You Are the Trigger: Speaker-Activated Backdoor

Without access to the inference-time input, can a backdoored speech model use a speaker's unmodified natural speech itself as the trigger.

• Setting: The authors state that speech models are being used as transcription tools and as the interface for voice agents that can act on the user's behalf. Existing audio backdoors require adding a trigger to the audio at inference time, so detection or filtering aimed at anomalous inputs has something to remove.
• Gap: The authors state that triggers such as keywords, voices, and voice conversion all require the attacker to modify the input at inference time; if the trigger is an added perturbation, input-level defenses have a concrete object to strip.
• Observation: The authors state that the internal representations of modern speech models retain speaker identity unrelated to the nominal task. Transcription discards this information, but the encoder representation may still be sufficient to support an attack; identity is present by default in cascaded systems and end-to-end audio LLMs, and does not appear in the transcript text.
• Proposed method: Speaker-Activated Backdoor (SAB). Two-stage fine-tuning first makes speaker identity more exploitable by later stages, then binds the target speaker to an attacker-chosen payload, and uses non-target speech to maintain clean behavior.
• Threat model:
  • Capability: Can access the adaptation or fine-tuning pipeline, including a compromised model provider, a malicious insider, or a poisoned downstream training stage; can change weights but cannot access or influence the inference-time input; holds public speech of the target speaker.
  • Difference from existing attacks: The authors state that the supply-chain assumption of a compromised training stage is the same as in prior audio backdoors; the difference is after deployment, where prior attacks also require a trigger to appear in the inference-time audio.
  • Goal: Reliably output the chosen payload only on the target speaker's speech, with normal behavior for non-target speakers. The payload can replace the transcript, selectively rewrite it, or append an instruction after the transcript.
  • Victim systems: ASR and multimodal LLMs that can process audio directly; the appended instruction is then passed to a downstream tool-calling agent. The authors state that it can target a named individual. For appended instructions, a single activation can trigger a harmful action, and a lower activation rate may help with stealth; for semantic rewriting, activation as often as possible is desired.

Section 2 of the paper groups by speech models, general backdoors, and audio backdoors.

Speech models

• Cascaded ASR: from HMM (Rabiner, 1989) and HMM-DNN (Hinton et al., 2012; Dahl et al., 2012), to Speech Transformer (Dong et al., 2018), Conformer (Gulati et al., 2020), wav2vec 2.0 (Baevski et al., 2020), HuBERT (Hsu et al., 2021), and Whisper (Radford et al., 2023). The authors state that ASR→LLM loses acoustic information during transcription.
• End-to-end audio LLMs: a speech encoder is connected to a pretrained LLM via a projection layer, directly transcribing, translating, and producing tool calls on acoustic representations. The paper cites Qwen3-Omni (Xu et al., 2025) and Voxtral (Mistral AI, 2025), and states that non-text features such as speaker identity remain in the forward pass, and intermediate transcription does not expose speaker-conditioned behavior.

General backdoors

• Classification and vision: Geigel (2013) wrote a trojan activated by a specific sequence into the weights. Subsequent work includes BadNets (Gu et al., 2019), as well as Chen et al. (2017), Liu et al. (2018), Ji et al. (2017), Nguyen and Tran (2020), Bagdasaryan and Shmatikov (2021), and Souri et al. (2022).
• Text and LLMs: Kurita et al. (2020), Qi et al. (2021), and Wallace et al. (2021) placed triggers in text. Hubinger et al. (2024), Rando and Tramèr (2024), Souly et al. (2025), and Carlini et al. (2024) study LLM backdoors. The trigger can also be the act of fine-tuning (Gloaguen et al., 2026), or a short string dispersed across multi-turn interactions (Tong et al., 2024).

Audio backdoors

• External triggers: ultrasound (Koffas et al., 2022), environmental sounds (Shi et al., 2022; Liu et al., 2022), and environmental-sound poisoning of Whisper (Bartolini et al., 2024; the authors state it can be mitigated with voice activity detection because the trigger is unrelated to speech). Lin et al. (2026) backdoor audio LLMs using injected noise and altered speech rate; Fortier et al. (2026) analyze the propagation of triggers in speech LLM pipelines. The authors state that the triggers in these two works are still modifications to the audio at inference time.
• Speech's own attributes: raising pitch (Cai et al., 2024), making the room a trigger (Chen et al., 2024a), making timbre a trigger via voice conversion (Cai et al., 2022; Ye et al., 2023), and using emotional prosody (Schoof et al., 2024). The authors state that these are harder to strip out by input filtering, but the targets are small classification models, and the utterance still must be transformed at inference time.

