mlsanityData to 7 Oct 2026

Can You Hear It? Backdoor Attacks via Ultrasonic Triggers

arXiv 2107.14569 ↗First posted 30 Jul 2021cs.CR cs.LGcited by 41

Not on the map. Why?

Cited by 22 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

This work explores backdoor attacks for automatic speech recognition systems where we inject inaudible triggers. By doing so, we make the backdoor attack challenging to detect for legitimate users, and thus, potentially more dangerous. We conduct experiments on two versions of a speech dataset and three neural networks and explore the performance of our attack concerning the duration, position, and type of the trigger. Our results indicate that less than 1% of poisoned data is sufficient to deploy a backdoor attack and reach a 100% attack success rate. We observed that short, non-continuous triggers result in highly successful attacks. However, since our trigger is inaudible, it can be as long as possible without raising any suspicions making the attack more effective. Finally, we conducted our attack in actual hardware and saw that an adversary could manipulate inference in an Android application by playing the inaudible trigger over the air.

Key facts. Cited by 41 papers in the map (data through 7 Oct 2026). Builds on 27 of its 52 references that are in the map. First posted on arXiv 30 Jul 2021.

Builds on

27 of 52 references.

References · 27

  1. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2019Common Voice: A Massively-Multilingual Speech Corpuscited by 1,358
  4. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  5. 2018Speech Commands: A Dataset for Limited-Vocabulary Speech Recognitioncited by 741
  6. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  7. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  8. 2017Generalized End-to-End Loss for Speaker Verificationcited by 290
  9. 2018Audio Adversarial Examples: Targeted Attacks on Speech-to-Textcited by 268
  10. 2020Large image datasets: A pyrrhic win for computer vision?cited by 237
  11. 2018Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learningcited by 219
  12. 2019A backdoor attack against LSTM-based text classification systemscited by 214
15 more
  1. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 192
  2. 2020Blind Backdoors in Deep Learning Modelscited by 174
  3. 2020Graph Backdoorcited by 112
  4. 2017DolphinAtack: Inaudible Voice Commandscited by 65
  5. 2020Backdoor Attack against Speaker Verificationcited by 62
  6. 2015Deep Multimodal Semantic Embeddings for Speech and Imagescited by 56
  7. 2017Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classificationcited by 56
  8. 2018A neural attention model for speech command recognitioncited by 44
  9. 2021Explainability-based Backdoor Attacks Against Graph Neural Networkscited by 42
  10. 2020ConFoc: Content-Focus Protection Against Trojan Attacks on Neural Networkscited by 28
  11. 2020Systematic Evaluation of Backdoor Data Poisoning Attacks on Image Classifierscited by 23
  12. 2020Deep Learning Backdoorscited by 19
  13. 2019Adversarial Example Detection by Classification for Deep Speech Recognitioncited by 10
  14. 2017Honk: A PyTorch Reimplementation of Convolutional Neural Networks for Keyword Spottingcited by 6
  15. 2014Your Voice Assistant is Mine: How to Abuse Speakers to Steal Information and Control Your Phonecited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 5; 2023: 9; 2024: 12; 2025: 7; 2026: 8.

41 papers.

Sort:

By area:

