From Inaudible Inputs to Model Failures: Low-Frequency Safety Risks in LALMs

arXiv:2608.091582026-08-09

Sounds humans can't hear can quietly break AI voice models

Researchers built an attack called ILL that plays an inaudible 5-20 Hz low-frequency sound alongside normal speech to make large audio-language models (LALMs) fail. Across six LALMs, ILL cut accuracy by up to 67 percentage points while human listeners rated it almost as inaudible as clean audio. Their defense, DRG, detects the hidden low-frequency shift and asks for a second recording, raising attacked accuracy from 28.5% to 46.1%.

METAL MEDIA explanatory visual

How the ILL attack and DRG defense work together

Evidence statusMeasured results reported

Threat setupAn attacker plays a 5-20 Hz waveform, inaudible to people, that mixes in the air with a user's speech before reaching the target model's microphone.
Building ILLSentence Attention Scale Estimation finds active speech intervals, and Frequency Confusion Transfer converts corpus-level frequency shifts into a continuous-phase low-frequency waveform, forming one reusable universal attack template.
Attack evaluationSix LALMs are tested on audio Q&A, speech recognition, translation, and emotion classification, measuring accuracy drops and 112-person human audibility ratings.
DRG defenseIncoming audio is split into two spectral clusters; inputs flagged as suspicious trigger a request for a second recording, and the model answers only from content consistent across both.
Recovery resultWith a clean second recording, the six-model mean attacked accuracy rises from 28.5% to 46.1%.

An explanatory diagram made by METAL MEDIA, not a figure supplied by the paper's authors.

What they did

The team designed ILL, an attack that uses a sound in the 5-20 Hz range, below human hearing, to disrupt large audio-language models (LALMs) that combine audio understanding with language generation.
ILL works by estimating when a model pays continuous attention to speech (Sentence Attention Scale Estimation) and by turning how a speech corpus's frequency content shifts over time into a continuous-phase low-frequency waveform (Frequency Confusion Transfer), producing one universal noise template reusable across different target models and utterances without needing access to the target.
Tested on six LALMs (four open-weight, two closed-source) across audio question answering, speech recognition, translation, and emotion classification, ILL reduced accuracy by up to 67 percentage points, including strong effects on a model never used to build the attack.
In a listening study with 112 people, audio mixed with ILL received a mean audibility rating of 1.33 (on a 7-point scale where 1 means inaudible), close to 1.17 for clean audio, and only 0.06-0.08% of its noise energy fell in the range humans can normally hear.
The proposed defense, Distributional Requery Guard (DRG), detects low-frequency distribution shifts (F1 scores of 89.69-99.00%) and requests a second recording when suspicious, raising the mean attacked accuracy across six models from 28.5% to 46.1% when the second recording is clean.

Figure 1: Overview of the low-frequency perception gap, the construction of ILL, the DRG detection pipeline, and the evaluation.

Table 13: Paired comparisons between ILL and the six attack baselines across the 18 model–task cells.
Baseline	Mean accuracy difference (pp)	ILL lower/tied/higher	Holm-adjusted p
Gaussian	1.2	9/5/4	.422
PNL (Natural)	1.0	10/3/5	.422
PNL (Mechanical)	1.4	12/0/6	.422
PNL (Human)	1.5	11/0/7	.422
Audio-Adv.	9.8	17/0/1	3.81×10−5
Whisper	11.3	18/0/0	2.29×10−5

Figure 2: Attack effectiveness on translation and recognition. Lower BLEU and higher WER indicate stronger disruption.

Table 14: Interpretation of the seven-point human audibility scale.
Score	Description
1	Completely imperceptible
2	Almost imperceptible
3	Barely noticeable
4	Slightly noticeable
5	Moderately noticeable
6	Clearly noticeable
7	Highly noticeable

Figure 3: Human audibility ratings across 100+ responses.

