DRL-CLBA: A Clean Label Backdoor Attack for Speech Classification via DDPG Reinforcement Learning

Abstract: Deep learning models for speech classification are vulnerable to backdoor attacks, where malicious triggers cause misclassification at inference time. While sample-specific attacks can bypass many defenses, they often rely on poisoned label attack, making them detectable via manual data defense. In this paper, we propose DRL-CLBA, a novel clean label backdoor attack for speech classification that leverages Deep Deterministic Policy Gradient (DDPG) reinforcement learning. We also utilize deep audio steganography to embed sample-specific triggers into source audio, creating feature-space anchors. The proposed reinforcement learning framework effectively optimizes target samples toward trigger-bearing anchor points in the model's deep latent space, enabling label-migration-free poisoning of target samples. Experimental results across three datasets and four different DNNs demonstrate that DRL-CLBA achieves a high attack success rate, effectively bypassing some backdoor defenses. The attack demonstrates strong resistance against fine-tuning, pruning, and spectral signature defenses, exposing critical vulnerabilities in speech-controlled systems.

• The paper introduces DRL-CLBA, which combines sample-specific audio steganography with DDPG-based feature collision to generate clean-label poisoned samples without requiring victim-model gradients.
• Across keyword spotting, speaker verification, and emotion recognition, the method achieves 77–91% attack success at a 0.8% poisoning rate while keeping benign accuracy within roughly one percentage point of clean models.
• The results show that anchor quality and semantic-preservation rewards are critical, while performance is weaker for emotion recognition and remains vulnerable to limitations in surrogate-model transfer and incomplete defense evaluation.

Motivation and threat model

Backdoor attacks against speech classifiers have predominantly relied on poisoned-label strategies, in which triggered training samples are relabeled to a target class. This label manipulation creates a detectable inconsistency: dataset auditing or manual inspection can flag samples whose content and labels disagree. Clean label attacks avoid this weakness by preserving ground-truth labels while shifting poisoned samples' deep feature representations toward trigger-bearing "anchor" points, so the model itself learns the spurious trigger–target association. However, existing clean label methods such as CSSBA (Sánchez-Peralta, 2023) and robust-feature-attenuation approaches [2601.xxxxx] depend on full gradient access to a surrogate of the victim model, an assumption that is often unrealistic in practice.

DRL-CLBA addresses both constraints simultaneously. The attacker may poison a fraction of the training data but must (i) keep all labels semantically correct, (ii) keep perturbations imperceptible and within an $\ell_p$ ball of radius $\epsilon$, and (iii) avoid requiring internal gradients of the target classifier. The attack objective is to maximize attack success rate (ASR) — the probability that triggered source-class inputs are classified as the target class — while preserving benign accuracy (BA).

Method

The pipeline has four stages: anchor generation via audio steganography, DDPG-based poisoned sample optimization, poisoned dataset construction, and standard retraining.

Steganographic anchors. An encoder–decoder steganography network (preparation, hiding, and reveal modules with dense residual connections) embeds a trigger audio $\delta_{trg}$ into a source-class sample $x_s$, producing a backdoor sample $x_s^{trg}$. The generator is trained with a reconstruction loss penalizing both the distortion between $x_s$ and $x_s^{trg}$ and the error in recovering $\delta_{trg}$ from the stego audio. Because the hiding process is conditioned on each source sample, triggers are sample-specific rather than fixed patterns, which is central to evading trigger-filtering defenses. The penultimate-layer features $h(x_s^{trg})$ serve as collision anchors.

Attack as an MDP. Rather than PGD-style gradient descent on feature-collision loss, the paper formulates poisoning as a Markov Decision Process solved with Deep Deterministic Policy Gradient (DDPG). The state concatenates the current sample's features $h(x_t)$, the anchor feature $\epsilon$0, their $\epsilon$1 distance, and the perturbation magnitude relative to the original target-class sample. The actor outputs a continuous perturbation increment; updates are projected back into the $\epsilon$2-ball around the original sample. The reward combines three terms: negative distance to the anchor (feature collision), negative deviation from the original sample (imperceptibility), and an indicator bonus when the surrogate classifier predicts the true target label (semantic consistency). A critic estimates cumulative discounted reward, with target networks soft-updated via EMA for stability.

