Pith. sign in

REVIEW 4 major objections 6 minor 81 references

From Inaudible Inputs to Model Failures: Low-Frequency Safety Risks in LALMs

T0 review · 4 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A fixed 5–20 Hz waveform, inaudible to humans, degrades large audio-language models by up to 67 percentage points in accuracy.

desk verdict A genuinely new low-frequency attack construction with solid digital-domain results, but the physical 'inaudible input' claim is not yet established and deserves a serious referee. read the letter →

arxiv 2608.09158 v1 pith:LGI4VD5R submitted 2026-08-10 cs.SD cs.AI

Yuanhe Zhang , Weiliu Wang , Jie Ren , Liang Lin , Zhenhong Zhou , Haoran Gao , Kun Wang , Chen Li
show 2 more authors
Li Sun Sen Su
This is my paper · ORCID
classification cs.SDcs.AI
keywords largeaudio-languagemodelslow-frequencyattackinaudibleinterferenceuniversaladversarialwaveformredteamingaudiosafetydistributionalrequeryavailability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper establishes that a fixed, universal waveform confined to the 5–20 Hz band—far below normal human hearing—can silently degrade the task performance of large audio-language models (LALMs) across multiple models and tasks. The proposed attack, Intermittent Low-Frequency Lockout (ILL), uses a single frozen template, constructed once from a reference corpus and reference model, that transfers without per-target optimization; it reduces accuracy by up to 67 percentage points on emotion classification while keeping audible noise below 0.1% of the waveform's energy and earning a mean human audibility rating near that of clean audio. The authors argue this reveals a hidden input channel that models perceive but users cannot, creating an availability and reliability risk. They also propose a lightweight defense, Distributional Requery Guard (DRG), which detects the low-frequency distribution shift and conditionally requests a second recording, recovering mean attacked accuracy from 28.5% to 46.1%. The core message is that model perception extends below the human hearing threshold, and safety evaluation must account for this mismatch.

What carries the argument

The machinery is the universal intermittent low-frequency waveform δ*(t): a fixed 5–20 Hz signal, silent to humans, that repeats an 'on' interval derived from Sentence Attention Scale Estimation (which finds durations of continuous semantic attention via boundary scores from the reference model's audio attention) and an 'off' interval determined by a duty ratio, and whose active segment is synthesized by Frequency Confusion Transfer (which quantizes corpus spectral centroids into states and decodes a most-probable state sequence with continuous phase, so the waveform's frequency trajectory mimics corpus spectral variation). The template is constructed once, remains fixed across test recordings and targets, and is meant to be emitted acoustically so the microphone captures the physical superposition x(t)+δ(t). Detection is carried out by DRG, a spectral K-means cluster on ℓ1-normalized frequency descriptors that flags low-frequency mass and requests a second recording.

What would settle it

Run a physical test in a typical office: emit the ILL waveform from a low-frequency-capable loudspeaker at a distance that yields a measured received amplitude near β=4 at a smartphone microphone, record a speech query, and compare the LALM's task accuracy to the clean baseline; if the low-frequency band is attenuated below the noise floor by the microphone's high-pass response or AGC, or if the model's accuracy does not drop substantially, the real-world transfer claimed by the paper would not hold.

Watch

Extended reading notes

Core claim

The paper's central claim is that low-frequency signals in the 5–20 Hz range, although inaudible to humans, can be used as a universal black-box attack against large audio-language models. The authors construct ILL, an intermittent waveform derived from two components: Sentence Attention Scale Estimation, which sets the on/off timing from multi-scale changes in a reference model's attention over a speech corpus, and Frequency Confusion Transfer, which converts the corpus's spectral variation into a phase-continuous low-frequency state sequence. The fixed template is emitted as a standalone acoustic signal that superposes with the user's speech at the microphone; in simulation, it reduces accuracy by up to 67 percentage points across six LALMs and four task types, while its spectral leakage above 20 Hz is 0.06–0.08% and human raters find it as inaudible as clean audio. The authors further claim that the disruption is accompanied by reduced attention to acoustic evidence and lower confidence, and that their Distributional Requery Guard detects the shift with F1 up to 99% and recovers useful semantics by requesting a second recording. The central discovery, as stated, is that a fixed inaudible waveform, independent of any test utterance or target model, constitutes a transferable and practically stealthy availability threat to LALMs.

Load-bearing premise

The attack's real-world effect depends on the 5–20 Hz component surviving the full acoustic-to-digital chain—source, room, microphone, high-pass filters, AGC, and codec—at a received amplitude near the simulated β=4, a chain the authors simulated only as digital mixing and did not reproduce in the physical world.

