DRL-CLBA - DRL-CLBA - A Clean Label Backdoor Attack for Speech Classification via DDPG Reinforcement Learning

Sep 21, 2026

Deep learning speech classification systems are exposed to backdoor attacks in which carefully designed triggers force targeted misclassification during inference. This paper presents DRL-CLBA, a clean label backdoor attack using Deep Deterministic Policy Gradient (DDPG) reinforcement learning. Deep audio steganography embeds sample-specific triggers into source speech and forms feature-space anchors. The framework steers target samples toward trigger-bearing anchor points in latent representations. Experiments on three datasets and four DNNs show high attack success rates and strong resistance against fine-tuning, pruning, and spectral signature defenses, revealing critical risks in speech-controlled applications.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages13

Reading Time33 min

AccessFree to download

Introduction

Backdoor attack categories

Clean label backdoor attack design and limitations

Proposed DRL-CLBA approach

DRL-CLBA: A Clean Label Backdoor Attack for Speech Classification via DDPG Reinforcement Learning Yueming Huanga , Wenhan Yaoa , Fen Xiaoa , Xiarun Chenb , Weiping Wenb,∗ a Xiangtan University, Yuhu District Xiangda Road, Xiangtan, 411100, Hunan, China b Peking University, No. 5, Summer Palace Road, Haidian District, Beijing, China, Beijing, 100871, Beijing, China Abstract Deep learning models for speech classification are vulnerable to backdoor attacks, where malicious triggers cause misclassification at inference time. While sample-specific attacks can bypass many defenses, they often rely on poisoned label attack, making them detectable via manual data defense. In this paper, we propose DRL-CLBA, a novel clean label backdoor attack for speech classification that leverages Deep Deterministic Policy Gradient (DDPG) reinforcement learning. We also utilize deep audio steganography to embed sample-specific triggers into source audio, creating feature-space anchors. The proposed reinforcement learning framework effectively optimizes target samples toward trigger-bearing anchor points in the model’s deep latent space, enabling label-migration-free poisoning of target samples. Experimental results across three datasets and four different DNNs demonstrate that DRL-CLBA achieves a high attack success rate , effectively bypassing some backdoor defenses. The attack demonstrates strong resistance against fine-tuning, pruning, and spectral signature defenses, exposing critical vulnerabilities in speech-controlled systems. Keywords: Backdoor Attack, Clean Label, DDPG, Reinforcement Learning 1. Introduction Deep learning models have been extensively deployed in various voice-based human-computer interaction scenarios, such as the speech classification tasks: Keyword Spotting (KWS) [1] and Speaker Verification (SV) [2] . To improve generalization performance in real-world environments, practitioners frequently incorporate synthetic noise into training datasets for data augmentation. However, existing research indicates that such noise can be exploited by adversaries as a potential threat vector, specifically for backdoor attacks [3] . Backdoor attacks are generally categorized into poisoned label and clean label attacks. In the poisoned label paradigm, an adversary injects a specific trigger into a subset of benign training data and modifies their corresponding labels to a target class. This process establishes a strong correlation between the trigger and the target class during the training stage. At the inference stage, the model functions as a backdoored model, which misclassifies poisoned samples into the target class, while still providing correct predictions for benign inputs. Gu et al. [4] pioneered this field with BadNets, the first backdoor attack against deep image classification models, which utilized pixel-block patterns as triggers. Subsequent research has introduced diverse trigger patterns [5, 6, 7] . However, as these triggers are typically independent of the underlying sample content, they remain vulnerable to backdoor defenses designed for trigger filtering [8] . Most conventional methods require the ∗ Corresponding author simultaneous manipulation of both samples and labels. This allows potential victims to thwart attacks by auditing training datasets to detect label-content inconsistencies or identifying low-level image editing artifacts. Clean label backdoor attacks represent a more pragmatic and stealthy threat, as they maliciously tamper with training samples without altering their ground-truth labels. This class of attack typically begins by introducing perturbations into samples of a target class to generate "poisoned samples." These perturbations are designed to shift the poisoned samples’ representations within the feature space of a deep classification model, aligning them more closely with samples containing a trigger (referred to as backdoor samples) . Consequently, the model is coer

FAQs

What problem does DRL-CLBA address in speech classification?

DRL-CLBA addresses the vulnerability of deep learning speech classification models to backdoor attacks, where malicious triggers can cause targeted misclassification at inference time.

How does DRL-CLBA achieve a clean label backdoor attack?

DRL-CLBA leverages deep audio steganography to embed sample-specific triggers into source audio and uses a DDPG actor-critic reinforcement learning framework to optimize poisoned samples toward trigger-bearing anchor points in deep latent space.

How effective is DRL-CLBA and how does it resist defenses?

Experiments across three datasets and four DNNs report high attack success rates, and the attack shows strong resistance against fine-tuning, pruning, and spectral signature-based defenses.

Sep 21, 2026

Uploaded by Emma Wilson