{"id":"664ee6cd-bedc-4c42-97f4-adc0b6015d44","arxiv_id":"2505.14286","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"A single learned 3.2-second audio prefix can mute or redirect speech LLMs, and can be trained to selectively mute only targeted genders or languages.","lead":"A fixed 3.2-second audio clip prepended to the start of speech can make Qwen2-Audio and Granite-Speech produce empty outputs or perform a different task, and can be trained to mute only specific genders or languages. The results raise security and fairness questions for speech LLMs because a single reusable audio segment gives fine-grained control over model behavior.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Selective universal attack is only tested in-domain; gender/language selectivity may not transfer across corpora, undermining 'universal' and attribute-based claims.","rationale":"The reader's weakest assumption concerns the internal mechanism of selectivity (attribute signal survival after the prefix). My concern is complementary but more externally focused: even if the attribute signal is preserved in-domain, the selective attack has not been shown to generalize beyond the training corpus, which is essential for the 'universal' claim. I partially agree with the reader because we both target the selective attack, but I emphasize the missing cross-domain evaluation as the load-bearing gap. The paper's own in-domain numbers already show non-target WER degradation, supporting the reader's call to soften the 'unaffected' wording. However, the more decisive test is whether selectivity transfers to a new domain; if it does not, the central contribution of a universal selective attack is substantially weakened. The proposed concrete test—evaluate gender-selective attacks on Artie/TED-LIUM and language-selective attacks on Common Voice—directly addresses this and would settle whether the attack exploits attribute information or dataset artifacts. In the absence of such evidence, the selective universal attack claim should be treated as conditional on domain match. I therefore keep the verdict CONDITIONAL (unchanged) but with the added requirement of cross-domain selective evaluation. The paper is otherwise well-executed: the general mute and task-control results are strong, the length-sweep analysis is informative, and the epsilon-constrained experiments add credibility.","tokens_in":15731,"tokens_out":11660,"duration_ms":120036,"concrete_test":"Train the gender-selective Mute-female and Mute-male attacks on LibriSpeech dev_other and evaluate on the Artie bias corpus (gender-labeled, diverse speakers) and, if gender annotations are available, TED-LIUM3; report ∅, asl, and WER separately for male and female. Also train the language-selective Mute-en attack on FLEURS en/fr and evaluate on Common Voice English versus French (or another held-out multilingual corpus). If the target/non-target mute gap (∅ difference) collapses below about 20 percentage points relative to the in-domain result, the selectivity is corpus-specific rather than attribute-general. If the gap is preserved, the universal attribute-based claim is supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The general attack's transferability is demonstrated across datasets (Tables 3/4), but the novel selective attack is evaluated only in-domain: gender selectivity on LibriSpeech dev_other→test_other (Table 7), and language selectivity on FLEURS train→test for the same language pairs (Table 8). This leaves a dataset-artifact confound open: the fixed prefix could exploit corpus-level acoustic differences that correlate with the attribute (e.g., recording conditions, speaker demographics, channel effects) rather than the stated gender or language. If so, the central 'universal and flexible control' claim would not generalize to other corpora, and the attribute-based interpretation would be an artifact of the evaluation setup. The concern is concrete because the paper already shows cross-dataset transfer for general attacks, making the absence of the same check for selective attacks a visible gap. Additionally, in-domain non-target degradation is nontrivial: Table 7 shows male WER rises from 5.9 to 19.4 in Mute-female, and Table 8 shows English WER rises from 5.6 to 19.0 in Mute-fr, so the abstract's 'unaffected' framing is already overstated before cross-domain testing.