From Inaudible Inputs to Model Failures: Low-Frequency Safety Risks in LALMs

The Risk: Inaudible Sounds Can Break Audio AI

Large audio-language models (LALMs)—AI systems trained to understand and respond to audio input—are vulnerable to a simple but overlooked attack: sounds humans cannot hear. The authors demonstrate that low-frequency signals (below the range of human hearing) can be injected into audio before it reaches an LALM, causing dramatic accuracy drops of up to 67 percentage points across six different models. The attack is "black box," meaning attackers need no access to the model's internals. The catch: humans rating the attacked audio gave it an audibility score of 1.33 out of 10, barely distinguishable from clean audio at 1.17, confirming the signals are genuinely inaudible.

How the Attack Works

The authors propose Intermittent Low-Frequency Lockout (ILL), a method to craft these adversarial low-frequency waveforms. Rather than trial-and-error, ILL uses two key techniques.

First, Sentence Attention Scale Estimation identifies when in the audio to inject low-frequency noise—the model is most vulnerable during certain time windows. Second, Frequency Confusion Transfer constructs the actual low-frequency signal by analyzing the natural spectral variations (frequency distributions) in a corpus of clean audio. This lets attackers build a plausible low-frequency waveform that looks like a natural variation rather than random noise, making it harder to detect.

The beauty of the approach is simplicity: ILL uses a single universal waveform template that works across multiple models without retraining or retuning per target.

The Defense

To counter this, the authors propose Distributional Requery Guard (DRG). The core idea is to detect when an audio recording exhibits an abnormal low-frequency distribution—a statistical red flag. When suspicious, DRG requests a fresh recording of the same content. This semantic recovery step is practical: in real deployments, asking a user to re-speak a phrase is less disruptive than silently accepting poisoned input.

Testing shows DRG is effective: it raised mean accuracy on attacked audio from 28.5% (after an attack) to 46.1% after clean reacquisition. This is meaningful but not perfect, suggesting future defenses need refinement.

Why It Matters

This work exposes a vulnerability class that LALMs inherit from their vision-language cousins but with a twist: audio's low-frequency components are definitionally inaudible, removing the usual assumption that humans can spot adversarial examples. As LALMs move into safety-critical domains—medical transcription, accessibility tools, voice authentication—this gap is urgent. The paper provides both the attack and a first-pass defense, framing the problem for future work.

The results span realistic conditions: six different LALMs (specifics not detailed in the abstract) and multiple audio understanding tasks. The high human audibility scores underscore the practical stealth of the method—it sidesteps the human senses entirely.