PaperlayerView exact revision on arXiv

Source-linked AI summary

From Inaudible Inputs to Model Failures: Low-Frequency Safety Risks in LALMs

Yuanhe Zhang, Weiliu Wang, Jie Ren, Liang Lin, Zhenhong Zhou, Haoran Gao, Kun Wang, Chen Li, Li Sun, Sen Su

arXiv:2608.09158v1cs.SDcs.AI

TL;DR

LALMs may process inaudible low-frequency signals that remain outside human perception, but the practical impact of this mismatch is insufficiently studied. The paper introduces ILL to red-team this risk and DRG to mitigate it, finding that ILL reduces accuracy by up to 67 percentage points while DRG raises mean attacked accuracy from 28.5% to 46.1%.

  • Problem

    The practical impact of stealthy, inaudible low-frequency interference on LALMs remains insufficiently studied despite their audio frontends processing signals beyond human perception.

  • Method

    The paper introduces ILL, a black-box red-teaming method using a fixed universal low-frequency waveform, and DRG, a detector that conditionally requests a second recording.

  • Results

    Across six LALMs and multiple audio understanding tasks, ILL reduces accuracy by up to 67 percentage points, while DRG raises mean attacked accuracy from 28.5% to 46.1%.

  • Takeaways & Limitations

    The findings identify inaudible low-frequency input as a hidden channel for disrupting LALM audio understanding and provide a preliminary defense against this risk.

  • Takeaways & Limitations

    Experiments simulate microphone reception rather than the complete loudspeaker-to-microphone acoustic path, leaving device- and environment-specific effects for controlled physical evaluation.

Abstract

from arXiv · show

Large audio-language models (LALMs) have demonstrated strong capabilities in understanding diverse audio inputs. This diversity includes low-frequency signals that are inaudible to humans but can still enter the model and influence its generation. However, the practical impact of such low-frequency inputs on LALMs remains largely unexplored. In this paper, we propose Intermittent Low-Frequency Lockout (ILL), an inaudible red teaming method that evaluates this risk using a universal waveform template in a black box setting. ILL uses Sentence Attention Scale Estimation to determine active intervals and Frequency Confusion Transfer to construct a low-frequency waveform with continuous phase from corpus spectral variation. To mitigate this risk, we propose Distributional Requery Guard (DRG) to detect low-frequency distribution shifts and conditionally request a second recording for semantic recovery. Across six LALMs and multiple audio understanding tasks, ILL reduces accuracy by up to 67 percentage points while receiving a mean human audibility rating of 1.33, close to 1.17 for clean audio; DRG raises mean attacked accuracy from 28.5\% to 46.1\% after clean reacquisition. These findings identify a previously overlooked safety risk for LALMs and provide a foundation for future research on robust audio understanding.

Introduction

LALMs can process low-frequency signals that are imperceptible to humans, creating a hidden input surface and safety risk. This paper introduces ILL to evaluate that risk and DRG to detect distribution shifts and recover semantics through conditional requery.

  • Motivation: LALM audio frontends transform sampled waveforms into acoustic representations, so inputs can affect models beyond what human perception reveals.A sufficiently low-frequency signal may enter the audio frontend while remaining imperceptible to users.
  • Method: ILL is a black-box inaudible red teaming method using a universal waveform template fixed across test recordings.It combines Sentence Attention Scale Estimation for active intervals with Frequency Confusion Transfer for continuous-phase low-frequency waveform construction.
  • Results: 67 percentage points: ILL reduces accuracy by up to this amount across six LALMs and multiple audio understanding tasks.The waveform has an audible noise ratio of 0.06–0.08% and a mean human audibility rating of 1.33, versus 1.17 for clean audio.
  • Defense: 89.69–99.00%: DRG achieves detection F1 scores in this range while detecting low-frequency distribution shifts.DRG mitigates the risk through conditional requery and joint semantic recovery.
  • Defense: 17.6 percentage points: DRG improves defense performance, raising six-model mean accuracy from 28.5% to 46.1%.The same requery mechanism recovers useful semantic evidence under other conditions.

