Hidden Audio Signals Hijack Voice AI Systems with 79-96% Success Rate
New research presented at the IEEE Symposium on Security and Privacy reveals a practical attack vector against Large Audio-Language Models (LALMs). Attackers can embed imperceptible signals into audio clips to hijack model behavior, achieving a 79-96% average success rate across 13 leading open models, including commercial services from Microsoft and Mistral.
How the Attack Works
The modified audio clip is inaudible to human ears but triggers the model to execute hidden commands. Crucially, the attack works regardless of the user's accompanying instructions, making the same clip reusable against the same model multiple times. Training the adversarial signal takes approximately 30 minutes.
Exploited Capabilities
Researchers demonstrated that compromised models could be coerced into:
- Conducting sensitive web searches without user knowledge
- Downloading files from attacker-controlled sources
- Sending emails containing user data to external addresses
Affected Models
The attack was validated against 13 popular open-weight LALMs, including commercial voice AI APIs. This highlights that current voice AI systems lack robust safeguards against adversarial audio perturbations.
📖 Read the full source: HN AI Agents
👀 See Also
McpVanguard Proxy Blocks OpenClaw Skill Data Exfiltration
A developer built McpVanguard, a proxy that sits between AI agents and their tools to block malicious call chains like data exfiltration, in response to Cisco finding OpenClaw skills performing silent data theft. It uses pattern matching, semantic intent scoring, and behavioral chain detection.
AI Is Breaking the Two Vulnerability Cultures: Coordinated Disclosure vs. Linux's "Bugs Are Bugs"
Jeff Kaufman analyzes how AI vulnerability discovery is fracturing both coordinated disclosure and Linux's quiet-fix culture, using the recent Copy Fail (ESP) vulnerability as a case study.
Configuring OpenClaw for Encrypted LLM Inference Using TEE Enclaves
A developer shares how they configured OpenClaw to use Onera's AMD SEV-SNP trusted execution environments for end-to-end encrypted LLM inference, including configuration examples and technical tradeoffs.
FlyTrap Attack Uses Adversarial Umbrellas to Compromise Camera-Based Autonomous Drones
UC Irvine researchers developed FlyTrap, a physical attack framework that uses painted umbrellas to exploit vulnerabilities in camera-based autonomous target tracking systems. The attack reduces tracking distances to dangerous levels, enabling drone capture, sensor attacks, or physical collisions.