Can You Hear It? Backdoor Attacks via Ultrasonic Triggers

Research output: Chapter in Book/Conference proceedings/Edited volumeConference contributionScientificpeer-review

22 Downloads (Pure)

Abstract

This work explores backdoor attacks for automatic speech recognition systems where we inject inaudible triggers. By doing so, we make the backdoor attack challenging to detect for legitimate users and, consequently, potentially more dangerous. We conduct experiments on two versions of a speech dataset and three neural networks and explore the performance of our attack concerning the duration, position, and type of the trigger. Our results indicate that less than 1% of poisoned data is sufficient to deploy a backdoor attack and reach a 100% attack success rate. We observed that short, non-continuous triggers result in highly successful attacks. Still, since our trigger is inaudible, it can be as long as possible without raising any suspicions making the attack more effective. Finally, we conduct our attack on actual hardware and saw that an adversary could manipulate inference in an Android application by playing the inaudible trigger over the air.

Original languageEnglish
Title of host publicationWiseML 2022 - Proceedings of the 2022 ACM Workshop on Wireless Security and Machine Learning
PublisherAssociation for Computing Machinery (ACM)
Pages57-62
Number of pages6
ISBN (Electronic)978-1-4503-9277-8
DOIs
Publication statusPublished - 2022
Event4th ACM Workshop on Wireless Security and Machine Learning, WiseML 2022 - San Antonio, United States
Duration: 19 May 2022 → …

Publication series

NameWiseML 2022 - Proceedings of the 2022 ACM Workshop on Wireless Security and Machine Learning

Conference

Conference4th ACM Workshop on Wireless Security and Machine Learning, WiseML 2022
Country/TerritoryUnited States
CitySan Antonio
Period19/05/22 → …

Keywords

  • backdoor attacks
  • inaudible trigger
  • neural networks

Fingerprint

Dive into the research topics of 'Can You Hear It? Backdoor Attacks via Ultrasonic Triggers'. Together they form a unique fingerprint.

Cite this