Editorial extensions

If this is right

  • LALMs that ingest raw audio inherit a security surface below the human hearing threshold, so any safety argument based on human audibility is insufficient.
  • A single universal waveform can disrupt multiple models without per-target optimization, lowering the barrier to launching an attack.
  • Objective spectral leakage and subjective audibility ratings must be reported together, since a low ANR does not by itself prove human imperceptibility.
  • Conditional reacquisition, as used by DRG, can recover task semantics in the presence of low-frequency interference, and the same requery helps for other noise types, suggesting a general defense principle.
  • The observed drop in audio attention mass and correct-answer probability under attack indicates that interference acts on internal evidence use, implying that monitoring these quantities might offer a detection signal.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: If the physical chain can deliver the modeled received amplitude β=4 at the microphone, the same ILL template could be tested over the air; the authors did not reproduce the complete acoustic path, so physical realism remains open.
  • Editorial inference: The success of a universal template suggests that similar below-perception side channels (e.g., ultrasonic or other sub-audible bands) might be exploited to perturb models that process those bands, though this is not tested here.
  • Editorial inference: DRG's principle—when input distribution shifts, ask for independent evidence—is a general availability-defense idea that could be applied to other input corruptions beyond low frequency, supported by the paper's transfer results on four other attack types.
  • Editorial inference: The strong effect of a fixed 5–20 Hz waveform on emotion classification (RAVDESS) suggests that prosodic and paralinguistic features are particularly sensitive to low-frequency contamination, a hypothesis the paper does not test directly.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper introduces Intermittent Low-Frequency Lockout (ILL), a fixed universal waveform in the 5-20 Hz band, constructed offline using attention-based active-interval estimation and corpus-derived frequency-state transitions, and evaluates it as a black-box attack on six large audio-language models (LALMs) across speech recognition, translation, audio question answering, and emotion classification. It also proposes Distributional Requery Guard (DRG), a clustering-based detector that flags low-frequency distribution shifts and requests a second recording for semantic recovery, and evaluates this defense on the same tasks. The digital experiments report task accuracy reductions of up to 67 percentage points, an audible noise ratio of 0.06-0.08%, a mean human audibility rating of 1.33 (close to 1.17 for clean audio), and defense gains from 28.5% to 46.1% attacked accuracy after clean reacquisition.

Significance. The paper targets a plausible and underexplored input-surface risk: signals below the conventional audibility cutoff that may still reach LALM frontends and influence behavior. The digital evaluation is broad and internally consistent, with a common RMS budget across baselines, ablation studies, and internal attention/confidence analyses. The method is black-box in the sense that the waveform is fixed and constructed from a reference model without querying the target. If the physical channel were validated, the work would constitute a meaningful contribution to LALM safety. However, the central 'inaudible' and 'practical' claims currently rest on a simulated receiver-side evaluation and on human ratings obtained through playback transducers that likely attenuate the very band under study. This gap is load-bearing and must be addressed by physical validation or by a substantial reframing of the claims to a digital simulation study.

major comments (4)
  1. [Threat Model; Limitations; Appendix A; Appendix F; Eq. (14)] The abstract's central claim that ILL is an inaudible input posing a practical hidden channel requires that a real acoustic emission deliver a 5-20 Hz component with the modeled amplitude beta=4 to the target microphone while a human in the same room perceives it as inaudible. The manuscript states in the Limitations that the experiments 'simulate microphone reception and do not reproduce the complete acoustic path from a loudspeaker through a real-world acoustic environment to a microphone,' and Appendix A provides only literature support for feasibility rather than end-to-end measurements. Meanwhile, the human audibility evaluation in Appendix F played the digitally mixed composite x+delta through conventional headphones or loudspeakers, which typically have strong roll-off below 20 Hz; a mean rating of 1.33 may therefore reflect the transducer's inability to reproduce 5-20 Hz rather than human insensitivity to a physically present low-frequency pressure field. Thus the two halves of the combined claim are not jointly established: the attack-effectiveness half assumes the chain preserves the low-frequency component to the model, while the inaudibility half likely removes it from the listener. This needs to be fixed by physical experiments or by explicitly scaling back the claims to a simulated receiver-side effect.
  2. [Eq. (13); Fig. 3; Appendix F] The audible noise ratio (ANR) is computed on the digital waveform and therefore says nothing about whether the acoustic field at the listener's ear contains perceptible low-frequency energy. The statement that 'the agreement between the human ratings and ANR supports the low perceptibility of ILL' is only valid for the playback chain used in the rating study, not for a physical deployment. Moreover, the human rating results are reported only as aggregate means and medians; no variance, confidence intervals, or per-condition statistics are given, so the difference between 1.33 and 1.17 is not shown to be statistically meaningful. Please report full distributions, confidence intervals, and ideally disaggregate by playback mode (headphones versus loudspeaker).
  3. [Appendix D; Eq. (14)] The common RMS budget sets RMS(delta)=4 for every attack, but the manuscript does not specify the RMS or amplitude normalization of the clean source audio x. If x is in a conventional sample range, a perturbation with RMS 4 can dominate the composite signal, which would make the model-side degradation unsurprising and would make the 'stealthy' interpretation of the human ratings depend entirely on playback roll-off. Please report the SNR (or the ratio of perturbation RMS to speech RMS) and verify that the reported attack effectiveness is not an artifact of a single arbitrary amplitude scale.
  4. [Fig. 5; Introduction; Table 3] The Introduction claims that 'the same requery mechanism also recovers useful semantic evidence under other noise perturbations and attack methods,' but the DRG detector is trained and evaluated (Table 3) only on ILL-style low-frequency interference. For the four additional attack types in Figure 5, it is not specified whether DRG's detector actually flags those attacks and with what accuracy, or whether requery was forced for the comparison. Without this information, the transfer claim is not substantiated. Please clarify the experimental setup or restrict the claim to the ILL case.
minor comments (6)
  1. [Method; Experiments] The phrases 'specified in Section' and 'defined in Section' appear without section numbers (in the DRG description and the metrics paragraph); please add numbered references.
  2. [Appendix F] The description '112 complete human response sets' is ambiguous: report whether these are 112 distinct participants each rating all conditions, or 112 ratings per condition.
  3. [Figures 5 and 6] The abbreviations 'M&alpha', 'S&beta', 'Q&gamma', etc. are not defined in the captions; add a legend identifying M (MiniCPM), S (StepAudio), Q (Qwen3), and the attack symbols.
  4. [Eq. (13)] The audible noise ratio uses an upper cutoff of 8 kHz without explanation; either justify the cutoff or align it with the stated 20 kHz audibility boundary.
  5. [Table 1] The color legend (gray/red/green) cannot be conveyed in a monochrome print; the parenthesized subscripts are sufficient, but the caption should state that the colors are only an aid in the electronic version.
  6. [Method; Frequency Confusion Transfer] The mean corpus duration T-bar is defined but it is not immediately clear how it is used; please explicitly connect it to the definition of K=round(T_cyc/T-bar)+1.

