From Inaudible Inputs to Model Failures: Low-Frequency Safety Risks in LALMs

Analysis

Why This Paper Matters

Large audio-language models (LALMs) are increasingly deployed in real-world applications, yet their security has not been thoroughly examined, especially regarding inaudible inputs. This paper reveals a critical vulnerability: low-frequency signals that are imperceptible to humans can still be processed by LALMs and cause significant performance degradation. The proposed attack, ILL, demonstrates that an adversary can craft universal waveforms that reduce accuracy by up to 67 percentage points across multiple models, all while remaining virtually inaudible (mean audibility rating 1.33 on a scale where 1 is inaudible and 5 is very audible, compared to 1.17 for clean audio). This is a stark reminder that model robustness must consider the full spectrum of human perception, not just audible frequencies.

The paper also introduces a defense mechanism, DRG, which detects low-frequency distribution shifts and requests a second recording to recover semantics. This is a practical approach that leverages the idea of re-acquisition, which is feasible in many interactive scenarios. The work is significant because it not only exposes a new attack vector but also provides a countermeasure, offering a balanced contribution to AI safety.

Technical Contributions

• Inaudible Red Teaming Method (ILL): A black-box attack that uses a universal waveform template, making it model-agnostic and easy to deploy.
• Sentence Attention Scale Estimation: A technique to determine active intervals in the audio where the attack should be applied, increasing effectiveness.
• Frequency Confusion Transfer: A method to construct low-frequency waveforms with continuous phase by leveraging spectral variation from a corpus, ensuring the attack is both stealthy and effective.
• Distributional Requery Guard (DRG): A defense that monitors for low-frequency distribution shifts and conditionally requests a second recording, allowing the model to recover from the attack.

Results

The paper reports that ILL reduces accuracy by up to 67 percentage points across six LALMs and multiple audio understanding tasks. The attack's stealth is confirmed by human evaluation, with a mean audibility rating of 1.33, close to the 1.17 for clean audio. DRG effectively mitigates the attack, raising mean attacked accuracy from 28.5% to 46.1% after clean reacquisition. These results are compelling, showing both the severity of the vulnerability and the efficacy of the proposed defense.

Significance

This research highlights a previously overlooked safety risk in LALMs, emphasizing that models must be robust to inputs beyond the human auditory range. The proposed attack and defense provide a foundation for future work in audio security, encouraging researchers to consider low-frequency threats when designing and evaluating LALMs. The findings also have broader implications for AI safety, as they demonstrate that even inaudible signals can be weaponized, necessitating more comprehensive security measures in multimodal systems.