Pith. sign in

REVIEW 4 major objections 6 minor 6 cited by

Attacker's Noise Can Manipulate Your Audio-based LLM in the Real World

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Adversarial noise broadcast through a speaker can make an audio-based LLM on a victim's device output attacker-chosen text such as 'Hey Qwen, send money to X', with 100% success in the paper's over-the-air test.

desk verdict Solid white-box attack analysis—the SpecAugment ablation is the real contribution—though the real-world scalability claim is a single-channel overreach that the paper's own Table 4 contradicts. read the letter →

arxiv 2507.06256 v1 pith:SQ5WN7RZ submitted 2025-07-07 cs.CR cs.AIcs.SDeess.AS

Vinu Sankar Sadasivan , Soheil Feizi , Rajiv Mathews , Lun Wang This is my paper
classification cs.CRcs.AIcs.SDeess.AS
keywords audio-basedLLMadversarialattackover-the-airQwen2-AudioSpecAugmentjailbreakingspeechrecognitiondegradation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that audio-based large language models (ALLMs) such as Qwen2-Audio can be manipulated by adversarial noise played through the air, not just by digitally injected audio. In the tested white-box setup, the attacker's noise makes the model output exact attacker-chosen strings such as 'Hey Qwen, send money to X' with 100% success when the noise is optimized with SpecAugment and additive-noise augmentation, and separate untargeted noise can push transcription perplexity from about 1.2 to values above 10, producing garbled or unrelated transcripts. The authors argue this is a scalable real-world threat because the adversary plays background noise in a shared space and an innocent user's device does the rest. The paper's experiments also show that the specific attack is brittle to sample-rate changes, noise reduction, and neural audio compression, but that adaptive attacks could plausibly bypass those defenses.

What carries the argument

The key objects are the perplexity-based targeted objective $L(x)=\exp\!\left(-\frac{1}{n}\sum_{i=1}^{n}\log p(t_i\mid x,s,t_{1:i-1})\right)$, maximized by gradient ascent with the perturbation clipped to $[-\epsilon,\epsilon]$, and the untargeted feature-disruption objective $L(\delta)=-\|M\odot M_F(x+\delta)-M\odot M_F(x)\|_2^2$, where $M_F$ is the Whisper-based audio tower and $M$ is a random Bernoulli mask. The mechanism that carries real-world transfer is composing audio augmentations—temporal translation, additive uniform noise, and SpecAugment frequency masking—into the gradient step, so the optimized noise is robust to the speaker-to-microphone channel. SpecAugment is the decisive component: without it attack success is 0%, with it the recorded attack reaches 70%, and adding additive noise lifts it to 100%.

What would settle it

Take the described targeted 'Hey Qwen' audio, play it through several commodity laptops and speakers, and record it with several phone models at varied distances; or apply a sample-rate rescale of 0.8 or 1.2 to the recorded signal before feeding it to Qwen2-Audio and count exact 'Hey Qwen' matches. If success falls to the paper's reported 0% under resampling in a separate room at conversational distance, the central 'real-world scalability' claim is refuted for that setting; if it stays at 100%, the claim is corroborated beyond one device pair.

Watch

Extended reading notes

Core claim

The central claim is that white-box gradient-based optimization over differentiable ALLMs yields stealthy audio noises that transfer through a physical acoustic channel. Optimizing the perplexity of a target text sequence under an $\ell_\infty$ bound produces 2–4 second clips that elicit 'Hey Qwen', 'Hey Qwen, delete my calendar events', and 'Hey Qwen, send money to X' with 100% exact-match accuracy across random seeds in the digital setting. When played from an HP Chromebook speaker and re-recorded by an iPhone 15, the same attack succeeds at 100% only if the optimization included SpecAugment plus additive noise; translation alone or no augmentation yields 0%, and SpecAugment alone gives 70%. For untargeted attacks, the paper maximizes the $\ell_2$ distance between masked audio-tower features, which degrades LibriSpeech transcription: at $\epsilon=0.1$, mean perplexity rises to $10.26 \pm 34.04$ and 62.75% of adversarial examples exceed the 99th percentile of clean-audio perplexity, while random noise of the same magnitude reaches only 17.15%. The authors further report that the targeted attack retains 100% success under a different system instruction that explicitly tells the model to ignore background noise.