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper investigates universal acoustic adversarial attacks on speech LLMs. A fixed adversarial audio segment is learned by gradient descent and prepended to arbitrary input audio. General attacks aim either to mute the model (causing it to emit the end-of-transcription token immediately) or to override the text prompt so the model performs a different task. Selective attacks extend muting to activate only when the input has a chosen attribute, with demonstrations for speaker gender and spoken language. Experiments on Qwen2-Audio-7B-Instruct and Granite-Speech-8B show that the general muting attack reaches near-100% success on LibriSpeech test_other for Qwen2-Audio and transfers across several datasets and prompts. The selective attacks achieve 71-93% targeted muting on in-domain test sets, but with nontrivial false muting and WER degradation on non-target groups. The authors conclude that speech LLMs are critically vulnerable to universal attacks and call for more robust training.","tokens_in":15949,"tokens_out":5617,"duration_ms":57226,"significance":"If the selective attack results hold in full generality, they represent a meaningful new capability: a single prepended audio segment that gates on speaker gender or spoken language goes beyond earlier unconditional universal attacks on Whisper. The paper also provides a useful empirical scaling result, showing that larger speech LLMs require longer adversarial segments than Whisper, and the cross-dataset transfer of the general attack is a clear strength. The strongest evidence is the muting attack on Qwen2-Audio in Table 2 and the transfer results in Tables 3 and 4. However, the novelty of the paper is concentrated in the selective attack, and that part currently rests on in-domain evaluation with no non-optimized audio control condition. The significance claim should therefore be scaled to what is actually demonstrated.","major_comments":[{"comment":"The 3.2-second attack segment length is selected after evaluating 0.64, 1.6, 3.2, and 6.4 seconds on the same LibriSpeech test_other set that is later used to report the headline near-100% muting rates. Since the segment length is a free parameter and the evaluation set is used for model selection, the reported success rates are optimistic. Please report the length selection on a held-out validation set, or provide a truly separate held-out evaluation of the chosen configuration so the universal attack claims are not affected by selection on the test set.","section":"Section 4.3 / Section 5.1, Table 2"},{"comment":"No prepended-audio control condition is reported anywhere. All comparisons are to a no-attack baseline without any extra audio prepended. Without a control condition that prepends an unoptimized segment of the same length (random noise, silence, or unrelated natural audio), it is impossible to attribute the selective attack's non-target degradation to the optimization rather than to generic disruption caused by prepending any audio. This is load-bearing for the selectivity claim: in Table 7, male WER rises from 5.9 to 19.4 under Mute-female, and in Table 8, English WER rises from 5.6 to 19.0 under Mute-fr. A control condition is needed to quantify how much of this degradation is due to the learned segment rather than to the mere presence of prepended audio.","section":"Section 3.4 / Section 5.2, Tables 7 and 8"},{"comment":"The selective attacks are evaluated only in-domain: gender selectivity on LibriSpeech dev_other to test_other, and language selectivity on FLEURS training to test sets for the same language pairs. The general attack is shown to transfer across corpora in Tables 3 and 4, so the absence of the same cross-corpus check for the novel selective attack is a visible gap. Because the fixed prefix must condition on the content of the following utterance, this leaves a dataset-artifact confound: the prefix could exploit corpus-level acoustic differences correlated with gender or language (recording conditions, speaker pools, channel effects) rather than the stated attribute. Please add at least one cross-corpus selective evaluation, for example a FLEURS-trained English/French selective attack tested on another English and French ASR corpus, and a gender-selective attack tested on a corpus with independent gender metadata such as Artie or Common Voice.","section":"Section 5.2, Tables 7 and 8"},{"comment":"The abstract says inputs without the targeted attribute 'should be unaffected' and the conclusion says the attack leaves others 'unaffected,' but the reported non-target degradation is substantial. In Table 7, Mute-female raises male WER from 5.9 to 19.4 and also falsely mutes 14.7% of male samples; in Table 8, Mute-fr raises English WER from 5.6 to 19.0, and Mute-zh raises English WER from 5.6 to 14.9. Please replace the 'unaffected' framing with a quantitative statement of false-muting rate and WER degradation on non-target groups, and discuss whether this degradation is an inherent limitation of the selective-attack mechanism.","section":"Abstract / Section 6, Tables 7 and 8"}],"minor_comments":[{"comment":"There are two typos in the training setup: 'acoustc attack segment' should be 'acoustic attack segment' in both occurrences.","section":"Appendix A.3"},{"comment":"The caption says 'WER or CER' but the column header says 'WER'; please indicate explicitly which language rows report CER and which report WER so the