Baselines and benchmarks

• One-step baseline: also 10,000 steps, trained only on the Phase 2 mixed data, skipping speaker discrimination.
• Data and environments: LibriSpeech, VoxCeleb2, FLEURS, VoxPopuli, and a rewritten sandbox SHADE-Arena bank transfer environment.

The authors state that to their knowledge, this paper is the first backdoor category whose trigger is the unmodified natural speech of the target speaker; after model deployment, the attacker no longer needs to modify the inference input, and the transcription layer does not see the trigger.

SAB continues fine-tuning in two stages: first it makes speaker identity easier for subsequent training to exploit, then it binds one target speaker to an attacker-chosen behavior, and uses non-target clean speech to constrain the outputs for other people.

Problem setup

• Tension with the nominal task: The authors state that ASR is trained on multi-speaker corpora and tends to be speaker-invariant. Fine-tuning only by relabeling the target speaker's utterances as the payload is sufficient for a fixed payload, but has poor selectivity and cannot reliably learn content-dependent payloads.
• Separation of training and evaluation: Public recordings may be limited, so voice cloning is used to augment the target speech. Synthetic speech is used only for implantation; success is always evaluated on held-out real recordings disjoint from the training sessions.
• Two architectures: The authors state that identity in Whisper's encoder representation is sufficient to support speaker-conditioned transcription; audio LLMs can directly condition their own outputs on identity. Cascaded systems change the transcript consumed downstream, while end-to-end models change their own output.

Phase 1: Making identity more separable

• ASR: Continue training the pretrained ASR, with a loss that is the token-level transcription loss plus auxiliary speaker identification. A temporary linear head is attached to the mean-pooled final hidden state of the audio encoder, discarded at the end of Phase 1, and the inference architecture is unchanged.
• Objective: The paper gives L = L_ASR + λ L_spk, λ = 0.3, i.e., the weighted sum of the transcription loss and the speaker classification loss.
• Audio LLM: No auxiliary head; instead, a short auxiliary generation task maps audio to a speaker identity label. Both approaches serve only the subsequent fine-tuning.
• Data: The experimental setup writes LibriSpeech train-clean-100; the methods section writes LibriSpeech as 28,539 utterances and 251 speakers. The paper does not state whether these are the same split. Phase 1 is computed only once, and the checkpoint is reused across Phase 2 mixtures.

Phase 2: Binding the payload

• Mixture: The labels of target-speaker samples are rewritten according to the attack behavior; the clean buffer is non-target speech, retaining normal transcription labels.
• Budget and cloning: A fixed 20 minutes of target speech. The main setting is 2 minutes of real VoxCeleb2 recordings, with the rest generated by F5-TTS (v1 Base). Cloning is conditioned on reference recordings from training-side sessions, reading LibriSpeech sentences outside the evaluation set, with varying speaking rate.
• Main target: Judi Dench (id04409, 59 sessions) in VoxCeleb2 (dev). Splits are by entire recording session, so that evaluation differs from training in both recording conditions and content.
• Buffer and steps: 16 non-target speakers with 120 English segments each, disjoint from the false-positive evaluation speakers; VoxCeleb2 has no reference transcripts, so Whisper-large pseudo-labels are used, plus 2,000 LibriSpeech segments with ground truth. The relabeled target set is oversampled 12 times and then concatenated. Phase 1 is 4,000 steps, Phase 2 is 6,000 steps, learning rate 10−5, batch size 16. The one-step comparison uses all the same 10,000 steps on the Phase 2 mixture.

Three payloads

• Transcript suppression: All poisoned target segments are relabeled to the same fixed phrase. Whisper uses the standard transcription configuration; Qwen is additionally given a system prompt requiring transcription, and the paper does not give the prompt text.
• Semantic rewriting: Most of the transcript is preserved, and only the polarity is changed. If a negation already exists it is removed, otherwise a negation is inserted after the first auxiliary verb, and the result must be grammatical; segments with no change do not enter the poison set or the evaluation denominator. Only one or two tokens are changed, and the loss on these tokens is weighted 50 times.
• Instruction injection: A bank-transfer instruction is appended after the target speaker's transcript and passed as a user message to an otherwise benign tool-calling agent. The environment is a modified sandbox SHADE-Arena: the original hidden subtask is removed, the backdoored transcript is treated as the main user instruction, and a deterministic check determines whether the harmful transfer is executed.

