🤖 AI

From Inaudible Inputs to Model Failures: Low-Frequency Safety Risks in LALMs

This paper introduces an inaudible red teaming method called Intermittent Low-Frequency Lockout (ILL) that exploits low-frequency signals to significantly degrade the performance of Large Audio-Language Models (LALMs), while also proposing a Distributional Requery Guard (DRG) mechanism to detect such attacks and recover semantic accuracy.

Original authors: Yuanhe Zhang, Weiliu Wang, Jie Ren, Liang Lin, Zhenhong Zhou, Haoran Gao, Kun Wang, Chen Li, Li Sun, Sen Su

Published 2026-08-11

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Yuanhe Zhang, Weiliu Wang, Jie Ren, Liang Lin, Zhenhong Zhou, Haoran Gao, Kun Wang, Chen Li, Li Sun, Sen Su

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are talking to a super-smart robot that can hear everything: your voice, the rustling of leaves, the hum of a refrigerator, and even the music playing in the background. Scientists call these "Large Audio-Language Models" (LALMs). They are like digital ears and brains combined, designed to understand the world through sound. But here's the catch: these robots hear things that human ears simply cannot. Just as a dog can hear a high-pitched whistle that is silent to us, these AI models can process sound waves that are far too low or too high for us to notice. This creates a strange gap: you might think you are having a normal conversation, but the robot is actually hearing a secret, invisible layer of noise underneath your words. This paper explores what happens when someone intentionally uses that invisible layer to trick the robot.

The researchers behind this study, led by Yuanhe Zhang and his team, decided to play a game of "red teaming," which is basically a fancy way of saying they tried to break the system to see where it was weak. They discovered a sneaky way to confuse these audio robots using Intermittent Low-Frequency Lockout (ILL). Think of it like this: imagine you are trying to listen to a friend tell a story, but someone is playing a very quiet, rhythmic thumping sound under the table. You can't hear the thumping at all, but it's vibrating the table just enough to make your friend's voice sound garbled to the person sitting across from you. That is essentially what ILL does. It uses a "universal waveform"—a specific pattern of low-frequency sound (between 5 and 20 Hz, which is below the range of human hearing)—that is injected into the audio the robot receives.

The team found that this invisible noise is incredibly effective at messing up the robot's brain. When they tested this on six different audio-language models, the robots' ability to understand speech, translate languages, or identify emotions dropped dramatically. In some cases, their accuracy fell by as much as 67 percentage points. The scariest part? The humans listening to the audio couldn't tell the difference. The researchers asked people to rate how noisy the audio sounded on a scale of 1 to 7. The clean audio got a rating of 1.17, and the audio with the secret attack got a rating of 1.33. That is barely a blip above "completely imperceptible," yet it was enough to make the AI stumble and give wrong answers.

The paper also argues against the idea that you need loud, obvious noise to break these systems. They showed that you don't need to blast the robot with static or loud music; a tiny, hidden, low-frequency pulse is enough to cause chaos. They tested this against other types of noise attacks and found that while their method wasn't always the absolute worst in every single scenario, it was consistently very strong and, crucially, much harder for humans to detect.

But the researchers didn't just want to break things; they wanted to fix them too. They proposed a defense called Distributional Requery Guard (DRG). Imagine if, every time you spoke to a robot and it seemed confused, the robot would politely say, "Hey, that sounded a bit weird. Could you say that again?" The DRG system acts like a bouncer at a club. It listens to the audio and checks if the "spectral fingerprint" (the pattern of frequencies) looks suspicious. If it detects that low-frequency interference is hiding in the mix, it asks the user to record the sentence a second time. By comparing the first recording (which might be jammed) with the second one (which is hopefully clean), the system can figure out what the user actually meant. This defense worked well, boosting the robots' accuracy from a low of 28.5% back up to 46.1% when a clean second recording was available.

In the end, this paper suggests a new kind of safety risk for the future of AI. It shows that because these models hear a wider range of sound than we do, they are vulnerable to attacks that are invisible to us. The authors suggest that we need to build better "ears" for our AI that can spot these hidden frequencies and ask for clarification, ensuring that what the robot hears matches what we actually intended to say. While the experiments were done in a controlled simulation rather than in the wild, the results highlight a real gap between human perception and machine hearing that we need to address before these audio assistants become a part of our daily lives.

Technical Summary: From Inaudible Inputs to Model Failures

Problem Statement

Large Audio-Language Models (LALMs) integrate acoustic perception with language reasoning, creating an input surface defined by physical waveforms rather than human perception alone. This paper identifies a critical safety gap: low-frequency signals (specifically in the 0–20 Hz range, including infrasound) are inaudible to humans but can be captured by standard microphones and processed by LALMs. While prior work has explored adversarial audio and acoustic corruption, the specific risk posed by fixed, low-frequency physical signals that remain imperceptible to users yet disrupt model behavior has remained underexplored. The authors argue that this creates a "perception boundary mismatch," where the model receives acoustic evidence (the superposition of speech and interference) that the human user cannot perceive, potentially leading to availability failures, incorrect transcriptions, or flawed semantic understanding.

Methodology

1. Threat Model

The study assumes an adversary emits a low-frequency waveform that physically superposes with a user's speech in the air before being captured by the target microphone. The attack is black-box and universal: the adversary constructs a single waveform offline using a reference corpus and a reference LALM, without querying the target model or adapting to specific test utterances. This waveform is then deployed to attack various LALMs and tasks.

