Abstract
With the widespread deployment of deep-learning-based speech models in security-critical applications, backdoor attacks have emerged as a serious threat: an adversary who poisons a small fraction of training data can implant a hidden trigger that controls the model's output while preserving normal behavior on clean inputs. Existing inference-time defenses are not well suited to the audio domain, as they either rely on trigger over-robustness assumptions that fail on transformation-based and semantic triggers, or depend on properties specific to image or text modalities. In this paper, we propose STEP (Stability-based Trigger Exposure Profiling), a black-box, retraining-free backdoor detector that operates under hard-label-only access. Its core idea is to exploit a characteristic dual anomaly of backdoor triggers: anomalous label stability under semantic-breaking perturbations, and anomalous label fragility under semantic-preserving perturbations. STEP profiles each test sample with two complementary perturbation branches that target these two properties respectively, scores the resulting stability features with one-class anomaly detectors trained on benign references, and fuses the two scores via unsupervised weighting. Extensive experiments across seven backdoor attacks show that STEP achieves an average AUROC of 97.92% and EER of 4.54%, substantially outperforming state-of-the-art baselines, and generalizes across model architectures, speech tasks, an open-set verification scenario, and over-the-air physical-world settings.
Abstract (translated)
随着基于深度学习的语音模型在安全关键型应用中的广泛部署，后门攻击已成为一种严重威胁：攻击者通过污染少量训练数据，能够植入一个隐藏的触发器来控制模型输出，同时保持模型在正常输入上的行为不变。现有的推理时防御方法在音频领域并不适用，因为它们要么依赖于在基于变换和语义触发器上失效的触发器过度鲁棒性假设，要么依赖于图像或文本模态特有的属性。本文提出STEP（基于稳定性触发器暴露分析），一种在仅硬标签访问权限下运行的黑盒、无需重训练的后门检测器。其核心思想是利用后门触发器的一种特征性双重异常：在语义破坏扰动下呈现的异常标签稳定性，以及在语义保持扰动下呈现的异常标签脆弱性。STEP通过两个互补的扰动分支分别针对这两种特性对每个测试样本进行分析，使用在良性参考数据上训练的单类异常检测器对得到的稳定性特征进行评分，并通过无监督加权融合两个分数。在七种后门攻击上的大量实验表明，STEP平均达到97.92%的AUROC和4.54%的EER，显著优于最先进的基线方法，并且能够泛化到不同模型架构、语音任务、开放集验证场景以及空口物理世界环境。
URL
https://arxiv.org/abs/2603.18103