Findings

Across six LALMs and multiple audio tasks, ILL reduced accuracy by up to 67 percentage points, with the largest drop occurring on StepAudio2, a model not used to build the attack, showing strong transfer to unseen targets.
ILL's audible noise ratio (ANR) was only 0.06-0.08%, versus over 98.9% for all comparison noise baselines, and in a 112-person listening study it scored a mean audibility rating of 1.33, close to 1.17 for clean audio.
DRG detected low-frequency interference with F1 scores of 89.69-99.00% across four evaluation datasets, and raised the six-model mean attacked accuracy from 28.5% to 46.1% after a clean second recording was supplied.
Across all 18 model-task combinations, ILL lowered accuracy relative to clean audio (mean drop of 13.1 percentage points, statistically significant), and it beat the Audio-Adv. and Whisper attack baselines significantly, though differences from Gaussian noise and natural/mechanical/human noise categories were not statistically significant.
Internal analysis showed ILL reduced the model's attention weight on audio and its confidence in the correct answer, and DRG partially restored both toward clean-condition levels.

Where it can be used

Security testing checklists for voice assistants, smart speakers, and phone-based AI agents could add inaudible low-frequency robustness tests inspired by ILL.
Product teams could adapt DRG-style detection of low-frequency spectral shifts plus conditional re-recording as an input filter for voice AI systems.
Red-teaming protocols for new audio-language models before release could include inaudible frequency-band attacks as a standard evaluation category.

Figure 5: Recovery under four additional attack types.

Limits and open work

The study simulated the waveform received by the microphone rather than reproducing the full speaker-to-air-to-microphone physical chain, so device- and environment-specific effects still need controlled physical testing.
The findings do not establish that such low-frequency signals are safe for humans, and the researchers deliberately avoided deploying ILL in uncontrolled real-world settings.
DRG's recovery benefit is largest when the second recording is clean; under persistent interference the improvement is smaller, so effectiveness depends on the quality of the re-recording.
The attention, representation, and confidence analyses show associations with the attack's effect but do not establish a complete causal mechanism, which the authors leave for future work.
ILL does not always outperform every noise baseline; differences from Gaussian noise and general environmental noise categories were not statistically significant after correction.

Figure 6: ILL component analysis on Qwen3-Omni. Panels vary (a) amplitude, (b) duty cycle, (c) segment length, and (d) state-sequence construction. Dashed lines mark the configuration used in the main experiments.

Why it matters

This is one of the first demonstrations that a sound completely inaudible to people can substantially derail how AI voice systems understand speech, exposing a security gap users cannot notice on their own. Anyone building or securing voice assistants, smart speakers, or call-center AI should treat this as a new class of risk to test for and design defenses against.

Terms in this paper

LALM (large audio-language model) · A large AI model that listens to audio and responds using language understanding and generation
black-box attack · An attack that works without knowing the internal parameters or structure of the target model
ANR (audible noise ratio) · The share of a perturbation's energy that falls within the range humans can normally hear (about 20 Hz-20 kHz)
F1 score · A detection accuracy metric that balances precision and recall
DRG (Distributional Requery Guard) · A defense that flags suspicious low-frequency input distributions and requests a second recording before answering

Original abstract (English)

Large audio-language models (LALMs) have demonstrated strong capabilities in understanding diverse audio inputs. This diversity includes low-frequency signals that are inaudible to humans but can still enter the model and influence its generation. However, the practical impact of such low-frequency inputs on LALMs remains largely unexplored. In this paper, we propose Intermittent Low-Frequency Lockout (ILL), an inaudible red teaming method that evaluates this risk using a universal waveform template in a black box setting. ILL uses Sentence Attention Scale Estimation to determine active intervals and Frequency Confusion Transfer to construct a low-frequency waveform with continuous phase from corpus spectral variation. To mitigate this risk, we propose Distributional Requery Guard (DRG) to detect low-frequency distribution shifts and conditionally request a second recording for semantic recovery. Across six LALMs and multiple audio understanding tasks, ILL reduces accuracy by up to 67 percentage points while receiving a mean human audibility rating of 1.33, close to 1.17 for clean audio; DRG raises mean attacked accuracy from 28.5\% to 46.1\% after clean reacquisition. These findings identify a previously overlooked safety risk for LALMs and provide a foundation for future research on robust audio understanding.

Authors · Yuanhe Zhang

Read on arXiv

Latest papers

All papers →

Latest from METAL MEDIA

NCT 127 drop BLINGY, their first full album in two years

Figures: Yuanhe Zhang et al., arXiv:2608.09158, CC BY 4.0