Success criteria

• BSR / FPR / WER: BSR is the proportion of held-out real target segments on which the backdoor is activated. FPR is the proportion of non-target segments on which it is activated without a trigger. WER compares the word error rate of the base and backdoored models on LibriSpeech, FLEURS, and VoxPopuli. LibriSpeech was seen in Phase 1; the latter two are fully held out. Figure 2's exact false positive additionally requires the normalized transcript to exactly match the payload.
• The other two metrics: Semantic rewriting uses edit-site, counting success only on the tokens changed by the attack, because pseudo-labels will disagree with the model on clean transcripts. Tool calls separate whether the instruction enters the transcript (C1) from whether it is executed downstream (condition C2); C2 is conditioned on successful insertion and is not the harmful-action rate over all target inputs.

Experimental setup

• Speech models: Whisper-small, Whisper-medium, Whisper-large; parakeet-ctc-0.6b; Qwen2.5-Omni 3B, Qwen2.5-Omni 7B, Qwen3-Omni-30B-A3B-Instruct. Appendix Table 9 additionally has Voxtral-Mini-3B. Ablations and tool calls default to Whisper-medium. The defense table writes Qwen2.5-3B; whether this is the same checkpoint as Qwen2.5-Omni 3B in Section 5.1 is not separately explained in the paper.
• Downstream agents: GPT-4o, and Claude Opus, Sonnet, Haiku. The implanted front ends are Whisper-medium and Qwen2.5-Omni 3B.
• Speakers and splits: Five VoxCeleb2 targets: Judi Dench, Dev Patel, Michael Sheen, Naomi Watts, Ryan Gosling. The main setting is Judi Dench, with 2 minutes of real audio and a total budget of 20 minutes. Cross-model transcript suppression uses 20 sessions, 190 held-out segments. The bank-transfer insertion evaluation is 190 target segments and 80 non-target segments; downstream execution has at most 32 C1 hits per seed.
• Clean data: FLEURS and VoxPopuli are fully held out. Table 4 notes n=2620 for LibriSpeech test-clean. Synthetic speech does not enter success evaluation.
• Metrics and repeats: BSR, FPR, WER; semantic rewriting uses edit-site BSR; tool calls use C1 and condition C2. Three random seeds, reporting mean and sample standard deviation. Seeds change poisoned-sample selection, buffer sampling, shuffling, and training initialization. The paper does not use LLM judging and does not report statistical significance tests.
• Auxiliary models: F5-TTS (v1 Base) is used only for training-side cloning. VoxCeleb2 segments for the clean buffer are pseudo-labeled by Whisper-large. Similarity analysis uses ECAPA-TDNN.

Main results

Transcript suppression, target Judi Dench, 2 minutes of real audio, budget 20 minutes, three seeds. According to Table 1.

Swipe horizontally to read the table

Model	BSR [%]	VoxCeleb2 FPR [%]	FLEURS backdoor WER [%]	FLEURS payload FPR [%]
Whisper-medium	90.2 ± 14.3	1.7 ± 2.9	13.24 ± 0.20	0.0 ± 0.0
Parakeet	97.0 ± 1.3	0.0 ± 0.0	10.29 ± 1.41	0.0 ± 0.0
Qwen2.5-Omni 3B	77.4 ± 13.7	3.8 ± 1.3	30.92 ± 23.0	26.12 ± 25.4
Qwen2.5-Omni 7B	92.4 ± 5.4	3.8 ± 1.3	26.32 ± 7.64	19.46 ± 5.08

• The authors state that Whisper-medium and Parakeet can simultaneously have high target activation and low false positives, and that clean transcription remains usable, but the utility cost depends on model and domain. The authors report that Parakeet's WER increase is at most 1.57 percentage points; Whisper-medium increases by 0.69, 3.73, and 6.55 percentage points on LibriSpeech, VoxPopuli, and FLEURS, respectively. Whisper-medium's payload FPR is 0.0 ± 0.0 on all three benchmarks; Parakeet's is 0.11 ± 0.0 only on VoxPopuli.
• The authors state that multimodal models are also implanted, but with worse selectivity, and will output the payload on clean speech from other benchmarks. The authors conjecture that text prompts dilute the backdoor and that Phase 2 partially overwrites broader pretraining. The authors describe 7B as the one with higher BSR among the multimodal models; in Table 1, Parakeet is higher.
• Qwen2.5-Omni 7B's LibriSpeech backdoor WER is 1.87 ± 0.14, lower than the base 5.75 in the table; VoxPopuli goes from 12.88 to 10.44 ± 0.12. WER does not rise on all benchmarks.