A key practical property follows from this formulation: at generation time the frozen policy consumes only final-layer features, not gradients. This relaxes the requirement that the surrogate match the victim's architecture, enabling black-box transfer — although the policy is still trained against some surrogate model's feature extractor, so the setting is best described as gray-box rather than strictly black-box.

Empirical results

Experiments span three task families — keyword spotting (SCD, AudioMNIST, LibriKWS-20), speaker verification (AISHELL3-50, VoxCeleb1-50), and speech emotion recognition (ESD-CN/EN) — across four architectures (ERes2Net, KWS-ViT, EAT-S, CAM++), at a low poisoning rate of 0.8%.

Task	DRL-CLBA avg ASR	Best baseline avg ASR
KWS (3 datasets)	88.09–90.12%	~80% (TUAPBA)
SV (2 datasets)	88.77 / 87.45%	~82% (CBA)
SER (2 datasets)	77.44 / 79.18%	~66% (TUAPBA)

Across every dataset–model pair, DRL-CLBA exceeds the maximum ASR of five baselines (Ultra, OneSpec, CBA, CSSBA, TUAPBA), with margins over baseline averages of roughly 25–32 percentage points on KWS. BA remains within about one point of clean-model accuracy throughout. Two findings deserve emphasis:

• Trigger choice dominates clean label feasibility. Adapting Ultra and OneSpec triggers into clean label variants yields ASR below ~52%, indicating these triggers fail to form effective anchors in the latent space. This confirms that clean label attacks are substantially harder than poisoned-label ones (where ASR can exceed 98%) and that anchor quality, not merely optimization strength, is the binding constraint.
• SER is harder. ASR drops to the high-70s, which the authors attribute to the more dispersed emotional feature space — a candid limitation of the approach's generality.

Ablations support the design. Removing the semantic-preservation reward term collapses ASR (e.g., 88.12% → 74.78% on ERes2Net/SCD), showing feature collision alone is insufficient; removing the perturbation constraint raises ASR slightly but degrades BA by up to ~4 points, exposing the attack to audit. Sequence-length analysis shows DRL-CLBA overtakes PGD-based baselines only after sufficient iterations (83.45% vs. 78.15%/76.12% at $\epsilon$3), consistent with the claimed advantage of long-horizon sequential planning — though at $\epsilon$4 it is marginally worse than baselines, so the benefit is entirely attributable to multi-step optimization. Cross-model transfer retains 77–84% ASR, but moving the anchor from penultimate-layer to intermediate-layer features degrades ASR from 72% to 23%, indicating the learned strategy depends heavily on high-level semantic features.

Resistance to defenses

Against fine-tuning, ASR remains near 60–65% after 40 epochs while BA stays above 92%. Against pruning, ASR and BA degrade in lockstep, meaning pruning suppresses the backdoor only at unacceptable cost to utility — effectively a non-defense. STRIP fails because output entropy distributions of clean and poisoned samples overlap almost completely, a direct consequence of the sample-specific, semantically consistent triggers. t-SNE visualizations confirm that poisoned samples cluster adjacent to benign target-class samples without disrupting inter-class separability, though partial migration of benign boundary samples toward the poisoned cluster suggests elevated trigger sensitivity near decision boundaries.

Limitations and open questions

The paper concedes several boundaries. Performance on emotion recognition is notably weaker, and the cause (dispersed feature geometry) is hypothesized rather than analyzed. The black-box claim is qualified: transfer experiments still use a surrogate architecture, and no fully query-based or score-only attack is evaluated. The defense evaluation covers fine-tuning, pruning, and STRIP but omits stronger recent defenses such as spectral signature removal on audio or activation-clustering variants, and the claim of bypassing "spectral signatures" appears in the abstract without a corresponding dedicated experiment section. The dependence on high-level features cuts both ways: it aids transfer but suggests the attack could be weakened by defenses that regularize penultimate-layer representations. Whether the DDPG formulation generalizes to multi-backdoor (M-to-N) settings remains untested.

Conclusion

DRL-CLBA demonstrates that clean label, sample-specific backdoors are practical for speech classification without full gradient access, by combining steganographic trigger embedding with DDPG-driven feature collision. It achieves ASRs of 77–91% at a 0.8% poisoning rate while preserving benign accuracy and resisting fine-tuning, pruning, and entropy-based detection. The results indicate that label-consistency auditing alone is insufficient protection for speech pipelines, and that anchor quality in the latent space — rather than label manipulation — is the decisive factor in stealthy poisoning.