Clean Audio Triggers Backdoors in Speech Enhancement

Problem

This paper investigates whether speech enhancement models, widely used as passive front-ends in real-time speech services, are vulnerable to backdoor attacks. Prior audio backdoor work has focused on classification tasks and requires active injection of artificial triggers at inference time, an assumption that does not fit the passive nature of enhancement modules. The authors identify a gap: an attacker who can only poison training data might still cause stealthy, inference-time corruption without adding external signals during deployment.

Approach

The authors propose CleanTrigger, a mechanism that uses the model's own ideal clean outputs as natural triggers, and present Ouroboros, an end-to-end data-poisoning backdoor framework for paired-data speech enhancement models. Under a black-box threat model the attacker can only modify training pairs. The poisoning procedure selects high-SNR clean target samples and replaces the paired noisy inputs with those targets so that the model learns to map high-purity inputs to a malicious target (for example, silence). An SNR-based selection strategy poisons top-ranked high-SNR samples to preserve low-SNR examples that are critical for normal denoising performance. Experiments use VoiceBank-DEMAND and WSJ0-CHiME3 datasets, four victim models spanning predictive and generative architectures (MP-SENet, SEMamba, CMGAN, FlowSE), a 10% poisoning rate baseline, and evaluation by attack success rate (ASR) and perceptual evaluation of speech quality (PESQ).

Key Findings

• Ouroboros attains near-100% ASR while producing minimal degradation on normal inputs; comparable ASR to an explicit artificial-trigger baseline despite using natural triggers.
• Generative enhancement models incur smaller PESQ degradation when backdoored than predictive models, suggesting a more favourable attack-effectiveness versus performance trade-off for generative architectures.
• Low poisoning rates suffice: even 2% poisoning can produce high ASR, while 10% yields consistently strong results with limited functional impact.
• SNR-based high-SNR selection outperforms random or low-SNR poisoning, achieving high ASR while preserving denoising quality.
• Physical-world recordings trigger the backdoor reliably: FlowSE reached 100% ASR and MP-SENet 96.7% on smartphone-recorded clean voices in a quiet room.
• Ouroboros generalises to targeted content-tampering: phrase injection produced 84.15% ASR for CMGAN and 46.24% for FlowSE when evaluating transcription matches.
• Common defences are limited: filtering reduced ASR partially (Wiener filter to 44.42%) but degraded perceptual quality, and fine-tuning with 20% clean data failed to remove the backdoor (ASR remained 98.18% for SEMamba and 100% for CMGAN on one dataset).

Limitations

The attack applies to paired-data trained speech enhancement models and assumes the attacker can poison training data but not control inference inputs. Experiments cover several models and two datasets but further cross-dataset and wider-system validation are noted as future work. Defence evaluations considered common filtering and fine-tuning but did not exhaust all possible mitigation strategies.

Implications

An attacker able to poison training data can implant a self-referential, trigger-less backdoor that activates during normal use whenever naturally clean audio is encountered. This enables stealthy functional disruption such as forcing silence or surreptitious content tampering, undermining integrity and trust in voice-enabled services. Common reactive defences may either fail to remove the backdoor or harm legitimate performance, expanding the attack surface of real-time speech pipelines and motivating new, targeted detection and hardening approaches.