Pith. sign in

REVIEW 4 major objections 6 minor 36 references

Never Stop Speaking: a Denial-of-Service Attack on End-to-End Speech Language Models

T0 review · 4 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Tiny, barely audible acoustic perturbations can force end-to-end speech models to generate responses at their maximum token cap, with reported success rates of 0.87 and 0.84.

desk verdict First perturbation-based DoS attack aimed at end-to-end speech LLMs, with credible white-box results, but the paper under-specifies the gradient path through discrete decoding. read the letter →

arxiv 2608.10405 v1 pith:4QQX46JO submitted 2026-08-11 cs.SD cs.AI

Shuozhe Cheng , Kunlan Xiang , Mingxuan Li , Ji Zhang , Dongxiao Liu , Wenbo Jiang This is my paper · ORCID
classification cs.SDcs.AI
keywords adversarialattackdenialofserviceend-to-endspeechlanguagemodelsEOSsuppressionvoiceactivitydetectionimperceptibleperturbationaudioLLMsecurityautoregressivedecoding
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that a small, barely audible noise added to a spoken input can make end-to-end audio language models keep talking instead of stopping. The attack is a white-box optimization: an attacker who knows a model's parameters adds a bounded perturbation, constrained to voiced portions of the audio, that suppresses the model's end-of-sentence signal and nudges its decoding toward the maximum token limit. On three open-source speech LLMs the reported attack success rate is 0.83 to 0.87, average output length rises from roughly 200 tokens to between 905 and 942 tokens, and peak GPU memory during inference grows by about one fifth. The paper's point is that continuous speech input, unlike discrete text, can be attacked directly in the waveform domain, so existing prompt-based defenses and EOS-suppression tricks for ASR are not the right baseline.

What carries the argument

The load-bearing object is the composite loss $L_{\rm DoS} = L_{\rm eos} + L_{\rm topk} + L_{\rm len} + L_{\rm sem}$ optimized by projected gradient descent. The EOS term assigns a weight $w_t = w_{\rm high}\exp(t/N\kappa)$ to positive EOS logits, concentrating pressure on later decoding steps; the length term uses an expected-length surrogate $E[L] = \sum_{t=1}^N t\, p_t \prod_{i=1}^{t-1}(1-p_i)$ so that a discrete count becomes differentiable; the semantic term compares encoder features via cosine similarity. A voice-activity-detection mask restricts perturbations to voiced segments, which the paper reports preserves attack success while improving stealth.

What would settle it

Run the same white-box optimization but block gradients from flowing through the token-selection step (treating the sampled token path as fixed for each iteration) and compare the resulting attack success rate and output length to the reported values; if the attack loses most of its effect, the stable EOS suppression depends on an unstated differentiability assumption.

Watch

Extended reading notes

Core claim

The central discovery is that the termination behavior of end-to-end speech LLMs can be steered by gradient-based perturbation of the raw waveform. The authors formulate the attack as minimizing a composite objective over a constrained perturbation $\delta$: suppress the EOS logits at every autoregressive step with step-dependent weights, raise the logits of the top-$k$ tokens, pull the expected generation length toward $N_{\max}$, and keep the semantic embedding of the perturbed audio close to the clean audio. With $\|\delta\|_\infty \le 10^{-4}$ and perturbations placed only in voiced regions, the optimized waveform pushes responses to an average of 941.88 and 920.24 tokens on LFM2.5-Audio and FunAudioChat, compared with 198.34 and 213.57 on clean audio, at reported attack success rates of 0.87 and 0.84.

Load-bearing premise

The load-bearing premise is that gradient descent on the audio waveform can reliably suppress the model's stop signal even though the model chooses tokens by discrete sampling during decoding, and the paper does not fully specify how that discrete step is differentiated.