Load-bearing premise

The paper's over-the-air result rests on the assumption that the single tested acoustic channel—an HP Chromebook speaker to an iPhone 15 recorder at an unstated distance and room—is representative of real eavesdropping conditions; the paper's own Table 4 shows that changing the sample rate by only 0.8$\times$ or 1.2$\times$ drops recorded-audio targeted success from 100% to 0%, so any real pipeline that resamples or compresses can destroy the perturbation.

Editorial extensions

If this is right

  • Voice assistants built on open ALLMs can be woken up and commanded by ambient noise alone, so wake-word detection and safety alignment do not by themselves prevent physical audio injection.
  • Matching the attack optimization to the physical channel is what matters: SpecAugment and additive-noise augmentation turn a 0% over-the-air attack into a 100% one.
  • The untargeted variant can act as a denial-of-service on speech-based interfaces, since transcription perplexity spikes and outputs become unrelated to the user's speech.
  • Input-side defenses that resample, denoise, or compress audio before the model can break the specific optimized noise, but the translation-augmentation result implies an adaptive attacker can re-optimize against known defenses.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A direct extension not tested by the paper: include sample-rate rescaling and codec-like compression in the augmentation composition during optimization, which would likely restore over-the-air success against pipelines that resample or transcode.
  • The fact that the attack transfers across system instructions suggests the manipulation lives in the audio encoder's feature geometry, so encoder-level adversarial training may be a more durable defense than prompt or system-instruction hardening.
  • Outside the paper's single HP-Chromebook-to-iPhone channel, the fragility at 0.8$\times$ and 1.2$\times$ sample rates means practical risk depends strongly on the device pipeline; a natural field test is measuring attack success across distances, rooms, and phone models.
  • If such ambient-noise attacks are demonstrated on deployed assistants with wake-word modules and transaction confirmations, the realistic impact would likely be false wake-ups and degraded transcription rather than silent unauthorized money transfer, because the paper explicitly does not model wake-word detection or password checks.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. This paper studies adversarial audio attacks against audio-based large language models (ALLMs), specifically Qwen2-Audio. It introduces two attack types: targeted attacks that craft audio perturbations to make the model output attacker-chosen phrases (e.g., "Hey Qwen, send money to X"), and untargeted attacks that aim to degrade speech transcription quality by perturbing the audio encoder's features. The paper further claims to scale these attacks to the real world by playing adversarial audio over the air through a speaker and recording it on a phone, using augmentation techniques (translation, additive noise, SpecAugment) during optimization. The authors evaluate defenses including sample-rate changes, spectral-gating noise reduction, and EnCodec compression. Their main claims are that targeted attacks achieve 100% success digitally and in a single over-the-air test setup, untargeted attacks degrade transcription quality, and the attacks transfer to a modified system instruction.

Significance. If the claims hold, this work highlights a realistic threat to voice-controlled AI assistants: an adversary could play crafted background noise that triggers specific harmful responses on innocent users' devices. The digital targeted attack results are strong, with 100% exact-match success across 10 seeds for multiple target strings. The defense experiments are also valuable, showing that common audio processing such as EnCodec compression or sample-rate conversion can neutralize the attacks. However, the core real-world scalability claim is currently undermined by the paper's own robustness data, and the untargeted attack results suffer from very high variance. The paper nevertheless opens an important direction for studying the security of audio-based multimodal LLMs.