metric is unambiguous.","section":"Table 8"},{"comment":"The citation 'Hughes et al.' appears without a year or venue in the text, and the corresponding reference entry has no year; please complete this citation.","section":"Section 2 / References"},{"comment":"The description of Figure 2 is too terse: please define how the cumulative average output length ratio is computed, how the bins are constructed from Qwen-Audio's gender classification probabilities, and whether the figure uses the unconstrained or the epsilon-constrained attack.","section":"Figure 2"},{"comment":"The explanation that English and Mandarin being 'more linguistically distinct' than English and French causes the higher selective-attack success is not supported by any experiment; acoustic or corpus-level differences are an equally plausible explanation and should be acknowledged or tested.","section":"Section 5.2.2"},{"comment":"The metric 'asl' (average sequence length) is reported without units; please state whether it is measured in tokens, words, or characters.","section":"Section 3.5"}],"recommendation":"major_revision","confidential_remarks":"The paper is within the scope of the journal and the general-attack results are solid. The editorial decision should hinge on whether the authors can strengthen the selective-attack evidence with a random-audio control and at least one cross-corpus selective evaluation; without those, the novelty claim in the title and abstract is overstated. I would encourage the editor to treat the missing control baseline and the in-domain-only selective evaluation as required additions rather than optional improvements."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the selective universal attack is the real novelty here, and the in-domain numbers are strong. But the paper's own tables undercut the 'unaffected' framing, and the selective attack hasn't been tested across corpora, so the attribute-conditioning claim is less solid than the general muting result.\n\nWhat's new: prior universal attacks on Whisper were indiscriminate. Learning one fixed 3.2s prefix that mutes only female speakers or only French speech is a step forward, and the gender/language results on the same corpus are convincing as a proof of concept. The general mute and task-control attacks on Qwen2-Audio and Granite-Speech are extensions of the authors' earlier Whisper work, but the transfer experiments (Tables 3/4) are a plus: the same prefix works across datasets and even different prompts, including unseen ones. The constrained-amplitude experiments in Appendix B are also a good-faith check on practicality.\n\nWhere it gets soft. First, 'unaffected' is wrong. In Table 7, male WER goes from 5.9 to 19.4 in Mute-female; in Table 8, English WER goes from 5.6 to 19.0 in Mute-fr. The attack is selective in the sense that the targeted group is much more muted, but the non-targeted group is clearly degraded. That weakens the fine-grained control story and should be acknowledged directly. Second, the selective attack is only evaluated in-domain: LibriSpeech dev_other to test_other for gender, FLEURS train to test for the same language pairs. The general attack gets cross-dataset transfer tests; the selective one doesn't. That leaves a real confound: the prefix might key on corpus-level acoustic differences correlated with gender or language rather than the attributes themselves. A cross-dataset selective test is needed before I'd trust 'universal' in the title. Third, the 3.2-second length was chosen after looking at test_other results. They report all lengths, which helps, but subsequent experiments use the best test-set length, so a small optimism bias is baked in. Fourth, there's no random-noise baseline. Prepending 3.2 seconds of audio could itself hurt ASR; the optimized-prefix effect isn't isolated.\n\nThe math and data handling look sound. The failure modes on beam search or with epsilon constraints are reported honestly. This is a solid empirical paper with a genuinely new attack concept, currently over-claimed in the abstract. Who is it for: researchers working on speech-LLM safety and adversarial robustness; also practitioners deploying audio interfaces. It deserves a serious referee, with the expectation that the authors add a random-noise baseline, cross-domain selective evaluations, and soften the 'unaffected' language.","headline":"Selective universal attack is genuinely new and works in-domain; the 'unaffected' framing is overstated and cross-domain validation is missing.","tokens_in":16457,"tokens_out":2711,"would_cite":true,"duration_ms":25348,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A fixed 3.2-second adversarial audio segment, prepended to any input, can mute speech LLMs, override their text prompt, and selectively silence only speakers of a targeted gender or language.","keywords":["universal adversarial attack","acoustic adversarial attack","speech