Speaker-Activated Backdoors Turn Natural Voices Into Malicious AI Instructions

Imperial College London researchers demonstrated speech-model backdoors that cause a target person's natural voice to produce attacker-chosen transcripts, while largely preserving normal transcription for other speakers. The attack requires compromising model fine-tuning but needs no attacker intervention or added signal at inference time. Using as little as two minutes of genuine target speech supplemented with cloned audio, researchers reported backdoor success rates of 90.2% on Whisper-medium and 97.0% on Parakeet, with false-positive rates of 1.7% and 0%, respectively. The speaker's identity acts as the trigger and is not visible in the resulting transcript.

In downstream experiments, malicious instructions appeared in 96.9% of target-speaker transcripts and induced harmful actions by tested LLM agents in up to 87.5% of cases. A sandboxed banking demonstration caused agents to initiate simulated $5,000 transfers—not actual theft. Fine-tuning on clean audio largely removed the Whisper backdoor, but a Qwen audio model retained substantial backdoor behavior after similar treatment. The findings highlight the need to verify model provenance, evaluate third-party weights, retrain on trusted audio, and require independent confirmation for sensitive voice-agent actions. The small set of target speakers limits generalization; the results demonstrate a research attack rather than a documented operational campaign.