Editorial extensions

If this is right

  • End-to-end speech LLMs are vulnerable to denial of service by imperceptible waveform perturbations, not just by crafted text prompts.
  • In a white-box setting an attacker can raise GPU memory consumption during inference by roughly 20 percent (for example, from 8.89 to 10.78 GB on LFM2.5-Audio) while keeping responses semantically similar.
  • The attack transfers across models at rates of 7 to 13 percent, so a perturbation optimized on one architecture retains partial effectiveness against others.
  • The same multi-loss recipe works under greedy decoding and tolerates small additional noise, suggesting the vulnerability is not an artifact of sampling randomness.
  • Lossy compression such as MP3 degrades the attack, pointing to signal transformation as a candidate defensive direction.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Not stated in the paper: how gradients are routed through discrete token selection remains unspecified, so a replication that blocks this path would test whether the attack's stability depends on that choice.
  • Not stated in the paper: the same composite-loss design should transfer to other continuous-input sequence models, such as vision-language LLMs with a termination token.
  • Not stated in the paper: the 7 to 13 percent cross-model transfer rates suggest that an attacker could optimize on a surrogate model and deploy black-box, which makes evaluation on larger model families a natural next step.
  • Not stated in the paper: because lossy compression weakens the attack, a learnable denoiser before decoding is a plausible defense, though the paper notes adaptive attackers could optimize through such a preprocessor.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. This paper proposes a white-box adversarial attack on end-to-end speech large language models (E2E ALLMs). The attack optimizes a small ℓ∞-bounded perturbation added only to voiced segments (selected via voice activity detection, VAD) of an input waveform, using a composite loss that combines weighted EOS-logit suppression (Eq. 5), a top-k logit-boosting term (Eq. 8), an expected-length surrogate loss (Eqs. 6-7), and a semantic-alignment loss (Eq. 9). The authors evaluate on LFM2.5-Audio, FunAudioChat, and Qwen2-Audio with 100 samples per dataset and report attack success rates (ASR) of 0.87, 0.84, and 0.83 and average output lengths around 900-940 tokens, along with ablations, greedy-decoding results, transferability, and robustness tests.

Significance. If the results are reproducible, the paper contributes a new attack surface for a rapidly deploying class of models and provides a first systematic study of denial-of-service attacks on E2E speech LLMs. The multi-objective loss is a reasonable engineering design, the VAD-based perturbation masking is a practical stealthiness improvement, and the evaluation spans three models and several baselines, including ablations. The main claims are weakened, however, by the absence of any statistical uncertainty quantification, an underspecified backward pass through discrete decoding, and a concrete numeric inconsistency in the resource-consumption results.

major comments (4)
  1. [Method, Optimization Pipeline (Eqs. 4-9)] The backward pass through the discrete autoregressive decoding loop is not specified. The losses Leos and Ltopk in Eqs. (5) and (8) are computed from logits at the token positions selected during decoding, and the token indices are discrete functions of the input; the paper acknowledges non-differentiability only for the length loss (Eq. 6), then states without justification that "the gradient of LDoS with respect to the perturbation is calculated via backpropagation." If the sampled token path is detached and treated as a constant, the optimizer only adjusts logits along a single trajectory per PGD iteration; if a straight-through estimator, Gumbel-softmax, or score-function estimator is used, it should be stated explicitly. This is load-bearing for reproducibility and for the claim that the attack robustly suppresses termination, and it needs to be pinned down.
  2. [Experiment, Metrics and Table 1] All headline results are averages over 100 samples with no error bars, confidence intervals, or significance tests. For instance, on LFM2.5-Audio the ASR difference between Our method (0.87) and Simple Loss (0.79) is about 8 percentage points; with n=100, the standard error of the difference is roughly 0.05, so the difference is not clearly beyond sampling noise. Report per-sample output lengths, bootstrap confidence intervals, and paired significance tests (e.g., Wilcoxon signed-rank) for the output-length and ASR comparisons.
  3. [Main Result and Table 1] The reported clean-input GPU memory usage for FunAudioChat is inconsistent: Table 1 lists 20.26 GB, while the text states 17.26 GB for clean inputs. Since increased memory consumption is one of the two central consequences claimed for the attack, this discrepancy must be resolved and all memory figures checked for consistency.
  4. [Attack Overview and Metrics] The definition of attack success rate (ASR) as the fraction of samples reaching Nmax, combined with an optimization loop that stops when the generated response reaches Nmax and a length loss that drives expected length toward Nmax, makes ASR partly a measure of optimization convergence rather than an independent property of the crafted perturbation. The paper should clarify that ASR is the converged success rate under full white-box feedback and additionally report the output-length distribution (e.g., median and quartiles) and the mean number of PGD iterations required for success.
minor comments (6)
  1. [Tables 1, 4, and 5] Numerical values are run together in several cells (e.g., "941.8810.78/47.99" and "920.2421.93/47.99"); add spacing or separators between the output-length and memory columns.
  2. [Table 2] The ablation table uses checkmarks with blank entries; state explicitly that a blank indicates the component is removed, and use ✓/✗ symbols to make the removed component unambiguous.
  3. [Throughout] The model name is inconsistent: "LFM2.5-Audio" appears in the abstract and setup, while "Liquid Audio" is used in Tables 1 and 4; unify the naming.
  4. [Appendix] The manuscript references an appendix for the response-quality prompt, Qwen2-Audio results, and transferability, but the provided text contains only garbled figure remnants in those sections; include a proper appendix with legible figures.
  5. [Eq. (5)] The weight definition wt = whigh exp(t/N κ) is ambiguous; specify whether the exponent is t/(Nκ) and define the domain of t (e.g., t = 1, ..., N).
  6. [Experiment Setup] The experimental setup should report dataset statistics (number of speakers, audio duration distribution, sample rate, languages) and hardware/GPU details, since resource consumption is a key claim and timing/memory figures depend on these choices.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper reports an optimization-based attack whose evaluation metric is aligned with the loss by design, but this is standard attack evaluation rather than a self-derived prediction.