major comments (4)
  1. [§4, Table 4] The flagship claim that the attacks "scale to real-world scenarios" is not supported by the evidence in this section. The over-the-air demonstration uses a single physical channel (HP Chromebook speaker to iPhone 15) with unstated distance, playback volume, and room acoustics, and the paper's own Table 4 shows that the recorded adversarial audio achieves 100% targeted success only at exactly the 1.0× sample-rate point; a 0.8× or 1.2× rescale drops success to 0%, even though the original (unplayed) adversarial audio survives those rescalings. Real-world user devices capture at native rates such as 44.1 kHz or 48 kHz and resample before the audio reaches the model, which in your table corresponds to non-1.0 factors and would likely fail. Tables 5 and 6 further show that full spectral-gating noise reduction and EnCodec compression at all tested bandwidths reduce recorded-audio success to 0%. These results indicate that the real-world attack succeeds only in a narrow set of conditions, so the abstract's and §4's generalization language is not justified. I recommend either substantially broadening the channel and pipeline robustness evaluation or explicitly narrowing the claim to a preliminary demonstration on one channel.
  2. [§4.2, Fig. 3] The real-world untargeted attack is reported only as four example outputs with raw perplexity values; there is no aggregate success rate, WER or ASR comparison, or error bar over the 25 recorded samples, and no repeated physical trials are described. Given that the digital untargeted results in Table 2 show enormous variance (e.g., adversarial WER 0.55 ± 1.69 at ε=0.1), the qualitative statement that "the perplexity statistics are much worse" does not establish that the attack degrades utility in the real world. Please provide quantitative metrics with confidence intervals or paired comparisons against the random-noise baseline on the same recorded utterances.
  3. [§3.2, Table 2] The digital untargeted attack's reported WER differences are smaller than their standard deviations (e.g., adversarial WER 0.55 ± 1.69 vs random 0.21 ± 0.85 at ε=0.1), so the claim that the adversarial perturbation causes "much extreme degradation" relative to random noise is not statistically supported. The paper should report a paired statistical test or bootstrap confidence intervals, and ideally a per-sample measure of how often the adversarial transcript is worse than the random transcript, to separate the attack's effect from random fluctuation.
  4. [§3.1, Table 1; §4, Table 3] The attacks are described as "stealthy" and as happening "without the user noticing" (abstract and Figure 1a), but no perceptual evaluation is reported. An ℓ∞ bound of ε=0.1 on audio normalized to [-1,1] corresponds to a noise floor of approximately -20 dBFS, which may be clearly audible depending on playback volume and ambient noise. A human listening study or at least a perceptual metric (e.g., SNR, PESQ, or a masking-noise criterion) is needed to justify the stealthiness premise, especially because the untargeted attack adds the noise directly on top of the user's speech.
minor comments (6)
  1. [Abstract and throughout] The term "transferrability" is misspelled; it should be "transferability."
  2. [§5.1] The sentence "the perplexity statistic with the new system instruction (and with the default system instruction) to be1.09± 0.07 (1± 0.09)" has a formatting issue after "be" and the parenthetical ordering is ambiguous; please clarify which condition each number corresponds to.
  3. [§3.2] The abbreviation "ASR" is used for "Attack Success Rate," which collides with the standard meaning "Automatic Speech Recognition" in the audio literature; please spell out the term at first use to avoid confusion.
  4. [§4.1] The experimental setup does not report the distance between the Chromebook speaker and the iPhone, the playback volume, or the room environment; these details are necessary for reproducibility and for assessing how representative the channel is.
  5. [Figure 2] Example 1 under "Adversarial response" shows non-English (Mandarin) output, which is an interesting failure mode, but the paper does not discuss why the model switches language; a brief explanation would be helpful.
  6. [§6] The conclusion states that the findings "urge caution in the open-sourcing of audio-based models," but the experiments are white-box on a single open model with no adaptive attacks or closed-source evaluation; the business implication is speculative and should be softened.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attacks are constructed and tested empirically, and the robustness limitations in Tables 4-6 do not make the central claims definitionally circular.

full rationale

The paper's derivations are self-contained empirical attack constructions rather than circular reductions. The targeted attack optimizes Eq. (1)'s perplexity loss directly against Qwen2-Audio and evaluates by exact string matching of sampled outputs; evaluating on the same model used for optimization is standard white-box adversarial practice, not a fitted-input-called-prediction. The over-the-air experiments add an independent physical channel (HP Chromebook speaker played into an iPhone 15 recording), and the augmentation ablations in Table 3 are factorial experiments rather than definitional equivalences. Tables 4-6 show that sample-rate rescaling, spectral gating, and EnCodec compression break the recorded attack; these are robustness limitations that undermine the real-world scalability generalization, but they are not circularity because the test conditions differ from the optimization conditions. The transferability test reuses the same base model with a changed system instruction, which limits the strength of the transfer claim but is again an empirical evaluation rather than a definitional reduction. Self-citations (Sadasivan et al., 2024; Jagielski et al., 2024; Liu et al., 2024; Wang et al., 2024) appear only in related-work context and are not load-bearing premises for the attack derivation. No equation is shown to equal its own input, and no fitted parameter is renamed as a prediction.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central claim depends on an assumed white-box attacker, an end-to-end differentiable model, and a clean acoustic path from speaker to microphone. The real-world success relies on augmentation hyperparameters (SpecAugment masks, additive noise) that are hand-tuned rather than fitted. No new physical entities are introduced.

