Loading...
Inaudible Backdoor Attack via Stealthy Frequency Trigger Injection in Audio Spectrogram
Zhang, Tianfang Phan, Huy Tang, Zijie Shi, Cong Wang, Yan Yuan, Bo Chen, Yingying
Zhang, Tianfang
Phan, Huy
Tang, Zijie
Shi, Cong
Wang, Yan
Yuan, Bo
Chen, Yingying
Citations
Altmetric:
Genre
Conference proceeding
Date
2024-05-29
Advisor
Committee member
Group
Department
Computer and Information Sciences
Permanent link to this record
Collections
Files
Research Projects
Organizational Units
Journal Issue
DOI
https://doi.org/10.1145/3636534.3649345
Abstract
Deep learning-enabled Voice User Interfaces (VUIs) have surpassed human-level performance in acoustic perception tasks. However, the significant cost associated with training these models compels users to rely on third-party data or outsource training services. Such emerging trends have drawn substantial attention to training-phase attacks, particularly backdoor attacks. Such attacks implant hidden trigger patterns (e.g., tones, environmental sounds) into the model during training, thereby manipulating the model's predictions in the inference phase. However, existing backdoor attacks can be easily undermined in practice as the inserted triggers are audible. Users may notice such attacks when listening to the training data and remaining alert for suspicious sounds. In this work, we present a novel audio backdoor attack that exploits completely inaudible triggers in the frequency domain of the audio spectrograms. Specifically, we optimize the trigger to be a frequency-domain pattern with the energy below the noise floor (e.g., background and hardware noises) at any given frequency, thereby rendering the trigger inaudible. To realize such attacks, we design a strategy that automatically generates inaudible triggers in the spectrum supported by commodity playback devices (e.g., smartphones and laptops). We further develop optimization techniques to enhance the trigger's robustness against speech content and onset variations. Experiments on hotword and speaker recognition indicate that our attack can achieve attack success rates of more than 98.2% and 81.0% under digital and physical attack scenarios. The results also demonstrate the trigger's inaudibility with a Signal-to-Noise Ratio (SNR) less than -3.54 dB against background noises. We further verify that our attack can successfully bypass state-of-the-art backdoor defense strategies based on learning and audio processing.
Description
Citation
Tianfang Zhang, Huy Phan, Zijie Tang, Cong Shi, Yan Wang, Bo Yuan, and Yingying Chen. 2024. Inaudible Backdoor Attack via Stealthy Frequency Trigger Injection in Audio Spectrogram. In Proceedings of the 30th Annual International Conference on Mobile Computing and Networking (ACM MobiCom '24). Association for Computing Machinery, New York, NY, USA, 31–45. https://doi.org/10.1145/3636534.3649345
Citation to related work
ACM
Has part
Proceedings of the 30th Annual International Conference on Mobile Computing and Networking
ADA compliance
Embedded videos
License
Attribution CC BY