full rationale

The paper is an attack-engineering demonstration, not a derivation of an empirical law. The composite loss LDoS is optimized directly with PGD, and the reported ASR and output lengths are measurements of how well that optimization succeeds on fresh samples. Although Eq. (7) (length loss) and the ASR metric both reference Nmax, the loss is a soft expectation surrogate while ASR is a hard threshold on actual decoded sequences, and the ablations show that Leos is the primary driver, so the headline number is not forced by construction. There are no load-bearing self-citations: the authors' prior work is not cited, and all references are standard external baselines or tools. The acknowledged non-differentiability of discrete decoding in the Method section is a reproducibility and correctness concern, not a circularity. Overall, the derivation is self-contained and no circular step reduces the result to its inputs.

Assumptions & free parameters 7 free parameters · 4 assumptions · 0 invented entities

The central claim rests on an optimization recipe whose hyperparameters, whigh, kappa, K, epsilon, Nmax, PGD iterations, and loss weights, are chosen by hand or by test-set ablation. The most consequential unstated assumption is that gradients can be obtained through the discrete decoding loop. The paper introduces no new theoretical entities.

free parameters (7)
  • whigh = 4
    Weight scale for positive EOS logits in Leos; chosen by hand with no sensitivity analysis reported beyond the ablation of kappa.
  • kappa (exponential growth parameter) = 4
    Selected because Table 3 shows the best attack success rate at kappa=4 on the evaluation models, which is test-set tuning rather than a parameter-free choice.
  • K (top-k) = 3
    Number of tokens used in the top-k logit loss; likely matches the default sampling k but is not justified independently.
  • epsilon (perturbation bound) = 1e-4
    Infinite-norm bound chosen to enforce imperceptibility; no listening test or psychoacoustic model supports this specific value.
  • Nmax = 1024
    Maximum generation length during attack optimization; because attack success is defined as reaching this cap, it directly shapes the reported ASR numbers.
  • PGD iterations = 200
    Optimization budget per sample, chosen for computational reasons with no convergence analysis.
  • loss weighting coefficients = all set to 1
    The composite loss is a simple sum of Leos, Ltopk, Llen, and Lsem; the equal weighting is arbitrary and not justified or ablated.
assumptions (4)
  • domain assumption Backpropagation through the autoregressive decoding loop yields meaningful gradients for the perturbation even though token selection is discrete.
    The Method section states gradients are calculated via backpropagation through the generation loop, but no reparameterization or straight-through estimator is described for the sampled tokens.
  • domain assumption EOS probability is p_t = sigmoid(z_t) and termination events are conditionally independent across steps, so Eq. (6) is a valid estimate of expected generation length.
    Equation (6) computes expected length as a sum of t times p_t times the product of (1 minus p_i); this is exact only under independence and sigmoid calibration of logits, neither of which is justified.
  • domain assumption An infinite-norm perturbation bound of 1e-4 guarantees imperceptibility.
    The paper equates the constraint with the human auditory perception threshold without a listening test, psychoacoustic model, or user study.
  • domain assumption LLM-as-a-judge scores on transcribed text measure semantic preservation of the audio responses.
    Response Quality is assessed by ChatGPT on extracted text tokens, although the attack manipulates audio token generation; no transcription or audio quality validation is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Never Stop Speaking: a Denial-of-Service Attack on End-to-End Speech Language Models." pith.science (2026). https://pith.science/paper/4QQX46JO

@misc{pith2026260810405,
  author       = {Pith},
  title        = {Pith review of: Never Stop Speaking: a Denial-of-Service Attack on End-to-End Speech Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4QQX46JO}},
  note         = {Machine review of arXiv:2608.10405}
}
read the original abstract

