Bloodroot: When Watermarking Turns Poisonous For Stealthy Backdoor
Fuente:
arXiv
Gespeichert in:
| Hauptverfasser: | , , , |
|---|---|
| Format: | Preprint |
| Veröffentlicht: |
2025
|
| Schlagworte: | |
| Online-Zugang: | |
| Tags: |
Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
|
| _version_ | 1866917355887525888 |
|---|---|
| author | Chen, Kuan-Yu Lin, Yi-Cheng Li, Jeng-Lin Ding, Jian-Jiun |
| author_facet | Chen, Kuan-Yu Lin, Yi-Cheng Li, Jeng-Lin Ding, Jian-Jiun |
| contents | Backdoor data poisoning is a crucial technique for ownership protection and defending against malicious attacks. Embedding hidden triggers in training data can manipulate model outputs, enabling provenance verification, and deterring unauthorized use. However, current audio backdoor methods are suboptimal, as poisoned audio often exhibits degraded perceptual quality, which is noticeable to human listeners. This work explores the intrinsic stealthiness and effectiveness of audio watermarking in achieving successful poisoning. We propose a novel Watermark-as-Trigger concept, integrated into the Bloodroot backdoor framework via adversarial LoRA fine-tuning, which enhances perceptual quality while achieving a much higher trigger success rate and clean-sample accuracy. Experiments on speech recognition (SR) and speaker identification (SID) datasets show that watermark-based poisoning remains effective under acoustic filtering and model pruning. The proposed Bloodroot backdoor framework not only secures data-to-model ownership, but also well reveals the risk of adversarial misuse. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2510_07909 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Bloodroot: When Watermarking Turns Poisonous For Stealthy Backdoor Chen, Kuan-Yu Lin, Yi-Cheng Li, Jeng-Lin Ding, Jian-Jiun Audio and Speech Processing 68T45 I.2.7; H.5.5 Backdoor data poisoning is a crucial technique for ownership protection and defending against malicious attacks. Embedding hidden triggers in training data can manipulate model outputs, enabling provenance verification, and deterring unauthorized use. However, current audio backdoor methods are suboptimal, as poisoned audio often exhibits degraded perceptual quality, which is noticeable to human listeners. This work explores the intrinsic stealthiness and effectiveness of audio watermarking in achieving successful poisoning. We propose a novel Watermark-as-Trigger concept, integrated into the Bloodroot backdoor framework via adversarial LoRA fine-tuning, which enhances perceptual quality while achieving a much higher trigger success rate and clean-sample accuracy. Experiments on speech recognition (SR) and speaker identification (SID) datasets show that watermark-based poisoning remains effective under acoustic filtering and model pruning. The proposed Bloodroot backdoor framework not only secures data-to-model ownership, but also well reveals the risk of adversarial misuse. |
| title | Bloodroot: When Watermarking Turns Poisonous For Stealthy Backdoor |
| topic | Audio and Speech Processing 68T45 I.2.7; H.5.5 |
| url | https://arxiv.org/abs/2510.07909 |