PaperlayerView exact revision on arXiv

Source-linked AI summary

AnchorPrompt: Self-Distilled Soft Prompts for Robust Audio-Language Models

Pooneh Mousavi, Amir Ivry, Mirco Ravanelli, Cem Subakan

arXiv:2610.00706v1cs.SDcs.LG

TL;DR

Existing LALM benchmarks largely use clean recordings and static prompts, despite vulnerability to real-world perturbations and hallucinations on evidence-free audio. AnchorPrompt uses self-distilled soft prompts with refusal targets when audio is insufficient to answer. It improves consistency in most tested conditions while preserving clean-audio performance and transferring to unseen perturbations.

  • Problem

    Existing benchmarks largely use clean recordings and static prompts, while LALMs face noisy, adversarial, and evidence-free inputs that can trigger instability or hallucination.

    Source: §1 · p. 1

  • Method

    AnchorPrompt trains soft prompts on a frozen LALM through clean-teacher self-distillation, assigning refusal targets when audio lacks sufficient evidence to answer.

    Source: §1 · p. 1, §2.2 · p. 2, §2.3 · p. 2

  • Results

    Consistency improves in most tested conditions, clean accuracy improves in six of nine model–benchmark pairs, and clean-audio refusal rates remain ≤0.3%.

    Source: §4.1 · p. 4, §4.2 · p. 4

  • Takeaways & Limitations

    The learned prompt transfers zero-shot to unseen choice permutations and acoustic reverberation, supporting an approach to stabilizing LALMs against real-world distortions.

    Source: §1 · p. 2, §5 · p. 4

Abstract

from arXiv · show

Large audio-language models (LALMs) are sensitive to input perturbations, such as noise, waveform corruption, and adversarial injections. We propose AnchorPrompt, an efficient adaptation method that keeps the model frozen and learns a single block of prompt vectors inserted at the decoder input, between the audio and question embeddings. We train these vectors through self-distillation over diverse audio and text perturbations. To improve answer consistency and mitigate hallucination, we use the model's prediction on the clean recording as the target for answerable inputs, and assign a refusal target when the audio lacks sufficient evidence to answer. Furthermore, AnchorPrompt is perturbation-agnostic at inference, requiring no prior detection of perturbations and enabling zero-shot transfer to unseen distortions. We evaluate three LALMs across three benchmarks and show that AnchorPrompt improves answer consistency in most tested conditions. Clean accuracy improves in six of nine model-benchmark pairs, with minimal impact on the remainder of 1.2% at most. Crucially, AnchorPrompt reduces hallucinations under severe audio corruption while keeping false refusals on clean audio rare. Finally, these consistency gains transfer to unseen perturbations, such as choice permutations and reverberation.

1. INTRODUCTION

Existing LALM benchmarks largely use clean recordings and static prompts, leaving behavior under noisy, incomplete, or adversarial inputs unsystematically evaluated. AnchorPrompt addresses this gap with self-distilled soft prompts and inference that needs no perturbation detection.

1. INTRODUCTION

  • Existing benchmarks do not systematically evaluate LALM behavior under real-world noisy, incomplete, or adversarial inputs, and text-only instructions cannot stabilize corrupted audio representations.Hand-written instructions alone fail to stabilize behavior across diverse audio and text perturbations.Source: §1 · p. 1
  • LALMs face natural and adversarial perturbations, and evidence-free audio can prompt hallucinations instead of uncertainty.The stated application stakes include safety-critical domains such as healthcare and emergency services.Source: §1 · p. 1
  • AnchorPrompt inserts trainable soft-prompt vectors between audio and question embeddings, distilling a frozen model’s clean-input answer to its perturbed-input student and using refusal targets when evidence is insufficient.The prompt vectors are the only trainable parameters; the method relies on self-distillation rather than ground-truth labels.Source: §1 · p. 1, Figure 1 · p. 1
  • At inference, AnchorPrompt needs no perturbation detection and is designed to transfer zero-shot to unseen distortions.The evaluation includes unseen choice permutations and room reverberation.Source: §1 · p. 2
  • The evaluation spans three LALMs and three benchmarks, comparing hand-written instructions on clean accuracy, distortion robustness, hallucination mitigation, and transfer to unseen perturbations.The tested unseen perturbations include choice permutations and room reverberation.Source: §1 · p. 2

2. METHOD

AnchorPrompt freezes the LALM and trains a soft prompt through self-distillation: perturbed inputs target the clean teacher’s answer when answerable and a refusal when evidence is insufficient.

