Pith. sign in

REVIEW 4 major objections 6 minor 44 references

Universal Acoustic Adversarial Attacks for Flexible Control of Speech-LLMs

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A fixed 3.2-second adversarial audio segment, prepended to any input, can mute speech LLMs, override their text prompt, and selectively silence only speakers of a targeted gender or language.

desk verdict Selective universal attack is genuinely new and works in-domain; the 'unaffected' framing is overstated and cross-domain validation is missing. read the letter →

arxiv 2505.14286 v1 pith:FDYYJWX5 submitted 2025-05-20 cs.CL cs.SDeess.AS

Rao Ma , Mengjie Qian , Vyas Raina , Mark Gales , Kate Knill This is my paper
classification cs.CLcs.SDeess.AS
keywords universaladversarialattackacousticspeechlanguagemodelmutingselectivetaskcontrolQwen2-AudioGranite-Speech
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper shows that a single short audio segment, learned once by gradient descent and then prepended to the front of any speech input, can give an attacker near-complete control over what a speech LLM outputs. With a 3.2-second segment, the attack mutes Qwen2-Audio in essentially all cases, transfers to unseen speakers, datasets, and even different text prompts, and also works, with lower efficiency, on Granite-Speech. The new contribution is a selective version that only triggers for inputs carrying a chosen attribute: trained to mute female voices or a specific language, it suppresses about 85 to 92 percent of targeted inputs while leaving non-targeted speech almost untouched. This means a one-time-crafted audio prefix could be used to silence particular groups of users or to quietly replace the requested task with another one.

What carries the argument

The load-bearing object is the prepended adversarial audio segment $a$, a fixed 3.2-second waveform learned through gradient descent on a small training set with the speech LLM's weights frozen. For muting, the objective is to maximize $P(y_1 = \text{eot} \mid \mathrm{Enc}(a \oplus x), P_{\text{src}})$, making the model emit the end-of-transcription token as its first decoded token; for task control, the objective maximizes the probability of a target transcript under the original prompt, using either reference transcriptions (Attack-ref) or the model's own predictions under the target prompt (Attack-hyp). For the selective attack, the training target switches between eot and the normal transcription according to an attribute function $f(x)$ that indicates, for example, female speaker or a given language, so the segment must internally gate its effect on the attribute of the input that follows it. All three objectives are optimized directly in the audio-sample space, with the same segment then prepended to any test utterance.

What would settle it

Prepended random, unoptimized noise: if a 3.2-second random audio segment also produces mute rates near 100%, or selectively mutes the targeted group, then the demonstrated control is an artifact of prepending audio rather than of the learned adversarial segment. Concretely, take the same LibriSpeech test_other set and prepend a fixed 3.2-second clip of Gaussian noise or any unrelated audio, then measure the empty-rate and WER; if the random clip silences the model as often as the learned segment, the central claim is undermined.

Watch

Extended reading notes

Core claim

The paper reports that a fixed, universal adversarial audio segment, a vector of about 51,200 audio samples (3.2 seconds), prepended to arbitrary input audio achieves near-100% muting of the Qwen2-Audio speech LLM's output, defined as the model emitting the end-of-transcription token before any content, and that the same segment, when optimized against a conditional training target, acts as a conditional mute: only inputs whose speaker gender or spoken language matches the attribute are silenced, while other inputs continue to be transcribed. The muting attack succeeds at rates above 96% across three additional English datasets and four non-English FLEURS languages, and remains effective when the text prompt is switched from ASR to translation or gender detection. The task-control variant forces the model, prompted to translate to French, to instead output English transcriptions with WER around 6 to 7%, comparable to the no-attack ASR baseline. The selective attacks achieve 92.2% success for muting female speech and 85.4% for muting English speech on FLEURS, with the non-targeted group's transcription quality largely intact. The paper concludes that these universal acoustic attacks reveal a critical robustness gap in speech LLMs.

Load-bearing premise

The selective attack assumes that a single fixed audio prefix can read the content of the utterance that follows it, meaning gender or language cues survive the prefix and the prefix can switch its effect accordingly, rather than the model merely being globally more or less responsive after any prepended audio.