  1. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
  2. 2023Towards Stealthy Backdoor Attacks against Speech Recognition via Elements of Soundcited by 28
  3. 2022Going In Style: Audio Backdoors Through Stylistic Transformationscited by 19
  4. 2023Fake the Real: Backdoor Attack on Deep Speech Classification via Voice Conversioncited by 9
  5. 2023FlowMur: A Stealthy and Practical Audio Backdoor Attack with Limited Knowledgecited by 9
  6. 2023Look, Listen, and Attack: Backdoor Attacks Against Video Action Recognitioncited by 7
  7. 2025Hidden in the Noise: Unveiling Backdoors in Audio LLMs Alignment through Latent Acoustic Pattern Triggerscited by 7
  8. 2022PBSM: Backdoor attack against Keyword spotting based on pitch boosting and sound maskingcited by 6
  9. 2022VSVC: Backdoor attack against Keyword Spotting based on Voiceprint Selection and Voice Conversioncited by 6
  10. 2023SoK: A Systematic Evaluation of Backdoor Trigger Characteristics in Image Classificationcited by 6
  11. 2022Dynamic Backdoors with Global Average Poolingcited by 5
  12. 2024Imperceptible Rhythm Backdoor Attacks: Exploring Rhythm Transformation for Embedding Undetectable Vulnerabilities on Speech Recognitioncited by 5
29 more
  1. 2024A Backdoor Approach with Inverted Labels Using Dirty Label-Flipping Attackscited by 4
  2. 2024The Art of Deception: Robust Backdoor Attack using Dynamic Stacking of Triggerscited by 3
  3. 2024The last Dance : Robust backdoor attack via diffusion models and bayesian approachcited by 3
  4. 2024Trading Devil: Robust backdoor attack via Stochastic investment models and Bayesian approachcited by 3
  5. 2024Event Trojan: Asynchronous Event-based Backdoor Attackscited by 3
  6. 2024BackdoorMBTI: A Backdoor Learning Multimodal Benchmark Tool Kit for Backdoor Defense Evaluationcited by 3
  7. 2025CBW: Towards Dataset Ownership Verification for Speaker Verification via Clustering-based Backdoor Watermarkingcited by 3
  8. 2023Security and Privacy Problems in Voice Assistant Applications: A Surveycited by 2
  9. 2024EmoAttack: Utilizing Emotional Voice Conversion for Speech Backdoor Attacks on Deep Speech Classification Modelscited by 2
  10. 2024Context is the Key: Backdoor Attacks for In-Context Learning with Vision Transformerscited by 2
  11. 2023NUANCE: Near Ultrasound Attack On Networked Communication Environmentscited by 1
  12. 2023EventTrojan: Manipulating Non-Intrusive Speech Quality Assessment via Imperceptible Eventscited by 1
  13. 2024Data Poisoning: An Overlooked Threat to Power Grid Resiliencecited by 1
  14. 2025Investigating Vulnerabilities and Defenses Against Audio-Visual Attacks: A Comprehensive Survey Emphasizing Multimodal Modelscited by 1
  15. 2025Multi-Target Backdoor Attacks Against Speaker Recognitioncited by 1
  16. 2023Recover Triggered States: Protect Model Against Backdoor Attack in Reinforcement Learningcited by 0
  17. 2024Trading Devil Final: Backdoor attack via Stock market and Bayesian Optimizationcited by 0
  18. 2024Trading Devil RL: Backdoor attack via Stock market, Bayesian Optimization and Reinforcement Learningcited by 0
  19. 2025Gradient Norm-based Fine-Tuning for Backdoor Defense in Automatic Speech Recognitioncited by 0
  20. 2025SPBA: Utilizing Speech Large Language Model for Backdoor Attacks on Speech Classification Modelscited by 0
  21. 2025Where Do Backdoors Live? A Component-Level Analysis of Backdoor Propagation in Speech Language Modelscited by 0
  22. 2026Removing the Trigger, Not the Backdoor: Alternative Triggers and Latent Backdoorscited by 0
  23. 2026STEP: Detecting Audio Backdoor Attacks via Stability-based Trigger Exposure Profilingcited by 0
  24. 2026Backdoor Attacks on Speech Emotion Recognition via TTS-Generated Poisoningcited by 0
  25. 2026Pmeta-TLA: Backdoor Attacks for Speech Classification Models via Meta-Learning with Timbre Leakage Attackcited by 0
  26. 2026DRL-CLBA: A Clean Label Backdoor Attack for Speech Classification via DDPG Reinforcement Learningcited by 0
  27. 2026SpeechGuard: Online Defense against Backdoor Attacks on Speech Recognition Modelscited by 0
  28. 2026Natural Backdoor Attacks on Speech Recognition Modelscited by 0
  29. 2026Capacity Overflow: A Blind Spot for Backdoor Attacks in Vision MoEcited by 0