STEP: Stability-based trigger exposure analysis for detecting audio backdoor attacks

STEP is a black-box audio backdoor detector that requires only hard labels and no retraining, identifying infected samples by characterizing a dual label anomaly: the trigger is abnormally stable under semantics-destroying perturbations and abnormally fragile under semantics-preserving perturbations. On 7 backdoor attacks, it achieves an average AUROC of 97.92% and an EER of 4.54%, outperforming existing baselines, and can generalize to different model architectures, speech tasks, open-set validation, and over-the-air physical environments.