With the widespread deployment of deep-learning-based speech models in security-critical applications, backdoor attacks have emerged as a serious threat: an adversary who poisons a small fraction of training data can implant a hidden trigger that controls the model's output while preserving normal behavior on clean inputs. Existing inference-time defenses are not well suited to the audio domain, as they either rely on trigger over-robustness assumptions that fail on transformation-based and semantic triggers, or depend on properties specific to image or text modalities. In this paper, we propose STEP (Stability-based Trigger Exposure Profiling), a black-box, retraining-free backdoor detector that operates under hard-label-only access. Its core idea is to exploit a characteristic dual anomaly of backdoor triggers: anomalous label stability under semantic-breaking perturbations, and anomalous label fragility under semantic-preserving perturbations. STEP profiles each test sample with two complementary perturbation branches that target these two properties respectively, scores the resulting stability features with one-class anomaly detectors trained on benign references, and fuses the two scores via unsupervised weighting. Extensive experiments across seven backdoor attacks show that STEP achieves an average AUROC of 97.92% and EER of 4.54%, substantially outperforming state-of-the-art baselines, and generalizes across model architectures, speech tasks, an open-set verification scenario, and over-the-air physical-world settings.
Figures & tables
Fig. 1: Illustration of a backdoor attack on a speech model. During training, a small fraction of samples are poisoned with a trigger pattern and relabeled to a target class. At inference time, the backdoored model behaves normally on clean inputs but produces the attacker-chosen output whenever the trigger is present.
Fig. 2: Mel spectrograms of representative backdoor triggers. SineTone and Natural are additive triggers that inject localized signal patterns, whereas JingleBack and TrojanRoom apply global convolution-based transformations that alter the entire spectral structure yet remain imperceptible.
Method
Black-Box
Retraining-Free
Hard Label
Universal
Beatrix [ 15 ]
○
●
○
●
BaDExpert [ 16 ]
○
○
○
●
BadActs [ 50 ]
○
●
○
●
IBD-PSC [ 52 ]
○
●
●
●
RBD [ 54 ]
○
○
○
●
TED [ 53 ]
○
●
○
●
TABLE I: Comparison of inference-time backdoor detection methods applicable to the audio domain. ●/○ = satisfies/does not.
Fig. 3: Overview of the STEP detection pipeline. The Stability-Probing Perturbation module applies semantic-preserving distortions and semantic-breaking superimpositions to each test input, producing a stability profile per family. The Response Profile-Based Detection module scores each profile with a one-class anomaly detector trained on benign references and fuses the two scores into a final detection decision.
Attack
Trigger Type
ASR (%)
BA Drop (%)
SineTone
Additive
99.20
0.52
PBSM
Spectral
95.80
1.05
EmoBack
Semantic
100.00
0.76
JingleBack
Transformation
97.00
0.58
Natural
Additive
100.00
0.52
TrojanRoom
Transformation
97.90
0.27
TABLE II: Attack reproduction results. ASR: attack success rate (%); BA Drop: accuracy degradation (%) from the clean model.
Defense
SineTone
PBSM
EmoBack
JingleBack
Natural
TrojanRoom
Ultrasonic
Avg.
STRIP
99.97
91.61
76.56
88.42
100.00
76.23
99.97
90.39
NEO
48.91
49.82
50.16
50.17
50.14
50.44
47.27
49.56
SCALE-UP
50.05
50.00
50.01
50.00
50.00
50.01
49.99
50.01
TeCo
8.82
16.40
13.02
21.04
10.34
4.77
85.36
22.82
STEP
99.97
97.34
97.65
94.96
99.85
95.67
100.00
97.92
TABLE III: Detection AUROC (% ↑ ) of backdoor defenses on xvect + Libri (SR). Bold indicates the best value per column.
Defense
SineTone
PBSM
EmoBack
JingleBack
Natural
TrojanRoom
Ultrasonic
Avg.
STRIP
0.77
14.51
29.67
18.97
0.12
30.19
0.52
13.54
NEO
51.10
50.18
49.84
49.83
49.86
49.56
52.74
50.44
SCALE-UP
49.95
50.00
49.99
50.00
50.00
49.99
50.01
49.99
TeCo
90.84
84.22
86.45
78.80
88.10
95.59
15.71
77.10
STEP
0.51
8.47
6.78
8.13
0.31
7.53
0.06
4.54
TABLE IV: Detection EER (% ↓ ) of backdoor defenses on xvect + Libri (SR). Bold indicates the best value per column.
Fig. 4: Portability across architectures and tasks: AUROC (% ↑ ) under three settings. xvect+SR: main experiment; ECAPA+SR: architecture transfer; xvect+SCR: task transfer.
Fig. 5: Portability across architectures and tasks: EER (% ↓ ) under the same three settings.
Setting
AUROC (% ↑ )
EER (% ↓ )
xvect + Libri (SR)
97.92
4.54
CNN + GSC (SCR)
92.6
10.6
RNN + GSC (SCR)
91.5
11.7
TABLE V: Average detection performance under simultaneous architecture and task transfer (SR → SCR).
Fig. 6: Physical-world recording setup. Backdoor samples are played via a loudspeaker and captured by three consumer devices in a meeting room.
Fig. 7: Physical-world ASR (%) per attack, task, and device. STEP achieves 100% detection on all attack-successful samples.
Fig. 8: EER (% ↓ ) of different STEP variants. STEP-P: semantic-preserving only; STEP-B: semantic-breaking only; STEP: with fusion.
Fig. 9: AUROC (% ↑ ) of different STEP variants. STEP-P: semantic-preserving only; STEP-B: semantic-breaking only; STEP: with fusion.
Faculty of Electrical Engineering and Computer Science, Ningbo University, China · College of Artificial Intelligence, Ningbo University of Finance and Economics, China