free parameters (5)
  • Adversarial perturbation budget epsilon = 0.01 (digital) and 0.1 (digital and real-world)
    Hand-chosen l-infinity bound; larger budgets (0.1) drive the untargeted attack's success (ASR@99% up from 15.45% to 62.75%) and are used in all real-world tests; the 0.1 budget is likely audible, contrary to the stealthy claim.
  • Optimization schedule (learning rate, iterations) = alpha=0.0002, 5000 iterations
    Standard PGD schedule chosen by the authors; no ablations shown for sensitivity to these values.
  • Augmentation hyperparameters for over-the-air transfer = n_mask=10, n_size=50, epsilon_noise=0.02
    These govern SpecAugment and additive-noise augmentation; Table 3 shows excluding them drops real-world success to 0%, so the result is contingent on them.
  • Untargeted success threshold (PPL percentile) = ASR@99% and ASR@95% thresholds
    Attack success in Table 2 is defined by comparing PPL against clean-data percentiles; reported success rates differ by roughly 8 to 15 points between the 95th and 99th percentile choices, so the headline numbers are threshold-dependent.
  • Bernoulli mask probability for feature-space attack = p=1/2
    Randomized masking in the modified loss uses a Bernoulli(1/2) mask to spread the l2 objective across coordinates; no ablation is provided to justify this value.
assumptions (5)
  • domain assumption White-box access: attacker knows all model parameters and gradients.
    Stated in Section 1: we operate within a white-box setting. The entire attack rests on this; no black-box or transfer-from-a-surrogate evaluation is provided beyond a system-instruction change.
  • domain assumption Qwen2-Audio is fully differentiable end-to-end with respect to the input audio waveform.
    Needed for the gradient-descent updates in Equations 2-3 and the feature-space attack; the paper states Qwen2-Audio is differentiable but provides no verification on the audio tower and LLM interface.
  • domain assumption The device's audio front-end (voice activity detection, echo cancellation, resampling, noise suppression) does not remove or alter the adversarial signal before it reaches the ALLM.
    The real-world threat model assumes recorded audio is fed directly to the model; Table 4's sensitivity to sample-rate changes suggests real front-ends could break the attack.
  • domain assumption High perplexity of the open-ended generated text indicates degraded response quality for the user.
    Used to define attack success in Section 3.2; examples in Figure 2 show fluent, if incorrect, outputs with high PPL, so PPL does not necessarily equal user-visible failure or harmful action.
  • domain assumption Exact string matching between model output and the attacker-chosen target string is a valid measure of a harmful outcome.
    The paper itself caveats in Section 3.1 that its target design does not account for real-world features like specific wake-word detection or password checks for sending money; no agent executes an action.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Attacker's Noise Can Manipulate Your Audio-based LLM in the Real World." pith.science (2026). https://pith.science/paper/SQ5WN7RZ

@misc{pith2026250706256,
  author       = {Pith},
  title        = {Pith review of: Attacker's Noise Can Manipulate Your Audio-based LLM in the Real World},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SQ5WN7RZ}},
  note         = {Machine review of arXiv:2507.06256}
}
read the original abstract

This paper investigates the real-world vulnerabilities of audio-based large language models (ALLMs), such as Qwen2-Audio. We first demonstrate that an adversary can craft stealthy audio perturbations to manipulate ALLMs into exhibiting specific targeted behaviors, such as eliciting responses to wake-keywords (e.g., "Hey Qwen"), or triggering harmful behaviors (e.g. "Change my calendar event"). Subsequently, we show that playing adversarial background noise during user interaction with the ALLMs can significantly degrade the response quality. Crucially, our research illustrates the scalability of these attacks to real-world scenarios, impacting other innocent users when these adversarial noises are played through the air. Further, we discuss the transferrability of the attack, and potential defensive measures.

Discussion (0). Sign in to comment.

Forward citations

Cited by 6 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Codec-Robust Attacks on Audio LLMs

    cs.SD 2026-05 unverdicted novelty 7.0 of 10

    CodecAttack perturbs audio in codec latent space with multi-bitrate EoT to achieve 85.5% average ASR on Opus-compressed Audio LLMs versus under 26% for waveform baselines, with transfer to MP3 and AAC.

