Fake the Real: Backdoor Attack on Deep Speech Classification via Voice Conversion
arXiv:2306.15875 · doi:10.21437/Interspeech.2023-733
Abstract
Deep speech classification has achieved tremendous success and greatly promoted the emergence of many real-world applications. However, backdoor attacks present a new security threat to it, particularly with untrustworthy third-party platforms, as pre-defined triggers set by the attacker can activate the backdoor. Most of the triggers in existing speech backdoor attacks are sample-agnostic, and even if the triggers are designed to be unnoticeable, they can still be audible. This work explores a backdoor attack that utilizes sample-specific triggers based on voice conversion. Specifically, we adopt a pre-trained voice conversion model to generate the trigger, ensuring that the poisoned samples does not introduce any additional audible noise. Extensive experiments on two speech classification tasks demonstrate the effectiveness of our attack. Furthermore, we analyzed the specific scenarios that activated the proposed backdoor and verified its resistance against fine-tuning.
arXiv commentAccepted by INTERSPEECH 2023
References in corpus (8)
- Very Deep Convolutional Networks for Large-Scale Image Recognition
- VoxCeleb: a large-scale speaker identification dataset
- ECAPA-TDNN: Emphasized Channel Attention, Propagation and Aggregation in TDNN Based Speaker Verification
- Speech Commands: A Dataset for Limited-Vocabulary Speech Recognition
- Poison Ink: Robust and Invisible Backdoor Attack
- Recent Advances in End-to-End Automatic Speech Recognition
- Few-Shot Backdoor Attacks on Visual Object Tracking
- VSVC: Backdoor attack against Keyword Spotting based on Voiceprint Selection and Voice Conversion