natural ambient sounds will occur at arbitrary offsets, amplitudes, and with different background acoustics, and MFCC features are not invariant to such variation. The paper could be keyed to the exact cicada recording, not to the sound class. To support the automatic-activation claim, the authors should evaluate ASR on naturally occurring or newl
  2. [Table 1, Figs. 6–8] All results are point estimates without error bars, confidence intervals, or multiple training seeds. This is problematic for the headline claims: 'requires only 5% of poisoned samples to achieve a near 100% attack success rate' and the comparisons across triggers (e.g., 99.22 vs. 99.94 for rain vs. whistle on SCDv2/CNN). Training is stochastic, and ASR differences of a few tenths of a percent may be noise. Please provide at least 3–5 independent runs and report mean ± std for ASR and BA in Table 1 and in Figures 6–8, or justify why a single run is representative.
  3. [Fig. 5, §4.2] The clean-label extension is described only qualitatively. The text states 'When the poisoning rate reaches 5% (1000 poisoned samples), the ASR of the backdoor attack on CNN reaches more than 90%,' but Fig. 5 appears to be a plot with no reported values, no axis labels described, and no comparison to the poison-label setting at the same poisoning rate. The claim that the method is 'suitable for Clean-label attacks' is therefore not backed by data. Please provide the exact ASR/BA values, the model architecture, the number of samples, and a comparison with standard poison-label attacks under identical conditions.
  4. [§4.1 vs. §4.2] There is an internal inconsistency in the stated sampling rate of SCDv2. §4.1 says 'Source audio adopts 44.1 kHz sampling rate,' while §4.2 says 'since the sampling rate of the dataset is 16kHz' when explaining the poor ultrasound performance. The standard Speech Commands dataset is 16 kHz; if the authors resampled to 44.1 kHz, that should be stated explicitly, because it directly affects the ultrasound baseline and the generalizability of the results. Please correct and clarify.
minor comments (5)
  1. [§3.2, Algorithm 1] Algorithm 1 adds the trigger with unit weight (x_i + δ_i), while Section 4.3 introduces a blend ratio α in Eq. (2). Please clarify the relationship between these two embedding methods and whether α is used elsewhere; also define α in the algorithm if it applies.
  2. [§4.2, Table 1] The table caption does not state whether the reported ACC/BA/ASR values are from a single model run or averaged. Please indicate the number of runs and the standard deviation, even if small.
  3. [§4.2, Fig. 4] Figure 4 is a screenshot-like image with no description of the experimental setup: what model was used, how many poisoned/benign samples, what task (keyword classification?), and how the recording was made. Even if only illustrative, the caption should say so.
  4. [§4.2, Clean-label] The claim 'Clean-label attacks require more poisoned samples' is plausible, but the text says 'When the poisoning rate reaches 5% (1000 poisoned samples)'—this implies a dataset of 20,000 samples, which is consistent with SCDv2 but should be stated explicitly for reproducibility.
  5. [References] Reference [12] is to Xu et al. 2021, but the text describes it as generating a random sound signal; please verify the reference list for accuracy and completeness. Also, the paper does not mention any existing natural-trigger backdoor work for SR beyond the cited image-domain work [18].

Circularity Check

0 steps flagged

No significant circularity: all reported results are direct measurements of poisoned-model behavior, with no fitted parameter later presented as a prediction.

full rationale

This paper is an empirical backdoor-attack study rather than a derivation. The attack pipeline is defined by Algorithm 1 (time-domain addition of a trigger waveform) and Eq. 2 (blended injection), both taken from standard practice and cited to prior external work; the trigger sounds themselves are obtained from open-source audio. The central results are direct measurements: ASR and BA are computed on test sets after training with poisoned data, under varied poisoning rates, trigger durations, and blend ratios. These hyperparameters are swept, not fitted to the test data and then renamed as predictions, so there is no fitted-input-called-prediction pattern. The claim that the backdoor is 'automatically activated by the corresponding sound in nature' (Abstract, Sect. 4.2, Sect. 5) is supported only by a single qualitative real-physical-scenario recording with no reported ASR, but that is an evidence-strength issue, not circularity: the paper does not define the natural sound in terms of the model's behavior, nor does it reuse a fitted constant as proof. There are no load-bearing self-citations, no imported uniqueness theorems, and no ansatz smuggled in via prior work by the same authors. The work is benchmarked against external datasets (SCDv2, ESC) and baseline models, and its claims are falsifiable by repeating the training and evaluation procedure. Therefore the derivation chain, such as it is, is self-contained, and no circular step can be identified.