Circularity Check

1 steps flagged · score 2.0 of 10

Core ILL transfer result is independent; only the ANR metric is self-definitional by band design.

  1. self definitional [Section 'Acoustic Stealthiness', Eq. (13); construction in Eq. (10)]
    "Because ILL operates at 5–20 Hz, we quantify this spectral leakage as: ANR = 100× Enoise(20 Hz–8 kHz)/Enoise(full band), where lower ANR indicates less perturbation energy in this band. Across the six datasets, ILL has an ANR of only 0.06–0.08%."

    ILL's active waveform is synthesized with instantaneous frequencies f_sk chosen uniformly in [f_min, f_max] = [5, 20] Hz (Eq. 5 and Eq. 10). Therefore virtually all of its energy lies below 20 Hz, so the numerator of Eq. (13) (energy in 20 Hz–8 kHz) is near zero by construction. Reporting this as a stealthiness result is a definitional consequence of the waveform design, not an independent confirmation; the non-tautological support comes from the separate human-rating study, which is itself subject to the playback-chain limitation acknowledged in the Limitations section.

full rationale

The core derivation chain is not circular. ILL is constructed once from a reference corpus and Qwen2.5-Omni attention, then fixed and evaluated on disjoint test examples across six LALMs. The largest accuracy drop (67 pp on RAVDESS) occurs on StepAudio2, a target not used in constructing the waveform, so the transfer claim has independent empirical content rather than reducing to the construction inputs. The DRG defense is trained on clean and ILL-jammed recordings and evaluated against the same interference type; this is standard supervised detection evaluation, not a derivation from the claim it supports. The only mild self-referential element is the ANR metric: because the waveform is deliberately synthesized in the 5–20 Hz band, its near-zero audible-band energy is largely guaranteed by the construction. The paper acknowledges this by defining ANR explicitly in terms of the 5–20 Hz operating band, and it supplements ANR with a human audibility study; the latter is not circular, though it inherits the acknowledged limitation that the complete physical acoustic path was not reproduced. The one self-citation (Zhang et al. 2026) appears only in the related-work enumeration of defenses and is not load-bearing. No central result reduces by construction to its own inputs.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central claims rest on domain assumptions about physical delivery and model preprocessing of sub-20 Hz signals, plus hand-tuned hyperparameters. The attack is measured rather than derived, so the ledger is short, but the untested physical link is a real burden.

