A new research paper from Hugging Face highlights a previously overlooked safety risk in large audio-language models (LALMs): inaudible low-frequency signals that can be injected into the model to cause failures. The study, titled "From Inaudible Inputs to Model Failures: Low-Frequency Safety Risks in LALMs," proposes a black-box red-teaming method and a corresponding defense mechanism.
The attack method, called Intermittent Low-Frequency Lockout (ILL), uses a universal waveform template to generate inaudible low-frequency signals. It employs two techniques: Sentence Attention Scale Estimation to determine active intervals and Frequency Confusion Transfer to construct a low-frequency waveform with continuous phase from corpus spectral variation. This allows the attack to be applied without internal model access.
Testing across six LALMs and multiple audio understanding tasks, ILL reduced accuracy by up to 67 percentage points. Notably, the attack was nearly imperceptible to humans, receiving a mean audibility rating of 1.33, close to the 1.17 rating for clean audio.
To mitigate this risk, the authors propose Distributional Requery Guard (DRG), a defense that detects low-frequency distribution shifts and conditionally requests a second recording for semantic recovery. DRG raised mean attacked accuracy from 28.5% to 46.1% after clean reacquisition.
The findings underscore a critical vulnerability in LALMs and provide a foundation for future research on robust audio understanding. The paper also lists several related works, including denial-of-service attacks on speech language models and prosody-driven jailbreaks.