Clean Label Attacks against SLU Systems
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2024
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866917775265497088 |
|---|---|
| author | Xinyuan, Henry Li Joshi, Sonal Thebaud, Thomas Villalba, Jesus Dehak, Najim Khudanpur, Sanjeev |
| author_facet | Xinyuan, Henry Li Joshi, Sonal Thebaud, Thomas Villalba, Jesus Dehak, Najim Khudanpur, Sanjeev |
| contents | Poisoning backdoor attacks involve an adversary manipulating the training data to induce certain behaviors in the victim model by inserting a trigger in the signal at inference time. We adapted clean label backdoor (CLBD)-data poisoning attacks, which do not modify the training labels, on state-of-the-art speech recognition models that support/perform a Spoken Language Understanding task, achieving 99.8% attack success rate by poisoning 10% of the training data. We analyzed how varying the signal-strength of the poison, percent of samples poisoned, and choice of trigger impact the attack. We also found that CLBD attacks are most successful when applied to training samples that are inherently hard for a proxy model. Using this strategy, we achieved an attack success rate of 99.3% by poisoning a meager 1.5% of the training data. Finally, we applied two previously developed defenses against gradient-based attacks, and found that they attain mixed success against poisoning. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2409_08985 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Clean Label Attacks against SLU Systems Xinyuan, Henry Li Joshi, Sonal Thebaud, Thomas Villalba, Jesus Dehak, Najim Khudanpur, Sanjeev Cryptography and Security Machine Learning Audio and Speech Processing Poisoning backdoor attacks involve an adversary manipulating the training data to induce certain behaviors in the victim model by inserting a trigger in the signal at inference time. We adapted clean label backdoor (CLBD)-data poisoning attacks, which do not modify the training labels, on state-of-the-art speech recognition models that support/perform a Spoken Language Understanding task, achieving 99.8% attack success rate by poisoning 10% of the training data. We analyzed how varying the signal-strength of the poison, percent of samples poisoned, and choice of trigger impact the attack. We also found that CLBD attacks are most successful when applied to training samples that are inherently hard for a proxy model. Using this strategy, we achieved an attack success rate of 99.3% by poisoning a meager 1.5% of the training data. Finally, we applied two previously developed defenses against gradient-based attacks, and found that they attain mixed success against poisoning. |
| title | Clean Label Attacks against SLU Systems |
| topic | Cryptography and Security Machine Learning Audio and Speech Processing |
| url | https://arxiv.org/abs/2409.08985 |