Related Work

LALMs extend audio understanding by linking continuous acoustic inputs with language-model reasoning, but this expanded interface also creates new avenues for adversarial control. Existing defenses address semantic attacks and general acoustic corruption, while stealthy low-frequency interference remains insufficiently studied.

  • LALM foundations: LALMs connect acoustic representations with language-model reasoning for speech interaction and general audio understanding.Their continuous acoustic inputs extend text-only interfaces while introducing audio input surfaces that can influence model behavior.
  • Audio adversarial attacks: Imperceptible or disguised acoustic commands previously controlled speech systems, and LALMs extend this attack surface to open-ended behavior and task completion.Existing LALM red teaming mainly examines safety failures induced by malicious or misleading audio inputs.
  • LALM defenses: Existing LALM defenses primarily restore safe behavior through attack-aware checks or corrections around model inference.These defenses are described alongside plug-and-play audio enhancement adapted from conventional denoising.
  • Research gap: Stealthy low-frequency interference remains insufficiently studied despite defenses targeting semantic attacks and general acoustic corruption.The cited approaches combine inference-time safety checks or corrections with pre-inference audio enhancement.

Method

The method constructs a universal intermittent low-frequency waveform by identifying semantically active speech intervals and transferring corpus spectral dynamics into a continuous-phase perturbation. A plug-in guard detects low-frequency distribution shifts and conditionally requests a second recording for semantic recovery.

  • Intermittent Low-Frequency Lockout: The attack superposes an inaudible low-frequency waveform with user speech acoustically, producing a composite waveform at the target microphone.Small loudspeakers and electret microphones retain nonzero response over 0.5–20 Hz, while smartphone microphones remain measurable across the infrasonic band in non-isolated settings.
  • Frequency Confusion Transfer: Frequency Confusion Transfer quantizes corpus spectral centroids into n frequency states, estimates transition statistics, and decodes a most-probable state sequence for each active interval.Corpus extrema define a shared quantization range, preserving each recording’s temporal spectral-state order; duration normalization divides an active interval into K equal-length subsegments.
  • Universal Perturbation Synthesis: The synthesized perturbation uses amplitude β, a vanishing-endpoint envelope, and continuous phase, then repeats the active waveform according to the attention-derived schedule.The attacker emits the waveform as a standalone acoustic signal; the fixed offline template remains universal across test recordings and target LALMs.
  • Distributional Requery Guard: Distributional Requery Guard detects low-frequency shifts by clustering spectral descriptors from clean and interfered recordings, labeling the higher low-frequency-mass cluster as interference.Cluster fitting and assignment use Euclidean distance, and the interference label is determined solely from input spectra without querying the target LALM.
  • Distributional Requery Guard: Flagged inputs trigger a second recording of the same utterance, and the target LALM receives both recordings with instructions to answer only from consistent, intelligible content.Inputs assigned to the clean cluster follow the standard inference path.

Experiments

Experiments across six LALMs and four audio-understanding task types show that a fixed 5–20 Hz ILL waveform transfers across models, broadly degrades performance, and remains difficult for humans to perceive. DRG detects the interference and improves recovery through conditional clean reacquisition, with limited utility loss on clean inputs.

