PaperlayerView exact revision on arXiv

Source-linked AI summary

Psychoacoustically Aligned Latent Smoothing for Adversarial Robustness of Full-Duplex Speech-to-Speech Dialogue Models

Kian Shamsaie, Iman Modarressi

arXiv:2609.27378v1cs.SDcs.AIcs.CLcs.HC

TL;DR

Full-duplex speech-to-speech agents face masked attacks through their continuously open audio channel, and protection for this setting remains an open question. The paper introduces PALS, which pairs psychoacoustically aligned latent smoothing with masking-shaped input augmentation. PALS-Train lowers attack success across hijack, mute, and jailbreak goals, while PALS-Certify provides a limited latent-space floor.

  • Problem

    Full-duplex agents ingest every frame through an always-open microphone and maintain persistent dialogue state, while how to protect them from masked adversarial attacks remains open.

    Source: §I · p. 1

  • Method

    PALS combines codebook-covariance latent noise at the RVQ interface with masking-threshold-shaped input augmentation and KL consistency training.

    Source: §I · p. 1

  • Results

    8.3% hijack, 11.2% mute, and 9.1% jailbreak are the PALS-Train attack-success rates, with clean UTMOS 3.82 versus 3.91 for the undefended agent.

    Source: A. Main Comparison · p. 6

  • Takeaways & Limitations

    PALS-Train’s empirical robustness exceeds the limited certificate supplied by the Monte Carlo-smoothed variant.

    Source: §I · p. 2, §VIII · p. 6

    The authors identify three remaining limitations.

    Source: C. Ablations, Slices, and Limitations · p. 6

Abstract

from arXiv · show

End-to-end speech-to-speech dialogue models listen and speak simultaneously, so a continuously open acoustic channel is exposed to adversarial manipulation. We formalize imperceptible attacks on full-duplex agents as optimization over additive perturbations confined beneath the psychoacoustic masking threshold of the carrier speech, under three goals: targeted semantic hijacking, response suppression, and policy jailbreaking. Against an undefended Moshi-style agent, white-box attacks succeed in up to 91.7% of trials. We then introduce psychoacoustically aligned latent smoothing (PALS), which injects anisotropic Gaussian noise shaped by local codebook covariance at the residual-vector-quantized latent interface, with input noise shaped by the masking threshold constraining the attacker and trained by a Kullback--Leibler consistency objective. Deployed with no inference-time cost, PALS reduces hijack to 8.3%, mute to 11.2%, and jailbreak to 9.1% at clean quality within 2.3%. A Monte Carlo-smoothed variant certifies an ellipsoidal latent radius up to 0.616, a guaranteed floor that the empirical robustness far exceeds.

I. INTRODUCTION

The introduction frames masked attacks as an open robustness problem for full-duplex streaming dialogue and presents PALS at the RVQ interface. It reports reduced hijack success and a limited latent-space certificate, while locating the defense’s novelty in psychoacoustically matched covariance.

I. INTRODUCTION

  • Full-duplex agents expose an always-open microphone, persistent dialogue state, and direct spoken actions, while protection against masked attacks remains an open question.The paper formalizes targeted semantic hijack, muting, and policy jailbreak; white-box attacks against an undefended Moshi-style agent succeed in 91.7%, 88.4%, and 76.2% of trials, respectively.Source: §I · p. 1
  • PALS couples anisotropic Gaussian noise shaped by local codebook covariance at the RVQ interface with masking-threshold-shaped input augmentation and a KL consistency objective.One scalar σ scales both augmentations; training uses no attack and makes no architecture changes.Source: §I · p. 1
  • PALS-Train runs without inference-time smoothing or cost, whereas PALS-Certify aggregates 1,000 noise draws to certify decisions within an ellipsoidal latent radius.The hard certificate applies in latent space; its waveform-radius mapping uses an empirical local encoder estimate.Source: §I · p. 1
  • PALS-Train cuts targeted hijack from 91.7% to 8.3% at matched perceptibility with a 2.3% relative quality drop; PALS-Certify reaches 47.0% certified decisions at radius 0.5.The certified radius is capped at 0.616 and is described as a floor far below the demonstrated attacks.Source: §I · pp. 1–2

II. RELATED WORK

  • The paper’s stated novelty is the psychoacoustically matched smoothing covariance, not the standard whitening-to-isotropic certificate machinery.The input-space covariance follows a maximum-entropy argument under the masking-threshold constraint.Source: §II · p. 2

III. THREAT MODEL AND ATTACK FORMULATION

The threat model represents the user channel as audio encoded into discrete RVQ tokens that a dialogue model consumes alongside the agent stream. Attacks are constrained by a carrier-specific psychoacoustic masking threshold, expressed as a ball in a masking-weighted norm.