language model","adversarial muting","selective attack","task control attack","Qwen2-Audio","Granite-Speech"],"falsifier":"Prepended random, unoptimized noise: if a 3.2-second random audio segment also produces mute rates near 100%, or selectively mutes the targeted group, then the demonstrated control is an artifact of prepending audio rather than of the learned adversarial segment. Concretely, take the same LibriSpeech test_other set and prepend a fixed 3.2-second clip of Gaussian noise or any unrelated audio, then measure the empty-rate and WER; if the random clip silences the model as often as the learned segment, the central claim is undermined.","tokens_in":15542,"feed_emoji":"🎧","tokens_out":6720,"duration_ms":99901,"temperature":0.7,"pith_summary":"The paper shows that a single short audio segment, learned once by gradient descent and then prepended to the front of any speech input, can give an attacker near-complete control over what a speech LLM outputs. With a 3.2-second segment, the attack mutes Qwen2-Audio in essentially all cases, transfers to unseen speakers, datasets, and even different text prompts, and also works, with lower efficiency, on Granite-Speech. The new contribution is a selective version that only triggers for inputs carrying a chosen attribute: trained to mute female voices or a specific language, it suppresses about 85 to 92 percent of targeted inputs while leaving non-targeted speech almost untouched. This means a one-time-crafted audio prefix could be used to silence particular groups of users or to quietly replace the requested task with another one.","feed_headline":"A single 3.2-second audio clip can silence speech-AI output on demand.","feed_subtitle":"A one-time universal prefix also learns to mute only female speakers or a chosen language, leaving others untouched.","key_machinery":"The load-bearing object is the prepended adversarial audio segment $a$, a fixed 3.2-second waveform learned through gradient descent on a small training set with the speech LLM's weights frozen. For muting, the objective is to maximize $P(y_1 = \\text{eot} \\mid \\mathrm{Enc}(a \\oplus x), P_{\\text{src}})$, making the model emit the end-of-transcription token as its first decoded token; for task control, the objective maximizes the probability of a target transcript under the original prompt, using either reference transcriptions (Attack-ref) or the model's own predictions under the target prompt (Attack-hyp). For the selective attack, the training target switches between eot and the normal transcription according to an attribute function $f(x)$ that indicates, for example, female speaker or a given language, so the segment must internally gate its effect on the attribute of the input that follows it. All three objectives are optimized directly in the audio-sample space, with the same segment then prepended to any test utterance.","core_discovery":"The paper reports that a fixed, universal adversarial audio segment, a vector of about 51,200 audio samples (3.2 seconds), prepended to arbitrary input audio achieves near-100% muting of the Qwen2-Audio speech LLM's output, defined as the model emitting the end-of-transcription token before any content, and that the same segment, when optimized against a conditional training target, acts as a conditional mute: only inputs whose speaker gender or spoken language matches the attribute are silenced, while other inputs continue to be transcribed. The muting attack succeeds at rates above 96% across three additional English datasets and four non-English FLEURS languages, and remains effective when the text prompt is switched from ASR to translation or gender detection. The task-control variant forces the model, prompted to translate to French, to instead output English transcriptions with WER around 6 to 7%, comparable to the no-attack ASR baseline. The selective attacks achieve 92.2% success for muting female speech and 85.4% for muting English speech on FLEURS, with the non-targeted group's transcription quality largely intact. The paper concludes that these universal acoustic attacks reveal a critical robustness gap in speech LLMs.","pith_inferences":["The same gradient-based prepend optimization could plausibly be adapted to other multimodal LLMs with speech encoders, but the required attack length may scale with model size; the paper's observation that larger models need longer segments suggests segment length is a key hyperparameter for future attacks.","The selective attack's success implies that the adversarial prefix does not erase gender or language information in the model's representations, which an attacker could exploit to build other conditional behaviors, such as triggering only on specific content words, without per-input labels.","A black-box extension, not tested in the paper, would optimize the prefix on an open-source surrogate model and transfer it to a closed API; given