Many studies have shown that specially crafted inputs can induce large language models (LLMs) to generate excessively long outputs, resulting in significant computational overhead and resource consumption. While most existing denial-of-service (DoS) attacks target text-only LLMs, end-to-end (E2E) speech LLMs are rapidly emerging. Existing text-based DoS attacks primarily rely on prompt engineering, such as adversarial suffixes or semantic inducement, which exploit the discrete nature of text inputs and therefore cannot be directly transferred to continuous speech inputs. Moreover, prior studies on speech model security mainly focus on ASR or TTS systems, leaving the DoS vulnerability of E2E speech LLMs largely unexplored. To address this gap, we propose the perturbation-based DoS attack targeting E2E speech models. Instead of inducing long outputs through prompt manipulation, our method optimizes imperceptible acoustic perturbations to directly influence the model's autoregressive generation process while preserving the original input length. Specifically, we formulate the attack as a composite optimization objective that jointly suppresses EOS generation, encourages prolonged decoding, and largely preserves semantic consistency by integrating weighted EOS loss, top-k logit loss, length loss, and semantic alignment loss. To further improve stealthiness, we employ voice activity detection (VAD) to inject perturbations only into voiced regions. Extensive experiments on three open-source E2E speech LLMs demonstrate that our method achieves stable attack success rate while significantly increasing generation length and GPU resource consumption, revealing security risks in modern ALLMs.

Figures

Figures reproduced from arXiv: 2608.10405 by the authors.

Figure 1
Figure 1. The figure shows the outputs of the model with and without [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. This figure illustrates the workflow of the adversarial DoS attack targeting end-to-end speech large models. VAD is used to separate [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Waveform comparison between (a) clean output and (b) [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: (a) Attack performance under different additional [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 6
Figure 6. Figure 6: attack transferability all evaluated models. These results demonstrate that the pro￾posed perturbations do not rely on sampling randomness, but instead directly influence the autoregressive generation pro￾cess by suppressing termination and encouraging continuous decod…
Figure 5
Figure 5. Figure 5: Prompt used for LLM-based response quality eval [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

36 extracted references · 16 canonical work pages

  1. [1]

    Communication, Simulation, and Intelligent Agents: Implications of Personal Intelligent Machines for Medical Education

    Clancey, William J. Communication, Simulation, and Intelligent Agents: Implications of Personal Intelligent Machines for Medical Education. Proceedings of the Eighth International Joint Conference on Artificial Intelligence (IJCAI-83)

  2. [2]

    Classification Problem Solving

    Clancey, William J. Classification Problem Solving. Proceedings of the Fourth National Conference on Artificial Intelligence

  3. [3]

    , title =

    Robinson, Arthur L. , title =. 1980 , doi =. https://science.sciencemag.org/content/208/4447/1019.full.pdf , journal =

    1980

  4. [4]

    New Ways to Make Microcircuits Smaller---Duplicate Entry

    Robinson, Arthur L. New Ways to Make Microcircuits Smaller---Duplicate Entry. Science

  5. [5]

    Clancey and Glenn Rennels , abstract =

    Diane Warner Hasling and William J. Clancey and Glenn Rennels , abstract =. Strategic explanations for a diagnostic consultation system , journal =. 1984 , issn =. doi:https://doi.org/10.1016/S0020-7373(84)80003-6 , url =

    doi:10.1016/s0020-7373(84)80003-6 1984

  6. [6]

    and Rennels, Glenn R

    Hasling, Diane Warner and Clancey, William J. and Rennels, Glenn R. and Test, Thomas. Strategic Explanations in Consultation---Duplicate. The International Journal of Man-Machine Studies

  7. [7]

    Poligon: A System for Parallel Problem Solving

    Rice, James. Poligon: A System for Parallel Problem Solving

  8. [8]

    Transfer of Rule-Based Expertise through a Tutorial Dialogue

    Clancey, William J. Transfer of Rule-Based Expertise through a Tutorial Dialogue

Show all 36 references
  1. [9]

    The Engineering of Qualitative Models

    Clancey, William J. The Engineering of Qualitative Models

  2. [10]

    2023 , eprint=

    Attention Is All You Need , author=. 2023 , eprint=

    2023

  3. [11]

    Pluto: The 'Other' Red Planet

    NASA. Pluto: The 'Other' Red Planet

  4. [12]

    2025 , eprint=

    DrVoice: Parallel Speech-Text Voice Conversation Model via Dual-Resolution Speech Representations , author=. 2025 , eprint=

