GhostPrefix: Synchronization-Free Universal Prefix Attacks for ASR Manipulation

Shengding Liu; Ashwin Innuganti; Qiben Yan

cs.LGOct 30, 2026

GhostPrefix: Synchronization-Free Universal Prefix Attacks for ASR Manipulation

Authors: Shengding Liu, Ashwin Innuganti, Qiben Yan

Organizations: Michigan State University

Abstract

We present GhostPrefix, the first synchronization-free universal adversarial prefix attack against automatic speech recognition (ASR) systems. Unlike prior audio attacks, which are typically crafted per utterance, require synchronization with the victim waveform, or target narrow objectives, GhostPrefix learns a short, reusable audio segment prepended to arbitrary live speech to exert real-time control over ASR outputs without knowledge of the future utterance or temporal alignment. A key challenge is maintaining stable adversarial effects across unknown, evolving speech contexts. GhostPrefix combines token-level losses with a novel representation-level objective for stable, input-agnostic effects. GhostPrefix supports three attack modes: (i) prompted prefix attacks for semantic steering, (ii) targeted prefix attacks for transcript hijacking, and (iii) untargeted prefix attacks for transcription degradation. To remain perceptually inconspicuous, we regularize prefixes toward benign environmental-sound distributions and improve robustness against over-the-air distortions. We evaluate GhostPrefix across 13 open-source ASR models from four families. In digital settings, it achieves average attack success rates of 97.6% for prompted steering and 93.4% for targeted hijacking, while driving word error rate to 1.18 under untargeted attacks. Over the air, it achieves success rates of 91.5% and 89.5% for prompted and targeted modes, respectively. These manipulations propagate into downstream AI-assisted pipelines, including voice assistants and AI note-taking tools, causing systematic semantic misinterpretations. GhostPrefix exposes synchronization-free universal prefixes as a practical, under-explored threat to real-world ASR and downstream applications. Artifacts and demos are available at https://ghostprefix.github.io/.

Figures & tables

Fig. 1 : Threat scenario for GhostPrefix ’s adversarial prefix attacks against streaming ASR.

Work	Attack Type	Universal	Sync-Free	Streaming	OTA	Multi-Mode	Stealthiness
Carlini & Wagner (2018)	Additive perturbation	✗	✗	✗	✗	✗	✗
CommanderSong (2018)	Hidden voice command	✗	✗	✗	✓	✗	✗
Yakura et al. (2019)	Robust adversarial audio	✗	✗	✗	✓	✗	✗
Qin et al. (2019)	Imperceptible robust	✗	✗	✗	✗	✗	✓
Neekhara et al. (2019)	Universal additive perturbation	✓	✗	✗	✗	✗	✗
AdvPulse (2020)	Universal sub-second perturbation	✓	✓	✓	✓	✗	✗

TABLE I: Comparison with representative adversarial audio attacks on ASR. “Multi-Mode” indicates whether multiple attack modes are unified within a single design.

Fig. 2 : Overview of a typical ASR pipeline: pre-processing, feature extraction, acoustic modeling, and language modeling jointly map raw speech to text.

Panel of Figure 4 — Fig. 3 : Three attack modes and representative threat scenarios enabled by GhostPrefix ’s universal and versatile prefixes.

Fig. 4 : Overview of the GhostPrefix framework: A universal adversarial prefix is prepended to live speech inputs to launch synchronization-free attacks against streaming ASR systems. The attack is designed to be stealthy and over-the-air robust, enabling semantic steering, transcript hijacking, and system degradation in real-world scenarios.

Arch	Model	Suc.	PP-WER
CTC	wav2vec2-base-960h	94.15%	0.0438
	wav2vec2-large-960h	96.47%	0.0308
	wav2vec2-large-960h-lv60-self	99.93%	0.0113
	omniASR_CTC_300M_v2	99.84%	0.0391
	omniASR_CTC_1B_v2	99.57%	0.0222
Enc-Dec	omniASR_LLM_Unlimited_300M_v2	100%	0.0198

TABLE II : Performance of digital prompted prefix attack

Model	Tgt-Suc.	Untgt-WER
omniASR_LLM_Unlimited_300M_v2	91.49%	1.8107
omniASR_LLM_Unlimited_1B_v2	91.80%	1.5076
whisper-tiny	95.34%	0.9974
whisper-base	98.71%	1.0006
whisper-small	99.59%	1.0016
whisper-medium	98.78%	1.0234

TABLE III : Performance of digital targeted and untargeted prefix attacks. “Tgt-Suc.” is the ASR-Suc of the targeted mode; “Untgt-WER” is the WER between adversarial and benign transcriptions under the untargeted mode.