free parameters (5)
  • Perturbation amplitude beta = 4 (RMS budget)
    Selected from the knee of the accuracy-vs-amplitude curve in Figure 6a; controls received noise intensity in simulations.
  • Duty ratio gamma = ~0.7 (saturation region)
    Ablation in Figure 6b shows little gain beyond 70% active proportion; the selected value is treated as default.
  • Number of frequency states n = unspecified (figure implies 4)
    Eq. 5 defines n>=2; the main text never fixes n, though Figure 1 draws a 4-state sequence.
  • Laplace smoothing alpha = unspecified
    Used in Eq. 8 for the transition matrix; no value is reported.
  • Boundary detection scales W = {rho, 5*rho, 10*rho}
    Heuristic choice in Sentence Attention Scale Estimation; no sensitivity analysis is given.
assumptions (5)
  • standard math Standard signal processing operations (STFT, spectral centroid, K-means, Viterbi decoding) are correct and applicable here.
    Used throughout the method; no proofs are needed for these well-established tools.
  • domain assumption 5-20 Hz energy survives the audio frontends of the six evaluated LALMs and influences generation.
    The attack is applied digitally before the models; observed drops imply low-frequency retention, but the preprocessing of each model is not profiled.
  • domain assumption A physical emitter, room, and microphone chain can deliver received amplitude beta=4 used in simulation.
    Appendix A cites low-frequency generation and microphone measurements, but no over-the-air experiment is performed.
  • domain assumption The 100-example reference corpora are representative enough to build a universal waveform and train DRG's K-means detector.
    Only 100 examples per dataset are used; sensitivity to corpus size is not studied.
  • domain assumption Human inaudibility is adequately measured by ANR leakage (20 Hz-8 kHz) and playback of digital mixes.
    Subjective ratings use 112 participants on digital playback; real loudspeaker emissions may add audible mechanical artifacts.

how reviews work

0 comments
Cite this review

Pith. "Pith review of From Inaudible Inputs to Model Failures: Low-Frequency Safety Risks in LALMs." pith.science (2026). https://pith.science/paper/LGI4VD5R

@misc{pith2026260809158,
  author       = {Pith},
  title        = {Pith review of: From Inaudible Inputs to Model Failures: Low-Frequency Safety Risks in LALMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LGI4VD5R}},
  note         = {Machine review of arXiv:2608.09158}
}
read the original abstract

Large audio-language models (LALMs) have demonstrated strong capabilities in understanding diverse audio inputs. This diversity includes low-frequency signals that are inaudible to humans but can still enter the model and influence its generation. However, the practical impact of such low-frequency inputs on LALMs remains largely unexplored. In this paper, we propose Intermittent Low-Frequency Lockout (ILL), an inaudible red teaming method that evaluates this risk using a universal waveform template in a black box setting. ILL uses Sentence Attention Scale Estimation to determine active intervals and Frequency Confusion Transfer to construct a low-frequency waveform with continuous phase from corpus spectral variation. To mitigate this risk, we propose Distributional Requery Guard (DRG) to detect low-frequency distribution shifts and conditionally request a second recording for semantic recovery. Across six LALMs and multiple audio understanding tasks, ILL reduces accuracy by up to 67 percentage points while receiving a mean human audibility rating of 1.33, close to 1.17 for clean audio; DRG raises mean attacked accuracy from 28.5\% to 46.1\% after clean reacquisition. These findings identify a previously overlooked safety risk for LALMs and provide a foundation for future research on robust audio understanding.

Figures

Figures reproduced from arXiv: 2608.09158 by the authors.

Figure 1
Figure 1. Overview of the low-frequency perception gap, the construction of ILL, the DRG detection pipeline, and the evaluation. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Attack effectiveness on translation and recognition. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Human audibility ratings across 100+ responses. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (2 more)
Figure 5
Figure 5. Figure 5: Recovery under four additional attack types. [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: ILL component analysis on Qwen3-Omni. Panels vary (a) amplitude, (b) duty cycle, (c) segment length, and (d) [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

81 extracted references · 56 canonical work pages

  1. [1]

    Audio is the achilles’ heel: Red teaming audio large multimodal models , author=. Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) , pages=

    2025

  2. [2]

    and Hullar, Timothy E

    Salt, Alec N. and Hullar, Timothy E. , year=. Responses of the ear to low frequency sounds, infrasound and wind turbines , volume=. Hearing Research , publisher=. doi:10.1016/j.heares.2010.06.007 , number=

    work page doi:10.1016/j.heares.2010.06.007 2010

  3. [5]

    ArXiv , year=

    Qwen2.5-Omni Technical Report , author=. ArXiv , year=

    work page

  4. [7]

    International Conference on Learning Representations , volume=

    Mmau: A massive multi-task audio understanding and reasoning benchmark , author=. International Conference on Learning Representations , volume=

  5. [8]

    2015 IEEE international conference on acoustics, speech and signal processing (ICASSP) , pages=

    Librispeech: an asr corpus based on public domain audio books , author=. 2015 IEEE international conference on acoustics, speech and signal processing (ICASSP) , pages=. 2015 , organization=

    2015

  6. [9]

    CoVoST 2 and Massively Multilingual Speech Translation , author=. Proc. Interspeech 2021 , pages=

    work page 2021

  7. [10]

    PloS one , volume=

    The Ryerson Audio-Visual Database of Emotional Speech and Song (RAVDESS): A dynamic, multimodal set of facial and vocal expressions in North American English , author=. PloS one , volume=. 2018 , publisher=

    2018

  8. [11]

    Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages=

    Muting whisper: A universal acoustic adversarial attack on speech foundation models , author=. Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages=

    work page 2024

Show all 81 references
  1. [12]