Axiom & Free-Parameter Ledger

3 free parameters · 5 axioms · 0 invented entities

The central claims rest on the standard backdoor poisoning threat model, the ability of MFCC features to preserve an additive trigger, and the untested assumption that real-world ambient sounds can activate the backdoor. No fitted mathematical parameters appear; the listed free parameters are experimental variables swept by the authors.

free parameters (3)
  • poisoning rate P_N = 5% (swept from ~0.5% to 10%)
    The headline "near 100% ASR at 5%" is conditional on this chosen poisoning fraction; it is not derived from theory.
  • trigger duration = 0.2s in Fig.2; 1s in Table 1; swept in Fig.7
    Attack success depends strongly on duration; the paper does not justify a specific natural-acoustic duration.
  • blend ratio alpha = 1.0 in Algorithm 1; swept in Fig.8
    The time-domain addition uses alpha=1; the blended-injection experiments vary alpha. This controls trigger amplitude and affects both ASR and stealth.
axioms (5)
  • domain assumption Attacker can inject a small fraction of poisoned samples into the training set (grey-box threat model).
    Invoked in Section 3 Threat Model; the entire attack requires controlling training data.
  • domain assumption Adding a natural sound in the time domain and then extracting MFCCs leaves a trainable trigger pattern that generalizes across the class of natural sounds.
    Algorithm 1 plus feature extraction; not derived, but empirically validated on three triggers.
  • domain assumption A sound recorded in the physical world is similar enough to the training trigger to activate the backdoor.
    Section 4.2 real physical scenario with cicadas; no quantitative analysis of acoustic variability.
  • standard math The Shannon-Nyquist sampling theorem, implying a 21 kHz ultrasound cannot be represented at 16 kHz sampling rate.
    Invoked to explain low ASR for ultrasound on SCDv2 in Section 4.2.
  • domain assumption Humans will not notice or flag natural-sound triggers as suspicious (covertness premise).
    Introduction claims triggers are hidden because sounds are ordinary; no human perception or detection experiment supports this.

reviewed 2026-08-01 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Natural Backdoor Attacks on Speech Recognition Models." pith.science (2026). https://pith.science/paper/Y3NTJKE2

@misc{pith2026260715724,
  author       = {Pith},
  title        = {Pith review of: Natural Backdoor Attacks on Speech Recognition Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Y3NTJKE2}},
  note         = {Machine review of arXiv:2607.15724}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

With the rapid development of deep learning, its vulnerability has gradually emerged in recent years. This work focuses on backdoor attacks on speech recognition systems. We adopt sounds that are ordinary in nature or in our daily life as triggers for natural backdoor attacks. We conduct experiments on two datasets and three models to validate the performance of natural backdoor attacks and explore the effects of poisoning rate, trigger duration and blend ratio on the performance of natural backdoor attacks. Our results show that natural backdoor attacks have a high attack success rate without compromising model performance on benign samples, even with short or low-amplitude triggers. It requires only 5% of poisoned samples to achieve a near 100% attack success rate. In addition, the backdoor will be automatically activated by the corresponding sound in nature, which is not easy to be detected and will bring severer harm.

Figures

Figures reproduced from arXiv: 2607.15724 by Jing Ma, Jinwen Xin, Xixiang Lyu.

