Abstract
As large language models become increasingly integrated into daily life, audio has emerged as a key interface for human-AI interaction. However, this convenience also introduces new vulnerabilities, making audio a potential attack surface for adversaries. Our research introduces WhisperInject, a two-stage adversarial audio attack framework that can manipulate state-of-the-art audio language models to generate harmful content. Our method uses imperceptible perturbations in audio inputs that remain benign to human listeners. The first stage uses a novel reward-based optimization method, Reinforcement Learning with Projected Gradient Descent (RL-PGD), to guide the target model to circumvent its own safety protocols and generate harmful native responses. This native harmful response then serves as the target for Stage 2, Payload Injection, where we use Projected Gradient Descent (PGD) to optimize subtle perturbations that are embedded into benign audio carriers, such as weather queries or greeting messages. Validated under the rigorous StrongREJECT, LlamaGuard, as well as Human Evaluation safety evaluation framework, our experiments demonstrate a success rate exceeding 86% across Qwen2.5-Omni-3B, Qwen2.5-Omni-7B, and Phi-4-Multimodal. Our work demonstrates a new class of practical, audio-native threats, moving beyond theoretical exploits to reveal a feasible and covert method for manipulating AI behavior.
Abstract (translated)
随着大型语言模型在日常生活中越来越普及，音频已成为人机交互的关键接口。然而，这种便利性也带来了新的安全漏洞，使音频成为潜在的攻击面。我们的研究介绍了WhisperInject，这是一种两阶段的对抗性音频攻击框架，可以操纵最先进的音频语言模型生成有害内容。我们使用了微小的音频输入扰动，这些扰动对人类听者来说是无害且不易察觉的。 第一阶段采用了一种基于奖励的优化方法——强化学习与投影梯度下降（RL-PGD），引导目标模型绕过自身的安全协议并生成有害响应。这种有害响应随后成为第二阶段“载荷注入”的攻击目标，在此阶段中，我们使用投影梯度下降（PGD）来优化嵌入到无害音频载体中的细微扰动，例如天气查询或问候信息。 在严格的StrongREJECT、LlamaGuard以及人类评估安全框架下验证后，我们的实验结果显示，WhisperInject在Qwen2.5-Omni-3B、Qwen2.5-Omni-7B和Phi-4-Multimodal模型上的成功率达到超过86%。这项工作揭示了一类新的实用且原生的音频威胁，并从理论性攻击方法转向了实际可行且隐蔽地操纵AI行为的方法。
URL
https://arxiv.org/abs/2508.03365
