{"id":"135af41c-ee0a-47f0-92c3-3efd75b2de29","arxiv_id":"2608.10405","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"Tiny additive noise computed by white-box gradient optimization can push end-to-end speech LLMs to generate near-maximum-length outputs with high success rates, increasing GPU consumption.","lead":"This paper shows that tiny, inaudible noise added to a voice recording can make speech-based AI models keep responding for far longer than normal, wasting computing resources. It presents what the authors describe as the first denial-of-service attack designed for end-to-end speech language models, a growing class of voice AI systems.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The optimization's backpropagation through discrete autoregressive sampling is unspecified; the reported attack success may rely on an unstated straight-through estimator rather than a validated suppression of termination.","rationale":"The reader's weakest_assumption identifies the same core issue: the absence of a stated method for backpropagating through discrete token selection in an autoregressive decoder. This is the most load-bearing concern because it targets the validity of the optimization procedure itself, not merely the statistical precision of the results. If the gradient path is incorrect or undocumented, the reported attack success could be an artifact of a biased straight-through estimator, which would not generalize to other models or settings, and the central claim of a stable DoS attack would be unsupported. Other issues identified by the reader, such as missing error bars, test-set-selected kappa, and a memory-usage typo, affect confidence but not the core mechanism. The proposed concrete test directly settles the concern: comparing the default implementation with a fully differentiable relaxation reveals whether the attack's success depends on the unspecified approximation. Since the reader's verdict is already CONDITIONAL, and this concern warrants exactly that condition (require clarification or code), the verdict should remain unchanged. I agree with the reader's weakest_assumption and find no other concern more fundamental to the paper's central claim.","tokens_in":14281,"tokens_out":11283,"duration_ms":113108,"concrete_test":"On LFM2.5-Audio with the same 100 OpenSLR samples and identical PGD settings, implement two optimization variants: (A) detach the token-selection path (stop-gradient through argmax/sampling) and (B) use a Gumbel-Softmax relaxation of the token sampling with temperature annealing so the entire decoding path is differentiable. If variant A achieves ASR above 0.85 and variant B reaches a comparable ASR, the discrete gradient concern is not load-bearing and the empirical claim holds under a principled relaxation. If variant B fails or drops substantially below 0.85, the reported success depends on the exact, unspecified gradient approximation, and the paper must disclose and justify it.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The Method section defines the composite loss LDoS in Eq. (4) and the optimization pipeline states that the gradient of LDoS with respect to the perturbation is calculated via backpropagation, but it never explains how the discrete token selections made during autoregressive decoding are handled in the backward pass. The losses Leos, Ltopk, and Llen (Eqs. 5, 7, 8) are computed from logits recorded at each decoding step t along the actual generated token path. Because the generated token indices are discrete functions of the input, gradients through those indices are zero unless a straight-through estimator or a differentiable relaxation is used. The paper acknowledges non-differentiability only for the length loss and introduces the expected-length surrogate in Eq. (6), but does not address the same issue for the EOS and top-k losses. If the token path is detached and treated as a constant, the optimizer adjusts logits only along the single sampled trajectory per PGD iteration, and the claimed success may be a byproduct of this biased approximation rather than a robust suppression of termination. Without a precise specification of the backward pass, the reported ASR values of 0.87 and 0.84 cannot be reproduced or independently verified, and the central claim that the attack reliably forces near-maximum generation remains incompletely supported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes a white-box adversarial attack on end-to-end speech large language models (E2E ALLMs). The attack optimizes a small ℓ∞-bounded perturbation added only to voiced segments (selected via voice activity detection, VAD) of an input waveform, using a composite loss that combines weighted EOS-logit suppression (Eq. 5), a top-k logit-boosting term (Eq. 8), an expected-length surrogate loss (Eqs. 6-7), and a semantic-alignment loss (Eq. 9). The authors evaluate on LFM2.5-Audio, FunAudioChat, and Qwen2-Audio with 100 samples per dataset and report attack success rates (ASR) of 0.87, 0.84, and 0.83 and average output lengths around 900-940 tokens, along with ablations, greedy-decoding results, transferability, and robustness