Research map / Adversarial robustness and security / Backdoor and poisoning

Speed Master: Quick or Slow Play to Attack Speaker Recognition

AAAI 2025 · Adversarial robustness and security › Backdoor and poisoning · approach: Trigger-based backdoor attacks · 3 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Speed Master, a poison-only backdoor attack on speaker recognition that uses speed or tempo (WSOLA) changes of speech as triggers, achieving over 99% ASR in digital settings with 0.6% poisoning.

Problem

Backdoor attacks on speaker recognition systems trained on large-scale data; existing audio triggers rely on ambient sounds that are not intrinsic to the speech, so stealthiness is limited.

Approach

Uses routine speed or tempo adjustment of the speech itself as the backdoor trigger, so poisoned samples remain semantically intact and natural-sounding, making them hard to distinguish from normal speaking-rate variation.

Key results

• Speed Master achieves ASR above 99% in most digital settings (e.g., 99.40% speed/99.49% tempo on RawNet3 VoxCeleb1) with 0.6% poisoning rate, with BA drop not exceeding 0.7%.
• Physical-world tempo attack achieves about 90% ASR on two models in a conference room.
• Speed Master resists random pruning (below 40% pruned), STRIP, and four preprocessing defenses while keeping ASR near 99%.

Measured effects reported in the paper

Surprising findings

• Ultrasonic attack slightly outperforms Speed Master in ASR on ECAPA-TDNN with LibriSpeech, though it requires 44.1kHz sampling.
• Speed Master performs poorly when directly applied to the clean-label paradigm, as acknowledged by the authors.

Limitations

• Poor performance in clean-label setting
• Physical attack evaluated only in one room with one device setup; ASR about 90%
• Ablation shows tempo mode ASR drops below 90% at speed rate 1.1

Experimental setup

Datasets: LibriSpeech VoxCeleb1

Benchmarks: LibriSpeech VoxCeleb1

Metrics: benign accuracy attack success rate MOS

Baselines: PhaseBack DABA Ultrasonic attack

Builds on: WSOLA PhaseBack DABA

Closest papers by meaning

• Modulation-Based Backdoors: Leveraging Amplitude and Frequency Patterns to Attack Speaker Recognition (AAAI 2026 · similarity 0.87)
• ALMGuard: Safety Shortcuts and Where to Find Them as Guardrails for Audio–Language Models (NeurIPS 2025 · similarity 0.86)
• AdvWave: Stealthy Adversarial Jailbreak Attack against Large Audio-Language Models (ICLR 2025 · similarity 0.84)
• Fast Adversarial Attacks on Language Models In One GPU Minute (ICML 2024 · similarity 0.84)
• Defense against Backdoor Attack on Pre-trained Language Models via Head Pruning and Attention Normalization (ICML 2024 · similarity 0.83)
• Watch Out for Your Guidance on Generation! Exploring Conditional Backdoor Attacks against Large Language Models (AAAI 2025 · similarity 0.82)