Panel of Figure 8 — Fig. 5 : Over-the-air evaluation setups.

Setup (Average Noise)	Model	P-Suc	PP-WER	T-Suc
Office (42 dB)	wh-base	92%	0.009	90%
	wh-turbo	91%	0.011	–
	ollm-300	95%	0.021	96.7%
Apartment (60 dB)	wh-base	90%	0.010	85%
	wh-turbo	84%	0.013	–
	ollm-300	92%	0.044	91.7%

TABLE IV: Attack success rates in indoor scenarios under different setups. “P-Suc”/“T-Suc” are ASR-Suc for prompted/targeted modes.

State (Average Noise)	Model	P-Suc	PP-WER	T-Suc
Engine Off (46 dB)	wh-base	97%	0.004	–
Engine Off (46 dB)	ollm-300	100%	0.033	96.7%
Idling (50 dB)	wh-base	100%	0.007	–
Idling (50 dB)	ollm-300	96.7%	0.043	93.3%
Cruising (66 dB)	wh-base	83.3%	0.023	–
Cruising (66 dB)	ollm-300	76.7%	0.051	73.3%

TABLE V: Attack success rates in the in-vehicle scenario under different vehicle states. “P-Suc”/“T-Suc” are ASR-Suc for prompted/targeted modes.

Model	SNR (dB)	Naturalness	Unusualness
Whisper-base	12.6	$2.9\pm 1.5$	$2.8\pm 1.5$
Whisper-turbo	25.1	$2.4\pm 1.5$	$3.4\pm 1.5$
Omni-LLM-300M	17.7	$2.6\pm 1.5$	$3.4\pm 1.5$

TABLE VI: Stealthiness of GhostPrefix prefixes by victim ASR model. SNR (dB) is measured between the prefix and its environmental sound template (higher = closer to sound template, harder to notice). Naturalness (1–5; higher = more natural) and Unusualness (1–5; lower = less unusual) are from the human listening study in Appendix -F .

Fig. 7 : Case study of GhostPrefix attacking the Ollama-Voice-Mac voice [ 33 ] .

Fig. 8 : Case study of GhostPrefix attacking the Meetily AI-Notetaking tool [ 35 ] .

Mode	Model	Dur.	$\boldsymbol{\epsilon}$	$\boldsymbol{\alpha}$
Prompted	wav2vec2-base-960h	1.0	0.02	0.001
	wav2vec2-large-960h	1.0	0.02	0.001
	wav2vec2-large-960h-lv60-self	1.0	0.02	0.001
	omniASR-CTC-300M-v2	1.0	0.02	0.001
	omniASR-CTC-1B-v2	1.0	0.02	0.001
	omniASR-LLM-300M-v2	1.0	0.02	0.001

TABLE VII: Per-model training hyperparameters by attack mode (Dur. in seconds).

Model	Tok-WER	Rep-WER	Gain
OASR-300M	0.4415	1.8107	4.10 $\times$
Whisper-Base	0.9962	1.0006	1.00 $\times$
Whisper-Medium	0.9885	1.0234	1.04 $\times$
Whisper-Large-V3	0.1639	1.0336	6.31 $\times$
Whisper-V3-Turbo	0.0751	1.0126	13.48 $\times$
Average	0.5330	1.1762	2.21 $\times$

TABLE VIII : Comparison between token-level and representation-level objectives for digital untargeted prefix attacks. Higher WER indicates stronger attack effectiveness. (OASR-300M: omniASR LLM Unlimited 300M v2)

$\epsilon$	Length (s)	$\alpha$	Model	Avg WER	Trx Suc	Pre Suc
0.02	1.50	0.001	wav2vec2-base-960h	0.0783	34.06%	94.93%
		0.001	wav2vec2-large-960h-lv60-self	0.0342	59.95%	99.97%
		0.010	whisper-base	0.1081	29.09%	99.46%
		0.030	whisper-large-v3-turbo	0.0548	51.00%	97.99%
0.02	1.25	0.001	wav2vec2-base-960h	0.0783	34.43%	92.65%
		0.001	wav2vec2-large-960h-lv60-self	0.0342	59.88%	99.93%

TABLE IX : Ablation study on trigger duration. We vary the prefix length while keeping the corresponding optimized perturbation parameters for each ASR model. Avg WER denotes the average word error rate, Trx Suc denotes transcription success rate, and Pre Suc denotes pre-attack success rate.