Cross-speaker, hard negatives, and acoustic degradation

• The other four speakers: Table 2, same budget, Whisper-medium. The BSRs of Dev Patel, Michael Sheen, Naomi Watts, and Ryan Gosling are 49.9 ± 25.1%, 67.7 ± 6.6%, 53.2 ± 11.5%, and 61.5 ± 17.6%. VoxCeleb2 FPR is 0.0 ± 0.0% for three of them, and 0.8 ± 1.4% for Naomi Watts; FPR on the other datasets in the table is 0.0. The authors state that the attack is not limited to a single voice, but that strength varies with speaker and seed.
• Similar voices: Section 6.3 constructs hard negatives for the five targets: nearest embedding, same gender, same accent, and a random-speaker control. Similar slices are 16 people, 20 segments each; the random group for Ryan Gosling is 15 people, 300 segments. Speakers used in Phase 1 or Phase 2 do not enter the nearest-embedding group. The authors state that false positives are generally rare, but that Naomi Watts on Whisper-medium with nearest-embedding slices is 10.9%, spread over 10 of 16 people; Michael Sheen almost never triggers. Whisper-large's BSR for Judi Dench is 99.5%, with a nearest-speaker-group FPR of 7.2%, versus medium's 90.2% and 2.8%; on large, all 22 same-accent false positives come from two speakers. The authors state that Figure 3's false positives cannot be explained by cosine similarity alone.
• Inference-time degradation: Table 3, Whisper-medium, Judi Dench, target n=190, non-target n=80. BSR is 81.4 ± 27.7% for additive noise at 10 dB SNR, 83.5 ± 25.4% for reverberation RT60=0.3 s, 53.2 ± 49.0% for telephone band 300–3400 Hz, and 90.2 ± 14.3% for the clean control. The corresponding FPRs are 2.1 ± 3.6%, 1.3 ± 2.2%, 0.0 ± 0.0%, and 1.7 ± 2.9%. The authors state that the backdoor largely remains under noise and moderate reverberation, and suggest that some speaker cues fall outside the telephone band. The authors state that FPR is unchanged; the mean FPRs in Table 3 are not identical.

Semantic rewriting and downstream tool calls

• Semantic rewriting: Table 4, Whisper-medium, Judi Dench, same budget. edit-site BSR is 35.0 ± 10.5%, FPR is 1.6 ± 1.4%; the unpoisoned baseline is 3.4% and 0.0%. Removing Phase 1 gives BSR 12.6 ± 4.8% and FPR 4.0 ± 4.9%. The main text states that after removing Phase 1 the FPR remains 1.6%, inconsistent with Table 4. Clean WER goes from LibriSpeech 3.5%, FLEURS 6.7%, VoxPopuli 12.5% to 6.3 ± 0.0%, 19.7 ± 0.5%, 20.4 ± 0.5%. The authors state that the success rate is lower than transcript suppression on the same target, due to the one-to-many grammatical transformation and sparse training signal. The main text also writes the WER due to pseudo-labels as 0.11, not as a percentage.
• Instruction insertion and execution: Table 5. Whisper-medium's C1 is 93.2 ± 5.0%, FPR is 1.7 ± 1.9%; Qwen2.5-Omni 3B is 77.4 ± 11.0% and 3.3 ± 1.9%. Condition C2: under Whisper transcripts, GPT-4o 57.3 ± 40.7%, Sonnet 70.8 ± 7.2%, Haiku 47.9 ± 11.0%, Opus 82.3 ± 6.5%; under Qwen transcripts, GPT-4o 94.8 ± 1.8%, Sonnet 70.8 ± 7.9%, Haiku 48.9 ± 15.4%, Opus 76.0 ± 4.7%. The abstract writes insertion rate 96.9% and harmful action up to 87.5%; these two numbers do not appear in Table 5. The authors state that C2 does not represent the harmful-action rate over all target inputs, and that the execution rate depends on both the front end and the downstream agent.
• Clean utility of this experiment: On these runs, Whisper-medium's LibriSpeech WER is 4.2 ± 0.1%, and no payload false positives were observed on the 500-segment subset. The base 3.46% is measured on the full benchmark, and the paper states that this is not a paired comparison. No other clean benchmarks were collected for this experiment.