Editorial extensions

If this is right

  • A single 3.2-second prefix can mute Qwen2-Audio across datasets, prompts, and languages, so any application built on that model is vulnerable to a one-time-crafted audio denial-of-service.
  • The selective attack enables an adversary to target a demographic or language group without affecting other users, potentially creating discriminatory access to services or evading safety guardrails that depend on model output.
  • The task-control attack makes the model ignore the user's text prompt and perform an attacker-chosen task instead, which could redirect downstream processing or mislead automated systems.
  • The transferability to Granite-Speech, a different architecture, suggests the vulnerability is not unique to Qwen2-Audio, though attack efficiency varies across models.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same gradient-based prepend optimization could plausibly be adapted to other multimodal LLMs with speech encoders, but the required attack length may scale with model size; the paper's observation that larger models need longer segments suggests segment length is a key hyperparameter for future attacks.
  • The selective attack's success implies that the adversarial prefix does not erase gender or language information in the model's representations, which an attacker could exploit to build other conditional behaviors, such as triggering only on specific content words, without per-input labels.
  • A black-box extension, not tested in the paper, would optimize the prefix on an open-source surrogate model and transfer it to a closed API; given the observed transfer across datasets and prompts within a model, cross-model transfer is plausible but unverified.
  • For defenders, the attack directly learns the prepended segment itself, so any system that inserts a fixed 'watermark' or 'prompt' audio before user input should treat that insertion point as a hostile surface.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper investigates universal acoustic adversarial attacks on speech LLMs. A fixed adversarial audio segment is learned by gradient descent and prepended to arbitrary input audio. General attacks aim either to mute the model (causing it to emit the end-of-transcription token immediately) or to override the text prompt so the model performs a different task. Selective attacks extend muting to activate only when the input has a chosen attribute, with demonstrations for speaker gender and spoken language. Experiments on Qwen2-Audio-7B-Instruct and Granite-Speech-8B show that the general muting attack reaches near-100% success on LibriSpeech test_other for Qwen2-Audio and transfers across several datasets and prompts. The selective attacks achieve 71-93% targeted muting on in-domain test sets, but with nontrivial false muting and WER degradation on non-target groups. The authors conclude that speech LLMs are critically vulnerable to universal attacks and call for more robust training.

Significance. If the selective attack results hold in full generality, they represent a meaningful new capability: a single prepended audio segment that gates on speaker gender or spoken language goes beyond earlier unconditional universal attacks on Whisper. The paper also provides a useful empirical scaling result, showing that larger speech LLMs require longer adversarial segments than Whisper, and the cross-dataset transfer of the general attack is a clear strength. The strongest evidence is the muting attack on Qwen2-Audio in Table 2 and the transfer results in Tables 3 and 4. However, the novelty of the paper is concentrated in the selective attack, and that part currently rests on in-domain evaluation with no non-optimized audio control condition. The significance claim should therefore be scaled to what is actually demonstrated.