  2. Sparse Tokens Suffice: Jailbreaking Audio Language Models via Token-Aware Gradient Optimization

    cs.CR 2026-05 conditional novelty 7.0 of 10

    Sparse selection of high-gradient-energy audio tokens suffices for effective jailbreaking of audio language models with minimal drop in attack success rate.

  3. Sparse Tokens Suffice: Jailbreaking Audio Language Models via Token-Aware Gradient Optimization

    cs.CR 2026-05 conditional novelty 7.0 of 10

    TAGO performs sparse jailbreak optimization on audio LMs by retaining only high-gradient-energy tokens, preserving near-full ASR at 25% retention across three models.

  4. Codec-Robust Attacks on Audio LLMs

    cs.SD 2026-05 unverdicted novelty 6.0 of 10

    CodecAttack optimizes perturbations in neural audio codec latent space to reach 85.5% average target-substring ASR on compressed Opus audio while waveform baselines stay below 26%.

  5. A Survey of Large Audio Language Models: Generalization, Trustworthiness, and Outlook

    cs.SD 2026-05 unverdicted novelty 5.0 of 10

    A survey of Large Audio Language Models that establishes a taxonomy of trustworthiness vulnerabilities and proposes a Defense-in-Depth roadmap for audio intelligence.

  6. Afrispeech Semantics: Evaluating Audio Semantic Reasoning in Spoken Language Models Across Domains and Accents

    cs.CL 2026-05 unverdicted novelty 4.0 of 10

    Audio language models are benchmarked on five semantic and paralinguistic reasoning tasks to reveal limitations in handling spoken audio evidence, accent variation, and domain shifts.

Reference graph

Works this paper leans on

40 extracted references · 14 canonical work pages · cited by 4 Pith papers

  1. [1]

    E. Amid, O. Thakkar, A. Narayanan, R. Mathews, and F. Beaufays. Extracting targeted training data from asr models, and how to mitigate it. arXiv preprint arXiv:2204.08345, 2022

    work page Pith review arXiv 2022

  2. [2]

    C. Anil, E. Durmus, N. Panickssery, M. Sharma, J. Benton, S. Kundu, J. Batson, M. Tong, J. Mu, D. Ford, et al. Many-shot jailbreaking. Advances in Neural Information Processing Systems, 37: 0 129696--129742, 2024

    work page 2024

  3. [3]

    R. Anil, A. M. Dai, O. Firat, M. Johnson, D. Lepikhin, A. Passos, S. Shakeri, E. Taropa, P. Bailey, Z. Chen, et al. Palm 2 technical report. arXiv preprint arXiv:2305.10403, 2023

    arXiv 2023

  4. [4]

    J. Bai, S. Bai, Y. Chu, Z. Cui, K. Dang, X. Deng, Y. Fan, W. Ge, Y. Han, F. Huang, et al. Qwen technical report. arXiv preprint arXiv:2309.16609, 2023

    arXiv 2023

  5. [5]

    Borsos, R

    Z. Borsos, R. Marinier, D. Vincent, E. Kharitonov, O. Pietquin, M. Sharifi, D. Roblek, O. Teboul, D. Grangier, M. Tagliasacchi, et al. Audiolm: a language modeling approach to audio generation. IEEE/ACM transactions on audio, speech, and language processing, 31: 0 2523--2533, 2023

    work page 2023

  6. [6]

    Carlini and D

    N. Carlini and D. Wagner. Audio adversarial examples: Targeted attacks on speech-to-text. In 2018 IEEE security and privacy workshops (SPW), pages 1--7. IEEE, 2018

    work page 2018

  7. [7]

    P. Chao, A. Robey, E. Dobriban, H. Hassani, G. J. Pappas, and E. Wong. Jailbreaking black box large language models in twenty queries. arXiv preprint arXiv:2310.08419, 2023

    arXiv 2023

  8. [8]

    S. Chen, C. Wang, Z. Chen, Y. Wu, S. Liu, Z. Chen, J. Li, N. Kanda, T. Yoshioka, X. Xiao, et al. Wavlm: Large-scale self-supervised pre-training for full stack speech processing. IEEE Journal of Selected Topics in Signal Processing, 16 0 (6): 0 1505--1518, 2022 a

    work page 2022

Show all 40 references
  1. [9]