    International Conference on Artificial Intelligence and Statistics , pages=

    Robustness of classifiers to uniform _p and Gaussian noise , author=. International Conference on Artificial Intelligence and Statistics , pages=. 2018 , organization=

    2018

  2. [13]

    2017 IEEE international conference on acoustics, speech and signal processing (ICASSP) , pages=

    A study on data augmentation of reverberant speech for robust speech recognition , author=. 2017 IEEE international conference on acoustics, speech and signal processing (ICASSP) , pages=. 2017 , organization=

    2017

  3. [15]

    IEEE Transactions on Acoustics Speech and Signal Processing , volume=

    Speech enhancement using a minimum-mean square error short-time spectral amplitude estimator , author=. IEEE Transactions on Acoustics Speech and Signal Processing , volume=

  4. [16]

    Proceedings of the 40th annual meeting of the Association for Computational Linguistics , pages=

    Bleu: a method for automatic evaluation of machine translation , author=. Proceedings of the 40th annual meeting of the Association for Computational Linguistics , pages=

  5. [17]

    Findings of the Association for Computational Linguistics: ACL 2025 , pages=

    Who Can Withstand Chat-Audio Attacks? An Evaluation Benchmark for Large Audio-Language Models , author=. Findings of the Association for Computational Linguistics: ACL 2025 , pages=

    2025

  6. [18]

    IEEE Transactions on Dependable and Secure Computing , year=

    Audiojailbreak: Jailbreak attacks against end-to-end large audio-language models , author=. IEEE Transactions on Dependable and Secure Computing , year=

  7. [19]

    2025 , journal=

    Universal Acoustic Adversarial Attacks for Flexible Control of Speech-LLMs , author=. 2025 , journal=

    2025

  8. [20]

    Proceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    Attacker’s noise can manipulate your audio-based llm in the real world , author=. Proceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

  9. [21]

    Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing , pages=

    Evaluating robustness of large audio language models to audio injection: An empirical study , author=. Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing , pages=

    2025

  10. [25]

    28th Annual Network and Distributed System Security Symposium,

    Guoming Zhang and Xiaoyu Ji and Xinfeng Li and Gang Qu and Wenyuan Xu , title =. 28th Annual Network and Distributed System Security Symposium,. 2021 , url =

    2021

  11. [26]

    Findings of the Association for Computational Linguistics: EMNLP 2023 , pages=

    Speechgpt: Empowering large language models with intrinsic cross-modal conversational abilities , author=. Findings of the Association for Computational Linguistics: EMNLP 2023 , pages=

    2023

  12. [30]

    25th USENIX security symposium (USENIX security 16) , pages=

    Hidden voice commands , author=. 25th USENIX security symposium (USENIX security 16) , pages=

  13. [31]

    Proceedings of the 2017 ACM SIGSAC conference on computer and communications security , pages=

    Dolphinattack: Inaudible voice commands , author=. Proceedings of the 2017 ACM SIGSAC conference on computer and communications security , pages=

    2017

  14. [32]

    2018 IEEE security and privacy workshops (SPW) , pages=

    Audio adversarial examples: Targeted attacks on speech-to-text , author=. 2018 IEEE security and privacy workshops (SPW) , pages=. 2018 , organization=

    2018

  15. [33]

    27th USENIX security symposium (USENIX security 18) , pages=

    \ CommanderSong \ : A systematic approach for practical adversarial voice recognition , author=. 27th USENIX security symposium (USENIX security 18) , pages=

  16. [34]

    Network and Distributed Systems Security (NDSS) Symposium , year=

    Surfingattack: Interactive hidden attack on voice assistants using ultrasonic guided waves , author=. Network and Distributed Systems Security (NDSS) Symposium , year=

  17. [35]

    Findings of the Association for Computational Linguistics: ACL 2024 , pages=

    Speechguard: exploring the adversarial robustness of multi-modal large language models , author=. Findings of the Association for Computational Linguistics: ACL 2024 , pages=

    2024

  18. [36]

    Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing , pages=

    Spirit: Patching speech language models against jailbreak attacks , author=. Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing , pages=

    2025

  19. [38]

    Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    Audio jailbreak: An open comprehensive benchmark for jailbreaking large audio-language models , author=. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

  20. [39]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Hidden in the noise: Unveiling backdoors in audio llms alignment through latent acoustic pattern triggers , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  21. [41]

    Proceedings of the IEEE , volume=

    A unified approach to short-time Fourier analysis and synthesis , author=. Proceedings of the IEEE , volume=. 1977 , publisher=

    1977

  22. [42]

    International journal of market research , volume=

    Do data characteristics change according to the number of scale points used? An experiment using 5-point, 7-point and 10-point scales , author=. International journal of market research , volume=. 2008 , publisher=

    2008

  23. [43]

    The Journal of the Acoustical Society of America , volume=

    A portable infrasound generator , author=. The Journal of the Acoustical Society of America , volume=. 2009 , publisher=

