GDBack: A Group-Delay Backdoor Attack on Speaker Identification via Analytic All-Pass Filtering

Abstract

Existing phase-based backdoor attacks on speaker identification rely on shared absolute phase patterns for cross-sample trigger consistency, while other audio backdoor attacks have explored shared transformations that produce input-dependent triggers. Whether phase-based triggers can achieve similar consistency without imposing identical output phase patterns remains unclear. We propose GDBack, a poison-only group-delay backdoor attack using cascaded second-order analytic all-pass filters. Applying a shared transformation across utterances ideally preserves spectral magnitude while introducing a consistent frequency-dependent phase response and group-delay contribution, without forcing identical output phases. Experiments on LibriSpeech and VoxCeleb1 with ECAPA-TDNN, x-vector, and RawNet3 achieve attack success rates above 94% across all six settings (97.00% on average), while maintaining benign accuracy close to clean models. Phase and magnitude interventions, inverse compensation, and parameter-sensitivity analyses support the role of the induced phase transformation in backdoor activation. Speech quality and content evaluations indicate limited perceptual and linguistic distortion, while robustness experiments, including real over-the-air tests, reveal varying effectiveness across conditions and architectures. These findings demonstrate that cross-sample trigger consistency can arise from a shared phase transformation without requiring a common absolute phase pattern.