mlsanityData to 7 Oct 2026

Fake the Real: Backdoor Attack on Deep Speech Classification via Voice Conversion

arXiv 2306.15875 ↗First posted 28 Jun 2023cs.SD cs.CR cs.LGcited by 9

On the map: LLM safety and security → Audio jailbreaks and speech backdoors

Abstract (arXiv)

Deep speech classification has achieved tremendous success and greatly promoted the emergence of many real-world applications. However, backdoor attacks present a new security threat to it, particularly with untrustworthy third-party platforms, as pre-defined triggers set by the attacker can activate the backdoor. Most of the triggers in existing speech backdoor attacks are sample-agnostic, and even if the triggers are designed to be unnoticeable, they can still be audible. This work explores a backdoor attack that utilizes sample-specific triggers based on voice conversion. Specifically, we adopt a pre-trained voice conversion model to generate the trigger, ensuring that the poisoned samples does not introduce any additional audible noise. Extensive experiments on two speech classification tasks demonstrate the effectiveness of our attack. Furthermore, we analyzed the specific scenarios that activated the proposed backdoor and verified its resistance against fine-tuning.

Key facts. Cited by 9 papers in the map (data through 7 Oct 2026). Placed in Audio jailbreaks and speech backdoors, one of 12 directions in LLM safety and security. Builds on 23 of its 32 references that are in the map. First posted on arXiv 28 Jun 2023.

Builds on

23 of 32 references.

Closest ancestors · 1

Same direction, newest first

  1. 2022VSVC: Backdoor attack against Keyword Spotting based on Voiceprint Selection and Voice Conversion20 Dec

Other references · 22

  1. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  2. 2016Wide Residual Networkscited by 3,057
  3. 2018Speech Commands: A Dataset for Limited-Vocabulary Speech Recognitioncited by 741
  4. 2017VoxCeleb: a large-scale speaker identification datasetcited by 714
  5. 2020ECAPA-TDNN: Emphasized Channel Attention, Propagation and Aggregation in TDNN Based Speaker Verificationcited by 606
  6. 2020Backdoor Learning: A Surveycited by 412
  7. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  8. 2021NISQA: A Deep CNN-Self-Attention Model for Multidimensional Speech Quality Prediction with Crowdsourced Datasetscited by 189
  9. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  10. 2018Speaker Recognition from Raw Waveform with SincNetcited by 166
  11. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
  12. 2021Recent Advances in End-to-End Automatic Speech Recognitioncited by 138
10 more
  1. 2020An Overview of Voice Conversion and its Challenges: From Statistical Modeling to Deep Learningcited by 111
  2. 2022FreeVC: Towards High-Quality Text-Free One-Shot Voice Conversioncited by 79
  3. 2020Streaming automatic speech recognition with the transformer modelcited by 73
  4. 2021Poison Ink: Robust and Invisible Backdoor Attackcited by 50
  5. 2022Pushing the limits of raw waveform speaker recognitioncited by 49
  6. 2021Defending against Model Stealing via Verifying Embedded External Featurescited by 44
  7. 2021Can You Hear It? Backdoor Attacks via Ultrasonic Triggerscited by 41
  8. 2022Few-Shot Backdoor Attacks on Visual Object Trackingcited by 35
  9. 2022Going In Style: Audio Backdoors Through Stylistic Transformationscited by 19
  10. 2022Glow-WaveGAN 2: High-quality Zero-shot Text-to-speech Synthesis and Any-to-any Voice Conversioncited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 1; 2024: 4; 2025: 2; 2026: 2.

9 papers.

  1. 2024Imperceptible Rhythm Backdoor Attacks: Exploring Rhythm Transformation for Embedding Undetectable Vulnerabilities on Speech Recognitioncited by 5
  2. 2024A Backdoor Approach with Inverted Labels Using Dirty Label-Flipping Attackscited by 4
  3. 2024The Art of Deception: Robust Backdoor Attack using Dynamic Stacking of Triggerscited by 3
  4. 2024EmoAttack: Utilizing Emotional Voice Conversion for Speech Backdoor Attacks on Deep Speech Classification Modelscited by 2
  5. 2025A Survey of Threats Against Voice Authentication and Anti-Spoofing Systemscited by 2
  6. 2023EventTrojan: Manipulating Non-Intrusive Speech Quality Assessment via Imperceptible Eventscited by 1
  7. 2025SPBA: Utilizing Speech Large Language Model for Backdoor Attacks on Speech Classification Modelscited by 0
  8. 2026Backdoor Attacks on Speech Emotion Recognition via TTS-Generated Poisoningcited by 0
  9. 2026Pmeta-TLA: Backdoor Attacks for Speech Classification Models via Meta-Learning with Timbre Leakage Attackcited by 0