    2009

  24. [44]

    Sensors , volume=

    Response identification in the extremely low frequency region of an electret condenser microphone , author=. Sensors , volume=. 2011 , publisher=

    2011

  25. [45]

    The Journal of the Acoustical Society of America , volume=

    Digital acoustic sensor performance across the infrasound range in non-isolated conditions , author=. The Journal of the Acoustical Society of America , volume=. 2018 , publisher=

    2018

  26. [46]

    The Journal of the Acoustical Society of America , volume=

    A comparison of smartphone and infrasound microphone data from a fuel air explosive and a high explosive , author=. The Journal of the Acoustical Society of America , volume=. 2024 , publisher=

    2024

  27. [47]

    Proceedings of the IEEE , volume=

    Communication in the presence of noise , author=. Proceedings of the IEEE , volume=. 1998 , publisher=

    1998

  28. [48]

    WebRTC audio codec and processing requirements , author=

  29. [49]

    B.; and Rabiner, L

    Allen, J. B.; and Rabiner, L. R. 1977. A unified approach to short-time Fourier analysis and synthesis. Proceedings of the IEEE, 65(11): 1558--1564

    1977

  30. [50]

    Asmar, K.; Garc \'e s, M.; Hart, D.; and Williams, B. 2018. Digital acoustic sensor performance across the infrasound range in non-isolated conditions. The Journal of the Acoustical Society of America, 144(5): 3036--3045

    2018

  31. [51]

    Carlini, N.; Mishra, P.; Vaidya, T.; Zhang, Y.; Sherr, M.; Shields, C.; Wagner, D.; and Zhou, W. 2016. Hidden voice commands. In 25th USENIX security symposium (USENIX security 16), 513--530

    2016

  32. [52]

    Carlini, N.; and Wagner, D. 2018. Audio adversarial examples: Targeted attacks on speech-to-text. In 2018 IEEE security and privacy workshops (SPW), 1--7. IEEE

    2018

  33. [53]

    Chen, G.; Song, F.; Zhao, Z.; Jia, X.; Liu, Y.; Qiao, Y.; Zhang, W.; Tu, W.; Yang, Y.; and Du, B. 2026. Audiojailbreak: Jailbreak attacks against end-to-end large audio-language models. IEEE Transactions on Dependable and Secure Computing

    2026

  34. [54]

    Chu, Y.; Xu, J.; Yang, Q.; Wei, H.; Wei, X.; Guo, Z.; Leng, Y.; Lv, Y.; He, J.; Lin, J.; et al. 2024. Qwen2-audio technical report. arXiv preprint arXiv:2407.10759

    2024 arXiv

  35. [55]

    Chu, Y.; Xu, J.; Zhou, X.; Yang, Q.; Zhang, S.; Yan, Z.; Zhou, C.; and Zhou, J. 2023. Qwen-audio: Advancing universal audio understanding via unified large-scale audio-language models. arXiv preprint arXiv:2311.07919

    2023 arXiv

  36. [56]

    Cui, J.; Xu, B.; Wang, C.; Yu, T.; Sun, W.; Xu, Y.; Wang, T.; He, Z.; Ma, W.; Cai, T.; et al. 2026. Minicpm-o 4.5: Towards real-time full-duplex omni-modal interaction. arXiv preprint arXiv:2604.27393

    2026 arXiv

  37. [57]

    Dawes, J. 2008. Do data characteristics change according to the number of scale points used? An experiment using 5-point, 7-point and 10-point scales. International journal of market research, 50(1): 61--104

    2008

  38. [58]

    Djanibekov, A.; Mukhituly, N.; Inui, K.; Aldarmaki, H.; and Lukas, N. 2025. Spirit: Patching speech language models against jailbreak attacks. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, 14514--14531

    2025

  39. [59]

    Ephraim, Y.; and Malah, D. 1984. Speech enhancement using a minimum-mean square error short-time spectral amplitude estimator. IEEE Transactions on Acoustics Speech and Signal Processing, 32(6): 1109--1121

    1984

  40. [60]

    Franceschi, J.-Y.; Fawzi, A.; and Fawzi, O. 2018. Robustness of classifiers to uniform _p and Gaussian noise. In International Conference on Artificial Intelligence and Statistics, 1280--1288. PMLR

    2018

  41. [61]

    G.; Chen, Q.; and Koltun, V

    Germain, F. G.; Chen, Q.; and Koltun, V. 2018. Speech denoising with deep feature losses. arXiv preprint arXiv:1806.10522

    2018 arXiv

  42. [62]

    Hou, G.; He, J.; Zhou, Y.; Guo, J.; Qiao, Y.; Zhang, R.; and Jiang, W. 2025. Evaluating robustness of large audio language models to audio injection: An empirical study. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, 25671--25687

    2025

  43. [63]