major comments (4)
  1. [Section 4.3 / Section 5.1, Table 2] The 3.2-second attack segment length is selected after evaluating 0.64, 1.6, 3.2, and 6.4 seconds on the same LibriSpeech test_other set that is later used to report the headline near-100% muting rates. Since the segment length is a free parameter and the evaluation set is used for model selection, the reported success rates are optimistic. Please report the length selection on a held-out validation set, or provide a truly separate held-out evaluation of the chosen configuration so the universal attack claims are not affected by selection on the test set.
  2. [Section 3.4 / Section 5.2, Tables 7 and 8] No prepended-audio control condition is reported anywhere. All comparisons are to a no-attack baseline without any extra audio prepended. Without a control condition that prepends an unoptimized segment of the same length (random noise, silence, or unrelated natural audio), it is impossible to attribute the selective attack's non-target degradation to the optimization rather than to generic disruption caused by prepending any audio. This is load-bearing for the selectivity claim: in Table 7, male WER rises from 5.9 to 19.4 under Mute-female, and in Table 8, English WER rises from 5.6 to 19.0 under Mute-fr. A control condition is needed to quantify how much of this degradation is due to the learned segment rather than to the mere presence of prepended audio.
  3. [Section 5.2, Tables 7 and 8] The selective attacks are evaluated only in-domain: gender selectivity on LibriSpeech dev_other to test_other, and language selectivity on FLEURS training to test sets for the same language pairs. The general attack is shown to transfer across corpora in Tables 3 and 4, so the absence of the same cross-corpus check for the novel selective attack is a visible gap. Because the fixed prefix must condition on the content of the following utterance, this leaves a dataset-artifact confound: the prefix could exploit corpus-level acoustic differences correlated with gender or language (recording conditions, speaker pools, channel effects) rather than the stated attribute. Please add at least one cross-corpus selective evaluation, for example a FLEURS-trained English/French selective attack tested on another English and French ASR corpus, and a gender-selective attack tested on a corpus with independent gender metadata such as Artie or Common Voice.
  4. [Abstract / Section 6, Tables 7 and 8] The abstract says inputs without the targeted attribute 'should be unaffected' and the conclusion says the attack leaves others 'unaffected,' but the reported non-target degradation is substantial. In Table 7, Mute-female raises male WER from 5.9 to 19.4 and also falsely mutes 14.7% of male samples; in Table 8, Mute-fr raises English WER from 5.6 to 19.0, and Mute-zh raises English WER from 5.6 to 14.9. Please replace the 'unaffected' framing with a quantitative statement of false-muting rate and WER degradation on non-target groups, and discuss whether this degradation is an inherent limitation of the selective-attack mechanism.
minor comments (6)
  1. [Appendix A.3] There are two typos in the training setup: 'acoustc attack segment' should be 'acoustic attack segment' in both occurrences.
  2. [Table 8] The caption says 'WER or CER' but the column header says 'WER'; please indicate explicitly which language rows report CER and which report WER so the metric is unambiguous.
  3. [Section 2 / References] The citation 'Hughes et al.' appears without a year or venue in the text, and the corresponding reference entry has no year; please complete this citation.
  4. [Figure 2] The description of Figure 2 is too terse: please define how the cumulative average output length ratio is computed, how the bins are constructed from Qwen-Audio's gender classification probabilities, and whether the figure uses the unconstrained or the epsilon-constrained attack.
  5. [Section 5.2.2] The explanation that English and Mandarin being 'more linguistically distinct' than English and French causes the higher selective-attack success is not supported by any experiment; acoustic or corpus-level differences are an equally plausible explanation and should be acknowledged or tested.
  6. [Section 3.5] The metric 'asl' (average sequence length) is reported without units; please state whether it is measured in tokens, words, or characters.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: empirical attack optimization with held-out evaluation; no derivation reduces to its inputs.

full rationale

The paper is an empirical attack-optimization study. The adversarial segment is a learned artifact optimized with gradient descent on a training subset (LibriSpeech dev_other or FLEURS training splits) and evaluated on held-out test sets. Equations (2), (3), (5), and (7) define the attack objective as maximizing the likelihood of a target output given the prepended segment; the target is not constructed from the fitted segment itself. Selective attacks use external attribute labels (gender annotations and language membership) to define the conditioning objective, and the fixed 3.2-second segment must generalize at inference time without access to those labels, so success is not guaranteed by construction. Prior work by the same group (Raina et al., 2024) is cited as methodological precedent, but the central claims are new measurements on Qwen2-Audio and Granite-Speech, including cross-dataset transfer for general attacks. No equation reduces to its own input, no fitted parameter is renamed as a prediction, and no load-bearing uniqueness claim rests on self-citation. The apparent limitations, such as selective attacks being evaluated only in-domain and non-target WER degradation in Tables 7 and 8, are empirical scope and generalization concerns, not circularity.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new physical or theoretical entities; the attack payload is a learned audio signal. The central claim rests on empirical optimization, a standard white-box threat model, and availability of attribute labels.

