用环境音作触发器，让语音模型听错指令，且可被语音检测器部分防御。
Hidden in Plain Sound: Environmental Backdoor Poisoning Attacks on Whisper, and Mitigations
- 在微调时注入环境音触发器，使模型对特定声音产生错误响应。
- 在多种测试条件下，Whisper模型均被成功攻破，误识别率超80%。
- 使用Silero VAD可过滤恶意触发音，但效果依赖具体声音类型。
随着基于Transformer的语音识别（SR）模型广泛应用，其在工业和机器人等关键场景中的安全问题日益突出。本文提出一种新型投毒攻击方法，在微调阶段将不同环境音触发器映射至不同长度的目标短语，针对最流行的Transformer语音模型Whisper进行测试。实验表明，该攻击在多种测试条件下均能有效诱导模型错误识别，误识率超过80%。为应对该威胁，研究探索了使用当前最先进的语音活动检测模型Silero VAD作为防御机制。实验结果显示，该方法可在不同程度上过滤恶意触发音，从而缓解攻击影响，但防御效果随触发音类型和测试条件而异。
原文摘要 · Abstract (English)
Thanks to the popularisation of transformer-based models, speech recognition (SR) is gaining traction in various application fields, such as industrial and robotics environments populated with mission-critical devices. While transformer-based SR can provide various benefits for simplifying human-machine interfacing, the research on the cybersecurity aspects of these models is lacklustre. In particular, concerning backdoor poisoning attacks. In this paper, we propose a new poisoning approach that maps different environmental trigger sounds to target phrases of different lengths, during the fine-tuning phase. We test our approach on Whisper, one of the most popular transformer-based SR model, showing that it is highly vulnerable to our attack, under several testing conditions. To mitigate the attack proposed in this paper, we investigate the use of Silero VAD, a state-of-the-art voice activity detection (VAD) model, as a defence mechanism. Our experiments show that it is possible to use VAD models to filter out malicious triggers and mitigate our attacks, with a varying degree of success, depending on the type of trigger sound and testing conditions.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。