Source-linked AI summary
Ouroboros: Self-Referential Backdoor Attacks on Speech Enhancement via Clean Audio Triggers
Yunjie Zhou, Yuheng Huang, Diqun Yan
TL;DR
Backdoor vulnerabilities in speech enhancement are underexplored because existing attacks target classification and require artificial inference-time triggers, which passive services cannot reliably accept. Ouroboros uses high-SNR clean speech as a natural trigger through training-data poisoning, achieving near-100% attack success with negligible PESQ degradation across models and datasets. The paper also reports physical-world feasibility and broader attack capabilities.
Problem
Speech enhancement backdoor vulnerabilities are underexplored, while existing audio attacks rely on artificial trigger injection that conflicts with passive service deployment.
Method
Ouroboros uses the model’s high-SNR clean speech targets as natural triggers and implants the backdoor through training-data poisoning without inference-time intervention.
Results
Near-100% ASR with negligible PESQ degradation is reported across diverse models and datasets, alongside real-world feasibility and resilience against common defenses.
Takeaways & Limitations
Clean audio naturally occurring during passive processing can activate a speech enhancement backdoor without externally injected trigger content.
Takeaways & Limitations
The work applies to paired-data-trained speech enhancement models and assumes a training-data-poisoning threat model.
Abstract
from arXiv · showhide
Speech enhancement models are widely deployed as frontend modules in real-time speech services, yet their vulnerability to backdoor attacks remains unexplored. Existing backdoor methods are confined to classification tasks and rely on active trigger injection, an assumption incompatible with the passive processing nature of speech enhancement models. In this paper, we propose Ouroboros, a novel backdoor attack framework that leverages the ideal clean outputs of speech enhancement models as natural triggers, enabling inference-time activation without any external trigger injection. Extensive evaluations show Ouroboros achieves near-perfect attack success rates with minimal performance degradation on diverse models and datasets. Physical-world validations confirm that naturally recorded, unaltered clean audio can reliably activate the backdoor. Moreover, Ouroboros generalizes to targeted content-tampering attacks and remains effective against common filtering and finetuning defenses.
1. Introduction
Speech enhancement backdoor vulnerabilities are underexplored, while existing audio attacks assume artificial trigger injection that conflicts with passive deployment. Ouroboros addresses this gap by using clean speech as a natural, inference-time trigger through training-data poisoning.
- Speech enhancement models are widely deployed in safety-critical pipelines, yet their backdoor vulnerabilities remain largely unexplored.
- Existing audio backdoor methods mainly target classification and inject artificial triggers, an assumption incompatible with passive speech enhancement services.
- CleanTrigger uses pure clean target speech as a natural trigger, enabling passive activation without external inference-time intervention.
- Ouroboros poisons training data so high-SNR clean speech activates malicious outputs such as silence while noisy speech retains normal enhancement behavior.
- The framework is designed for paired-data-trained speech enhancement models and is evaluated for effectiveness, stealthiness, and practical feasibility.
2. Proposed Method
Ouroboros models speech enhancement as supervised regression and poisons paired training data under a black-box threat model. It selects high-SNR clean samples as natural triggers while preserving low-SNR samples important for normal enhancement.
- The attacker can modify only training data, without knowing the model or deployment environment or manipulating inference-time inputs.
- The enhancement model learns a noisy-to-clean mapping by minimizing a regression loss over paired samples.
- The attacker maximizes triggered attack success while constraining degradation on nontriggered inputs, with silence specified as an example target.
- CleanTrigger replaces external perturbations with pure clean target speech, so naturally occurring high-purity audio can activate the backdoor.
- SNR-based poisoning selects high-SNR samples because low-SNR samples are more important for preserving normal denoising performance.
- The poisoning procedure computes SNR, sorts samples, replaces selected inputs and targets with trigger-target pairs, and combines them with untouched clean pairs.
3.1. Experimental Setup
Experiments evaluate Ouroboros across two benchmark datasets and four predictive or generative speech enhancement models. Attack success is measured by silence output, while PESQ measures nontriggered quality impact.
- The evaluation uses VoiceBank-Demand and WSJ0-CHiME3 with MP-SENet, SEMamba, CMGAN, and FlowSE victim models.
- The BadNets baseline uses a repeated 64 Hz pure sine wave at 15 dB SNR as an artificial trigger.
- ASR is the percentage of trigger samples producing silence at RMS ≤0.0005, approximately −66 dBFS.