the observed transfer across datasets and prompts within a model, cross-model transfer is plausible but unverified.","For defenders, the attack directly learns the prepended segment itself, so any system that inserts a fixed 'watermark' or 'prompt' audio before user input should treat that insertion point as a hostile surface."],"forward_implications":["A single 3.2-second prefix can mute Qwen2-Audio across datasets, prompts, and languages, so any application built on that model is vulnerable to a one-time-crafted audio denial-of-service.","The selective attack enables an adversary to target a demographic or language group without affecting other users, potentially creating discriminatory access to services or evading safety guardrails that depend on model output.","The task-control attack makes the model ignore the user's text prompt and perform an attacker-chosen task instead, which could redirect downstream processing or mislead automated systems.","The transferability to Granite-Speech, a different architecture, suggests the vulnerability is not unique to Qwen2-Audio, though attack efficiency varies across models."],"supporting_citations":[{"why":"Supplies the prepend-based universal muting attack and the evaluation metrics (empty-rate and average sequence length) that this paper adapts to speech LLMs.","marker":"Raina et al. 2024"},{"why":"Introduces the universal task-control attack objective with reference and hypothesis training, which this paper extends to Qwen2-Audio and Granite-Speech.","marker":"Raina and Gales 2024"},{"why":"Describes the Qwen2-Audio model architecture and training, which defines the primary attack target and the exact input representation.","marker":"Chu et al. 2024"},{"why":"Defines the Granite-Speech architecture, the second model used to demonstrate cross-model transfer of the universal attack.","marker":"Granite Team 2025b"},{"why":"Provides the Whisper large-v3 encoder that Qwen2-Audio uses for speech features, the representation the adversarial segment directly perturbs.","marker":"Radford et al. 2023"},{"why":"Supplies the LibriSpeech dataset on which muting and gender-selective attacks are trained and evaluated.","marker":"Panayotov et al. 2015"},{"why":"Supplies the FLEURS multilingual dataset used to train and evaluate language-selective attacks.","marker":"Conneau et al. 2023"}],"fun_headline_variants":["One 3.2-second audio clip can silence speech-LLMs on demand","Universal acoustic attack can mute speech AI for specific voices","Single audio prefix can force speech LLM to change tasks","Universal audio attack selectively mutes female or language speech","One audio clip gives fine-grained control over speech AI"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The selective attack assumes that a single fixed audio prefix can read the content of the utterance that follows it, meaning gender or language cues survive the prefix and the prefix can switch its effect accordingly, rather than the model merely being globally more or less responsive after any prepended audio.","fun_headline_variants_meta":{"raw":{"variants":["One 3.2-second audio clip can silence speech-LLMs on demand","Universal acoustic attack can mute speech AI for specific voices","Single audio prefix can force speech LLM to change tasks","Universal audio attack selectively mutes female or language speech","One audio clip gives fine-grained control over speech AI"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001232,"raw_usage":{"total_tokens":5083,"prompt_tokens":987,"completion_tokens":4096,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":603,"completion_tokens_details":{"reasoning_tokens":4013}},"tokens_in":603,"tokens_out":4096,"duration_ms":27653,"temperature":1.0,"reasoning_tokens":4013,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T15:36:25.469893+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Prepended random, unoptimized noise: if a 3.2-second random audio segment also produces mute rates near 100%, or selectively mutes the targeted group, then the demonstrated control is an artifact of prepending audio rather than of the learned adversarial segment. Concretely, take the same LibriSpeech test_other set and prepend a fixed 3.2-second clip of Gaussian noise or any unrelated audio, then measure the empty-rate and WER; if the random clip silences the model as often as the learned segment, the central claim is undermined.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the Whisper large-v3 encoder that Qwen2-Audio uses for speech features, the representation the adversarial segment directly perturbs."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the LibriSpeech dataset on which muting and gender-selective attacks are trained and evaluated."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the FLEURS multilingual dataset used to train and evaluate language-selective attacks."}],"review_version":1}