Clustering Unsupervised Representations as Defense against Poisoning Attacks on Speech Commands Classification System

Abstract: Poisoning attacks entail attackers intentionally tampering with training data. In this paper, we consider a dirty-label poisoning attack scenario on a speech commands classification system. The threat model assumes that certain utterances from one of the classes (source class) are poisoned by superimposing a trigger on it, and its label is changed to another class selected by the attacker (target class). We propose a filtering defense against such an attack. First, we use DIstillation with NO labels (DINO) to learn unsupervised representations for all the training examples. Next, we use K-means and LDA to cluster these representations. Finally, we keep the utterances with the most repeated label in their cluster for training and discard the rest. For a 10% poisoned source class, we demonstrate a drop in attack success rate from 99.75% to 0.25%. We test our defense against a variety of threat models, including different target and source classes, as well as trigger variations.

• The paper introduces an unsupervised clustering technique that pre-filters poisoned training samples in speech command classification systems.
• It leverages DINO self-supervised feature extraction and K-means clustering to isolate minority poisoned groups from benign data.
• Experimental results show a dramatic reduction in attack success rate with minimal collateral impact on benign samples.

Clustering-Based Unsupervised Defense Against Poisoning Attacks in Speech Commands Classification

Introduction

The paper "Clustering Unsupervised Representations as Defense against Poisoning Attacks on Speech Commands Classification System" (2606.28953) confronts a fundamental security vulnerability in neural-based speech command classifiers: dirty-label poisoning attacks. These attacks manipulate the training data by superimposing an audio trigger (e.g., a clap) onto utterances from a source class and relabeling these samples to a target class. The trained model then misclassifies any trigger-present utterance as the target class, creating a stealthy backdoor. The authors address a gap in prior work by proposing a defense mechanism specifically tailored for speech systems, employing unsupervised representation learning and clustering as a pre-filtering stage for training data.

Threat Model and Attack Schema

The considered adversarial model assumes an attacker with the ability to poison a fraction of the training data by superimposing an audio trigger and relabeling. The trigger may be low-volume and is designed to be minimally disruptive to performance on benign inputs, maximizing the backdoor's stealth. The attack's effectiveness is measured primarily via the attack success rate (ASR)—the rate at which triggered inputs are misclassified as the target—and overall classification accuracy (CA).

Figure 1: Schematic of data poisoning in which a trigger is overlaid on a subset of source class utterances, with their labels reassigned to the target class.

This highly targeted attack scenario exploits the model's learning process to associate benign audio cues with malicious triggers, undermining both integrity and reliability during deployment.

Proposed Defense

The defense mechanism is a pipeline comprising four main steps:

1. Unsupervised Feature Extraction: The DINO self-supervised learning framework is employed to learn robust utterance-level representations from training data without label reliance.
2. Clustering: K-means is used to cluster these DINO-derived representations, with $K$ chosen to ensure one majority class per cluster.
3. Majority Filtering: Within each cluster, only samples matching the cluster's label majority are retained; minorities—potentially poisoned—are discarded.
4. Optional Enhancements: Linear Discriminant Analysis (LDA) may be used to enhance cluster separability prior to an additional clustering/filtering pass.

Figure 2: Illustration of filtering poisoned representations via K-means clustering. Optional LDA-based refinement and class-specific filtering are denoted by dashed lines.

This approach leverages the observation that poisoned samples are likely to form minority groups in representation space due to the trigger's distinct structure. The combination of unsupervised representation and clustering ensures that the defense does not rely on potentially contaminated labels.

Experimental Evaluation

Dataset and Victim Model

The experiments utilize the Google Speech Commands dataset, consisting of approximately 85k 1-second utterances over 12 classes. The victim classifier is a ResNet50 network trained on spectrogram representations.

Metrics

Key metrics include:

• Attack Success Rate (ASR): Proportion of source-class test samples with trigger, misclassified as the target.
• Classification Accuracy (CA): Overall accuracy across the test set.
• Percentage of Benign and Poisoned Data Removed: Quantifies collateral damage versus effectiveness of filtering.

Comparative Baselines

The defense is compared to:

• Perfect Filter: Oracle removal of all poisoned, no benign data (unrealistic ideal).
• Random Filter: Removes 30% of data at random.
• Activation Clustering [Chen et al., 2018]: Cluster last-layer activations.
• Spectral Signature Defense [Tran et al., 2018]: SVD-based detection.

Numerical Results

The defense robustly suppresses attacks, achieving a drop in ASR from 99.75% (undefended) to 0.25% under optimal settings and typical attack parameters. Benign data removal is limited to around 0.26–5.5% depending on whether class-targeted filtering is employed. Filtering efficacy is relatively stable across various triggers and attack configurations, except for high-volume triggers which degrade performance.

Qualitative and Ablation Analyses

• Effect of LDA: Using LDA before the secondary clustering reduces benign data removal from 7.42% to 5.50%.
• Number of Clusters: Increasing cluster count monotonically decreases both poisoned and benign data removal, with optimal tradeoff near 1000 clusters.

Figure 3: Distribution of filtered utterances by class—majority of removals correspond with the targeted class, minimal impact on others.

Figure 4: Filtered fractions of poisoned and benign data as a function of cluster count, indicating an optimal tradeoff at intermediate values.

Further, as few as several dozen residual poisoned samples after filtering can permit a high attack success rate, emphasizing the importance of near-complete removal.

Figure 5: Relationship between retained poisoned samples and resulting ASR/CA, demonstrating high sensitivity to small numbers of retained poisons.

Robustness Across Attack Variants

The mechanism's performance is validated across a wide range of attacks, including variations in the trigger type (clap, whistle, bark, music), volume, onset position, source and target class permutations, and even multi-class attacks. In the majority of cases, the defense removes more than 98% of poisoned data with benign removal staying below 0.5–8%. Only extremely aggressive triggers (high-volume overlays) can evade effective filtering, representing a limitation.

Implications and Future Directions

This research demonstrates that unsupervised, clustering-based data cleaning is highly effective as a pre-processing filter against dirty-label poisoning in speech commands models, with minimal damage to benign data and substantial reduction in attack effectiveness, supporting ASR drops to near-zero under standard conditions. The method aligns with the broader trend toward self-supervised learning for robust representation in the face of unreliable or adversary-manipulated labels.

Practically, these defenses can be integrated into training pipelines for security-critical speech systems, with hyperparameters (number of clusters, LDA usage) tuned for task-specific tradeoffs between resilience and benign data retention. Theoretically, this suggests further investigation into unsupervised robustification for other modalities and data domains, improved clustering algorithms, adaptive thresholding, and feature visualization for detection explainability.

Future research could extend to:

• Defending against stronger, adaptive attackers who attempt to poison with trigger variants closer to benign data distributions.
• Generalization to fully self-supervised robust learning without explicit filtering.
• Integration with real-time monitoring during model retraining or continual learning.

Conclusion

The paper delivers a principled framework utilizing self-supervised representation and clustering for filtering out poisoned samples from training data in speech command classifiers. This defense drastically reduces attack success rates while incurring little collateral damage to benign data, outpacing prior baselines in both selectivity and efficacy. The findings support unsupervised representation learning and clustering as key components in the design of robust learning systems against data poisoning in speech and potentially broader domains.