From Inaudible Inputs to Model Failures: Low-Frequency Safety Risks in LALMs
Yuanhe Zhang, Weiliu Wang, Jie Ren, Liang Lin, Zhenhong Zhou, Haoran Gao, Kun Wang, Chen Li, Li Sun, Sen Su
cs.SD, cs.AI
2026-08-10
A single universal 5-20 Hz waveform degrades six audio LLMs by up to 67 points with 0.06-0.08% audible leakage; a detect-and-requery guard restores mean accuracy from 28.5% to 46.1%.
The input surface of a large audio-language model (LALM) is defined by its audio frontend, not by human hearing. Commercial microphones keep a measurable response down to 0.5 Hz, well below the roughly 20 Hz floor of human hearing, so an inaudible low-frequency signal can enter the model and steer its output while the user hears nothing. Prior red teaming on LALMs covered malicious speech and audible noise; this channel, from BUPT with CAS, NTU and Tencent collaborators, had not been systematically tested.
The attack, Intermittent Low-Frequency Lockout (ILL), is black-box and universal: one waveform is built offline from a reference corpus and a reference model (Qwen2.5-Omni), then reused unchanged against every target model and utterance.
Two components set the waveform. Sentence Attention Scale Estimation derives the active-interval length: forward passes yield the attention matrix over audio tokens, and multi-scale boundary detection finds spans of continuous semantic attention; the corpus median lands at 3.67-5.07 seconds across datasets and models, and the waveform is emitted intermittently on that rhythm. Frequency Confusion Transfer sets the content: per-frame spectral centroids are quantized into states within 5-20 Hz, state-transition statistics are aggregated over the corpus, and dynamic programming decodes the most probable state sequence with a mandatory frequency change between adjacent segments, synthesized with continuous phase. The intuition is to mimic the statistical texture of speech spectra, which disturbs the model's reading of speech semantics.
The defense, Distributional Requery Guard (DRG), computes a normalized spectral distribution of the input, compares it with two K-means centroids (the cluster with more low-frequency mass is the interference cluster), and for flagged inputs requests a second recording; the model then answers only from content consistent across both. Detection is two V-dimensional distance evaluations, with no neural forward pass and no query to the target model.
Six LALMs (Qwen2.5-Omni, Qwen3-Omni, MiniCPM-o 4.5, StepAudio2 Mini, GPT-audio-mini, Gemini-3.5-flash) and four tasks (MMAU audio QA, LibriSpeech recognition, CoVoST 2 translation, RAVDESS emotion).
| Setting | Audible noise ratio | Human audibility (1-7) |
| Clean | 0% | 1.17 |
| Audible baselines | >98.9% | 3.75+ |
| ILL | 0.06-0.08% | 1.33 |
The largest single drop is StepAudio2 on emotion classification: 75% to 8%, a 67-point fall on a model the waveform was never tuned against, which is direct evidence of transfer. Ablations attribute the damage to the structured state sequence rather than low-frequency energy per se: at matched amplitude, Gaussian noise, a fixed tone and a uniform sweep are all clearly weaker. Internally, audio attention mass, representation similarity (1.0 to 0.63) and correct-answer probability (0.824 to 0.018) collapse together, and DRG pulls each partway back. Detection F1 is 89.69-99.00%; with a clean second recording, mean accuracy across the six models rises from 28.5% to 46.1%; forcing requery on clean inputs moves 10 of 12 scores by at most 0.03.
For voice assistants and voice agents this is a new availability attack surface: no file tampering, just a low-frequency source in the room, invisible to the user. DRG's detect-and-requery pattern is cheap enough to drop into existing pipelines. The construction also generalizes as an evaluation method: using attention statistics to set timing and corpus spectral statistics to set content is a template for probing other channels that models perceive but humans do not.
The experiments simulate microphone reception and do not reproduce the full physical chain from loudspeaker through a real acoustic environment to the microphone; source power, propagation loss and device variation are left to controlled physical evaluation. The mechanism analysis is correlational (attention, representations and confidence move together), not causal. Some baselines start very low (GPT scores 9% on clean RAVDESS), limiting the meaning of point drops there, and ILL does not dominate every audible baseline; the claim is scoped to the 5-20 Hz band alone causing broad degradation.