    S. Chen, Y. Wu, C. Wang, S. Liu, D. Tompkins, Z. Chen, and F. Wei. Beats: Audio pre-training with acoustic tokenizers. arXiv preprint arXiv:2212.09058, 2022 b

    2022 arXiv

  2. [10]

    Y. Chu, J. Xu, X. Zhou, Q. Yang, S. Zhang, Z. Yan, C. Zhou, and J. Zhou. Qwen-audio: Advancing universal audio understanding via unified large-scale audio-language models. arXiv preprint arXiv:2311.07919, 2023

    2023 arXiv

  3. [11]

    Y. Chu, J. Xu, Q. Yang, H. Wei, X. Wei, Z. Guo, Y. Leng, Y. Lv, J. He, J. Lin, et al. Qwen2-audio technical report. arXiv preprint arXiv:2407.10759, 2024

    2024 arXiv

  4. [12]

    N. Das, S. Dingliwal, S. Ronanki, R. Paturi, Z. Huang, P. Mathur, J. Yuan, D. Bekal, X. Niu, S. M. Jayanthi, et al. Speechverse: A large-scale generalizable audio language model. arXiv preprint arXiv:2405.08295, 2024

    2024 arXiv

  5. [13]

    Défossez, J

    A. Défossez, J. Copet, G. Synnaeve, and Y. Adi. High fidelity neural audio compression, 2022. URL https://arxiv.org/abs/2210.13438

    2022 arXiv

  6. [14]

    Ghosh, S

    S. Ghosh, S. Kumar, A. Seth, C. K. R. Evuru, U. Tyagi, S. Sakshi, O. Nieto, R. Duraiswami, and D. Manocha. Gama: A large audio-language model with advanced audio understanding and complex reasoning abilities. arXiv preprint arXiv:2406.11768, 2024

    2024 arXiv

  7. [15]

    Y. Gong, D. Ran, J. Liu, C. Wang, T. Cong, A. Wang, S. Duan, and X. Wang. Figstep: Jailbreaking large vision-language models via typographic visual prompts. arXiv preprint arXiv:2311.05608, 2023

    2023 arXiv

  8. [16]

    S. Hu, L. Zhou, S. Liu, S. Chen, L. Meng, H. Hao, J. Pan, X. Liu, J. Li, S. Sivasankaran, et al. Wavllm: Towards robust and adaptive speech large language model. arXiv preprint arXiv:2404.00656, 2024

    2024 arXiv

  9. [17]

    Jagielski, O

    M. Jagielski, O. Thakkar, and L. Wang. Noise masking attacks and defenses for pretrained speech models. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 4810--4814. IEEE, 2024

    2024

  10. [18]

    M. Kang, C. Xu, and B. Li. Advwave: Stealthy adversarial jailbreak attack against large audio-language models. arXiv preprint arXiv:2412.08608, 2024

    2024 arXiv

  11. [19]

    K. Li, C. Shen, Y. Liu, J. Han, K. Zheng, X. Zou, Z. Wang, X. Du, S. Zhang, H. Luo, et al. Audiotrust: Benchmarking the multifaceted trustworthiness of audio large language models. arXiv preprint arXiv:2505.16211, 2025

    2025

  12. [20]

    H. Liu, Y. Chen, A. Narayanan, A. Balachandran, P. J. Moreno, and L. Wang. Can deepfake speech be reliably detected? arXiv preprint arXiv:2410.06572, 2024

    2024 arXiv

  13. [21]

    X. Liu, N. Xu, M. Chen, and C. Xiao. Autodan: Generating stealthy jailbreak prompts on aligned large language models. arXiv preprint arXiv:2310.04451, 2023

    2023 arXiv

  14. [22]

    Mehrotra, M

    A. Mehrotra, M. Zampetakis, P. Kassianik, B. Nelson, H. Anderson, Y. Singer, and A. Karbasi. Tree of attacks: Jailbreaking black-box llms automatically. Advances in Neural Information Processing Systems, 37: 0 61065--61105, 2024

    2024

  15. [23]

