aiqbench analysis
This research demonstrates that speech recognition models are highly susceptible to natural backdoor attacks using everyday sounds as triggers. The study reveals that compromising just 5% of training data allows attackers to activate malicious behavior with near-perfect success rates while maintaining normal performance on benign inputs. These findings highlight critical security vulnerabilities in deploying deep learning systems for audio processing without robust defense mechanisms against subtle, undetectable poisoning techniques.
Natural Backdoor Attacks on Speech Recognition Models
arXiv:2607.15724v1 Announce Type: cross Abstract: With the rapid development of deep learning, its vulnerability has gradually emerged in recent years. This work focuses on backdoor attacks on speech recognition systems. We adopt sounds that are ordinary in nature or in our daily life as triggers for natural backdoor attacks. We conduct experiments on two datasets and three models to validate the performance of natural backdoor attacks and explore the effects of poisoning rate, trigger duration and blend ratio on the performance of natural backdoor attacks. Our results show that natural backdoor attacks have a high attack success rate without compromising model performance on benign samples, even with short or low-amplitude triggers. It requires only 5% of poisoned samples to achieve a near 100% attack success rate. In addition, the backdoor will be automatically activated by the corresponding sound in nature, which is not easy to be detected and will bring severer harm.
Abstract:With the rapid development of deep learning, its vulnerability has gradually emerged in recent years. This work focuses on backdoor attacks on speech recognition systems. We adopt sounds that are ordinary in nature or in our daily life as triggers for natural backdoor attacks. We conduct experiments on two datasets and three models to validate the performance of natural backdoor attacks and explore the effects of poisoning rate, trigger duration and blend ratio on the performance of natural backdoor attacks. Our results show that natural backdoor attacks have a high attack success rate without compromising model performance on benign samples, even with short or low-amplitude triggers. It requires only 5% of poisoned samples to achieve a near 100% attack success rate. In addition, the backdoor will be automatically activated by the corresponding sound in nature, which is not easy to be detected and will bring severer harm.
This is the authors' manuscript of a chapter published in Machine Learning for Cyber Security, Lecture Notes in Computer Science, vol. 13655, pp. 597-610 (2023)
Cryptography and Security (cs.CR); Machine Learning (cs.LG); Sound (cs.SD)
arXiv:2607.15724 [cs.CR]
(or arXiv:2607.15724v1 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2607.15724 arXiv-issued DOI via DataCite (pending registration)
Machine Learning for Cyber Security, Lecture Notes in Computer Science, vol. 13655, pp. 597-610 (2023)
https://doi.org/10.1007/978-3-031-20096-0_45 DOI(s) linking to related resources
Full text under the publisher's open licence · 217 words
Related coverage
Backdoor Attacks on Speech Emotion Recognition via TTS-Generated Poisoning
arXiv · Sep 3, 2026
SpeechGuard: Online Defense against Backdoor Attacks on Speech Recognition Models
arXiv · Jul 20, 2026
Where Do Backdoors Live? A Component-Level Analysis of Backdoor Propagation in Speech Language Models
arXiv · Jun 11, 2026
Building a restaurant telephony AI host with Amazon Connect
AWS · Aug 24, 2026