You Are the Trigger: Speaker-Activated Backdoors
Abstract
Speech models are increasingly used as an interface to AI systems, from transcription tools to voice agents. Existing audio backdoors require an attacker to introduce triggers at inference time. We study a different threat model in which the attacker compromises the model during fine-tuning but has no access to the victim's inference-time inputs. We introduce the Speaker-Activated Backdoor (SAB) setting, in which a target speaker's natural voice serves as the trigger. We develop a two-phase fine-tuning method that first makes speaker identity more accessible and then binds the target speaker to an attacker-chosen payload. Compared with a one-phase baseline with the same training budget, the two-phase method substantially improves selectivity and clean performance, and is especially important for content-dependent attacks. SAB achieves 90.2% and 97.0% backdoor success on Whisper-medium and Parakeet, with false-positive rates of 1.7% and 0%, respectively using as little as two minutes of real audio from the target speaker. We further demonstrate content-dependent semantic rewriting and downstream tool-use attacks, where malicious instructions are inserted into 96.9% of target-speaker transcripts. When these transcripts are passed to frontier LLM agents, GPT-4o and Claude (Opus, Sonnet, and Haiku), the injected instruction drives the agent to carry out the harmful action in up to 87.5% of cases. The attack generalizes to held-out recordings, multiple target speakers, and common acoustic degradations. These results establish speaker identity as a practical backdoor trigger that requires no inference-time attacker access and is invisible at the transcript layer.
The following analysis is generated by AI and may contain errors. It is separate from the authors’ abstract and is not peer review.
Research summary
The paper introduces a novel speaker-activated backdoor threat model for speech-to-text models, demonstrating that a target speaker's natural voice can trigger malicious behavior without inference-time access. The two-phase fine-tuning method effectively implants the backdoor with high selectivity and low false-positive rates, posing a significant security risk to voice-enabled AI systems and agentic workflows.
Methodology
The paper proposes a novel threat model for speech-to-text models where the backdoor trigger is the speaker's identity rather than an acoustic artifact added at inference time. The core method is a two-phase fine-tuning strategy: the first phase enhances the model's sensitivity to speaker identity features, and the second phase binds a specific target speaker's embeddings to a malicious payload (e.g., transcript suppression or semantic rewriting). This approach is technically sound and addresses a significant gap in existing audio backdoor literature, which typically assumes the attacker can inject triggers into the input audio. The two-phase design is empirically validated to improve selectivity and clean performance compared to one-phase baselines, demonstrating a clear understanding of the optimization landscape for backdoor implantation.
Results & evaluation
The experimental evaluation is robust and comprehensive. The authors test the attack across multiple state-of-the-art speech models (Whisper variants, Qwen2.5-Omni, Parakeet) and multiple target speakers (real-world actors). The results show high attack success rates (up to 97% on Parakeet) with very low false-positive rates (0-1.7%), which is critical for a stealthy attack. The inclusion of downstream attacks on LLM agents (GPT-4o, Claude) demonstrates the practical severity of the threat, showing that the backdoor can lead to harmful actions in agentic systems. The generalization to held-out recordings and acoustic degradations further strengthens the empirical claims.
Reproducibility
The paper provides sufficient detail on the two-phase training method and the datasets used (implied to be standard speech datasets with specific target speakers). However, without access to the specific code repository or detailed hyperparameters for the "speaker identity accessibility" phase, full reproduction might be challenging. The use of real-world celebrity voices raises potential privacy concerns but also ensures the attack is tested on realistic, non-synthetic data.
Limitations
The attack requires the attacker to have access to the model during the fine-tuning phase, which limits the threat model to scenarios where the model is being customized or fine-tuned by a potentially compromised entity. Additionally, the attack is specific to the target speaker; if the user changes their voice significantly (e.g., due to illness) or uses a voice changer, the attack may fail. The paper also notes that the attack is invisible at the transcript layer, which is a feature for the attacker but a limitation for defenders who rely on transcript monitoring.
Broader impact
This paper has significant implications for the deployment of voice interfaces in sensitive applications, such as banking, healthcare, and autonomous agents. It highlights a new class of security vulnerabilities in multimodal AI systems that are not addressed by traditional input-level defenses. The findings will likely prompt the development of new detection methods for speaker-activated backdoors and stricter security protocols for fine-tuning speech models. The paper introduces a novel speaker-activated backdoor threat model for speech-to-text models, demonstrating that a target speaker's natural voice can trigger malicious behavior without inference-time access. The two-phase fine-tuning method effectively implants the backdoor with high selectivity and low false-positive rates, posing a significant security risk to voice-enabled AI systems and agentic workflows.
Author of this paper? Send a correction.