SoundBreak: A Systematic Study of Audio-Only Adversarial Attacks on Trimodal Models

TL;DR

SoundBreak reveals a previously overlooked vulnerability surface in trimodal audio–video–language models by showing that untargeted, audio-only perturbations can trigger strong multimodal failures. By designing six complementary objective functions that stress encoder representations, attention, and hidden states, the approach achieves up to $96\%$ ASR across models, with encoder-space attacks being the most potent and often requiring only small perceptual distortions ($LPIPS\approx0.08$, $SI-SNR\approx0$). The study also uncovers limited cross-model transferability and highlights that speech-recognition systems like Whisper respond mainly to distortion magnitude rather than structured perturbations. These findings emphasize the need for defenses that enforce cross-modal consistency and robust encoding, particularly to guard against single-modality attacks in practical settings.

Abstract

Multimodal foundation models that integrate audio, vision, and language achieve strong performance on reasoning and generation tasks, yet their robustness to adversarial manipulation remains poorly understood. We study a realistic and underexplored threat model: untargeted, audio-only adversarial attacks on trimodal audio-video-language models. We analyze six complementary attack objectives that target different stages of multimodal processing, including audio encoder representations, cross-modal attention, hidden states, and output likelihoods. Across three state-of-the-art models and multiple benchmarks, we show that audio-only perturbations can induce severe multimodal failures, achieving up to 96% attack success rate. We further show that attacks can be successful at low perceptual distortions (LPIPS <= 0.08, SI-SNR >= 0) and benefit more from extended optimization than increased data scale. Transferability across models and encoders remains limited, while speech recognition systems such as Whisper primarily respond to perturbation magnitude, achieving >97% attack success under severe distortion. These results expose a previously overlooked single-modality attack surface in multimodal systems and motivate defenses that enforce cross-modal consistency.

Figures (7)

• Figure 1: Audio-only adversarial attacks on audio–video–language models. An additive perturbation applied solely to the audio stream propagates through the model, resulting in incorrect outputs.
• Figure 2: Relation between total training iterations and ASR for $\mathcal{L}_\text{negLM}$. Each point corresponds to an attack configuration, colored by training data size. Extended optimization on smaller datasets yields higher ASR.
• Figure 3: Attack budget vs ASR for $\mathcal{L}^{(\text{cos})}$ on VideoLLAMA2. Each attack was trained until convergence.
• Figure 4: Relationship between attack effectiveness on Whisper and perceptual distortion. Top: WER difference vs LPIPS. Bottom: WER difference vs SI-SNR.
• Figure 5: Prompt template used for LLM-as-a-judge evaluation on AVSD. The judge evaluates predictions against ground truth captions, summaries, and conversation context.