Clustering Unsupervised Representations as Defense against Poisoning Attacks on Speech Commands Classification System

• URL: http://arxiv.org/abs/2606.28953v1
• Date: Sat, 27 Jun 2026 14:51:30 GMT
• Title: Clustering Unsupervised Representations as Defense against Poisoning Attacks on Speech Commands Classification System
• Abstract summary: We consider a dirty-label poisoning attack scenario on a speech commands classification system.<n>A threat model assumes that certain utterances from one of the classes are poisoned by superimposing a trigger on it.<n>We propose a filtering defense against such an attack.
• Score: 31.128950119385355
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Poisoning attacks entail attackers intentionally tampering with training data. In this paper, we consider a dirty-label poisoning attack scenario on a speech commands classification system. The threat model assumes that certain utterances from one of the classes (source class) are poisoned by superimposing a trigger on it, and its label is changed to another class selected by the attacker (target class). We propose a filtering defense against such an attack. First, we use DIstillation with NO labels (DINO) to learn unsupervised representations for all the training examples. Next, we use K-means and LDA to cluster these representations. Finally, we keep the utterances with the most repeated label in their cluster for training and discard the rest. For a 10% poisoned source class, we demonstrate a drop in attack success rate from 99.75% to 0.25%. We test our defense against a variety of threat models, including different target and source classes, as well as trigger variations.

Related papers

• Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks [11.390175856652856]
  Clean-label attacks are a more stealthy form of backdoor attacks that can perform the attack without changing the labels of poisoned data. We study different strategies for selectively poisoning a small set of training samples in the target class to boost the attack success rate. Our threat model poses a serious threat in training machine learning models with third-party datasets.
  arXiv  Detail & Related papers  (2024-07-15T15:38:21Z)
• SEEP: Training Dynamics Grounds Latent Representation Search for Mitigating Backdoor Poisoning Attacks [53.28390057407576]
  Modern NLP models are often trained on public datasets drawn from diverse sources. Data poisoning attacks can manipulate the model's behavior in ways engineered by the attacker. Several strategies have been proposed to mitigate the risks associated with backdoor attacks.
  arXiv  Detail & Related papers  (2024-05-19T14:50:09Z)
• Certified Robustness to Clean-Label Poisoning Using Diffusion Denoising [56.04951180983087]
  We present a certified defense to clean-label poisoning attacks under $ell$-norm.<n>Inspired by the adversarial robustness achieved by $randomized$ $smoothing, we show how an off-the-shelf diffusion denoising model can sanitize the tampered training data.
  arXiv  Detail & Related papers  (2024-03-18T17:17:07Z)
• Universal Backdoor Attacks [35.62950737977423]
  Web-scraped datasets are vulnerable to data poisoning. Backdoor attacks often target specific classes rather than any class learned by the model. We show that universal data poisoning attacks exist that allow controlling misclassifications from any source class into any target class.
  arXiv  Detail & Related papers  (2023-11-30T19:37:47Z)
• Silent Killer: A Stealthy, Clean-Label, Black-Box Backdoor Attack [10.047470656294335]
  We introduce Silent Killer, a novel attack that operates in clean-label, black-box settings. We investigate the use of universal adversarial perturbations as triggers in clean-label attacks. We find that gradient alignment for crafting the poison is required to ensure high success rates.
  arXiv  Detail & Related papers  (2023-01-05T15:11:05Z)
• Narcissus: A Practical Clean-Label Backdoor Attack with Limited Information [22.98039177091884]
  "Clean-label" backdoor attacks require knowledge of the entire training set to be effective. This paper provides an algorithm to mount clean-label backdoor attacks based only on the knowledge of representative examples from the target class. Our attack works well across datasets and models, even when the trigger presents in the physical world.
  arXiv  Detail & Related papers  (2022-04-11T16:58:04Z)
• What Doesn't Kill You Makes You Robust(er): Adversarial Training against Poisons and Backdoors [57.040948169155925]
  We extend the adversarial training framework to defend against (training-time) poisoning and backdoor attacks. Our method desensitizes networks to the effects of poisoning by creating poisons during training and injecting them into training batches. We show that this defense withstands adaptive attacks, generalizes to diverse threat models, and incurs a better performance trade-off than previous defenses.
  arXiv  Detail & Related papers  (2021-02-26T17:54:36Z)
• Poisoned classifiers are not only backdoored, they are fundamentally broken [84.67778403778442]
  Under a commonly-studied backdoor poisoning attack against classification models, an attacker adds a small trigger to a subset of the training data. It is often assumed that the poisoned classifier is vulnerable exclusively to the adversary who possesses the trigger. In this paper, we show empirically that this view of backdoored classifiers is incorrect.
  arXiv  Detail & Related papers  (2020-10-18T19:42:44Z)
• Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching [56.280018325419896]
  Data Poisoning attacks modify training data to maliciously control a model trained on such data. We analyze a particularly malicious poisoning attack that is both "from scratch" and "clean label" We show that it is the first poisoning method to cause targeted misclassification in modern deep networks trained from scratch on a full-sized, poisoned ImageNet dataset.
  arXiv  Detail & Related papers  (2020-09-04T16:17:54Z)
• Towards Class-Oriented Poisoning Attacks Against Neural Networks [1.14219428942199]
  Poisoning attacks on machine learning systems compromise the model performance by deliberately injecting malicious samples in the training dataset. We propose a class-oriented poisoning attack that is capable of forcing the corrupted model to predict in two specific ways. To maximize the adversarial effect as well as reduce the computational complexity of poisoned data generation, we propose a gradient-based framework.
  arXiv  Detail & Related papers  (2020-07-31T19:27:37Z)
• Tricking Adversarial Attacks To Fail [0.05076419064097732]
  Our white-box defense tricks untargeted attacks into becoming attacks targeted at designated target classes. Our Target Training defense tricks the minimization at the core of untargeted, gradient-based adversarial attacks.
  arXiv  Detail & Related papers  (2020-06-08T12:22:07Z)
• Headless Horseman: Adversarial Attacks on Transfer Learning Models [69.13927986055553]
  We present a family of transferable adversarial attacks against such classifiers. We first demonstrate successful transfer attacks against a victim network using textitonly its feature extractor. This motivates the introduction of a label-blind adversarial attack. Our attack lowers the accuracy of a ResNet18 trained on CIFAR10 by over 40%.
  arXiv  Detail & Related papers  (2020-04-20T01:07:45Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.