    T. A. Nguyen, B. Muller, B. Yu, M. R. Costa-Jussa, M. Elbayad, S. Popuri, C. Ropers, P.-A. Duquenne, R. Algayres, R. Mavlyutov, et al. Spirit-lm: Interleaved spoken and written language model. Transactions of the Association for Computational Linguistics, 13: 0 30--52, 2025

    2025

  16. [24]

    Introducing the gpt store

    OpenAI. Introducing the gpt store. https://openai.com/index/introducing-the-gpt-store/, 2024. Accessed: 2025-05-15

    2024

  17. [25]

    Panayotov, G

    V. Panayotov, G. Chen, D. Povey, and S. Khudanpur. Librispeech: an asr corpus based on public domain audio books. In Acoustics, Speech and Signal Processing (ICASSP), 2015 IEEE International Conference on, pages 5206--5210. IEEE, 2015

    2015

  18. [26]

    D. S. Park, W. Chan, Y. Zhang, C.-C. Chiu, B. Zoph, E. D. Cubuk, and Q. V. Le. Specaugment: A simple data augmentation method for automatic speech recognition. arXiv preprint arXiv:1904.08779, 2019

    1904 arXiv

  19. [27]

    X. Qi, K. Huang, A. Panda, M. Wang, and P. Mittal. Visual adversarial examples jailbreak large language models. CoRR, 2023

    2023

  20. [28]

    Radford, J

    A. Radford, J. W. Kim, T. Xu, G. Brockman, C. Payne, J. Leike, and I. Sutskever. Robust speech recognition via large-scale weak supervision, 2022

    2022

  21. [29]

    ``do anything now'' (dan) chatgpt jailbreak prompt

    RedditUser123. ``do anything now'' (dan) chatgpt jailbreak prompt. https://www.reddit.com/r/ChatGPT/..., Jan. 2023. Accessed: 2025-03-30

    2023

  22. [30]

    J. Roh, V. Shejwalkar, and A. Houmansadr. Multilingual and multi-accent jailbreaking of audio llms. arXiv preprint arXiv:2504.01094, 2025

    2025 arXiv

  23. [31]

    P. K. Rubenstein, C. Asawaroengchai, D. D. Nguyen, A. Bapna, Z. Borsos, F. d. C. Quitry, P. Chen, D. E. Badawy, W. Han, E. Kharitonov, et al. Audiopalm: A large language model that can speak and listen. arXiv preprint arXiv:2306.12925, 2023

    2023 arXiv

  24. [32]

    V. S. Sadasivan, S. Saha, G. Sriramanan, P. Kattakinda, A. Chegini, and S. Feizi. Fast adversarial attacks on language models in one gpu minute. arXiv preprint arXiv:2402.15570, 2024

    2024 arXiv

  25. [33]

    Sainburg

    T. Sainburg. timsainb/noisereduce: v1.0, June 2019. URL https://doi.org/10.5281/zenodo.3243139

    2019 doi

  26. [34]

    C. Tang, W. Yu, G. Sun, X. Chen, T. Tan, W. Li, L. Lu, Z. Ma, and C. Zhang. Salmonn: Towards generic hearing abilities for large language models. arXiv preprint arXiv:2310.13289, 2023

    2023 arXiv

  27. [35]

    X. Tao, S. Zhong, L. Li, Q. Liu, and L. Kong. Imgtrojan: Jailbreaking vision-language models with one image. arXiv preprint arXiv:2403.02910, 2024

    2024

  28. [36]

    Touvron, L

    H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y. Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288, 2023

    2023 arXiv

  29. [37]

    L. Wang, O. Thakkar, and R. Mathews. Unintended memorization in large asr models, and how to mitigate it. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 4655--4659. IEEE, 2024

    2024

  30. [38]

    Zhang, S

    D. Zhang, S. Li, X. Zhang, J. Zhan, P. Wang, Y. Zhou, and X. Qiu. Speechgpt: Empowering large language models with intrinsic cross-modal conversational abilities. arXiv preprint arXiv:2305.11000, 2023

    2023 arXiv

  31. [39]

    S. Zhu, R. Zhang, B. An, G. Wu, J. Barrow, Z. Wang, F. Huang, A. Nenkova, and T. Sun. Autodan: interpretable gradient-based adversarial attacks on large language models. arXiv preprint arXiv:2310.15140, 2023

    2023 arXiv

  32. [40]

    A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043, 2023

    2023 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.