Source-linked AI summary
Backdoor Attack against Speaker Verification
Tongqing Zhai, Yiming Li, Ziqi Zhang, Baoyuan Wu, Yong Jiang, Shu-Tao Xia
TL;DR
Data-hungry speaker-verification training often relies on third-party data, raising the question of poisoning risk, while classification backdoors do not directly fit verification. The paper proposes a clustering-based attack with different triggers across speaker groups; it reports successful attacks with benign performance largely preserved.
Problem
Speaker-verification training often needs third-party data, and the paper asks whether it creates security risks; classification backdoors do not directly fit because enrollment labels may differ from training labels.
Source: §1 · p. 1Method
The attack poisons training data by clustering speakers from their representations and assigning different triggers to different clusters.
Source: §1 · p. 1Results
At least 45% ASR was reported in all evaluated cases, with EER on par with benign-trained models; BadNets failed in most cases or significantly increased EER.
Source: §3.2 · p. 3Takeaways & Limitations
The reported attack demonstrates that poisoning can compromise speaker verification without information about the enrolled speaker.
Source: §1 · p. 1, §3.2 · p. 3ASR was evaluated with one enrolled speaker; the authors note that multiple simultaneously enrolled speakers may further improve it.
Source: §3.2 · p. 3
Abstract
from arXiv · showhide
Speaker verification has been widely and successfully adopted in many mission-critical areas for user identification. The training of speaker verification requires a large amount of data, therefore users usually need to adopt third-party data ($e.g.$, data from the Internet or third-party data company). This raises the question of whether adopting untrusted third-party data can pose a security threat. In this paper, we demonstrate that it is possible to inject the hidden backdoor for infecting speaker verification models by poisoning the training data. Specifically, we design a clustering-based attack scheme where poisoned samples from different clusters will contain different triggers ($i.e.$, pre-defined utterances), based on our understanding of verification tasks. The infected models behave normally on benign samples, while attacker-specified unenrolled triggers will successfully pass the verification even if the attacker has no information about the enrolled speaker. We also demonstrate that existing backdoor attacks cannot be directly adopted in attacking speaker verification. Our approach not only provides a new perspective for designing novel attacks, but also serves as a strong baseline for improving the robustness of verification methods. The code for reproducing main results is available at \url{https://github.com/zhaitongqing233/Backdoor-attack-against-speaker-verification}.
1. INTRODUCTION
Speaker verification is used in mission-critical settings, yet its data-hungry training often depends on third-party data, raising a security question. The paper proposes a clustering-based poisoning attack tailored to verification and reports experiments supporting its effectiveness.
1. INTRODUCTION
- Third-party training data raises a security concern for speaker verification, which is widely used in mission-critical areas and often needs large datasets.The paper asks whether adopting such data introduces security risks.Source: §1 · p. 1
- The proposed attack groups training speakers by representation and assigns different triggers to different clusters, addressing the mismatch between training and enrollment identities.The authors explain that classification backdoors cannot be directly adopted because enrollment labels need not match training labels.Source: §1 · p. 1
- The attack is designed to work without information about the enrolled speaker and uses a small amount of poisoned data with low-energy triggers.The authors describe the low-energy one-hot-spectrum noise triggers as stealthy while effective.Source: §1 · pp. 1–2
- The paper identifies third-party-data security risks and proposes a clustering-based attack paradigm against speaker verification.It also reports extensive experiments to verify the method's effectiveness.Source: §1 · p. 2
2. THE PROPOSED METHOD
The method addresses a verification-specific gap: enrolled speakers need not appear in training, so direct classification-style trigger-to-label attacks do not fit. It clusters training speakers and injects cluster-specific triggers, under a poisoning threat model that excludes access to enrollment or control of training and model structure.
2.1. Preliminaries
- Enrollment uses a speaker’s utterances to form a representative vector, and inference accepts an utterance when its similarity score exceeds a threshold.The enrolled speaker need not appear in the training set; the threshold is selected by minimizing FAR + FRR.Source: §2.1 · p. 2
- The attacker can modify training samples but has no enrollment information and need not manipulate the training process or model structure.The authors identify third-party training data, platforms, and model APIs as possible attack settings.Source: §2.1 · p. 2
2.2. Attack against Speaker Verification
- Directly connecting one trigger to all training speakers can fail or collapse different speakers’ representations, while enrollment labels may not match training labels.This is why classification-style backdoors do not directly transfer to speaker verification.Source: §2.2 · p. 2
- The attack obtains speaker representations from a pre-trained feature extractor, averages each speaker’s utterance embeddings, and clusters speakers using k-means.The authors note that other clustering methods are future work.Source: §2.2 · p. 2
- It injects distinct attacker-specified utterance triggers into different clusters and tries the adopted triggers sequentially at inference.The method is intended to succeed without information about the enrolled speaker; trigger volume and poisoning rate are attack parameters.Source: §2.2 · p. 3
3. EXPERIMENTS
Experiments compare the clustering-based attack with benign and BadNets baselines on two datasets and two speaker-verification model types. The main results and hyperparameter study assess attack success alongside verification performance and stealthiness.
3.1. Experimental Setting
- Experiments use d-vector and x-vector models on TIMIT and VoxCeleb, evaluating EER and trigger-based ASR.The attack uses K = 20 clusters, a 15% poisoning rate, and −45dB trigger volume; ASR aggregates five repetitions per test speaker. Benign and adapted BadNets models are comparison baselines.Source: §3.1 · p. 3
3.2. Main Results
- ASR was ≥45% in every evaluated model–dataset case, with EER on par with Benign; BadNets mostly failed or succeeded only by crashing the model.The comparison covers the TIMIT and VoxCeleb datasets; the BadNets exception was on d-vector with VoxCeleb and had significantly high EER.Source: §3.2 · p. 3, Table 1 · p. 4
3.3. Ablation Study
- Increasing the number of clusters generally raises ASR while EER changes little, indicating better attack performance at higher cluster counts.The hyperparameter results are shown for TIMIT in Fig. 2.Source: §3.3 · p. 4, Figure 2 · p. 4
- Higher trigger volume increases ASR while EER remains almost unchanged, but reduces stealthiness.Fig. 2 reports the hyperparameter results on TIMIT.Source: §3.3 · p. 4, Figure 2 · p. 4
- Increasing the poisoning rate raises both ASR and EER, creating a trade-off between attack performance and stealthiness.The poisoning-rate results are shown in the third row of Fig. 2.Source: §3.3 · p. 4, Figure 2 · p. 4
4. CONCLUSION
The conclusion presents clustering-based poisoning with distinct triggers across speaker clusters as an effective approach to backdoor attacks on speaker verification.
- The proposed clustering-based scheme assigns different triggers to poisoned samples from different clusters and is reported effective across benchmark datasets and model structures.Source: §4 · p. 4