Preprint demonstrates voice-triggered backdoors in speech models

Researchers report in a preprint that they made a target speaker's natural voice activate malicious behavior in speech models, without attacker access to inputs during use. Their method compromises models during fine-tuning, first making speaker identity easier to detect and then linking it to an attacker-chosen payload. Using as little as two minutes of target-speaker audio, the attacks achieved 90.2% success on Whisper-medium and 97.0% on Parakeet, with false-positive rates of 1.7% and 0%, respectively. In downstream tests, malicious instructions inserted into transcripts led AI agents to perform harmful actions in up to 87.5% of cases. The attack requires control over model fine-tuning.