2.1. Soft prompt

  • A single prompt of L = 8 learnable vectors is inserted between audio and question embeddings; each LALM has its own prompt, and all other model weights stay frozen.Vectors are initialized from randomly chosen vocabulary-token embeddings.Source: §2.1 · p. 2

2.2. Training inputs and targets

  • The clean teacher answers each item once; clean and moderate-perturbation inputs target that answer, while full masking and −20 dB SNR target CANNOT DETERMINE.The clean-answer target is used even when it differs from the ground-truth answer.Source: §2.2 · p. 2

2.3. Training objective

  • Training minimizes student cross-entropy on assigned target tokens and updates only the prompt; ground-truth answers are excluded from the loss.Teacher answers are computed once before training; ground truth is used for evaluation and constructing adversarial injections.Source: §2.3 · p. 2

3. EXPERIMENTAL SETUP

The setup partitions three benchmark datasets, applies natural, adversarial, and out-of-distribution perturbations, and compares three LALMs using accuracy, consistency, and refusal-related measures.

3.1. Data and partitioning

  • SAKURA, MMAU test-mini, and MMAR recordings are split by track into 20% training, 16% validation, and 64% test.The test sets contain 2,560 SAKURA, 640 MMAU, and 637 MMAR questions; training contains 1,200 questions before perturbations.Source: §3.1 · p. 2

3.2. Perturbations

  • Evaluated perturbations include noise, masking, adversarial audio and text injections, plus zero-shot choice permutations and 1-second reverberation.The −20 dB SNR noise and 100% masking conditions are designated refusal-target conditions.Source: §3.2 · pp. 2–3

3.3. Models, baselines, and training

  • The experiments use Qwen2.5-Omni, Qwen3-Omni, and Audio Flamingo 3, comparing the frozen base model and a hand-written instruction baseline with AnchorPrompt.The prompt length is L = 8 with the full training set; training runs for three epochs, and checkpoint selection uses agreement with the teacher on held-out validation recordings.Source: §3.3 · p. 3

3.4. Evaluation

  • Evaluation pairs accuracy, where refusals count as incorrect, with consistency against each configuration’s own clean behavior; severe-condition answer rates and clean-audio over-refusal are also reported.Consistency counts matching refusals as consistent, so it is reported alongside accuracy; answer rates are measured under 100% masking and −20 dB SNR noise, with over-refusal measured on clean audio.Source: §3.4 · pp. 3–4, Table 2 · p. 4

4. RESULTS

AnchorPrompt improves robustness across several tested perturbations, while keeping clean-audio performance largely stable. Its gains also transfer to unseen perturbations, though that benefit varies by model, benchmark, and perturbation.

4.1. Robustness to perturbations

  • Clean accuracy improves in six of nine model–benchmark pairs, with decreases of only 0.1–1.2 percentage points in the other three.For Qwen2.5-Omni, clean-accuracy gains accompany lower clean-audio refusal rates; AF3 changes by −1.2 to +1.4 percentage points relative to Base.Source: §4.1 · p. 4
  • AnchorPrompt improves accuracy and clean-answer consistency under adversarial injections across every evaluated model–benchmark pair, while gains under noise and masking are more variable.Qwen models improve in consistency in most natural-perturbation conditions; AF3 changes marginally because it is already highly consistent there.Source: §4.1 · p. 4
  • The tested Manual instruction does not match AnchorPrompt’s adversarial-injection gains; on Qwen2.5-Omni it lowers accuracy across every condition as the model declines to answer more often.Both prompts share the same decoder position after audio encoding, but only the soft prompt is explicitly optimized over clean and perturbed inputs.Source: §4.1 · p. 4

4.2. Answering under full masking and severe noise

  • Under 100% masking, answer rates fall to 0%–6.7%; under −20 dB SNR noise, they fall to 3.3%–13.4%, while clean-audio refusal rates remain ≤0.3%.These two corruption conditions are included in training, so the results measure adherence to trained refusal targets rather than zero-shot detection of missing evidence.Source: §4.2 · p. 4

4.3. Zero-shot transfer to unseen perturbations

  • Clean-answer consistency is higher in eight of nine model–benchmark pairs under choice permutation and seven of nine under reverberation.Gains are not uniform: under reverberation, consistency falls by 4.2 points for Qwen2.5-Omni on MMAU and 1.6 points for AF3 on MMAR; Table 3 reports accuracy change and consistency.Source: §4.3 · p. 4, Table 3 · p. 4

5. DISCUSSION AND CONCLUSION

AnchorPrompt adapts frozen LALMs through self-distillation and refusal targeting. The paper reports improved robustness while preserving clean-audio performance, mitigating hallucinations under severe corruption, and transferring to unseen perturbations.

  • AnchorPrompt adapts frozen LALMs through self-distillation and refusal targeting.Source: §5 · p. 4
  • Across multiple benchmarks and models, AnchorPrompt improves robustness against audio and text perturbations while preserving clean-audio performance.Source: §5 · p. 4
  • The method mitigates hallucinations under severe corruption without triggering false refusals on clean inputs, and its learned prompt vectors transfer to unseen perturbations.Examples of unseen perturbations include choice reordering and acoustic reverberation.Source: §5 · p. 4
Loading 2610.00706v1…