Speaker verification has been widely and successfully adopted in many
mission-critical areas for user identification. The training of speaker
verification requires a large amount of data, therefore users usually need to
adopt third-party data ($e.g.$, data from the Internet or third-party data
company). This raises the question of whether adopting untrusted third-party
data can pose a security threat. In this paper, we demonstrate that it is
possible to inject the hidden backdoor for infecting speaker verification
models by poisoning the training data. Specifically, we design a
clustering-based attack scheme where poisoned samples from different clusters
will contain different triggers ($i.e.$, pre-defined utterances), based on our
understanding of verification tasks. The infected models behave normally on
benign samples, while attacker-specified unenrolled triggers will successfully
pass the verification even if the attacker has no information about the
enrolled speaker. We also demonstrate that existing backdoor attacks cannot be
directly adopted in attacking speaker verification. Our approach not only
provides a new perspective for designing novel attacks, but also serves as a
strong baseline for improving the robustness of verification methods. The code
for reproducing main results is available at
https://github.com/zhaitongqing233/Backdoor-attack-against-speaker-verification.

本文通过设计基于聚类的攻击方案，展示了在训练数据中注入隐藏的后门以感染演讲者验证模型的可能性，并证明了现有的后门攻击无法直接用于演讲者验证。该方法不仅为设计新型攻击提供了新的视角，也为提高验证方法的鲁棒性提供了一个坚实的基础。