Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Breaking Audio Large Language Models by Attacking Only the Encoder: A Universal Targeted Latent-Space Audio Attack

Roee Ziv, Raz Lapid, Moshe Sipper

TL;DR

The paper addresses security risks in audio-language models by demonstrating a universal, targeted attack that operates solely through reusable audio encoders. It introduces U-TLSA, a gray-box method that learns one perturbation in the waveform space to steer encoder latent representations toward a attacker-chosen target, without gradient access to the decoder. Empirical results on Qwen2-Audio-7B-Instruct across diverse datasets show high cross-domain success rates and substantial efficiency benefits over end-to-end attacks, while random noise fails to trigger targets. The work highlights encoder-level vulnerabilities as a practical attack surface and motivates defenses at the encoder boundary to secure ALLMs in real deployments.

Abstract

Audio-language models combine audio encoders with large language models to enable multimodal reasoning, but they also introduce new security vulnerabilities. We propose a universal targeted latent space attack, an encoder-level adversarial attack that manipulates audio latent representations to induce attacker-specified outputs in downstream language generation. Unlike prior waveform-level or input-specific attacks, our approach learns a universal perturbation that generalizes across inputs and speakers and does not require access to the language model. Experiments on Qwen2-Audio-7B-Instruct demonstrate consistently high attack success rates with minimal perceptual distortion, revealing a critical and previously underexplored attack surface at the encoder level of multimodal systems.

Breaking Audio Large Language Models by Attacking Only the Encoder: A Universal Targeted Latent-Space Audio Attack

TL;DR

The paper addresses security risks in audio-language models by demonstrating a universal, targeted attack that operates solely through reusable audio encoders. It introduces U-TLSA, a gray-box method that learns one perturbation in the waveform space to steer encoder latent representations toward a attacker-chosen target, without gradient access to the decoder. Empirical results on Qwen2-Audio-7B-Instruct across diverse datasets show high cross-domain success rates and substantial efficiency benefits over end-to-end attacks, while random noise fails to trigger targets. The work highlights encoder-level vulnerabilities as a practical attack surface and motivates defenses at the encoder boundary to secure ALLMs in real deployments.

Abstract

Audio-language models combine audio encoders with large language models to enable multimodal reasoning, but they also introduce new security vulnerabilities. We propose a universal targeted latent space attack, an encoder-level adversarial attack that manipulates audio latent representations to induce attacker-specified outputs in downstream language generation. Unlike prior waveform-level or input-specific attacks, our approach learns a universal perturbation that generalizes across inputs and speakers and does not require access to the language model. Experiments on Qwen2-Audio-7B-Instruct demonstrate consistently high attack success rates with minimal perceptual distortion, revealing a critical and previously underexplored attack surface at the encoder level of multimodal systems.
Paper Structure (12 sections, 8 equations, 2 figures, 2 tables)

This paper contains 12 sections, 8 equations, 2 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Method
  4. Experimental Setup
  5. Model and data.
  6. Evaluation metrics.
  7. Threat model and baselines.
  8. Attack configuration.
  9. Results
  10. Universality and Robustness.
  11. Efficiency: Encoder-Only vs. End-to-End.
  12. Conclusions

Figures (2)

  • Figure 1: U-TLSA Optimization Process. The optimization pipeline freezes the audio encoder and minimizes the cosine distance between the embedding of the fixed target audio ($H_{tgt}$) and the current embedding of the carrier audio with the universal perturbation ($x + \delta$). The gradient update is applied solely to the universal perturbation $\delta$, while the LLM decoder remains frozen and inactive.
  • Figure 2: Spectrogram Analysis. Top: The original benign audio. Middle: The learned universal perturbation ($\delta$) with $\epsilon=0.02$, showing significantly lower power (dB) compared to the speech signal. Bottom: The adversarial audio ($x+\delta$), which remains visually nearly identical to the original audio due to the imperceptible nature of the perturbation.