tests.","tokens_in":14500,"tokens_out":6873,"duration_ms":60228,"significance":"If the results are reproducible, the paper contributes a new attack surface for a rapidly deploying class of models and provides a first systematic study of denial-of-service attacks on E2E speech LLMs. The multi-objective loss is a reasonable engineering design, the VAD-based perturbation masking is a practical stealthiness improvement, and the evaluation spans three models and several baselines, including ablations. The main claims are weakened, however, by the absence of any statistical uncertainty quantification, an underspecified backward pass through discrete decoding, and a concrete numeric inconsistency in the resource-consumption results.","major_comments":[{"comment":"The backward pass through the discrete autoregressive decoding loop is not specified. The losses Leos and Ltopk in Eqs. (5) and (8) are computed from logits at the token positions selected during decoding, and the token indices are discrete functions of the input; the paper acknowledges non-differentiability only for the length loss (Eq. 6), then states without justification that \"the gradient of LDoS with respect to the perturbation is calculated via backpropagation.\" If the sampled token path is detached and treated as a constant, the optimizer only adjusts logits along a single trajectory per PGD iteration; if a straight-through estimator, Gumbel-softmax, or score-function estimator is used, it should be stated explicitly. This is load-bearing for reproducibility and for the claim that the attack robustly suppresses termination, and it needs to be pinned down.","section":"Method, Optimization Pipeline (Eqs. 4-9)"},{"comment":"All headline results are averages over 100 samples with no error bars, confidence intervals, or significance tests. For instance, on LFM2.5-Audio the ASR difference between Our method (0.87) and Simple Loss (0.79) is about 8 percentage points; with n=100, the standard error of the difference is roughly 0.05, so the difference is not clearly beyond sampling noise. Report per-sample output lengths, bootstrap confidence intervals, and paired significance tests (e.g., Wilcoxon signed-rank) for the output-length and ASR comparisons.","section":"Experiment, Metrics and Table 1"},{"comment":"The reported clean-input GPU memory usage for FunAudioChat is inconsistent: Table 1 lists 20.26 GB, while the text states 17.26 GB for clean inputs. Since increased memory consumption is one of the two central consequences claimed for the attack, this discrepancy must be resolved and all memory figures checked for consistency.","section":"Main Result and Table 1"},{"comment":"The definition of attack success rate (ASR) as the fraction of samples reaching Nmax, combined with an optimization loop that stops when the generated response reaches Nmax and a length loss that drives expected length toward Nmax, makes ASR partly a measure of optimization convergence rather than an independent property of the crafted perturbation. The paper should clarify that ASR is the converged success rate under full white-box feedback and additionally report the output-length distribution (e.g., median and quartiles) and the mean number of PGD iterations required for success.","section":"Attack Overview and Metrics"}],"minor_comments":[{"comment":"Numerical values are run together in several cells (e.g., \"941.8810.78/47.99\" and \"920.2421.93/47.99\"); add spacing or separators between the output-length and memory columns.","section":"Tables 1, 4, and 5"},{"comment":"The ablation table uses checkmarks with blank entries; state explicitly that a blank indicates the component is removed, and use ✓/✗ symbols to make the removed component unambiguous.","section":"Table 2"},{"comment":"The model name is inconsistent: \"LFM2.5-Audio\" appears in the abstract and setup, while \"Liquid Audio\" is used in Tables 1 and 4; unify the naming.","section":"Throughout"},{"comment":"The manuscript references an appendix for the response-quality prompt, Qwen2-Audio results, and transferability, but the provided text contains only garbled figure remnants in those sections; include a proper appendix with legible figures.","section":"Appendix"},{"comment":"The weight definition wt = whigh exp(t/N κ) is ambiguous; specify whether the exponent is t/(Nκ) and define the domain of t (e.g., t = 1, ..., N).","section":"Eq. (5)"},{"comment":"The experimental setup should report dataset statistics (number of speakers, audio duration distribution, sample rate, languages) and hardware/GPU details, since resource consumption is a key claim and timing/memory figures depend on these choices.","section":"Experiment Setup"}],"recommendation":"major_revision","confidential_remarks":"The paper appears to be an early preprint with several presentation gaps (garbled appendix, numeric typo, unclear table formatting). The core idea is interesting and the multi-model evaluation is a plus, but the marginal gain over the \"Simple Loss\" baseline is modest (e.g., 0.87 vs 0.79 on LFM2.5-Audio), so the authors should be pushed to provide statistical error bars and a precise account of the backward pass through discrete decoding before publication."