free parameters (2)
  • Attack segment length = 3.2 seconds (51,200 samples)
    Selected after sweeping 0.64, 1.6, 3.2, and 6.4 seconds and observing strongest mute performance on the evaluation set; the 3.2s value is then used for the remaining experiments.
  • Amplitude constraint epsilon = 0.02 (L-infinity norm)
    Chosen manually after comparing epsilon=0.005 and 0.02 in Table 10; used for imperceptible attack experiments, trading off a few points of attack success.
assumptions (4)
  • domain assumption The adversary can prepend an adversarial audio segment to the input in the deployed system without preprocessing or filtering.
    Threat model in Section 3.2 assumes the user controls the input audio and can manipulate the speech signal at the acoustic level.
  • domain assumption White-box access to model weights during attack training is a realistic scenario.
    Stated in Section 3.2; all optimization uses gradient descent through the frozen model.
  • domain assumption Ground-truth attribute labels (speaker gender, language) are available for training the selective attack.
    Equation 6 defines f(x) using labels from LibriSpeech metadata and FLEURS language splits.
  • domain assumption Prepending any 3.2s audio segment does not, by itself, mute the model; the effect is due to the optimized content.
    The paper does not report a random-noise prepended baseline, so part of the mute effect could come from the concatenation itself.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Universal Acoustic Adversarial Attacks for Flexible Control of Speech-LLMs." pith.science (2026). https://pith.science/paper/FDYYJWX5

@misc{pith2026250514286,
  author       = {Pith},
  title        = {Pith review of: Universal Acoustic Adversarial Attacks for Flexible Control of Speech-LLMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FDYYJWX5}},
  note         = {Machine review of arXiv:2505.14286}
}
read the original abstract

The combination of pre-trained speech encoders with large language models has enabled the development of speech LLMs that can handle a wide range of spoken language processing tasks. While these models are powerful and flexible, this very flexibility may make them more vulnerable to adversarial attacks. To examine the extent of this problem, in this work we investigate universal acoustic adversarial attacks on speech LLMs. Here a fixed, universal, adversarial audio segment is prepended to the original input audio. We initially investigate attacks that cause the model to either produce no output or to perform a modified task overriding the original prompt. We then extend the nature of the attack to be selective so that it activates only when specific input attributes, such as a speaker gender or spoken language, are present. Inputs without the targeted attribute should be unaffected, allowing fine-grained control over the model outputs. Our findings reveal critical vulnerabilities in Qwen2-Audio and Granite-Speech and suggest that similar speech LLMs may be susceptible to universal adversarial attacks. This highlights the need for more robust training strategies and improved resistance to adversarial attacks.

Figures

Figures reproduced from arXiv: 2505.14286 by the authors.

Figure 1
Figure 1. Illustration of language-based selective attack. [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Cumulative average output length ratio (relative to ASR references) for Mute-female and Mute-male models, plotted against Qwen-Audio’s zero￾shot gender classification probabilities using Pgdr. In [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Mel spectrograms of universal adversarial [PITH_FULL_IMAGE:figures/full_fig_p012_3.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

44 extracted references · 22 canonical work pages

  1. [1]

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, and 1 others. 2023. GPT-4 technical report . arXiv preprint arXiv:2303.08774

    arXiv 2023

  2. [2]

    Rosana Ardila, Megan Branson, Kelly Davis, Michael Kohler, Josh Meyer, Michael Henretty, Reuben Morais, Lindsay Saunders, Francis Tyers, and Gregor Weber. 2020. Common Voice: A Massively-Multilingual Speech Corpus . In Proceedings of the Twelfth Language Resources and Evaluation Conference, pages 4218--4222

    work page 2020

  3. [3]

    Jinze Bai, Shuai Bai, Yunfei Chu, Zeyu Cui, Kai Dang, Xiaodong Deng, Yang Fan, Wenbin Ge, Yu Han, Fei Huang, and 1 others. 2023. Qwen technical report . arXiv preprint arXiv:2309.16609

    arXiv 2023

  4. [4]