A. System Under Attack

  • At 24 kHz, user-channel audio is encoded into 12.5-Hz latent frames of dimension 512 before eight 2,048-entry RVQ codebooks quantize them.Source: A. System Under Attack · p. 2
  • The dialogue model jointly consumes interleaved user and agent token streams plus an inner-monologue text stream, conditioning responses on dialogue history.Source: A. System Under Attack · p. 2

B. The Perceptual Ball

  • The attacker’s perturbation budget is defined against each carrier’s MPEG-1 model 1 global masking threshold in STFT time-frequency bins.Source: B. The Perceptual Ball · pp. 2–3
  • The feasible perturbations form a radius-η ball in the masking-weighted supremum norm, bounding the largest threshold-normalized STFT coefficient.Source: B. The Perceptual Ball · p. 3
  • Budgets are reported as Δ=20 log10 η dB: 0 dB reaches the audibility threshold, while negative values add margin.Source: B. The Perceptual Ball · p. 3
  • Projection onto the convex perceptual ball clips per-bin magnitudes and applies inverse STFT.Source: B. The Perceptual Ball · p. 3

C. Attack Objectives

The attack formulation includes targeted response hijacking, muting, and a reusable-prefix jailbreak objective. Each objective is optimized under the perceptual-ball constraint, with over-the-air attacks incorporating room and noise variation.

C. Attack Objectives

  • The targeted hijack optimizes a perturbation under the perceptual-ball constraint to force an attacker-chosen response, using white-box access and Adam optimization.Source: C. Attack Objectives · p. 3
  • The mute objective drives the agent stream toward its silence tokens, using the natural-pause code as the full-duplex analogue of muting speech foundation models.Source: C. Attack Objectives · p. 3
  • The jailbreak optimizes a reusable prefix prepended to harmful spoken requests toward affirmative openings.Source: C. Attack Objectives · p. 3
  • Over-the-air attacks wrap these objectives in an expectation over room impulse responses and noise.Source: C. Attack Objectives · p. 3

IV. PSYCHOACOUSTICALLY ALIGNED LATENT SMOOTHING

PALS applies smoothing at the RVQ latent bottleneck, where attacks must pass, using one scalar to scale the defense. Its latent augmentation follows local codebook geometry and re-quantizes noisy frames into valid codes.

IV. PSYCHOACOUSTICALLY ALIGNED LATENT SMOOTHING

  • PALS perturbs the latent bottleneck with a single scalar σ scaling the defense, targeting the interface through which attacks must pass.Source: §IV · p. 3

A. Geometry-Aware Latent Augmentation

B. The Masking-Matched Input Dual

PALS pairs masking-shaped waveform noise with latent augmentation and trains consistency between clean and augmented paths. The deployed post-trained model has no added inference cost, while the separately smoothed certification operator does.

B. The Masking-Matched Input Dual

  • Waveform augmentation uses independent complex Gaussian STFT noise with per-bin variance matched to the masking threshold’s expected-power budget.Source: B. The Masking-Matched Input Dual · p. 3
  • Under that covariance constraint, the circularly symmetric complex Gaussian uniquely maximizes differential entropy; this is not pointwise feasibility in the perceptual ball.Source: B. The Masking-Matched Input Dual · p. 3

C. Training Objective

  • The training objective combines next-token cross-entropy with a β=4 KL coupling between clean-code and doubly augmented-code output distributions, averaged per emitted token.Source: C. Training Objective · pp. 3–4
  • Table I separates PALS-Train attack, clean, and over-the-air evaluations from PALS-Certify semantic accuracy at latent ℓ2 radius 0.5.Source: Table I · p. 4
  • Training uses no adversarial optimization and costs roughly 1.4× wall-clock; PALS-Train runs unmodified without inference-time cost, unlike Monte Carlo-smoothed PALS-Certify.Source: C. Training Objective · p. 4

V. CERTIFIED ROBUSTNESS ANALYSIS

PALS-Certify provides a fixed-covariance latent certificate, while the certified radius is a limited floor rather than coverage of the tested attack range. The analysis also transfers the certificate to a masking-weighted norm and treats input-space radius estimates as heuristic.

