Ouroboros: Self-Referential Backdoor Attacks on Speech Enhancement via Clean Audio Triggers

• URL: http://arxiv.org/abs/2608.30329v1
• Date: Mon, 31 Aug 2026 06:46:41 GMT
• Title: Ouroboros: Self-Referential Backdoor Attacks on Speech Enhancement via Clean Audio Triggers
• Abstract summary: Ouroboros is a novel backdoor attack framework that leverages the ideal clean outputs of speech enhancement models as natural triggers.<n>Ouroboros achieves unaltered near-perfect attack success rates with minimal performance degradation.<n>Ouroboros generalizes to targeted content-tampering attacks and remains effective against common filtering and finetuning defenses.
• Score: 8.760008746068463
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Speech enhancement models are widely deployed as frontend modules in real-time speech services, yet their vulnerability to backdoor attacks remains unexplored. Existing backdoor methods are confined to classification tasks and rely on active trigger injection, an assumption incompatible with the passive processing nature of speech enhancement models. In this paper, we propose Ouroboros, a novel backdoor attack framework that leverages the ideal clean outputs of speech enhancement models as natural triggers, enabling inference-time activation without any external trigger injection. Extensive evaluations show Ouroboros achieves near-perfect attack success rates with minimal performance degradation on diverse models and datasets. Physical-world validations confirm that naturally recorded, unaltered clean audio can reliably activate the backdoor. Moreover, Ouroboros generalizes to targeted content-tampering attacks and remains effective against common filtering and finetuning defenses.

Related papers

• SpeechGuard: Online Defense against Backdoor Attacks on Speech Recognition Models [0.45835414225547183]
  Backdoor attacks pose a critical threat to neural network models.<n>In security-sensitive applications such as voice interaction for autonomous driving, the presence of backdoor attacks introduces substantial security risks.<n>We propose SpeechGuard, the first online backdoor defense pipeline designed to identify and purify poisoned audio samples.
  arXiv  Detail & Related papers  (2026-07-17T07:16:57Z)
• Backdoor Attacks on Speech Emotion Recognition via TTS-Generated Poisoning [4.436455150491443]
  Speech Emotion Recognition (SER) systems increasingly leverage self-supervised acoustic representations.<n>This paper presents the first systematic study of poisoning-based backdoor attacks on SER.<n>We introduce a stealthy, low-energy acoustic trigger that can be embedded imperceptibly into both natural and synthetic speech.
  arXiv  Detail & Related papers  (2026-06-19T02:36:11Z)
• Self-Purification Mitigates Backdoors in Multimodal Diffusion Language Models [74.1970982768771]
  We show that well-established data-poisoning pipelines can successfully implant backdoors into MDLMs.<n>We introduce a backdoor defense framework for MDLMs named DiSP (Diffusion Self-Purification)
  arXiv  Detail & Related papers  (2026-02-24T15:47:52Z)
• Robust Anti-Backdoor Instruction Tuning in LVLMs [53.766434746801366]
  We introduce a lightweight, certified-agnostic defense framework for large visual language models (LVLMs)<n>Our framework finetunes only adapter modules and text embedding layers under instruction tuning.<n>Experiments against seven attacks on Flickr30k and MSCOCO demonstrate that ours reduces their attack success rate to nearly zero.
  arXiv  Detail & Related papers  (2025-06-04T01:23:35Z)
• Neural Antidote: Class-Wise Prompt Tuning for Purifying Backdoors in CLIP [51.04452017089568]
  Class-wise Backdoor Prompt Tuning (CBPT) is an efficient and effective defense mechanism that operates on text prompts to indirectly purify CLIP.<n>CBPT significantly mitigates backdoor threats while preserving model utility.
  arXiv  Detail & Related papers  (2025-02-26T16:25:15Z)
• ELBA-Bench: An Efficient Learning Backdoor Attacks Benchmark for Large Language Models [55.93380086403591]
  Generative large language models are vulnerable to backdoor attacks.<n>$textitELBA-Bench$ allows attackers to inject backdoor through parameter efficient fine-tuning.<n>$textitELBA-Bench$ provides over 1300 experiments.
  arXiv  Detail & Related papers  (2025-02-22T12:55:28Z)
• AS-FIBA: Adaptive Selective Frequency-Injection for Backdoor Attack on Deep Face Restoration [14.392609872661065]
  Deep learning-based face restoration models have become targets for sophisticated backdoor attacks.<n>We introduce a unique degradation objective tailored for attacking restoration models.<n>We propose the Adaptive Selective Frequency Injection Backdoor Attack (AS-FIBA) framework.
  arXiv  Detail & Related papers  (2024-03-11T04:44:26Z)
• BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learning [85.2564206440109]
  This paper reveals the threats in this practical scenario that backdoor attacks can remain effective even after defenses. We introduce the emphtoolns attack, which is resistant to backdoor detection and model fine-tuning defenses.
  arXiv  Detail & Related papers  (2023-11-20T02:21:49Z)
• Fake the Real: Backdoor Attack on Deep Speech Classification via Voice Conversion [14.264424889358208]
  This work explores a backdoor attack that utilizes sample-specific triggers based on voice conversion. Specifically, we adopt a pre-trained voice conversion model to generate the trigger, ensuring that the poisoned samples does not introduce any additional audible noise.
  arXiv  Detail & Related papers  (2023-06-28T02:19:31Z)
• Defense for Black-box Attacks on Anti-spoofing Models by Self-Supervised Learning [71.17774313301753]
  We explore the robustness of self-supervised learned high-level representations by using them in the defense against adversarial attacks. Experimental results on the ASVspoof 2019 dataset demonstrate that high-level representations extracted by Mockingjay can prevent the transferability of adversarial examples.
  arXiv  Detail & Related papers  (2020-06-05T03:03:06Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.