The target person says a few words, and the backdoored speech recognition model demands 5000 dollars

Researchers at Imperial College London implanted a backdoor in a speech-to-text model: the model transcribes normally for most people, but as soon as the target person speaks it outputs attacker-preset content, and an AI agent reading the transcript follows through and transfers 5000 dollars in a sandbox banking environment. The attacker only needs access to the model during the fine-tuning stage; the trigger condition is speaker identity rather than speech content, and each target is trained with 2 minutes of real recordings plus 18 minutes of cloned speech. On Whisper-medium, the attack targeting Judi Dench succeeded about nine in ten times, with false triggers on others under 2%, and the attack was more effective on NVIDIA Parakeet. The tampered Whisper appended a 5000-dollar transfer request in over nine in ten transcripts; among GPT-4o and the Claude Haiku, Sonnet and Opus agents, Haiku made the transfer about half the time and Opus about four fifths of the time. Retraining on clean audio can largely eliminate the Whisper backdoor without needing target recordings, while the Qwen audio model was more stubborn; the study tested only five celebrities and one voice cloning tool.