  • Experimental setup: Six LALMs were evaluated using 100 test examples per dataset across MMAU, LibriSpeech, CoVoST 2, and RAVDESS, with ILL transferred from Qwen2.5-Omni.The evaluation covered question answering, speech recognition, speech translation, and emotion classification.
  • Attack effectiveness: 67 percentage points was the largest RAVDESS accuracy reduction, occurring on unseen StepAudio2 rather than the Qwen2.5 reference model.Degradation on the other five LALMs indicates strong migration capability under black-box transfer.
  • Attack effectiveness: ILL achieved the lowest CoVoST 2 BLEU on every target while remaining competitive on accuracy-based tasks, despite not uniformly outperforming audible-noise baselines.The result demonstrates broad degradation from the 5–20 Hz band rather than uniform numerical dominance over every baseline.
  • Stealthiness: 0.06–0.08% was ILL’s ANR across six datasets, whereas all evaluated baselines exceeded 98.9%.ILL operated at 5–20 Hz, and lower ANR indicates less perturbation energy in the measured audible band.
  • Stealthiness: 1.33 was ILL’s mean human audibility rating, close to 1.17 for clean audio, while every comparison method received a higher mean rating.Both ILL and clean audio had a median rating of 1 across 112 complete human response sets.
  • Defense effectiveness: 89.69–99.00% was the DRG F1 range across four evaluation datasets, and clean reacquisition raised six-model mean accuracy from 28.5% to 46.1%.Clean reacquisition was best or tied for best in 19 of 24 settings, while ten of twelve forced-requery clean-input scores remained within 0.03 of standard inference.

Analysis

The analysis finds that ILL’s structured waveform design, corpus-derived timing, and default operating point drive its effectiveness. Model-internal evidence links attacks to reduced audio reliance, altered representations, and lower decision confidence, with DRG partially restoring these signals.

  • Duty Cycle: Beyond γ > 70%, attack effectiveness changes little, indicating the selected duty cycle reaches saturation while retaining inactive waveform intervals.Lower task performance indicates a stronger attack.
  • Attack Duration: Shorter segments are ineffective, while extending the default segment length by one or two orders of magnitude provides no further gain.The default length is sufficient to trigger the observed failure.
  • State-Sequence Construction: ILL causes greater degradation than Gaussian noise, a fixed-frequency signal, and a uniform frequency sweep on classification and translation.The consistent advantage supports the proposed state-sequence design.
  • Active-Interval Estimation: 3.67–5.07 seconds: attention-derived active-interval estimates across datasets and reference LALMs remain within this range, with at most 0.50 seconds of within-dataset cross-model spread.This consistency supports using corpus-level attention statistics rather than model-specific timing.
  • Model-Internal Evidence: 0.0416 to 0.0373 on MMAU and 0.0777 to 0.0531 on RAVDESS: ILL reduces attention mass assigned to audio, while DRG partially restores it.The shift is consistent with reduced reliance on acoustic evidence during generation.
  • Model-Internal Evidence: 1.0000 to 0.8659 on MMAU and 1.0000 to 0.6309 on RAVDESS: attacked representation similarity falls before recovering to approximately 0.96 under DRG.The representation shift accompanies reduced audio attention and altered encoded semantics.
  • Model-Internal Evidence: 0.8050 to 0.1709 on MMAU and 0.8240 to 0.0179 on RAVDESS: ILL lowers correct-answer probability, while DRG moves all four confidence values toward clean counterparts.The effect is not limited to answer correctness because confidence in the selected final answer also decreases.

Limitations

The study avoids uncontrolled deployment because ILL could affect unintended devices or users, and its simulated microphone setup does not capture complete real-world acoustic paths. Its analysis identifies risk and demonstrates a preliminary defense without establishing a complete causal mechanism.

  • ILL is not deployed in uncontrolled scenarios because red teaming could affect unintended devices or users and cause potentially irreversible consequences.
  • The experiments simulate microphone reception rather than reproducing the complete loudspeaker-to-microphone acoustic path in real-world environments.Device- and environment-specific effects remain for controlled physical evaluation.
  • The analysis characterizes attention, representation, and output-confidence changes without establishing a complete causal mechanism.Deeper mechanistic analysis remains future work while the study prioritizes risk identification and preliminary-defense effectiveness.

Conclusion

The work identifies inaudible low-frequency input as a practical hidden channel for disrupting audio understanding in LALMs and introduces ILL as a black-box red-teaming method using a fixed universal waveform. Across six LALMs and multiple speech tasks, ILL transfers without target-specific optimization, substantially degrades task performance, and limits spectral leakage into the measured audible band to 0.06–0.08%.