    Hsu, T.-w.; Lu, K.-H.; Chiang, C.-H.; and Lee, H.-y. 2025. Reducing object hallucination in large audio-language models via audio-aware decoding. arXiv preprint arXiv:2506.07233

    2025 arXiv

  44. [64]

    Jeng, Y.-N.; Yang, T.-M.; and Lee, S.-Y. 2011. Response identification in the extremely low frequency region of an electret condenser microphone. Sensors, 11(1): 623--637

    2011

  45. [65]

    L.; and Khudanpur, S

    Ko, T.; Peddinti, V.; Povey, D.; Seltzer, M. L.; and Khudanpur, S. 2017. A study on data augmentation of reverberant speech for robust speech recognition. In 2017 IEEE international conference on acoustics, speech and signal processing (ICASSP), 5220--5224. IEEE

    2017

  46. [66]

    Lin, L.; Yu, M.; Luo, K.; Zhang, Y.; Peng, L.; Wang, D.; Tang, X.; Zhang, Y.; Yang, X.; Zhou, Z.; et al. 2026. Hidden in the noise: Unveiling backdoors in audio llms alignment through latent acoustic pattern triggers. In Proceedings of the AAAI Conference on Artificial Intelli...

    2026

  47. [67]

    R.; and Russo, F

    Livingstone, S. R.; and Russo, F. A. 2018. The Ryerson Audio-Visual Database of Emotional Speech and Song (RAVDESS): A dynamic, multimodal set of facial and vocal expressions in North American English. PloS one, 13(5): e0196391

    2018

  48. [68]

    Ma, R.; Qian, M.; Raina, V.; Gales, M.; and Knill, K. 2025. Universal Acoustic Adversarial Attacks for Flexible Control of Speech-LLMs. Association for Computational Linguistics (ACL)

    2025

  49. [69]

    Panayotov, V.; Chen, G.; Povey, D.; and Khudanpur, S. 2015. Librispeech: an asr corpus based on public domain audio books. In 2015 IEEE international conference on acoustics, speech and signal processing (ICASSP), 5206--5210. IEEE

    2015

  50. [70]

    Papineni, K.; Roukos, S.; Ward, T.; and Zhu, W.-J. 2002. Bleu: a method for automatic evaluation of machine translation. In Proceedings of the 40th annual meeting of the Association for Computational Linguistics, 311--318

    2002

  51. [71]

    Park, J.; and Robertson, J. 2009. A portable infrasound generator. The Journal of the Acoustical Society of America, 125(4): EL148--EL151

    2009

  52. [72]

    M.; Ronanki, S.; Bhatia, A.; Mundnich, K.; Dingliwal, S.; Das, N.; Hou, Z.; Huybrechts, G.; Vishnubhotla, S.; et al

    Peri, R.; Jayanthi, S. M.; Ronanki, S.; Bhatia, A.; Mundnich, K.; Dingliwal, S.; Das, N.; Hou, Z.; Huybrechts, G.; Vishnubhotla, S.; et al. 2024. Speechguard: exploring the adversarial robustness of multi-modal large language models. In Findings of the Association for Computat...

    2024

  53. [73]

    Raina, V.; Ma, R.; McGhee, C.; Knill, K.; and Gales, M. 2024. Muting whisper: A universal acoustic adversarial attack on speech foundation models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, 7549--7565

    2024

  54. [74]

    K.; Asawaroengchai, C.; Nguyen, D

    Rubenstein, P. K.; Asawaroengchai, C.; Nguyen, D. D.; Bapna, A.; Borsos, Z.; Quitry, F. d. C.; Chen, P.; Badawy, D. E.; Han, W.; Kharitonov, E.; et al. 2023. Audiopalm: A large language model that can speak and listen. arXiv preprint arXiv:2306.12925

    2023 arXiv

  55. [75]

    S.; Feizi, S.; Mathews, R.; and Wang, L

    Sadasivan, V. S.; Feizi, S.; Mathews, R.; and Wang, L. 2026. Attacker’s noise can manipulate your audio-based llm in the real world. In Proceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers), 1430--1440

    2026

  56. [76]

    Sakshi, S.; Tyagi, U.; Kumar, S.; Seth, A.; Selvakumar, R.; Nieto, O.; Duraiswami, R.; Ghosh, S.; and Manocha, D. 2025. Mmau: A massive multi-task audio understanding and reasoning benchmark. In International Conference on Learning Representations, volume 2025, 84929--84964

    2025

  57. [77]

    N.; and Hullar, T

    Salt, A. N.; and Hullar, T. E. 2010. Responses of the ear to low frequency sounds, infrasound and wind turbines. Hearing Research, 268(1-2): 12--21

    2010

  58. [78]

    Song, Z.; Jiang, Q.; Cui, M.; Li, M.; Gao, L.; Zhang, Z.; Xu, Z.; Wang, Y.; Ouyang, G.; Chen, Z.; et al. 2026. Audio jailbreak: An open comprehensive benchmark for jailbreaking large audio-language models. In Proceedings of the 64th Annual Meeting of the Association for Comput...

