MASTERKEY: Practical Backdoor Attack Against Speaker Verification Systems
Speaker Verification (SV) is widely deployed in mobile systems to authenticate legitimate users by using their voice traits. In this work, we propose a backdoor attack MASTERKEY, to compromise the SV models. Different from previous attacks, we focus on a real-world practical setting where the attacker possesses no knowledge of the intended victim. To design MASTERKEY, we investigate the limitation of existing poisoning attacks against unseen targets. Then, we optimize a universal backdoor that is capable of attacking arbitrary targets. Next, we embed the speaker's characteristics and semantics information into the backdoor, making it imperceptible. Finally, we estimate the channel distortion and integrate it into the backdoor. We validate our attack on 6 popular SV models. Specifically, we poison a total of 53 models and use our trigger to attack 16,430 enrolled speakers, composed of 310 target speakers enrolled in 53 poisoned models. Our attack achieves 100% attack success rate with a 15% poison rate. By decreasing the poison rate to 3%, the attack success rate remains around 50%. We validate our attack in 3 real-world scenarios and successfully demonstrate the attack through both over-the-air and over-the-telephony-line scenarios.
Code (0)
등록된 구현이 없습니다.
Tasks
Backdoor AttackSpeaker VerificationMethods 이 논문이 사용한 방법론
Similar Papers 제목 키워드 기반
Multi-Target Backdoor Attacks Against Speaker Recognition
In this work, we propose a multi-target backdoor attack against speaker identification using position-independent clicking sounds as triggers. Unlike previous single-target approaches, our method targets up to 50 speaker…
Speaker IdentificationSpeaker VerificationSpeaker RecognitionBackdoor Attack against Speaker Verification
Speaker verification has been widely and successfully adopted in many mission-critical areas for user identification. The training of speaker verification requires a large amount of data, therefore users usually need to …
Backdoor AttackClusteringSpeaker VerificationUser IdentificationDon't Trigger Me! A Triggerless Backdoor Attack Against Deep Neural Networks
Backdoor attack against deep neural networks is currently being profoundly investigated due to its severe security consequences. Current state-of-the-art backdoor attacks require the adversary to modify the input, usuall…
Backdoor AttackA Clean-graph Backdoor Attack against Graph Convolutional Networks with Poisoned Label Only
Graph Convolutional Networks (GCNs) have shown excellent performance in dealing with various graph structures such as node classification, graph classification and other tasks. However,recent studies have shown that GCNs…
Backdoor AttackGraph ClassificationNode ClassificationFrom Shortcuts to Triggers: Backdoor Defense with Denoised PoE
Language models are often at risk of diverse backdoor attacks, especially data poisoning. Thus, it is important to investigate defense solutions for addressing them. Existing backdoor defense methods mainly focus on back…
backdoor defenseData PoisoningDenoisingSentence+1