Figure 1
Figure 1. Figure 1 [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Poisoned audio samples with different natural triggers: (a) original audio sam￾ple; (b) natural trigger of sound of rain; (c) natural trigger of whistle; (d) natural trigger of bird call [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Extract MFCCs as features from raw audio [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: A natural backdoor attack in real physical scenarios. In our above experiments, the generation of poisoned samples requires modi￾fying the labels of the samples, which makes the poisoned samples easily detected upon human inspection. Our attack method can also be extended to Clean-label attacks [27], which means the adversary can insert a trigger without modifying the label of the samples, thus making our … view at source ↗
Figure 5
Figure 5. Figure 5: Clean-label attacks with different numbers of poisoned samples. 4.3 Effect of Different Factors on ASR We examine the impact of different factors on the performance of natural back￾door attacks, including poisoning rate, trigger duration and blend ratio. Poisoning Rate. We explore the performance of natural backdoor attacks under different poisoning rates. As shown in Fig.6, as the poisoning rate in￾crease… view at source ↗
Figure 6
Figure 6. Figure 6: The performance of natural backdoor attacks under different poisoning rates. increase, BA has only minor changes. And the change curve of the ASR for the two infected models remains consistent. When the trigger duration reaches 0.1 s, the ASR exceeds 90%. When it reaches 0.8 s, the ASR is close to 100%. Blend Ratio. We employ the Blended Injection Strategy [17] to generate poi￾soned samples. The parameters… view at source ↗
Figure 7
Figure 7. Figure 7: The performance of natural backdoor attacks under different trigger duration [PITH_FULL_IMAGE:figures/full_fig_p012_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: The impact of different blend ratios on natural backdoor attacks [PITH_FULL_IMAGE:figures/full_fig_p012_8.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

27 extracted references · 8 linked inside Pith

  1. [1]

    Parkhi, O.M., Vedaldi, A., Zisserman, A.: Deep face recognition (2015)

    2015

  2. [2]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    Sun, Y., Wang, X., Tang, X.: Deep learning face representation from predicting 10,000 classes. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 1891–1898 (2014)

    2014

  3. [3]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    Redmon, J., Divvala, S., Girshick, R., Farhadi, A.: You only look once: Unified, real-time object detection. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 779–788 (2016)

    2016

  4. [4]

    arXiv preprint arXiv:1609.08144 (2016)

    Wu, Y., Schuster, M., Chen, Z., Le, Q.V., Norouzi, M., Macherey, W., Krikun, M., Cao, Y., Gao, Q., Macherey, K., et al.: Google’s neural machine translation system: Bridging the gap between human and machine translation. arXiv preprint arXiv:1609.08144 (2016)

    Pith/arXiv arXiv 2016

  5. [5]

    Yu, D., Deng, L.: Automatic speech recognition, vol. 1. Springer (2016)

    2016

  6. [6]

    Ieee Access6, 14410–14430 (2018)

    Akhtar, N., Mian, A.: Threat of adversarial attacks on deep learning in computer vision: A survey. Ieee Access6, 14410–14430 (2018)

    2018

  7. [7]

    arXiv preprint arXiv:1706.06083 (2017)

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)

    Pith/arXiv arXiv 2017

  8. [8]

    IEEE Transactions on Neural Networks and Learning Systems (2022)

    Li, Y., Jiang, Y., Li, Z., Xia, S.T.: Backdoor learning: A survey. IEEE Transactions on Neural Networks and Learning Systems (2022)

    2022

  9. [9]

    Journal of Big data3(1), 1–40 (2016)

    Weiss, K., Khoshgoftaar, T.M., Wang, D.: A survey of transfer learning. Journal of Big data3(1), 1–40 (2016)

    2016

  10. [10]

    Proceedings of Machine Learning and Systems1, 374–388 (2019)

    Bonawitz, K., Eichner, H., Grieskamp, W., Huba, D., Ingerman, A., Ivanov, V., Kiddon, C., Konečn` y, J., Mazzocchi, S., McMahan, B., et al.: Towards federated learning at scale: System design. Proceedings of Machine Learning and Systems1, 374–388 (2019)

    2019

  11. [11]

    Liu, Y., Ma, S., Aafer, Y., Lee, W.C., Zhai, J., Wang, W., Zhang, X.: Trojaning attack on neural networks (2017)

    2017

  12. [12]

    In: 2021 IEEE Symposium on Security and Privacy (SP)