    2026

  59. [79]

    K.; Popenhagen, S.; Ocampo Giraldo, L.; Cardenas, E.; Hix, J.; Thompson, S.; Chichester, D.; and Garc \'e s, M

    Takazawa, S. K.; Popenhagen, S.; Ocampo Giraldo, L.; Cardenas, E.; Hix, J.; Thompson, S.; Chichester, D.; and Garc \'e s, M. 2024. A comparison of smartphone and infrasound microphone data from a fuel air explosive and a high explosive. The Journal of the Acoustical Society of...

    2024

  60. [80]

    Wang, C.; Wu, A.; Gu, J.; and Pino, J. 2021. CoVoST 2 and Massively Multilingual Speech Translation. In Proc. Interspeech 2021, 2247--2251

    2021

  61. [81]

    Wu, B.; Yan, C.; Hu, C.; Yi, C.; Feng, C.; Tian, F.; Shen, F.; Yu, G.; Zhang, H.; Li, J.; et al. 2025. Step-audio 2 technical report. arXiv preprint arXiv:2507.16632

    2025 arXiv

  62. [82]

    Xu, J.; Guo, Z.; He, J.; Hu, H.; He, T.; Bai, S.; qin Chen, K.; Wang, J.; Fan, Y.; Dang, K.; Zhang, B.; Wang, X.; Chu, Y.; and Lin, J. 2025 a . Qwen2.5-Omni Technical Report. ArXiv, abs/2503.20215

    2025 arXiv

  63. [83]

    Xu, J.; Guo, Z.; Hu, H.; Chu, Y.; Wang, X.; He, J.; Wang, Y.; Shi, X.; He, T.; Zhu, X.; et al. 2025 b . Qwen3-omni technical report. arXiv preprint arXiv:2509.17765

    2025 arXiv

  64. [84]

    Yan, Q.; Liu, K.; Zhou, Q.; Guo, H.; and Zhang, N. 2020. Surfingattack: Interactive hidden attack on voice assistants using ultrasonic guided waves. In Network and Distributed Systems Security (NDSS) Symposium

    2020

  65. [85]

    Yang, H.; Qu, L.; Shareghi, E.; and Haffari, G. 2025 a . Audio is the achilles’ heel: Red teaming audio large multimodal models. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Techno...

    2025

  66. [86]

    Yang, W.; Li, Y.; Fang, M.; Wei, Y.; and Chen, L. 2025 b . Who Can Withstand Chat-Audio Attacks? An Evaluation Benchmark for Large Audio-Language Models. In Findings of the Association for Computational Linguistics: ACL 2025, 17205--17220

    2025

  67. [87]

    Yang, Y.; Zhang, X.; Han, Z.; Wang, S.; Zhuang, J.; Jin, Z.; Shao, J.; Sun, G.; and Zhang, C. 2025 c . Speech-Audio Compositional Attacks on Multimodal LLMs and Their Mitigation with SALMONN-Guard. arXiv preprint arXiv:2511.10222

    2025

  68. [88]

    Yin, H.; Xiao, Y.; Kwon, Y.; Dang, T.; and Choi, J.-W. 2026. Focus Then Listen: An Empirical Study of Plug-and-Play Audio Enhancer for Noise-Robust Large Audio Language Models. arXiv preprint arXiv:2603.04862

    2026 arXiv

  69. [89]

    Yu, Y.; Jin, H.; Yu, Y.; Zhuang, J.; and Wang, H. 2026. Now You Hear Me: Audio Narrative Attacks Against Large Audio-Language Models. arXiv preprint arXiv:2601.23255

    2026

  70. [90]

    Yuan, X.; Chen, Y.; Zhao, Y.; Long, Y.; Liu, X.; Chen, K.; Zhang, S.; Huang, H.; Wang, X.; and Gunter, C. A. 2018. \ CommanderSong \ : A systematic approach for practical adversarial voice recognition. In 27th USENIX security symposium (USENIX security 18), 49--64

    2018

  71. [91]

    Zhang, D.; Li, S.; Zhang, X.; Zhan, J.; Wang, P.; Zhou, Y.; and Qiu, X. 2023. Speechgpt: Empowering large language models with intrinsic cross-modal conversational abilities. In Findings of the Association for Computational Linguistics: EMNLP 2023, 15757--15773

    2023

  72. [92]

    Zhang, G.; Yan, C.; Ji, X.; Zhang, T.; Zhang, T.; and Xu, W. 2017. Dolphinattack: Inaudible voice commands. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, 103--117

    2017

  73. [93]

    Zhang, Y.; Tian, J.; Zhang, Y.; Yan, S.; Lin, L.; Zhou, Z.; Sun, L.; and Su, S. 2026. SEE: Signal Embedding Energy for Quantifying Noise Interference in Large Audio Language Models. arXiv preprint arXiv:2601.07331

    2026

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.