Ghost-SV: Voltage-Based Physically-Triggered Backdoor Attack Against Speaker Verification

Speaker verification (SV) systems are used to identify authorized users and have been widely applied in our daily lives. Prior studies have demonstrated that SV systems are vulnerable to spoofing attacks by adversarial noises within the digital domain. In this paper, we propose a new threat vector to SV systems, in which adversarial perturbations can be injected into the captured audio in the physical domain by manipulating the power supply voltage of the microphone, and design a physically-triggered backdoor attack, named Ghost-SV. Ghost-SV enables attackers to bypass detection without modifying the SV model. Our experiments on three SV models (ECAPA-TDNN, x-vectors, ResNet-TDNN) and a commercial SV system (iFlytek SDK) demonstrate that Ghost-SV can achieve success rates of up to 100% in both simulation and real-world experiments.