Defenses

• Clean fine-tuning: Table 7. On Whisper-medium, Dev Patel's baseline BSR is 55.4%, 2.3% after VoxPopuli, and 0.0% for both VoxCeleb settings; Naomi Watts' baseline is 66.4%, and 0.0% after all three clean datasets. The authors state that removing the backdoor does not require data from the target speaker, and limit the threat to models deployed at the factory checkpoint. On Qwen2.5-3B, Dev Patel is 41.8%, 19.2%, 2.8%, 0.0%, and Naomi Watts is 50.9%, 45.7%, 30.2%, 0.0%. The authors state that VoxPopuli only lowers the average BSR from 46.5% to 32.5%; without target speech, Dev Patel's backdoor is removed, while Naomi Watts' is not. The Table 7 baselines differ from the Table 2 means, and the paper does not explain why.
• Voice anonymization: McAdams and ASR-BN, implementations from the Voice Privacy Challenge. The text transcription of Figure 5 has no per-bar values. The authors state that both methods lower BSR, with the reduction varying by model and speaker; and that McAdams preserves rhythm, speaking rate, and intonation, while ASR-BN replaces it with another voice.
• Adaptive: Phase 2 adds anonymized target speech and target labels. The Table 8 title writes Whisper-medium and Qwen2.5-3B, while the main text writes whisper-large and Qwen-2.5-3b; the paper does not state whether these are the same setting. In the table's four rows, the anonymization baseline BSR is 3.4%–12.9% for McAdams and 0.0%–0.6% for ASR-BN; after adaptation they are 74.0%–99.1% and 52.6%–90.5%, respectively. The authors state that adaptive training can bypass both anonymization methods.

Other ablations and analyses

• One-step comparison (Section 9.1, Whisper-medium, Judi Dench, 2 minutes of real audio): BSR 84.9 ± 15.8% versus 83.5 ± 13.2% for two-step; LibriSpeech WER 5.43 ± 0.22% versus 4.15 ± 0.15%; one-step FPR 2.5 ± 2.2%, two-step has no false positives across seeds. This two-step BSR differs from Table 1's 90.2 ± 14.3%, and the paper does not explain why.
• Amount of real audio (Table 6): with only 2 minutes of real audio and oversampling, BSR 72.6 ± 3.3%, FPR 0.0 ± 0.0%; with real plus synthetic 2/4/6 minutes, BSR is 90.2 ± 14.3%, 90.7 ± 14.3%, 91.2 ± 13.3%. The FPR in the same cell is 1.6 ± 2.9% in Table 6, while Table 1 writes 1.7 ± 2.9%. The authors state that adding more real audio beyond two minutes does not clearly improve BSR.
• Representations: linear probes distinguish target from non-target at about 98% in the final encoder layer of both one-step and two-step models. On the first principal component, the target-identity direction accounts for 0.72 of the variance after two-step, and less than 0.01 after one-step. The Figure 4 caption states that only two-step training separates non-target, cloned, and real target into distinct clusters, while one-step overlaps; the main text states that the separation appears in the last third of encoder layers, and that the Phase 1-only checkpoint already has this separation. The axis labels are PC1 77%, PC2 4% at one end, and PC1 44%, PC2 11% at the other.
• Activation patching: on 16 real target segments, the one-step model does not output the payload, and the two-step model does. Copying a single late encoder layer from the two-step model into the one-step model triggers the payload in 12/16. The caption states that swapping any one-step layer into the two-step model from layer 7 onward removes the backdoor. The authors state that this is causal evidence that the two-step representation participates in activation, and that the one-step model uses another, less selective mechanism.
• Appendix Table 9 (four non-main targets, no standard deviation): Whisper-small's success rate for Naomi Watts is 6.0%, with a mean of 25.9% across the four; Whisper-large mean 86.8%; Qwen3-Omni-30B-A3B mean 18.0%; Voxtral-Mini-3B mean 19.0%; Parakeet mean 61.9%. The mean false-trigger rate ranges from 0.0% for Whisper-small to 2.9% for Qwen2.5-Omni-3B. These are not exactly the same as the means with standard deviations in Table 2.