    Peter Bell, Mark JF Gales, Thomas Hain, Jonathan Kilgour, Pierre Lanchantin, Xunying Liu, Andrew McParland, Steve Renals, Oscar Saz, Mirjam Wester, and 1 others. 2015. The MGB challenge: Evaluating multi-genre broadcast media recognition . In 2015 IEEE Workshop on Automatic Speech Recognition and Understanding (ASRU), pages 687--693. IEEE

    work page 2015

  5. [5]

    Nicholas Carlini and David A. Wagner. 2018. https://arxiv.org/abs/1801.01944 Audio Adversarial Examples: Targeted Attacks on Speech-to-Text . CoRR, abs/1801.01944

    arXiv 2018

  6. [6]

    Yunfei Chu, Jin Xu, Qian Yang, Haojie Wei, Xipin Wei, Zhifang Guo, Yichong Leng, Yuanjun Lv, Jinzheng He, Junyang Lin, and 1 others. 2024. Qwen2-audio technical report . arXiv preprint arXiv:2407.10759

    arXiv 2024

  7. [7]

    Moustapha Cisse, Yossi Adi, Natalia Neverova, and Joseph Keshet. 2017. https://arxiv.org/abs/1707.05373 Houdini: Fooling Deep Structured Prediction Models . Preprint, arXiv:1707.05373

    arXiv 2017

  8. [8]

    Alexis Conneau, Min Ma, Simran Khanuja, Yu Zhang, Vera Axelrod, Siddharth Dalmia, Jason Riesa, Clara Rivera, and Ankur Bapna. 2023. Fleurs: Few-shot learning evaluation of universal representations of speech . In 2022 IEEE Spoken Language Technology Workshop (SLT), pages 798--805. IEEE

    work page 2023

Show all 44 references
  1. [9]

    Kounavis, and Duen Horng Chau

    Nilaksh Das, Madhuri Shanbhogue, Shang - Tse Chen, Li Chen, Michael E. Kounavis, and Duen Horng Chau. 2018. https://arxiv.org/abs/1805.11852 ADAGIO: Interactive Experimentation with Adversarial Attack and Defense for Audio . CoRR, abs/1805.11852

    2018 arXiv

  2. [10]

    Yassir Fathullah, Chunyang Wu, Egor Lakomkin, Junteng Jia, Yuan Shangguan, Ke Li, Jinxi Guo, Wenhan Xiong, Jay Mahadeokar, Ozlem Kalinli, and 1 others. 2024. Prompting large language models with speech recognition abilities . In ICASSP 2024-2024 IEEE International Conference o...

    2024

  3. [11]

    Adrian Florea, Xilin Jiang, Nima Mesgarani, and Xiaofan Jiang. 2025. Exploring finetuned audio-LLM on heart murmur features . Smart Health, page 100557

    2025

  4. [12]

    Yuan Gong and Christian Poellabauer. 2017. https://arxiv.org/abs/1711.03280 Crafting Adversarial Examples For Speech Paralinguistics Applications . CoRR, abs/1711.03280

    2017 arXiv

  5. [13]

    IBM Granite Team. 2025 a . https://huggingface.co/ibm-granite/granite-3.2-8b-instruct Granite Language Models

    2025

  6. [14]

    IBM Granite Team. 2025 b . https://huggingface.co/ibm-granite/granite-speech-3.2-8b Granite Speech-language Model

    2025

  7. [15]

    Isha Gupta, David Khachaturov, and Robert Mullins. 2025. ``I am bad''': Interpreting Stealthy, Universal and Robust Audio Jailbreaks in Audio-Language Models . arXiv preprint arXiv:2502.00718

    2025 arXiv

  8. [16]

    Gupta, G

    N. Gupta, G. Tur, D. Hakkani-Tur, S. Bangalore, G. Riccardi, and M. Gilbert. 2006. https://doi.org/10.1109/TSA.2005.854085 The AT&T spoken language understanding system . IEEE Transactions on Audio, Speech, and Language Processing, 14(1):213--222

    2006

  9. [17]

    Fran c ois Hernandez, Vincent Nguyen, Sahar Ghannay, Natalia Tomashenko, and Yannick Esteve. 2018. TED-LIUM 3: Twice as much data and corpus repartition for experiments on speaker adaptation . In Speech and Computer: 20th International Conference, SPECOM 2018, Leipzig, Germany...