  • Conclusion: ILL probes inaudible low-frequency risks in LALMs using a fixed universal waveform in a black-box red-teaming setting.The method targets a hidden channel that can disrupt audio understanding.
  • Conclusion: Across six LALMs and multiple speech tasks, ILL transfers without target-specific optimization and substantially degrades task performance.The conclusion reports cross-model and cross-task effectiveness without target-specific optimization.
  • Conclusion: 0.06–0.08% spectral leakage is limited to the measured audible band under ILL.This quantifies the attack’s leakage into the audible frequency range.

A Physical-Chain Feasibility and Scope · B Computational Complexity of DRG

The physical-chain analysis separates whether ILL can reach a model from whether commodity hardware preserves its waveform faithfully. DRG has lightweight descriptor-based detection, with feature fitting performed offline and deployment triggering a second recording only for jammed inputs.

  • A Physical-Chain Feasibility and Scope: ILL’s receiver-side amplitude control establishes a feasibility test for model reachability, but waveform fidelity through commodity hardware is neither required nor guaranteed.The analysis explicitly separates reachability from fidelity for acoustic deployment.
  • A Physical-Chain Feasibility and Scope: An emitted perturbation must survive the source, propagation environment, microphone, analog frontend, and digital processing before reaching the LALM.Indoor or outdoor propagation can involve reflections, obstacles, weather, and ambient noise, while each stage may attenuate or distort 5–20 Hz components.
  • A Physical-Chain Feasibility and Scope: 20 Hz is a human-audibility convention rather than an acoustic propagation cutoff, and controlled sources have transmitted sub-20 Hz signals.Park and Robertson measured coherent infrasound 3.8 km away with received signal-to-noise ratios of 5–15 dB.
  • A Physical-Chain Feasibility and Scope: 0.5–20 Hz signals have been captured using a small electret condenser microphone connected to a notebook or desktop computer.These results support low-frequency detectability but not a universal flat microphone response.
  • A Physical-Chain Feasibility and Scope: Ports, AC coupling, analog high-pass filters, automatic gain control, and manufacturer-specific processing can alter received low-frequency amplitude and phase.These hardware and processing differences limit generalization across capture chains.
  • B Computational Complexity of DRG: Offline descriptor fitting uses FFT-based STFT, temporal magnitude aggregation, ℓ1 normalization, descriptor storage, and fixed-two-cluster K-means operations.The stated costs include O(UxdefV log V ) for each STFT, O(UxdefV ) for temporal summation, O(V ) for normalization, and O(|Ddef|V ) for storage and each K-means fitting iteration.
  • B Computational Complexity of DRG: Deployment extraction costs O(Ux(1)V log V ) for STFT and O(Ux(1)V ) for aggregation, followed by exactly two centroid-distance evaluations costing O(V ).The detector stores the descriptor and two fixed centroids, requires no neural-network forward pass or target-LALM query, and requests x(2) only for inputs assigned to kjam.

C Dataset Sampling and Aggregation · D Attack Baselines and Common Amplitude

The evaluation samples 100 examples per dataset or subset, aggregating selected three-way datasets into 300-example results. Attack methods are compared under a shared full-duration RMS budget, with distinct interference sources and duration handling for PNL.

