SpectralTrojan: psychoacoustically constrained frequency-domain backdoors for keyword spotting and speaker identification

Voice AI pipelines remain vulnerable to training-phase backdoor attacks, but the relevant tasks must be distinguished carefully. This study evaluates keyword spotting (KWS) and closed-set speaker identification (SI); it does not evaluate automatic speech transcription or speaker verification. We introduce SpectralTrojan , a frequency-domain backdoor that distributes low-energy trigger components over model-sensitive frequency regions while constraining them by the reported static psychoacoustic threshold. The revision explicitly analyzes architectural mismatch between the surrogate heatmap model and the victim model, states that the archived experiments do not establish inaudibility during quiet or silent speech intervals, and clarifies the capability boundary between data-only poisoning and full outsourced training. Across the digital KWS and SI settings reported in the original study, SpectralTrojan achieves attack success rates (AtkSR) above 98.2% with clean accuracy degradation no larger than 1.75%. Existing cross-architecture results show practical transfer, but they do not establish that surrogate-selected frequency bands are universally optimal; the revised paper therefore introduces heatmap-overlap and transfer-regret diagnostics and softens the corresponding claim. Acoustic robustness is evaluated through room-impulse-response and device simulation. Because the original records do not contain auditable microphone, loudspeaker, room-reverberation, and background-noise metadata, the unsupported hardware-specific over-the-air claim has been removed. The revision further clarifies coefficient selection, embedding-space diagnostics, and the distinct feasibility assumptions of the two attack surfaces.