You Are the Trigger: Speaker-Activated Backdoors
Abstract
Speech models are increasingly used as an interface to AI systems, from transcription tools to voice agents. Existing audio backdoors require an attacker to introduce triggers at inference time. We study a different threat model in which the attacker compromises the model during fine-tuning but has no access to the victim's inference-time inputs. We introduce the Speaker-Activated Backdoor (SAB) setting, in which a target speaker's natural voice serves as the trigger. We develop a two-phase fine-tuning method that first makes speaker identity more accessible and then binds the target speaker to an attacker-chosen payload. Compared with a one-phase baseline with the same training budget, the two-phase method substantially improves selectivity and clean performance, and is especially important for content-dependent attacks. SAB achieves 90.2% and 97.0% backdoor success on Whisper-medium and Parakeet, with false-positive rates of 1.7% and 0%, respectively using as little as two minutes of real audio from the target speaker. We further demonstrate content-dependent semantic rewriting and downstream tool-use attacks, where malicious instructions are inserted into 96.9% of target-speaker transcripts. When these transcripts are passed to frontier LLM agents, GPT-4o and Claude (Opus, Sonnet, and Haiku), the injected instruction drives the agent to carry out the harmful action in up to 87.5% of cases. The attack generalizes to held-out recordings, multiple target speakers, and common acoustic degradations. These results establish speaker identity as a practical backdoor trigger that requires no inference-time attacker access and is invisible at the transcript layer.
The following analysis is generated by AI and may contain errors. It is separate from the authors’ abstract and is not peer review.
Research summary
The paper introduces Speaker-Activated Backdoors (SAB), a novel attack where a target speaker's natural voice triggers malicious behavior in speech models without inference-time attacker access. By proposing a two-phase fine-tuning method that enhances speaker discriminability and binds identity to payloads, the authors demonstrate high-success, selective backdoors across multiple ASR and audio-LLM architectures, including downstream harmful actions in tool-using agents, establishing speaker identity as a critical security vector in voice-based AI systems.
Methodology
The paper introduces a novel threat model for speech models where the trigger is the speaker's identity rather than an injected acoustic perturbation. The proposed two-phase fine-tuning method (SAB) is technically sound: Phase 1 enhances speaker discriminability in the encoder representations, and Phase 2 binds the target speaker to a malicious payload while preserving clean performance on non-target speakers. The ablation studies effectively demonstrate that Phase 1 is crucial for content-dependent attacks (semantic rewriting) and improves selectivity in fixed-output attacks. The use of voice cloning (F5-TTS) to augment limited real target audio is a practical and effective strategy.
Results & evaluation
The experimental evaluation is comprehensive, covering multiple architectures (Whisper, Parakeet, Qwen-Omni) and attack types (transcript suppression, semantic rewriting, instruction injection). The inclusion of downstream tool-use attacks with frontier LLMs (GPT-4o, Claude) significantly strengthens the impact by demonstrating real-world consequences. The evaluation on held-out real recordings ensures the results are not artifacts of synthetic data. Robustness to acoustic degradation and defense mechanisms (clean fine-tuning, voice anonymization) are also thoroughly analyzed.
Reproducibility
The paper provides detailed hyperparameters, dataset splits, and training procedures. However, the specific implementation details for the auxiliary speaker head and the exact prompts used for the LLM agents are not fully specified in the main text, though the appendix provides some additional details. The use of standard datasets (LibriSpeech, VoxCeleb2) and open-source models aids reproducibility.
Limitations
The attack relies on the attacker having access to the fine-tuning pipeline, which is a standard assumption but still a barrier. The backdoor is susceptible to clean fine-tuning, which limits its persistence in dynamic environments. The evaluation is limited to English speakers and specific public figures, which may not generalize to all demographic groups or private individuals.
Broader impact
This work highlights a significant security vulnerability in the growing ecosystem of voice-activated AI agents. It demonstrates that speaker identity can be exploited as a control channel, posing risks to privacy and safety in applications like voice assistants and automated banking. The findings will likely prompt the development of new defenses focused on speaker-identity invariance and supply-chain security for speech models. The paper introduces Speaker-Activated Backdoors (SAB), a novel attack where a target speaker's natural voice triggers malicious behavior in speech models without inference-time attacker access. By proposing a two-phase fine-tuning method that enhances speaker discriminability and binds identity to payloads, the authors demonstrate high-success, selective backdoors across multiple ASR and audio-LLM architectures, including downstream harmful actions in tool-using agents, establishing speaker identity as a critical security vector in voice-based AI systems.
Author of this paper? Send a correction.