  • C Dataset Sampling and Aggregation: 100 examples are sampled from each evaluated dataset or subset; MMAU’s speech, sound, and music subsets are evaluated separately.A single “MMAU” result aggregates 300 examples across the three subsets.
  • C Dataset Sampling and Aggregation: 300 examples comprise each single “PNL” result, aggregating 100 examples from its Natural, Mechanical, and Human interference types.The same aggregation convention used for MMAU applies to PNL.
  • C Dataset Sampling and Aggregation: The Average defense-detector training condition contains 100 clean examples and 100 examples with noise interference.These examples are randomly drawn from different datasets.
  • D Attack Baselines and Common Amplitude: Gaussian, PNL, Audio-Adv., and Whisper represent random, environmental, white-box adversarial, and transferable audio-interference baselines, respectively.Gaussian uses generated noise; PNL uses Natural, Machine, and Human recordings; Audio-Adv. accesses the attacked model; Whisper targets transferability.
  • D Attack Baselines and Common Amplitude: Attacks are compared under a common waveform-domain energy budget using RMS rather than an unnormalised peak value.For each method, the complete perturbation includes ILL’s off intervals, has its DC component removed, and undergoes RMS normalisation.
  • D Attack Baselines and Common Amplitude: RMS(δm) = 4 for every non-clean method before mixing, including Gaussian, PNL, Audio-Adv., Whisper, and complete intermittent ILL.The protocol accounts for ILL’s envelope and inactive intervals, and the model receives the composite x + δm.
  • D Attack Baselines and Common Amplitude: PNL interference recordings shorter than the source audio are replayed cyclically until covering the full source duration before Equation 14.This duration-matching procedure is applied before the interference is added.

E Expanded MMAU Attack Results

The expanded MMAU results evaluate ILL across speech, sound, and music tasks and Natural, Mechanical, and Human PNL categories. Across 18 model–task cells, ILL consistently lowers accuracy and significantly outperforms selected baselines in disruption.

  • Expanded evaluation: Tables 7–12 expand MMAU across speech, sound, and music and PNL across Natural, Mechanical, and Human categories for every evaluated model.Re-averaging these rows and columns reproduces every Table 1 value after rounding to one decimal place.
  • Consistency and task-level analysis: 18 of 18 model–task cells show lower accuracy under ILL than Clean, with a mean reduction of 13.1 percentage points and median reduction of 11.0 points.A one-sided paired Wilcoxon signed-rank test gives p = 3.81 × 10−6.
  • Consistency and task-level analysis: 21.5 points is the largest mean reduction on MMAUSpeech, followed by 9.3 points on MMAUSound.The supplied passage identifies MMAUSpeech and MMAUSound as the largest and second-largest reductions, respectively.
  • Baseline comparisons: 17 of 18 cells show lower ILL accuracy than Audio-Adv., while all 18 cells show lower ILL accuracy than Whisper.Both differences remain significant after Holm correction across the six baseline comparisons.
  • Baseline comparisons: Differences between ILL and Gaussian or the three individual PNL categories are not significant after correction.The passage contrasts these comparisons with the significant Audio-Adv. and Whisper differences.

F Human Audibility Evaluation · G Ethics Statement

The human audibility evaluation used standardized composite stimuli and a seven-point perceptual scale with 112 unpaid student volunteers. The ethics statement constrained testing to prerecorded, simulated conditions, acknowledged misuse risks, and paired disclosure of limitations with DRG mitigation.

  • F Human Audibility Evaluation: 112 distinct participants were publicly recruited student volunteers in undergraduate or postgraduate education, with no compensation provided.
  • F Human Audibility Evaluation: Participants rated the same composite waveform x + δm presented to the model, preserving source–interference interaction under a common RMS budget for all non-clean stimuli.
  • F Human Audibility Evaluation: Ratings used a seven-point scale where 1 means no perceivable noise and 7 means highly noticeable noise.
  • G Ethics Statement: The study framed ILL as a dual-use audio security risk for controlled red teaming and mitigation, without deploying it in public or uncontrolled acoustic environments.
  • G Ethics Statement: Attack evaluations used prerecorded benchmark audio and simulated target-microphone waveforms, limiting outcomes to task-level errors rather than exposure of bystanders or consequential decisions.
  • G Ethics Statement: The authors acknowledge potential misuse but withhold device-specific emission and calibration settings, while documenting hardware and acoustic dependencies and evaluating DRG as a lightweight mitigation.
Loading 2608.09158v1…