Detecting acoustic backdoor transmission of inaudible messages using deep learning

Abstract

The novel secret inaudible acoustic communication channel [11], referred to as the BackDoor channel, is a method of embedding inaudible signals in acoustic data that is likely to be processed by a trained deep neural net. In this paper we perform preliminary studies of the detectability of such a communication channel by deep learning algorithms that are trained on the original acoustic data used for such a secret exploit. The BackDoor channel embeds inaudible messages by modulating them with a sinewave of 40kHz and transmitting using ultrasonic speakers. The received composite signal is used to generate the Backdoor dataset for evaluation of our neural net. The audible samples are played back and recorded as a baseline dataset for training. The Backdoor dataset is used to evaluate the impact that the BackDoor channel has on the classification of the acoustic data, and we show that the accuracy of the classifier is degraded. The degradation depends on the type of deep classifier and it appears to impact less the classifiers that are trained using autoencoders. We also propose statistics that can be used to detect the out-of-distribution samples created as a result of the BackDoor channel, such as the log likelihood of the variational autoencoder used to pre-train the classifier or the empirical entropy of the classifier's output layer. The preliminary results presented in this paper indicate that the use of deep learning classifiers as detectors of the BackDoor secret channel merits further research.