2. Intermittent Low-Frequency Lockout (ILL)

The authors propose ILL, a red-teaming method designed to evaluate this risk using a universal waveform template. ILL consists of two core modules:

Sentence Attention Scale Estimation: This module analyzes the self-attention maps of a reference LALM to identify "active intervals" where the model focuses on continuous semantic processing. By averaging attention matrices across layers and heads, the method derives a corpus-level duration ( $L_{on}$ ) that aligns with typical semantic spans. This determines the timing of the attack's active and inactive phases (duty cycle $\gamma$ ).
Frequency Confusion Transfer: To disturb the model's perception of speech semantics, this module maps the spectral variation of the reference corpus into a low-frequency state sequence. It quantizes the spectral centroid of the corpus into $n$ states and uses transition statistics to generate a continuous-phase, smooth-envelope low-frequency waveform ( $\delta_{on}$ ). This waveform is synthesized with a specific amplitude ( $\beta$ ) and repeated according to the schedule derived from the attention analysis.

3. Distributional Requery Guard (DRG)

To mitigate the identified risk, the authors propose DRG, a plug-in input filter that operates before LALM inference:

Detection: DRG constructs a training set of clean and jammed (low-frequency interfered) recordings. It extracts spectral descriptors (STFT magnitudes normalized across frequency bins) and clusters them using K-means. The cluster with higher energy in the low-frequency range is labeled as the "interference cluster."
Conditional Requery: During deployment, if a user's initial recording is classified as belonging to the interference cluster, the system requests a second, independent recording of the same utterance.
Recovery: The target LALM is instructed to compare both recordings and generate an answer based only on content that is consistent and intelligible across the pair, effectively filtering out the transient or persistent interference.

Key Results

Attack Effectiveness

Evaluated across six LALMs (MiniCPM, StepAudio2, Qwen2.5, Qwen3, GPT, Gemini) and multiple tasks (ASR, Translation, Audio QA, Emotion Classification), ILL demonstrated significant disruption:

Performance Degradation: ILL reduced accuracy by up to 67 percentage points on the StepAudio2 model for the RAVDESS emotion classification task. Across the six models, the mean accuracy under attack dropped to 28.5% (from a clean baseline of 46.1% or higher depending on the specific model/task average), indicating a severe vulnerability.
Transferability: The fixed waveform, constructed using Qwen2.5, successfully degraded the performance of all other target models, including closed-source systems, without target-specific optimization.
Stealthiness:
- Audible Noise Ratio (ANR): ILL had an ANR of only 0.06–0.08%, meaning negligible energy leaked into the audible band (20 Hz–8 kHz), compared to >98% for other baselines like Gaussian noise or PNL.
- Human Perception: In human evaluations (112 participants), ILL received a mean audibility rating of 1.33 (on a 1–7 scale), statistically indistinguishable from clean audio (1.17). In contrast, other attack methods received significantly higher ratings (e.g., 3.75–3.92).

Defense Performance

Detection: DRG achieved F1 scores between 89.69% and 99.00% in detecting low-frequency distribution shifts.
Recovery: When a clean second recording was available, DRG raised the mean attacked accuracy from 28.5% to 46.1%. The mechanism also showed transferability, recovering performance under other noise perturbations and attack types (Gaussian, PNL, Audio-Adv, Whisper).
Benign Utility: When forced to requery on clean inputs, DRG caused minimal performance degradation (changes within 0.03 of standard inference in most cases).

Mechanistic Analysis

Internal analysis revealed that ILL's success is linked to:

Reduced Attention: The attack significantly lowered the attention mass assigned to audio tokens (e.g., from 0.0416 to 0.0373 on MMAU).
Representation Shift: Cosine similarity between clean and attacked encoded representations dropped significantly (e.g., from 1.0 to 0.63 on RAVDESS).
Confidence Degradation: The probability assigned to the correct answer plummeted (e.g., from 0.805 to 0.170 on MMAU), indicating a shift in the model's internal decision-making process.

Significance and Claims

The paper claims to identify a previously overlooked safety risk: inaudible low-frequency inputs as a hidden channel for disrupting LALMs.

Novelty: Unlike previous adversarial attacks that rely on high-frequency perturbations or semantic manipulation, this work demonstrates that a fixed, low-frequency physical signal can cause broad degradation across diverse models and tasks while remaining imperceptible to humans.
Methodological Contribution: The introduction of ILL provides a black-box red-teaming framework for evaluating this specific risk, while DRG offers a lightweight, detection-based mitigation strategy that does not require retraining the LALM.
Safety Implications: The findings suggest that current LALMs are vulnerable to "availability" attacks where the model's behavior diverges from the user's perception. The authors emphasize that this risk is distinct from semantic jailbreaks, as it exploits the physical properties of the audio frontend.
Limitations: The authors explicitly state that their experiments simulate microphone reception and do not validate field deployment in uncontrolled environments. They acknowledge that physical feasibility depends on source power and propagation conditions, and they do not provide device-specific settings for emitting such signals. The work prioritizes identifying the risk and demonstrating a preliminary defense rather than establishing a complete causal mechanism or enabling real-world exploitation.