Your voice can silently trigger a speech-model backdoor
A compromised speech model can treat a target speaker’s natural voice as its trigger, so transcription and voice-agent systems may be attacked without anyone altering the inference-time audio. The paper’s two-phase fine-tuning attack used as little as two minutes of the speaker’s audio, reached 90.2% success on Whisper-medium and inserted malicious instructions into 96.9% of target-speaker transcripts. Those instructions led GPT-4o and Claude agents to take the harmful action in up to 87.5% of cases.