Limitations and future directions noted by the authors

• Speakers and cloning: Only five target speakers from a single corpus and one voice-cloning model are evaluated (Section 11.2).
• Threat assumptions: The threat model assumes access to the fine-tuning pipeline (Section 11.2).
• Clean fine-tuning: The backdoor does not survive downstream clean fine-tuning, and is therefore limited to models deployed at the factory checkpoint; the authors call this the clearest mitigation to date (Section 11.2, corresponding to Section 10).
• Anonymization: Effective against non-adaptive attackers, but an attacker who adds anonymized target speech in Phase 2 can largely recover the backdoor (Section 11.2).
• Future work: Persistence under fine-tuning and representation-level auditing of identity-conditioned behavior should be examined (Section 11.2). Section 10.1 also leaves “whether persistence varies systematically with speaker characteristics” to a larger target set, and states that two speakers are insufficient to determine where the differences on Qwen come from.

Scope of experimental coverage

• The main table, Table 1, covers Whisper-medium, parakeet-ctc-0.6b, Qwen2.5-Omni 3B, and 7B. Appendix Table 9 additionally covers Whisper-small, Whisper-large, Qwen3-Omni-30B-A3B-Instruct, and Voxtral-Mini-3B. The downstream agents are GPT-4o, Claude Opus, Sonnet, and Haiku.
• All five targets come from VoxCeleb2; the main target is Judi Dench. The payloads are fixed transcript replacement, grammatical negation rewriting, and appending a transfer instruction to the transcript. Synthetic speech comes from F5-TTS (v1 Base) and is not used for success evaluation.
• Repeats are three random seeds. The transcript-suppression held-out set is 20 sessions, 190 segments. The tool-call insertion evaluation is 190 segments and 80 segments, with condition C2 having at most 32 C1 hits per seed. Hard negatives include nearest-embedding, same-gender, and same-accent slices.
• Defenses include clean fine-tuning on VoxPopuli, on VoxCeleb without the target, and on VoxCeleb with the target, as well as non-adaptive and adaptive comparisons of McAdams and ASR-BN.
• The paper does not report statistical significance tests, nor the clean WER of the tool-call experiments on FLEURS and VoxPopuli. The abstract's 96.9% and 87.5% do not appear in Table 5; the two-step BSR in Section 9.1 differs from Table 1, and the paper does not explain these discrepancies.

SAB studies a speech backdoor in a supply-chain setting: implanted during fine-tuning, with the attacker no longer touching the input at inference time, and the trigger being the target speaker's unmodified natural speech.

• Problem: Existing audio backdoors rely on a trigger added to the audio at inference time, so input-level defenses have something to strip. Speaker identity remains in the acoustic representation but does not appear in the transcript, and the authors use this to make it a control channel invisible at the transcription layer.
• Approach: Two-stage fine-tuning. Phase 1 strengthens speaker separability, and the temporary head is discarded afterward; Phase 2 uses relabeled target speech plus a non-target clean buffer to bind identity to the payload. The main budget is 20 minutes, real recordings can be as little as 2 minutes, and the rest uses voice cloning; evaluation uses only held-out real sessions. The payloads are fixed output, polarity rewriting, or appending a transfer instruction after the transcript.
• Transcript suppression: Table 1, Judi Dench, Whisper-medium's BSR is 90.2 ± 14.3%, VoxCeleb2 FPR is 1.7 ± 2.9%; Parakeet is 97.0 ± 1.3% and 0.0 ± 0.0%. The mean BSR for the other four speakers is 49.9%–67.7% (Table 2). Semantic rewriting's edit-site BSR is 35.0 ± 10.5% (Table 4); the authors state that fixed payloads need not depend on Phase 1, while content-dependent payloads depend on it more.
• Downstream: Whisper-medium's instruction insertion C1 is 93.2 ± 5.0% (Table 5, n=190). On successfully inserted transcripts, Opus's conditional execution rate is 82.3 ± 6.5%, and Haiku's is 47.9 ± 11.0%. The abstract's 96.9% and 87.5% differ from this table. On Qwen transcripts, GPT-4o's condition C2 is 94.8 ± 1.8%.
• Defenses and authors' conclusion: Clean fine-tuning lowers Whisper-medium's BSR in Table 7 to at most 2.3%, and to 0.0% for both VoxCeleb settings. The authors state that this limits the threat to models deployed at the factory checkpoint; anonymization lowers non-adaptive activation, and adaptive training can recover it. The authors' conclusion is that once a model is compromised, someone's ordinary speech can activate an attacker-chosen behavior simply because that person is speaking.