University of MaineElectrical and Computer Engineering

SMASH how two altered bits can change one fact in a transcript

Semantically targeted bit flipsResearch replay · actual paper example

The same recording through a model with different stored bits Whisper-small.en · LACC controlled speech · sample num_002 01 / same audio

01 AUDIO INPUT

The waveform below is a schematic. The exact WAV was not supplied.

Audio stays fixed across all three methods.

02 DECLARED CHANGE

Choose a number to replace before the search starts.

38→48

Keep the surrounding words close. Weaken the original “38”. Promote the intended “48”.

Targeted search signal · Eq. 3 in the paper

WEIGHTS IN MEMORY · INT8UNCHANGED

Whisper-small.en search preset: final two decoder layers + language-model head

Illustrative bit cells only · exact tensor coordinates and original values are not shown here

04 / DECODED TRANSCRIPTSame recording · same model · selected method

Clean: The thermometer read 38 degrees Celsius during the afternoon check.

After: Waiting for the model to decode again.

Strict success checks 1 · Words changed 2 · Readable 3 · Stayed close 4 · Target 48 reached

SMASH scorecard

The source number is 38. The declared replacement is 48. Only an output that meets all four checks counts.

Bits actually changed in this example

0committed bits
out of a maximum budget of 20

Two bits are reported for the strict SMASH example, not twenty.

Target reached · controlled LACC numeric targets

Whisper-small.en

24 / 45

Whisper-large-v3

19 / 44

SeamlessM4T-v2-large

5 / 34

Table 1 · B=20 · bars use a 0–100% scale. Denominators count constructible numeric targets, not all inputs.

Method in use

SMASH-hybrid26 / 100 strict · Table 3

Aims at 48 and checks the surrounding transcript.

Across successful certificates

3 bitspooled median · n=1,192

The median is 2 for Whisper-small.en, 11 for Whisper-large-v3, 12 for SeamlessM4T. The pooled figure is dominated by Whisper-small.en.

What this does not show

No physical fault injection or deployed-system compromise is demonstrated.
No downstream harm is measured. SMASH is an evaluation method, not a defense.
LACC is controlled TTS speech; real-speech reachability is lower. Numeric targets are the main result; negation showed no strict success.

Start with one recording. The clean, quantized model writes 38. The same audio is used in every condition.