Sirens' Whisper: Inaudible Near-Ultrasonic Jailbreaks of Speech-Driven LLMs

Zijian Ling; Pingyi Hu; Xiuyong Gao; Xiaojing Ma; Man Zhou; Jun Feng; Songfeng Lu; Dongmei Zhang

cs.CRMar 14, 2026

Sirens' Whisper: Inaudible Near-Ultrasonic Jailbreaks of Speech-Driven LLMs

Authors: Zijian Ling, Pingyi Hu, Xiuyong Gao, Xiaojing Ma, Man Zhou, Jun Feng, Songfeng Lu, Dongmei Zhang,

Organizations: School of Cyber Science and Engineering, Huazhong University of Science and Technology · State Key Laboratory of Internet Architecture, Tsinghua University · Hubei Key Laboratory of Distributed System Security, Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Huazhong University of Science and Technology · Microsoft Corporation

Abstract

Speech-driven large language models (LLMs) are increasingly accessed through speech interfaces, introducing new security risks via open acoustic channels. We present Sirens' Whisper (SWhisper), the first practical framework for covert prompt-based attacks against speech-driven LLMs under realistic black-box conditions using commodity hardware. SWhisper enables robust, inaudible delivery of arbitrary target baseband audio-including long and structured prompts-on commodity devices by encoding it into near-ultrasound waveforms that demodulate faithfully after acoustic transmission and microphone nonlinearity. This is achieved through a simple yet effective approach to modeling nonlinear channel characteristics across devices and environments, combined with lightweight channel-inversion pre-compensation. Building on this high-fidelity covert channel, we design a voice-aware jailbreak generation method that ensures intelligibility, brevity, and transferability under speech-driven interfaces. Experiments across both commercial and open-source speech-driven LLMs demonstrate strong black-box effectiveness. On commercial models, SWhisper achieves up to 0.94 non-refusal (NR) and 0.925 specific-convincing (SC). A controlled user study further shows that the injected jailbreak audio is perceptually indistinguishable from background-only playback for human listeners. Although jailbreaks serve as a case study, the underlying covert acoustic channel enables a broader class of high-fidelity prompt-injection and commandexecution attacks.

Figures & tables

Figure 1: Illustration of covert acoustic delivery against a speech-driven LLM. The attacker transmits inaudible near-ultrasound audio that, after microphone nonlinearity, faithfully reconstructs a target baseband signal on a commodity device, enabling jailbreaks and other prompt-based or command-injection attacks.

Figure 2: Microphone processing pipeline and near-ultrasound demodulation.

Panel of Table 1 — Table 1: Performance on text-based target models under the default setting (gray cells: surrogate = target; bold : best results).

Target Model	Method	NR $\uparrow$	SC $\uparrow$
GLM-4-Voice	GCG [ 58 ]	0.320	0.248
	IGCG [ 17 ]	0.220	0.175
	PAIR [ 6 ]	0.480	0.408
	Auto-DAN [ 28 ]	0.740	0.543
	Ours	0.980	0.813
Qwen-Omni	GCG [ 58 ]	0.060	0.060

Table 2: Performance on two end-to-end LALMs under the default setting, using LLaMA-3.1-8B-Instruct as the surrogate model ( bold : best results).

Figure 4: Word error rate (WER) of different jailbreak prompt generation methods across surrogate models.

Level	Scenario	WER $\downarrow$	NR $\uparrow$	SC $\uparrow$
50 dB	Office	0.026	0.780	0.713
	Park	0.023	0.780	0.723
	Restaurant	0.025	0.720	0.693
	Street	0.029	0.760	0.715
60 dB	Office	0.043	0.760	0.703
	Park	0.021	0.760	0.723

Table 3: Performance of SWhisper under diverse acoustic conditions with varying noise and speech levels.

Figure 8: Ablation study on the impact of key components in SWhisper on attack performance.

Panel of Figure 9 — Figure 9: Spectrograms of near-ultrasound signals recorded on different devices.

Scenario	Average †	p-value $\uparrow$	Perception $\uparrow$
Quiet	0.521	0.614	4.995
Office	0.475	0.516	4.985
Restaurant	0.483	0.718	4.985
Park	0.525	0.516	4.970
Street	0.492	0.829	4.920

Table 4: User study results on human perception of inaudibility under speaker playback across varied environments.

Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

Model	dB	Office	Park	Restaurant	Street
		(NR $\uparrow$ / SC $\uparrow$ )	(NR $\uparrow$ / SC $\uparrow$ )	(NR $\uparrow$ / SC $\uparrow$ )	(NR $\uparrow$ / SC $\uparrow$ )
Gemma-3-4B	50	0.700 / 0.440	0.640 / 0.418	0.580 / 0.340	0.560 / 0.343
Gemma-3-4B	60	0.600 / 0.415	0.760 / 0.450	0.520 / 0.343	0.600 / 0.368
Qwen2.5-7B	50	0.960 / 0.870	0.960 / 0.898	1.000 / 0.908	1.000 / 0.888
Qwen2.5-7B	60	0.980 / 0.873	0.960 / 0.868	0.960 / 0.888	0.980 / 0.905
Mistral-7B	50	1.000 / 0.953	1.000 / 0.935	1.000 / 0.940	0.960 / 0.925

Appendix

Table 5: Performance of SWhisper under diverse acoustic conditions with varying noise and speech levels.

Table 13

Panel of Table 10 — Table 10: Text-based attack performance of SWhisper with different jailbreak prompt generation methods, evaluated across surrogate and target models (gray cells: surrogate = target; bold : best results).

Adversarial Attacks

Adversarial attacks exploit crafted inputs, poisoned data, or system interactions to manipulate AI predictions, behavior, privacy, or reliability.

See all 447 papers

SpeechJBB: Probing Safety Alignment and Comprehension in Large Audio Language Models under Code-Switched Speech
Jun 4, 2026Virginia Ceccatelli, Yejin Jeon, David Ifeoluwa AdelaniAudio-Language Model Evaluation Language Model Safety Evaluation
Mila - Quebec AI Institute · McGill University, Canada · Canada CIFAR AI Chair
Hijacking Large Audio-Language Models via Context-Agnostic and Imperceptible Auditory Prompt Injection
Apr 16, 2026Meng Chen, Kun Wang, Li Lu +2Audio-Language Models LLM Security
The State Key Laboratory of Blockchain and Data Security, Zhejiang University · Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security · National University of Singapore +1
You Are the Trigger: Speaker-Activated Backdoors
Oct 19, 2026Nataša Krčo, Euodia Dodd, Peter Romov +1Backdoor Attacks Automatic Speech Recognition
Imperial College London

Jun 4, 2026J/K move · Enter open · S save

SpeechJBB: Probing Safety Alignment and Comprehension in Large Audio Language Models under Code-Switched Speech

Virginia Ceccatelli, Yejin Jeon, David Ifeoluwa Adelani

Mila - Quebec AI Institute · McGill University, Canada · Canada CIFAR AI Chair

Audio-Language Model Evaluation Language Model Safety Evaluation Code-Switching Speech Processing Jailbreak Attacks

Open paper AskPDF arXiv

Large audio language models (LALMs) are increasingly deployed in real-world applications, yet their safety alignment is still primarily evaluated on monolingual, text-based harmful prompts. This leaves their generalizability under multilingual and spoken settings, particularly code-switched speech, largely underexplored. To address this gap, we introduce SpeechJBB, an audio jailbreak dataset for benchmarking across multiple state-of-the-art LALMs. The extent of safety weaknesses is further probed by introducing an augmented setting where phonologically plausible pseudo-words are inserted around safety-critical terms to simulate localized obfuscation. Across models, code-switched harmful audio yields substantially high jailbreak success rates (JSR), with non-English monolingual and non-English code-switched pairs exhibiting the highest attack success. Pseudo-word insertion further reduces refusal rates, which demonstrates that natural-sounding obfuscation can effectively bypass safety policies.

Abstract

Adversarial Attacks

Explore similar work

SpeechJBB: Probing Safety Alignment and Comprehension in Large Audio Language Models under Code-Switched Speech

Hijacking Large Audio-Language Models via Context-Agnostic and Imperceptible Auditory Prompt Injection

You Are the Trigger: Speaker-Activated Backdoors