Technical Summary: DRL-CLBA

Problem Statement

Deep learning models deployed for speech classification tasks, such as Keyword Spotting (KWS) and Speaker Verification (SV), are vulnerable to backdoor attacks. While traditional "poisoned label" attacks (where triggers are injected and labels are altered) are effective, they are increasingly detectable through manual data auditing or automated defenses that identify label-content inconsistencies.

Conversely, "clean label" backdoor attacks, which tamper with training samples without altering their ground-truth labels, offer greater stealth. However, existing clean label methods face significant limitations:

1. Gradient Dependency: Many approaches (e.g., CSSBA) require access to the full gradient information of the target model, which is often unavailable in real-world black-box scenarios.
2. Fixed Triggers: Some methods rely on static, fixed-pattern triggers that can be filtered out by defensive mechanisms.
3. Optimization Challenges: Achieving high attack success rates (ASR) while maintaining semantic consistency and imperceptibility in the complex feature space of speech models is difficult using standard gradient-based optimization (e.g., PGD).

Methodology: DRL-CLBA

The paper proposes DRL-CLBA (Deep Deterministic Policy Gradient-based Clean Label Backdoor Attack), a framework that combines deep audio steganography with reinforcement learning to generate sample-specific, clean-label backdoors.

1. Core Components

• Deep Audio Steganography (Anchor Generation):
  • An encoder-decoder steganography model is used to embed a trigger into source class audio.
  • Unlike fixed triggers, this generates sample-specific triggers that vary for each backdoor sample.
  • The output serves as an "anchor" in the deep latent feature space. The goal is to force the model to learn a semantic similarity between these triggered source samples and specific target class samples.
• Reinforcement Learning Framework (DDPG):
  • The attack is formulated as a Markov Decision Process (MDP) to optimize poisoned samples without requiring full gradient access to the target model.
  • State ($S$): Composed of deep feature representations of the current poisoned sample, the anchor feature, the distance between them, and the perturbation magnitude.
  • Action ($A$): A continuous perturbation increment ($\Delta x_t$) applied to the target sample.
  • Reward ($R$): A multi-objective function balancing:
    1. Feature Collision: Minimizing the distance between the poisoned sample's features and the anchor features.
    2. Imperceptibility: Constraining the perturbation magnitude ($\|x_{t+1} - x_{tar}\|_2$).
    3. Semantic Consistency: Ensuring the poisoned sample is still predicted as the original target class (clean label) by the model.
  • Networks: An Actor network ($\mu$) generates actions based on the state, while a Critic network ($Q$) evaluates the expected cumulative reward. Target networks ($\mu', Q'$) are used for stability via soft updates.

2. Attack Pipeline

1. Initialization: Generate anchor vectors using the steganography model and initialize DDPG networks.
2. Training: The DDPG agent iteratively optimizes poisoned samples to minimize feature distance to anchors while satisfying the reward constraints.
3. Poisoned Dataset Generation: The trained policy is frozen and used to generate poisoned samples from the target class dataset. Crucially, original labels are preserved.
4. Backdoor Implantation: The poisoned samples are merged with the benign training set. The victim model is trained on this mixed dataset using standard cross-entropy loss.

Key Contributions

1. Novel Attack Paradigm: Introduction of a clean label, sample-specific backdoor attack for speech classification that does not require full gradient access to the target model.
2. Steganographic Anchors: Utilization of deep audio steganography to create dynamic, sample-specific triggers that serve as robust feature-space anchors, avoiding the detectability of static patterns.
3. RL-Driven Optimization: Integration of DDPG to navigate the complex optimization landscape of feature collision, effectively balancing attack success, stealth, and semantic consistency.
4. Comprehensive Validation: Rigorous evaluation across three datasets (KWS, SV, SER) and four diverse DNN architectures (ERes2Net, KWS-ViT, EAT-S, CAM++).

Experimental Results

The authors evaluated DRL-CLBA against five baseline methods (including Ultra, OneSpec, CBA, CSSBA, and TUAPBA) across three tasks:

• Keyword Spotting (KWS): DRL-CLBA achieved average ASRs of 88.09% (SCD), 89.76% (AudioMNIST), and 90.12% (LibriKWS-20), significantly outperforming all baselines (which ranged roughly between 30% and 80%).
• Speaker Verification (SV): Achieved average ASRs of 88.77% (AISHELL3-50) and 87.45% (VoxCeleb1-50), again surpassing all baselines.
• Speech Emotion Recognition (SER): Achieved average ASRs of 77.44% (ESD-CN) and 79.18% (ESD-EN). While lower than KWS/SV (attributed to the dispersed nature of emotional features), it still outperformed baselines.
• Benign Accuracy (BA): In all scenarios, the attack maintained high benign accuracy (typically >90%), demonstrating that the backdoored model performs normally on clean data.
• Robustness:
  • Fine-tuning: The attack retained ~60-65% ASR after 40 epochs of fine-tuning.
  • Model Pruning: High pruning rates degraded both ASR and BA similarly, indicating the backdoor is deeply embedded but not easily removable without destroying model utility.
  • STRIP Defense: Entropy distribution analysis showed poisoned and clean samples were nearly indistinguishable, successfully bypassing STRIP detection.
• Transferability: The method demonstrated strong generalization in black-box settings (cross-model transfer), maintaining 77-84% ASR when the surrogate model differed from the target inference model.

Significance and Claims

The paper claims that DRL-CLBA exposes critical vulnerabilities in speech-controlled systems by demonstrating that:

1. Clean label attacks are highly effective in speech domains when combined with reinforcement learning and steganography, bypassing defenses that rely on label inspection or fixed trigger detection.
2. Reinforcement Learning is superior to traditional gradient-based optimization for this task, as it effectively captures long-term dependencies and avoids local optima in the sequential decision-making process of generating poisoned samples.
3. Sample-specific triggers generated via steganography provide a level of stealth and robustness that static triggers cannot match.

The authors conclude that current voice-based human-computer interaction systems are at significant risk, as their models can be compromised with high success rates while remaining functionally normal and difficult to detect via standard auditing or defense mechanisms.