    2025

  5. [13]

    arXiv preprint arXiv:2511.23404 , year=

    LFM2 Technical Report , author=. arXiv preprint arXiv:2511.23404 , year=

  6. [14]

    arXiv preprint arXiv:2407.10759 , year=

    Qwen2-Audio Technical Report , author=. arXiv preprint arXiv:2407.10759 , year=

    arXiv

  7. [15]

    arXiv preprint arXiv:2412.13879 , year=

    Crabs: Consuming Resource via Auto-generation for LLM-DoS Attack under Black-box Settings , author=. arXiv preprint arXiv:2412.13879 , year=

    arXiv

  8. [16]

    2026 , eprint=

    ReasoningBomb: A Stealthy Denial-of-Service Attack by Inducing Pathologically Long Reasoning in Large Reasoning Models , author=. 2026 , eprint=

    2026

  9. [17]

    2024 , eprint=

    Denial-of-Service Poisoning Attacks against Large Language Models , author=. 2024 , eprint=

    2024

  10. [18]

    2024 , eprint=

    SpeechGuard: Exploring the Adversarial Robustness of Multimodal Large Language Models , author=. 2024 , eprint=. doi:10.48550/arXiv.2405.08317 , note=

    2024 doi arXiv

  11. [19]

    2018 , eprint=

    Audio Adversarial Examples: Targeted Attacks on Speech-to-Text , author=. 2018 , eprint=. doi:10.48550/arXiv.1801.01944 , note=

    2018 doi arXiv

  12. [20]

    2017 , eprint=

    Attention Is All You Need , author=. 2017 , eprint=. doi:10.48550/arXiv.1706.03762 , note=

    2017 doi arXiv

  13. [21]

    WebRTC Voice Activity Detector , year=

  14. [22]

    A Hybrid CNN-BiLSTM Voice Activity Detector , year=

    Wilkinson, Nicholas and Niesler, Thomas , booktitle=. A Hybrid CNN-BiLSTM Voice Activity Detector , year=

  15. [23]

    Interspeech , pages=

    Feature Learning with Raw-Waveform CLDNNs for Voice Activity Detection , author=. Interspeech , pages=

  16. [24]

    and Rabiner, L

    Atal, B. and Rabiner, L. , journal=. A pattern recognition approach to voiced-unvoiced-silence classification with applications to speech recognition , year=

  17. [25]

    2023 , eprint=

    Sparks of Large Audio Models: A Survey and Outlook , author=. 2023 , eprint=

    2023

  18. [26]

    2024 , eprint=

    Ichigo: Mixed-Modal Early-Fusion Realtime Voice Assistant , author=. 2024 , eprint=

    2024

  19. [27]

    Audio Adversarial Example With No Noise in the Silent Area for Speech Recognition System , year=

    Ko, Kyoungmin and Kim, Sunghwan and Kwon, Hyun , journal=. Audio Adversarial Example With No Noise in the Silent Area for Speech Recognition System , year=

  20. [28]

    International Conference on Learning Representations , year=

    Towards Deep Learning Models Resistant to Adversarial Attacks , author=. International Conference on Learning Representations , year=

  21. [29]

    2023 , eprint=

    SlothSpeech: Denial-of-service Attack Against Speech Recognition Models , author=. 2023 , eprint=

    2023

  22. [30]

    Definition of the Opus Audio Codec , author=

  23. [31]

    Proceedings of the IEEE , volume=

    The MPEG audio layer-3 coding standard , author=. Proceedings of the IEEE , volume=

  24. [32]

    2025 , eprint=

    Excessive Reasoning Attack on Reasoning LLMs , author=. 2025 , eprint=

    2025

  25. [33]

    2025 , eprint=

    ExtendAttack: Attacking Servers of LRMs via Extending Reasoning , author=. 2025 , eprint=

    2025

  26. [34]

    and Li, Haizhou

    Chen, Yiming and Li, Zexin and Yue, Xianghu and Tan, Robby T. and Li, Haizhou. N atural S loth: Revisiting Denial-of-Service Attacks on Large Language Models. Proceedings of the 64th Annual Meeting of the A ssociation for C omputational L inguistics (Volume 1: Long Papers). 20...

    2026 doi

  27. [35]

    2023 , note =

    OpenAI , title =. 2023 , note =

    2023

  28. [36]

    2025 , howpublished =

    OpenAI , title =. 2025 , howpublished =

    2025

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.