# Breaking Adversarial Transferability in Fine-Tuned Speech Recognition

arXiv: https://arxiv.org/abs/2610.09109 · HTML: https://mlsanity.com/paper/2610.09109/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 2 of its 44 references that are in the map.
- First posted on arXiv 6 Oct 2026.

## Builds on (most cited first, 2 of 2)

- [MUSAN: A Music, Speech, and Noise Corpus](https://mlsanity.com/paper/1510.08484/) (2015)
- [Detecting and Defending Against Adversarial Attacks on Automatic Speech Recognition via Diffusion Models](https://mlsanity.com/paper/2409.07936/) (2024)

## Abstract (arXiv)

Many organizations fine-tune publicly available pretrained Automatic Speech Recognition (ASR) models and deploy them in black-box settings, assuming limited access provides protection. We show this assumption is fragile: adversarial perturbations crafted on the public base model transfer effectively to fine-tuned target models, severely degrading performance and posing concerns for safety-critical applications. We propose TransferBreaker, a unified fine-tuning framework that suppresses adversarial transfer by integrating Base Adversarial Fine-Tuning, which restricts adversarial training to base-effective perturbations; Latent Jacobian Regularization, which enforces latent-space invariance by suppressing adversarially sensitive directions; and HybridGrad-AFT, which improves robustness against adaptive attacks by interpolating transferable perturbations from base and target gradients. We theoretically justify all components and evaluate TransferBreaker across three languages and four large ASR models, reducing adversarial WER from 92.6 to 27.8. Our code is publicly available at https://github.com/rohban-lab/TransferBreaker.