- PESQ evaluates perceptual quality on nontriggered noisy inputs, with a smaller score drop indicating less impact on enhancement.
3.2. Attack Performance
Ouroboros achieves near-100% attack success with more natural passive triggers than the artificial baseline and causes milder enhancement-quality degradation. The quality impact differs by architecture, with generative models degrading less than predictive models.
- Near-100% ASR is comparable to the strong artificial-trigger baseline while supporting more stealthy, natural, and passive activation.
- Ouroboros imposes a milder impact on the original enhancement task than the baseline across evaluated scenarios.
- Generative models show consistently smaller PESQ degradation after backdoor implantation than predictive models.
3.3. Ablation Study
The ablations examine poisoning rate and SNR-based sample selection, showing that high attack success can be achieved while preserving normal enhancement quality. High-SNR poisoning provides the best balance between attack effectiveness and performance retention.
- Ablation of Poisoning Rate: A 10% poisoning rate ensures high ASR while keeping the impact on normal functionality within acceptable limits.CMGAN was evaluated across poisoning rates from 2% to 12%; even 2% achieved high ASR.
- Ablation of SNR Selection Strategy: Deterministic poisoning strategies significantly outperform random selection in the SNR-based poisoning ablation.The comparison was conducted on VB-DEMAND using Table 2.
- Ablation of SNR Selection Strategy: High-SNR poisoning achieves the best balance, producing the highest ASR on both models with minimal PESQ degradation.Compared with low-SNR poisoning, it preserves more original speech enhancement performance by reserving critical low-SNR samples.
3.4. Resistance to Defenses
Ouroboros remains difficult to remove with filtering and fine-tuning defenses. Filtering creates a trade-off between reducing attack success and damaging legitimate speech quality, while limited clean-data retraining leaves ASR high.
- Filtering: The Wiener filter reduces ASR to 44.42% but degrades perceptual speech quality, whereas Lowpass filtering remains ineffective and severely impairs enhancement functionality.These results were evaluated on CMGAN with VB-DEMAND.
- Filtering: Filtering defenses either fail to eliminate the backdoor or disproportionately damage legitimate performance.The reported trade-off renders these defenses inadequate for securing speech enhancement systems.
- Fine-Tuning: With 20% clean retraining data, ASR remains 98.18% for SEMamba and 100% for CMGAN on WSJ0-CHiME3.The results indicate that standard fine-tuning on limited clean data does not eliminate the backdoor.
3.5. Physical World Evaluation
Physical-world tests used naturally recorded clean speech as triggers across diverse human voices. Ouroboros successfully activated on both generative and predictive enhancement models, producing outputs below the human auditory perception threshold.
- Physical World Evaluation: The physical-world evaluation recorded 60 clean voices on a smartphone at 16 kHz, spanning two genders and two languages.Recordings were made in a quiet room at ≤30 dBA.
- Physical World Evaluation: 100% ASR was achieved on generative FlowSE, while predictive MP-SENet achieved 96.7% ASR.Both models produced output energy far below the approximately -60 dBFS human auditory perception threshold, constituting silence attacks.
3.6. Extension to Content-Tampering Attacks
Ouroboros is extended from disruption to phrase-targeted content tampering, generating the phrase “this is a test” in enhanced outputs. The attack achieves higher ASR for CMGAN than FlowSE while producing marginal PESQ improvements in both.
- The target phrase “this is a test” is generated using Coqui-TTS for CMGAN and Pyttsx3 for FlowSE on VB-DEMAND.
- 84.15% ASR for CMGAN and 46.24% for FlowSE demonstrate phrase-targeted content tampering across two generative speech enhancement models.ASR measures exact transcription of the target phrase by Whisper-Large-V2.
- Marginal PESQ improvements are observed for both CMGAN and FlowSE during phrase-targeted attacks.
- The authors attribute FlowSE’s lower ASR to inferior trigger-phrase quality from Pyttsx3 compared with Coqui-TTS audio for CMGAN.
4. Conclusion
The paper presents Ouroboros as a stealthy backdoor framework that uses high-SNR clean audio as natural triggers without active attacker intervention. Across diverse models and datasets, it reports near-100% ASR, negligible PESQ degradation, defense resilience, and real-world feasibility.
- Ouroboros uses the CleanTrigger mechanism to exploit high-SNR clean audio as natural triggers for passive backdoor activation.
- Evaluations across diverse datasets and models report near-100% ASR with negligible PESQ degradation.
- The framework shows strong resilience against backdoor defenses and feasibility in real-world settings.