mlsanityData to 14 Oct 2026

Attacker's Noise Can Manipulate Your Audio-based LLM in the Real World

arXiv 2507.06256 ↗First posted 7 Jul 2025cs.CR cs.AI cs.SDcited by 9

Not on the map. Why?

Abstract (arXiv)

This paper investigates the real-world vulnerabilities of audio-based large language models (ALLMs), such as Qwen2-Audio. We first demonstrate that an adversary can craft stealthy audio perturbations to manipulate ALLMs into exhibiting specific targeted behaviors, such as eliciting responses to wake-keywords (e.g., "Hey Qwen"), or triggering harmful behaviors (e.g. "Change my calendar event"). Subsequently, we show that playing adversarial background noise during user interaction with the ALLMs can significantly degrade the response quality. Crucially, our research illustrates the scalability of these attacks to real-world scenarios, impacting other innocent users when these adversarial noises are played through the air. Further, we discuss the transferrability of the attack, and potential defensive measures.

Key facts. Cited by 9 papers in the map (data through 14 Oct 2026). Builds on 31 of its 38 references that are in the map. First posted on arXiv 7 Jul 2025.

Builds on

31 of 38 references.

References · 31

  1. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  2. 2022Robust Speech Recognition via Large-Scale Weak Supervisioncited by 4,057
  3. 2023Qwen Technical Reportcited by 3,344
  4. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  5. 2021WavLM: Large-Scale Self-Supervised Pre-Training for Full Stack Speech Processingcited by 1,657
  6. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  7. 2019SpecAugment: A Simple Data Augmentation Method for Automatic Speech Recognitioncited by 1,380
  8. 2023PaLM 2 Technical Reportcited by 1,162
  9. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 672
  10. 2022AudioLM: a Language Modeling Approach to Audio Generationcited by 616
  11. 2023Qwen-Audio: Advancing Universal Audio Understanding via Unified Large-Scale Audio-Language Modelscited by 608
  12. 2024Qwen2-Audio Technical Reportcited by 560
19 more
  1. 2023SpeechGPT: Empowering Large Language Models with Intrinsic Cross-Modal Conversational Abilitiescited by 529
  2. 2023SALMONN: Towards Generic Hearing Abilities for Large Language Modelscited by 506
  3. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Promptscited by 398
  4. 2022BEATs: Audio Pre-Training with Acoustic Tokenizerscited by 388
  5. 2023AudioPaLM: A Large Language Model That Can Speak and Listencited by 343
  6. 2018Audio Adversarial Examples: Targeted Attacks on Speech-to-Textcited by 274
  7. 2024GAMA: A Large Audio-Language Model with Advanced Audio Understanding and Complex Reasoning Abilitiescited by 156
  8. 2024Spirit LM: Interleaved Spoken and Written Language Modelcited by 126
  9. 2023AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Modelscited by 111
  10. 2024WavLLM: Towards Robust and Adaptive Speech Large Language Modelcited by 109
  11. 2024Fast Adversarial Attacks on Language Models In One GPU Minutecited by 88
  12. 2024SpeechVerse: A Large-scale Generalizable Audio Language Modelcited by 63
  13. 2024ImgTrojan: Jailbreaking Vision-Language Models with ONE Imagecited by 57
  14. 2024AdvWave: Stealthy Adversarial Jailbreak Attack against Large Audio-Language Modelscited by 38
  15. 2025Multilingual and Multi-Accent Jailbreaking of Audio LLMscited by 31
  16. 2022Extracting Targeted Training Data from ASR Models, and How to Mitigate Itcited by 7
  17. 2023Unintended Memorization in Large ASR Models, and How to Mitigate Itcited by 5
  18. 2024Noise Masking Attacks and Defenses for Pretrained Speech Modelscited by 3
  19. 2024Can DeepFake Speech be Reliably Detected?cited by 1

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 3; 2026: 6.

9 papers.

  1. 2025Speech-Audio Compositional Attacks on Multimodal LLMs and Their Mitigation with SALMONN-Guardcited by 13
  2. 2025When Good Sounds Go Adversarial: Jailbreaking Audio-Language Models with Benign Inputscited by 4
  3. 2025Breaking Audio Large Language Models by Attacking Only the Encoder: A Universal Targeted Latent-Space Audio Attackcited by 4
  4. 2026Sparse Tokens Suffice: Jailbreaking Audio Language Models via Token-Aware Gradient Optimizationcited by 2
  5. 2026Afrispeech Semantics: Evaluating Audio Semantic Reasoning in Spoken Language Models Across Domains and Accentscited by 2
  6. 2026SoundBreak: A Systematic Study of Audio-Only Adversarial Attacks on Trimodal Modelscited by 1
  7. 2026Codec-Robust Attacks on Audio LLMscited by 1
  8. 2026Audio Jailbreaks in Large Audio-Language Models: Taxonomy, Attack-Defense Analysis, and Cost-Aware Evaluationcited by 1
  9. 2026From Acoustic Sensing to Physical Actions: A Comprehensive Survey of Security Risks in Edge-Deployed Audio LLM-Based Agentscited by 0