    Xu, X., Wang, Q., Li, H., Borisov, N., Gunter, C.A., Li, B.: Detecting ai trojans using meta neural analysis. In: 2021 IEEE Symposium on Security and Privacy (SP). pp. 103–120. IEEE (2021)

    2021

  13. [13]

    In: Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining

    Tang, R., Du, M., Liu, N., Yang, F., Hu, X.: An embarrassingly simple approach for trojan attack in deep neural networks. In: Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining. pp. 218–228 (2020)

    2020

  14. [14]

    In: ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

    Zhai, T., Li, Y., Zhang, Z., Wu, B., Jiang, Y., Xia, S.T.: Backdoor attack against speaker verification. In: ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). pp. 2560–2564. IEEE (2021)

    2021

  15. [15]

    arXiv preprint arXiv:2107.14569 (2021) 14 J

    Koffas, S., Xu, J., Conti, M., Picek, S.: Can you hear it? backdoor attacks via ultrasonic triggers. arXiv preprint arXiv:2107.14569 (2021) 14 J. Xin et al

    Pith/arXiv arXiv 2021

  16. [16]

    IEEE Access7, 47230–47244 (2019)

    Gu, T., Liu, K., Dolan-Gavitt, B., Garg, S.: Badnets: Evaluating backdooring at- tacks on deep neural networks. IEEE Access7, 47230–47244 (2019)

    2019

  17. [17]

    arXiv preprint arXiv:1712.05526 (2017)

    Chen, X., Liu, C., Li, B., Lu, K., Song, D.: Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 (2017)

    Pith/arXiv arXiv 2017

  18. [18]

    In: European Conference on Computer Vision

    Liu, Y., Ma, X., Bailey, J., Lu, F.: Reflection backdoor: A natural backdoor attack on deep neural networks. In: European Conference on Computer Vision. pp. 182–

  19. [19]

    arXiv preprint arXiv:2110.07139 (2021)

    Qi, F., Chen, Y., Zhang, X., Li, M., Liu, Z., Sun, M.: Mind the style of text! adversarial and backdoor attacks based on text style transfer. arXiv preprint arXiv:2110.07139 (2021)

    Pith/arXiv arXiv 2021

  20. [20]

    arXiv preprint arXiv:2105.12400 (2021)

    Qi, F., Li, M., Chen, Y., Zhang, Z., Liu, Z., Wang, Y., Sun, M.: Hidden killer: Invisible textual backdoor attacks with syntactic trigger. arXiv preprint arXiv:2105.12400 (2021)

    Pith/arXiv arXiv 2021

  21. [21]

    Applied Sciences12(12), 5786 (2022)

    Ye, J., Liu, X., You, Z., Li, G., Liu, B.: Drinet: Dynamic backdoor attack against automatic speech recognization models. Applied Sciences12(12), 5786 (2022)

    2022

  22. [22]

    arXiv preprint arXiv:1804.03209 (2018)

    Warden, P.: Speech commands: A dataset for limited-vocabulary speech recogni- tion. arXiv preprint arXiv:1804.03209 (2018)

    Pith/arXiv arXiv 2018

  23. [23]

    In: ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

    Samizade, S., Tan, Z.H., Shen, C., Guan, X.: Adversarial example detection by clas- sification for deep speech recognition. In: ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). pp. 3102–3106. IEEE (2020)

    2020

  24. [24]

    Eating sound collection (2020), https://www.kaggle.com/datasets/mashijie/ eating-sound-collection

    2020

  25. [25]

    Baseline model (2021), https://tianchi.aliyun.com/competition/entrance/531887/ forum

    2021

  26. [26]

    arXiv preprint arXiv:1808.08929 (2018)

    De Andrade, D.C., Leo, S., Viana, M.L.D.S., Bernkopf, C.: A neural attention model for speech command recognition. arXiv preprint arXiv:1808.08929 (2018)

    Pith/arXiv arXiv 2018

  27. [27]

    Turner, A., Tsipras, D., Madry, A.: Clean-label backdoor attacks (2018)

    2018

This paper was first reviewed by deepseek-v4-flash on August 1, 2026.