Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Sirens' Whisper: Inaudible Near-Ultrasonic Jailbreaks of Speech-Driven LLMs

Zijian Ling, Pingyi Hu, Xiuyong Gao, Xiaojing Ma, Man Zhou, Jun Feng, Songfeng Lu, Dongmei Zhang, Bin Benjamin Zhu

Abstract

Speech-driven large language models (LLMs) are increasingly accessed through speech interfaces, introducing new security risks via open acoustic channels. We present Sirens' Whisper (SWhisper), the first practical framework for covert prompt-based attacks against speech-driven LLMs under realistic black-box conditions using commodity hardware. SWhisper enables robust, inaudible delivery of arbitrary target baseband audio-including long and structured prompts-on commodity devices by encoding it into near-ultrasound waveforms that demodulate faithfully after acoustic transmission and microphone nonlinearity. This is achieved through a simple yet effective approach to modeling nonlinear channel characteristics across devices and environments, combined with lightweight channel-inversion pre-compensation. Building on this high-fidelity covert channel, we design a voice-aware jailbreak generation method that ensures intelligibility, brevity, and transferability under speech-driven interfaces. Experiments across both commercial and open-source speech-driven LLMs demonstrate strong black-box effectiveness. On commercial models, SWhisper achieves up to 0.94 non-refusal (NR) and 0.925 specific-convincing (SC). A controlled user study further shows that the injected jailbreak audio is perceptually indistinguishable from background-only playback for human listeners. Although jailbreaks serve as a case study, the underlying covert acoustic channel enables a broader class of high-fidelity prompt-injection and commandexecution attacks.

Sirens' Whisper: Inaudible Near-Ultrasonic Jailbreaks of Speech-Driven LLMs

Abstract

Speech-driven large language models (LLMs) are increasingly accessed through speech interfaces, introducing new security risks via open acoustic channels. We present Sirens' Whisper (SWhisper), the first practical framework for covert prompt-based attacks against speech-driven LLMs under realistic black-box conditions using commodity hardware. SWhisper enables robust, inaudible delivery of arbitrary target baseband audio-including long and structured prompts-on commodity devices by encoding it into near-ultrasound waveforms that demodulate faithfully after acoustic transmission and microphone nonlinearity. This is achieved through a simple yet effective approach to modeling nonlinear channel characteristics across devices and environments, combined with lightweight channel-inversion pre-compensation. Building on this high-fidelity covert channel, we design a voice-aware jailbreak generation method that ensures intelligibility, brevity, and transferability under speech-driven interfaces. Experiments across both commercial and open-source speech-driven LLMs demonstrate strong black-box effectiveness. On commercial models, SWhisper achieves up to 0.94 non-refusal (NR) and 0.925 specific-convincing (SC). A controlled user study further shows that the injected jailbreak audio is perceptually indistinguishable from background-only playback for human listeners. Although jailbreaks serve as a case study, the underlying covert acoustic channel enables a broader class of high-fidelity prompt-injection and commandexecution attacks.
Paper Structure (58 sections, 14 equations, 9 figures, 4 tables)

This paper contains 58 sections, 14 equations, 9 figures, 4 tables.

Table of Contents

  1. Introduction
  2. Toward inaudible speech-driven jailbreak attacks.
  3. Challenge 1: Achieving practical covert delivery under real-world constraints.
  4. Challenge 2: Constructing voiceable jailbreak prompts.
  5. Our Approach.
  6. Our Contributions.
  7. Related Work
  8. Jailbreak Attacks on LLMs
  9. Nonlinear Acoustic Injection Attacks
  10. Preliminaries
  11. Optimization-Based Jailbreak Attacks
  12. Challenges in Near-Ultrasound Injection
  13. Threat Model
  14. Adversarial Goal.
  15. Capabilities and Knowledge.
  16. ...and 43 more sections

Figures (9)

  • Figure 1: Illustration of covert acoustic delivery against a speech-driven LLM. The attacker transmits inaudible near-ultrasound audio that, after microphone nonlinearity, faithfully reconstructs a target baseband signal on a commodity device, enabling jailbreaks and other prompt-based or command-injection attacks.
  • Figure 2: Microphone processing pipeline and near-ultrasound demodulation.
  • Figure 3: The workflow of SWhisper.
  • Figure 4: Word error rate (WER) of different jailbreak prompt generation methods across surrogate models.
  • Figure 5: Performance of SWhisper under different attack distances.
  • ...and 4 more figures