    2018

  10. [18]

    Attacking Audio Language Models with Best-of-N Jailbreaking

    John Hughes, Sara Price, Aengus Lynch, Rylan Schaeffer, Fazl Barez, Sanmi Koyejo, Henry Sleight, Ethan Perez, and Mrinank Sharma. Attacking Audio Language Models with Best-of-N Jailbreaking

  11. [19]

    Zhuohang Li, Yi Wu, Jian Liu, Yingying Chen, and Bo Yuan. 2020. https://doi.org/10.1145/3372297.3423348 AdvPulse: Universal, Synchronization-free, and Targeted Audio Adversarial Attacks via Subsecond Perturbations . In Proceedings of the 2020 ACM SIGSAC Conference on Computer ...

    2020

  12. [20]

    Zhiyun Lu, Wei Han, Yu Zhang, and Liangliang Cao. 2021. https://arxiv.org/abs/2104.02757 Exploring Targeted Universal Adversarial Perturbations to End-to-end ASR Models . Preprint, arXiv:2104.02757

    2021 arXiv

  13. [21]

    Josh Meyer, Lindy Rauchenstein, Joshua D Eisenberg, and Nicholas Howell. 2020. Artie bias corpus: An open dataset for detecting demographic bias in speech applications . In Proceedings of the twelfth language resources and evaluation conference, pages 6462--6468

    2020

  14. [22]

    Shuyo Nakatani. 2010. https://github.com/shuyo/language-detection Language Detection Library for Java

    2010

  15. [23]

    McAuley, and Farinaz Koushanfar

    Paarth Neekhara, Shehzeen Hussain, Prakhar Pandey, Shlomo Dubnov, Julian J. McAuley, and Farinaz Koushanfar. 2019. https://arxiv.org/abs/1905.03828 Universal Adversarial Perturbations for Speech Recognition Systems . CoRR, abs/1905.03828

    2019 arXiv

  16. [24]

    Vassil Panayotov, Guoguo Chen, Daniel Povey, and Sanjeev Khudanpur. 2015. Librispeech: an ASR corpus based on public domain audio books . In 2015 IEEE international conference on acoustics, speech and signal processing (ICASSP), pages 5206--5210. IEEE

    2015

  17. [25]

    Yao Qin, Nicholas Carlini, Ian Goodfellow, Garrison Cottrell, and Colin Raffel. 2019. https://arxiv.org/abs/1903.10346 Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition . Preprint, arXiv:1903.10346

    2019 arXiv

  18. [26]

    Alec Radford, Jong Wook Kim, Tao Xu, Greg Brockman, Christine McLeavey, and Ilya Sutskever. 2023. Robust speech recognition via large-scale weak supervision . In International conference on machine learning, pages 28492--28518. PMLR

    2023

  19. [27]

    Vyas Raina and Mark Gales. 2024. Controlling Whisper: Universal Acoustic Adversarial Attacks to Control Multi-Task Automatic Speech Recognition Models . In 2024 IEEE Spoken Language Technology Workshop (SLT), pages 208--215. IEEE

    2024

  20. [28]

    Gales, and Kate M

    Vyas Raina, Mark J.F. Gales, and Kate M. Knill. 2020. https://doi.org/10.21437/Interspeech.2020-1890 Universal Adversarial Attacks on Spoken Language Assessment Systems . In Interspeech 2020, pages 3855--3859

    2020 doi

  21. [29]

    Vyas Raina, Rao Ma, Charles McGhee, Kate Knill, and Mark Gales. 2024. Muting whisper: A universal acoustic adversarial attack on speech foundation models . arXiv preprint arXiv:2405.06134

    2024 arXiv

  22. [30]

