Stealthy Backdoor Attack Against Speaker Recognition Using Phase-Injection Hidden Trigger

Deep learning has achieved significant breakthroughs in speaker recognition, driven by continual advancements in foundation models. However, malicious third-party platforms have introduced a severe security concern through backdoor attacks, in which attackers can manipulate a model to output a specific label by implanting a trigger. Existing speech backdoor attack methods typically utilize fixed and unnoticeable perturbations as triggers, but these may still be audible and thus detected during training and inference stages. To overcome this limitation, we propose a novel backdoor attack paradigm (PhaseBack) injecting triggers in the phase spectrum. PhaseBack exhibits sufficient stealth by leveraging the fact that the human ear is insensitive to phase information. Besides, injecting partial perturbations in the frequency domain results in global perturbations throughout the time domain, making the attack more effective. Extensive experiments on the Voxceleb1 dataset demonstrate the effectiveness and stealthiness of PhaseBack. Moreover, it has strong resistance to bypass several defense methods.

Automated summary

Deep learning has made significant progress in speaker recognition, but malicious third-party platforms pose a serious security threat through backdoor attacks. Existing speech backdoor attack methods use fixed and unnoticeable perturbations as triggers, which can still be detected. To overcome this, we propose PhaseBack, a novel backdoor attack paradigm that injects triggers in the phase spectrum, leveraging the insensitivity of the human ear to phase information. PhaseBack's effectiveness and stealthiness are demonstrated through extensive experiments on the Voxceleb1 dataset, and it also shows strong resistance against several defense methods.