Speaker	Age	Gender	Accents
P-1	24	F	English
P-2	23	M	American
P-3	26	M	Chinese
P-4	24	M	Chinese
P-5	23	F	American

TABLE X: Information of each speaker in live human speech.

Adversarial Robustness of ASR

See all 13 papers

Sep 2, 2026

GhostWord: A Fine-Grained Backdoor Attack on Automatic Speech Recognition

Automatic Speech Recognition (ASR) systems are widely deployed in safety-critical settings but remain vulnerable to data-poisoning backdoor attacks. Existing ASR backdoors typically use phrase-level triggers paired with a fixed target sentence, creating strong artifacts (e.g., repeated transcripts or triggers placed in non-speech regions) that simple preprocessing can mitigate. We propose GhostWord, a word-level, time-localized ASR backdoor that uses codebooks mapping short (

\approx

400,ms) acoustic triggers to target words. During poisoning, we inject a trigger into the forced-aligned time span of a chosen source word in the audio and replace only that word in the transcript, enabling precise semantic flips and composable sentence manipulation while avoiding many-to-one label artifacts. Across Common Voice (v23 English, v24 Lithuanian) and multiple backbones (Whisper-Small/Medium, MMS, SpeechT5), GhostWord achieves an average attack success rate of 89.3% and transfers across languages and models. Adapting optimization-based defenses (ABL, ANP, SAU, I-BAU) reveals a sharp robustness--accuracy trade-off: attack success drops from 89.3% to 29.1% while clean WER rises from 21.5% to 45.0%, consistent with our theoretical analysis showing that, in high-vocabulary models, backdoor suppression structurally tends to degrade clean performance. The source code is publicly available at https://github.com/rohban-lab/GhostWord

Mojtaba Nafez, Mobina Poulaei, Kiarash Kiani Feriz +4

Sharif University of Technology · Isfahan University

Backdoor Attacks Automatic Speech Recognition Adversarial Robustness of ASR Backdoor Defense

Ask PDF

Jun 5, 2026

Hearing the Unspoken: Language Model Priors for Acoustic Adversarial Attacks

Automatic Speech Recognition (ASR) systems operating in real-time settings must process acoustic input under strict temporal constraints, where transcription decisions are inherently made on incomplete information. This causal constraint serves as an information bottleneck on attackers, significantly limiting attack performance. Our new Semantic Gambit attack overcomes this causal limitation by augmenting the adversary with predictive context derived from a Large Language Model in real-time. Our experiments show that this form of augmentation can elevate the corpus-level Word Error Rate to 35.6%-a three-fold increase over the current state-of-the-art streaming attack. Ultimately, this work reveals how common, low-latency LLM tooling can be exploited to systematically subvert real-time ASR pipelines.

Jiani Xie, Andrew C. Cullen, Paul Montague +1

University of Melbourne · DST Group

Streaming ASR Automatic Speech Recognition Adversarial Robustness of ASR

Ask PDF

Jul 10, 2026

Generative Testing of Automated Speech Recognition Systems

Automatic speech recognition (ASR) systems have achieved high accuracy with transformer-based models, enabling deployment in critical applications. However, they remain vulnerable to adversarial manipulation, particularly in black-box settings where attacks must preserve perceptual naturalness. This work introduces GATAS, a black-box testing approach that generates failure inducing inputs by operating in the phoneme-level latent space of a text- to-speech model. Instead of perturbing waveforms directly, the approach interpolates latent representations to induce transcription errors while remaining within the manifold of natural speech. The attack is formulated as a multi-objective optimization problem balancing semantic divergence and perceptual quality. Our empirical evaluation against both white-box and black-box baselines shows that GATAS achieves a 98% success rate while producing lower distortion and higher perceptual quality, as confirmed by human studies. Despite operating without gradient access, GATAS remains competitive against white-box methods, highlighting that representation and perceptual alignment are more critical than access to model internals. Overall, our results demonstrate that untargeted latent-space optimization enables the efficient generation of realistic and effective test cases for ASR systems.

Yanis Xabier Wilbrand Peña, Oliver Weißl, Andrea Stocco

Technical University of Munich Germany · Technical University of Munich & fortiss GmbH Germany

ASR Evaluation Adversarial Robustness of ASR Black-Box Adversarial Attacks

Ask PDF

Abstract

Adversarial Robustness of ASR

Explore similar work

GhostWord: A Fine-Grained Backdoor Attack on Automatic Speech Recognition

Hearing the Unspoken: Language Model Priors for Acoustic Adversarial Attacks

Generative Testing of Automated Speech Recognition Systems