V. CERTIFIED ROBUSTNESS ANALYSIS

  • PALS-Certify fixes covariance Σ across clean and perturbed points; whitening yields an ellipsoidal certificate that applies despite hard quantization.The Euclidean ball is the ellipsoid’s inscribed sphere; anisotropy gives up to 10 certified points over isotropic smoothing in Figure 3(a).Source: §V · p. 4
  • Anisotropy adds up to 10 certified points over isotropic smoothing, with its gain confined to high-variance codebook directions inside the ellipsoid.Trace normalization and the minimum covariance eigenvalue cap the scalar ℓ2 radius.Source: §V · p. 4
  • At σ = 0.25, the certified latent-radius curve terminates at its Clopper–Pearson/trace ceiling of 0.616, corresponding to an input budget of only approximately −26 dB, far below the [−20, 0] dB attacks.Source: §V · p. 4, Figure 3 · p. 5
  • The risk decomposition links post-training loss, KL consistency, augmentation coverage of the perceptual ball, and an explicit penalty for Gaussian tail mass outside it.The tail term avoids assuming Gaussian support stays inside the perceptual ball.Source: §V · pp. 4–5
  • Under the tight-frame condition, the latent certificate transfers to a masking-weighted ℓ2 guarantee for threshold-compliant perturbations, not a pointwise supremum-norm guarantee.The transfer applies when the induced latent displacement satisfies ∥Σ^-1/2δz∥2 ≤ RΣ.Source: §V · p. 5
  • The pullback from latent to waveform radius is heuristic because the encoder Lipschitz constant is an empirical local estimate, not a certified global bound.The reported estimate uses held-out segments, with the 95th percentile used for input budgets.Source: §V · p. 5

A. Model, Data, and Training

The study post-trains a Moshi-style agent on dual-channel conversational English and calibrates PALS noise using held-out audio.

A. Model, Data, and Training

  • The agent is a 7B-parameter temporal transformer with RVQ tokens, a Mimi-style codec at 12.5 Hz with eight codebooks, and an inner-monologue text stream.Post-training uses a pretrained checkpoint and 3,118 hours of dual-channel conversational English from five sources.Source: A. Model, Data, and Training · p. 5
  • Training runs 80k AdamW steps on 32 H100 GPUs for approximately five days, with a batch of 64 five-minute segments and a 10k-step σ ramp.The learning rate is 2×10^-5 with cosine decay and weight decay 0.1.Source: A. Model, Data, and Training · p. 5
  • PALS uses σ=0.25, β=4, and ρ=0.1, with covariances calibrated on 20 hours of held-out audio.Source: A. Model, Data, and Training · p. 5

B. Attack Suite, Metrics, and Baselines

The evaluation attacks semantic hijacking, muting, and jailbreak goals under masked perturbation budgets, with digital and simulated over-the-air conditions and adaptive baselines.

B. Attack Suite, Metrics, and Baselines

  • Attacks use 1,000 Adam iterations, five restarts, projection onto the perceptual set, and budgets from −20 to 0 dB.Hijack uses 200 chosen responses over 1,000 carriers; mute is defined by activity below 5% for 10 seconds, and jailbreak uses 520 requests with universal prefixes.Source: B. Attack Suite, Metrics, and Baselines · p. 6
  • The over-the-air evaluation convolves attacks with room responses from 120 rooms and adds MUSAN babble at 10–20 dB under expectation over transforms.Judged quantities use Gemini 2.5 Pro, while mute is among the measured attack goals.Source: B. Attack Suite, Metrics, and Baselines · p. 6
  • Clean quality is measured with UTMOS, DNSMOS, Whisper WER, turn-taking F1, and ITU-T P.808; adaptive comparisons include Gaussian augmentation, smoothing, PGD training, and Demucs.Intervals use 104 bootstrap resamples.Source: B. Attack Suite, Metrics, and Baselines · p. 6

A. Main Comparison

PALS-Train sharply reduces attack success at a small quality cost, while PALS-Certify supplies a smaller formal robustness floor. Ablations point to psychoacoustic input shaping and codebook geometry as key components, with certification and evaluation scope bounded as described.

A. Main Comparison

  • 8.3% hijack, 11.2% mute, and 9.1% jailbreak are achieved by PALS-Train, with clean UTMOS 3.82 versus 3.91 and unchanged turn-taking F1.Its attacks are 1.5× to 2.3× lower than PGD, and WER rises only to 7.7%.Source: A. Main Comparison · p. 6

B. Certified Robustness

  • PALS-Certify certifies 47.0% of decisions at latent radius 0.5, below its 0.616 ceiling, and the floor covers none of the demonstrated attacks.Mechanical mute evaluation drops from 88.4±2.0% to 11.2±1.9%, without relying on an LLM judge.Source: B. Certified Robustness · p. 6

C. Ablations, Slices, and Limitations

  • Removing KL consistency, isotropic covariance, or input masking raises hijack from 8.3% to 12.7%, 13.6%, or 14.9%, respectively.PALS-Train reaches 2.9% attack success under the hardest reverberation-and-babble condition. The hard certificate is latent-space, transfers in weighted-ℓ2, and is evaluated on English dyadic conversations.Source: C. Ablations, Slices, and Limitations · p. 6

VIII. CONCLUSION

  • PALS-Train cuts attack success by roughly an order of magnitude at a 2.3% quality cost and no inference-time overhead, while empirical robustness far exceeds the certified floor.PALS-Train operates at the codec bottleneck that every attack must cross.Source: §VIII · p. 6

Related papers

Loading 2609.27378v1…