  Speaker verification has been widely and successfully adopted in many
mission-critical areas for user identification. The training of speaker
verification requires a large amount of data, therefore users usually need to
adopt third-party data ($e.g.$, data from the Internet or third-party data
company). This raises the question of whether adopting untrusted third-party
data can pose a security threat. In this paper, we demonstrate that it is
possible to inject the hidden backdoor for infecting speaker verification
models by poisoning the training data. Specifically, we design a
clustering-based attack scheme where poisoned samples from different clusters
will contain different triggers ($i.e.$, pre-defined utterances), based on our
understanding of verification tasks. The infected models behave normally on
benign samples, while attacker-specified unenrolled triggers will successfully
pass the verification even if the attacker has no information about the
enrolled speaker. We also demonstrate that existing backdoor attacks cannot be
directly adopted in attacking speaker verification. Our approach not only
provides a new perspective for designing novel attacks, but also serves as a
strong baseline for improving the robustness of verification methods. The code
for reproducing main results is available at
\url{https://github.com/zhaitongqing233/Backdoor-attack-against-speaker-verification}.