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Punchline: this is the first perturbation-based DoS attack I have seen aimed specifically at end-to-end speech LLMs, and the experiments make a credible case that it works in white-box settings. The main text under-specifies how gradients are obtained through the discrete decoding loop; that is the thing to fix before I would trust the headline numbers.\n\nWhat is new: the move from text-prompt DoS to continuous acoustic perturbations is a real step. The composite loss with weighted EOS suppression, top-k logit boosting, expected-length surrogate, and cosine semantic alignment is a sensible engineering package. The VAD-masked perturbation is a nice stealth touch, and the ablation shows each piece does something; the greedy-decoding and cross-model transfer experiments are more than most attack papers bother with. Credit where due: the results are consistent across three open-source models, and the ASR values (0.87/0.84/0.83) are strong enough to take seriously.\n\nSoft spots, in order of importance. First, the gradient question is not answered. Eq. (6) handles the length loss, but the EOS and top-k losses are computed from logits along a sampled token path, and no straight-through estimator or relaxation is described. If the path is detached, the optimizer is following one trajectory per PGD iteration; the claimed success might still be real, but the paper as written cannot be reproduced. This is fixable with one clear paragraph. Second, Table 1 versus text inconsistency: clean FunAudioChat memory is 20.26 GB in the table and 17.26 GB in the prose. Minor but needs correction. Third, no error bars on the 100-sample averages; with ASR differences of a few points between ablations, variance matters. Fourth, ASR is defined as reaching Nmax, and the length loss is also pushing expected length toward Nmax, so the main table is partly a fitness report. That is acceptable for an attack demonstration, but the paper should say it plainly.\n\nWho this is for: people working on speech model security or adversarial audio. It deserves a serious referee; the missing gradient specification and the consistency issues are repairable, and the core finding — small bounded perturbations force near-max decoding on current E2E ALLMs — is important enough to verify.","headline":"First perturbation-based DoS attack aimed at end-to-end speech LLMs, with credible white-box results, but the paper under-specifies the gradient path through discrete decoding.","tokens_in":15074,"tokens_out":2702,"would_cite":true,"duration_ms":25653,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Tiny, barely audible acoustic perturbations can force end-to-end speech models to generate responses at their maximum token cap, with reported success rates of 0.87 and 0.84.","keywords":["adversarial attack","denial of service","end-to-end speech language models","EOS suppression","voice activity detection","imperceptible perturbation","audio LLM security","autoregressive decoding"],"falsifier":"Run the same white-box optimization but block gradients from flowing through the token-selection step (treating the sampled token path as fixed for each iteration) and compare the resulting attack success rate and output length to the reported values; if the attack loses most of its effect, the stable EOS suppression depends on an unstated differentiability assumption.","tokens_in":14051,"feed_emoji":"🗣️","tokens_out":8544,"duration_ms":61745,"temperature":0.7,"pith_summary":"This paper claims that a small, barely audible noise added to a spoken input can make end-to-end audio language models keep talking instead of stopping. The attack is a white-box optimization: an attacker who knows a model's parameters adds a bounded perturbation, constrained to voiced portions of the audio, that suppresses the model's end-of-sentence signal and nudges its decoding toward the maximum token limit. On three open-source speech LLMs the reported attack success rate is 0.83 to 0.87, average output length rises from roughly 200 tokens to between 905 and 942 tokens, and peak GPU memory during inference grows by about one fifth. The paper's point is that continuous speech input, unlike discrete text, can be attacked directly in the waveform domain, so existing prompt-based defenses and EOS-suppression tricks for ASR are not the right baseline.","feed_headline":"A faint audio nudge can make speech AIs babble 4x longer","feed_subtitle":"White-box tests push end-to-end audio LLMs to max output and raise GPU memory use by about a fifth.","key_machinery":"The load-bearing object is the composite loss $L_{\\rm DoS} = L_{\\rm eos} + L_{\\rm topk} + L_{\\rm len} + L_{\\rm sem}$ optimized by projected gradient descent. The EOS term assigns a weight $w_t = w_{\\rm high}\\exp(t/N\\kappa)$ to positive EOS logits, concentrating pressure on later decoding steps; the length term uses an expected-length surrogate $E[L] = \\sum_{t=1}^N t\\, p_t \\prod_{i=1}^{t-1}(1-p_i)$ so that a discrete count becomes differentiable; the semantic term compares encoder features via cosine similarity. A voice-activity-detection mask restricts perturbations to voiced segments, which the paper