    Jaechul Roh, Virat Shejwalkar, and Amir Houmansadr. 2025. Multilingual and Multi-Accent Jailbreaking of Audio LLMs . arXiv preprint arXiv:2504.01094

    2025 arXiv

  23. [31]

    Weitong Ruan, Yaroslav Nechaev, Luoxin Chen, Chengwei Su, and Imre Kiss. 2020. https://doi.org/10.21437/Interspeech.2020-2844 Towards an ASR Error Robust Spoken Language Understanding System . In Interspeech 2020, pages 901--905

    2020 doi

  24. [33]

    Lea Schönherr, Katharina Kohls, Steffen Zeiler, Thorsten Holz, and Dorothea Kolossa. 2018. https://arxiv.org/abs/1808.05665 Adversarial Attacks Against Automatic Speech Recognition Systems via Psychoacoustic Hiding . Preprint, arXiv:1808.05665

    2018 arXiv

  25. [34]

    Changli Tang, Wenyi Yu, Guangzhi Sun, Xianzhao Chen, Tian Tan, Wei Li, Lu Lu, Zejun MA, and Chao Zhang. 2024. https://openreview.net/forum?id=14rn7HpKVk SALMONN: Towards Generic Hearing Abilities for Large Language Models . In The Twelfth International Conference on Learning R...

    2024

  26. [35]

    Gemini Team, Rohan Anil, Sebastian Borgeaud, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, Katie Millican, and 1 others. 2023. Gemini: a family of highly capable multimodal models . arXiv preprint arXiv:2312.11805

    2023 arXiv

  27. [36]

    Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timoth \'e e Lacroix, Baptiste Rozi \`e re, Naman Goyal, Eric Hambro, Faisal Azhar, and 1 others. 2023. Llama: Open and efficient foundation language models . arXiv preprint arXiv:2302.13971

    2023 arXiv

  28. [37]

    Gokhan Tur and Renato De Mori. 2011. https://api.semanticscholar.org/CorpusID:60003789 Spoken Language Understanding: Systems for Extracting Semantic Information from Speech

    2011

  29. [38]

    Bin Wang, Xunlong Zou, Geyu Lin, Shuo Sun, Zhuohan Liu, Wenyu Zhang, Zhengyuan Liu, AiTi Aw, and Nancy F Chen. 2025. AudioBench: A Universal Benchmark for Audio Large Language Models . NAACL

    2025

  30. [39]

    Hanlin Wu, Xufeng Duan, and Zhenguang Cai. 2025. Distinct social-linguistic processing between humans and large audio-language models: Evidence from model-brain alignment . arXiv preprint arXiv:2503.19586

    2025

  31. [40]

    Erjia Xiao, Hao Cheng, Jing Shao, Jinhao Duan, Kaidi Xu, Le Yang, Jindong Gu, and Renjing Xu. 2025. Tune In, Act Up: Exploring the Impact of Audio Modality-Specific Edits on Large Audio Language Models in Jailbreak . arXiv preprint arXiv:2501.13772

    2025

  32. [41]

    Hao Yang, Lizhen Qu, Ehsan Shareghi, and Gholamreza Haffari. 2024. Audio Is the Achilles' Heel: Red Teaming Audio Large Multimodal Models . arXiv preprint arXiv:2410.23861

    2024 arXiv

  33. [42]

    Wenyi Yu, Changli Tang, Guangzhi Sun, Xianzhao Chen, Tian Tan, Wei Li, Lu Lu, Zejun Ma, and Chao Zhang. 2024. Connecting speech encoder and large language model for ASR . In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pag...

    2024

  34. [43]

    Xuejing Yuan, Yuxuan Chen, Yue Zhao, Yunhui Long, Xiaokang Liu, Kai Chen, Shengzhi Zhang, Heqing Huang, Xiaofeng Wang, and Carl A. Gunter. 2018. https://arxiv.org/abs/1801.08535 CommanderSong: A Systematic Approach for Practical Adversarial Voice Recognition . Preprint, arXiv:...

    2018 arXiv

  35. [44]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list...

  36. [45]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.