Abstract:Backdoor attacks aim to inject backdoors to victim machine learning models during training time, such that the backdoored model maintains the prediction power of the original model towards clean inputs and misbehaves towards backdoored inputs with the trigger. The reason for backdoor attacks is that resource-limited users usually download sophisticated models from model zoos or query the models from MLaaS rather than training a model from scratch, thus a malicious third party has a chance to provide a backdoored model. In general, the more precious the model provided (i.e., models trained on rare datasets), the more popular it is with users. In this article, from a malicious model provider perspective, we propose a black-box backdoor attack, named B 3 , where neither the rare victim model (including the model architecture, parameters, and hyperparameters) nor the training data is available to the adversary. To facilitate backdoor attacks in the black-box scenario, we design a cost-effective model extraction method that leverages a carefully constructed query dataset to steal the functionality of the victim model with a limited budget. As the trigger is key to successful backdoor attacks, we develop a novel trigger generation algorithm that intensifies the bond between the trigger and the targeted misclassification label through the neuron with the highest impact on the targeted label. Extensive experiments have been conducted on various simulated deep learning models and the commercial API of Alibaba Cloud Compute Service. We demonstrate that B 3 has a high attack success rate and maintains high prediction accuracy for benign inputs. It is also shown that B 3 is robust against state-of-the-art defense strategies against backdoor attacks, such as model pruning and NC.

Data Poisoning and Backdoor Attacks on Audio Intelligence Systems

Echo: Reverberation-based Fast Black-Box Adversarial Attacks on Intelligent Audio Systems.

Data Poisoning Attacks in Internet-of-Vehicle Networks: Taxonomy, State-of-The-Art, and Future Directions.

B3: Backdoor Attacks Against Black-box Machine Learning Models

The Silent Manipulator: A Practical and Inaudible Backdoor Attack against Speech Recognition Systems

UltraBD: Backdoor Attack against Automatic Speaker Verification Systems via Adversarial Ultrasound

WaveFuzz: A Clean-Label Poisoning Attack to Protect Your Voice

Toward Stealthy Backdoor Attacks Against Speech Recognition via Elements of Sound

Towards Stealthy Backdoor Attacks against Speech Recognition via Elements of Sound

Defending Adversarial Attacks on Cloud-aided Automatic Speech Recognition Systems.

Defend Data Poisoning Attacks on Voice Authentication

SirenAttack: Generating Adversarial Audio for End-to-End Acoustic Systems

Privacy-preserving and Privacy-attacking Approaches for Speech and Audio -- A Survey

IUAC: Inaudible Universal Adversarial Attacks Against Smart Speakers

Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Models

Hidden in Plain Sound: Environmental Backdoor Poisoning Attacks on Whisper, and Mitigations

Stronger Data Poisoning Attacks Break Data Sanitization Defenses

Defending against Adversarial Audio via Diffusion Model

Towards the Universal Defense for Query-Based Audio Adversarial Attacks

Explore the Effect of Data Selection on Poison Efficiency in Backdoor Attacks

Audio Attacks and Defenses against AED Systems -- A Practical Study