reports preserves attack success while improving stealth.","core_discovery":"The central discovery is that the termination behavior of end-to-end speech LLMs can be steered by gradient-based perturbation of the raw waveform. The authors formulate the attack as minimizing a composite objective over a constrained perturbation $\\delta$: suppress the EOS logits at every autoregressive step with step-dependent weights, raise the logits of the top-$k$ tokens, pull the expected generation length toward $N_{\\max}$, and keep the semantic embedding of the perturbed audio close to the clean audio. With $\\|\\delta\\|_\\infty \\le 10^{-4}$ and perturbations placed only in voiced regions, the optimized waveform pushes responses to an average of 941.88 and 920.24 tokens on LFM2.5-Audio and FunAudioChat, compared with 198.34 and 213.57 on clean audio, at reported attack success rates of 0.87 and 0.84.","pith_inferences":["Not stated in the paper: how gradients are routed through discrete token selection remains unspecified, so a replication that blocks this path would test whether the attack's stability depends on that choice.","Not stated in the paper: the same composite-loss design should transfer to other continuous-input sequence models, such as vision-language LLMs with a termination token.","Not stated in the paper: the 7 to 13 percent cross-model transfer rates suggest that an attacker could optimize on a surrogate model and deploy black-box, which makes evaluation on larger model families a natural next step.","Not stated in the paper: because lossy compression weakens the attack, a learnable denoiser before decoding is a plausible defense, though the paper notes adaptive attackers could optimize through such a preprocessor."],"forward_implications":["End-to-end speech LLMs are vulnerable to denial of service by imperceptible waveform perturbations, not just by crafted text prompts.","In a white-box setting an attacker can raise GPU memory consumption during inference by roughly 20 percent (for example, from 8.89 to 10.78 GB on LFM2.5-Audio) while keeping responses semantically similar.","The attack transfers across models at rates of 7 to 13 percent, so a perturbation optimized on one architecture retains partial effectiveness against others.","The same multi-loss recipe works under greedy decoding and tolerates small additional noise, suggesting the vulnerability is not an artifact of sampling randomness.","Lossy compression such as MP3 degrades the attack, pointing to signal transformation as a candidate defensive direction."],"supporting_citations":[{"why":"Supplies the projected gradient descent loop used to update the perturbation.","marker":"Madry et al. 2018"},{"why":"Establishes EOS-logit suppression as an attack vector against speech models, the starting point this paper extends.","marker":"Haque et al. 2023"},{"why":"Provides the Crabs text-LLM DoS baseline that the paper must beat.","marker":"Zhang et al. 2024"},{"why":"Provides the ExtendAttack reasoning-LLM DoS baseline used for comparison.","marker":"Zhu et al. 2025"},{"why":"Defines the Qwen2-Audio target model used in the evaluation.","marker":"Chu et al. 2024"},{"why":"Defines the FunAudioChat target model used in the evaluation.","marker":"Tan et al. 2025"},{"why":"Defines the LFM2.5-Audio target model used in the evaluation.","marker":"AI 2025"},{"why":"Supplies the VAD-based silent-region masking strategy adopted to keep perturbations stealthy.","marker":"Ko, Kim, and Kwon 2026"}],"fun_headline_variants":["Tiny audio tweaks make speech AIs talk 4x longer","Inaudible perturbations force speech LLMs to over-generate","White-box attack makes speech models ramble 4x longer","Stealthy sound attack stretches speech AI outputs to 4x"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that gradient descent on the audio waveform can reliably suppress the model's stop signal even though the model chooses tokens by discrete sampling during decoding, and the paper does not fully specify how that discrete step is differentiated.","fun_headline_variants_meta":{"raw":{"variants":["Tiny audio tweaks make speech AIs talk 4x longer","Inaudible perturbations force speech LLMs to over-generate","White-box attack makes speech models ramble 4x longer","Stealthy sound attack stretches speech AI outputs to 4x"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001022,"raw_usage":{"total_tokens":4342,"prompt_tokens":1009,"completion_tokens":3333,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":625,"completion_tokens_details":{"reasoning_tokens":3259}},"tokens_in":625,"tokens_out":3333,"duration_ms":22325,"temperature":1.0,"reasoning_tokens":3259,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T14:21:10.242261+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same white-box optimization but block gradients from flowing through the token-selection step (treating the sampled token path as fixed for each iteration) and compare the resulting attack success rate and output length to the reported values; if the attack loses most of its effect, the stable EOS suppression depends on an unstated differentiability assumption.","supporting_citations":[],"review_version":1}