Inaudible-frequency attack cuts audio-LLM accuracy up to 67pp

A new preprint on arXiv argues that audio-language models can be steered by sound humans effectively cannot hear. The authors describe an Intermittent Low-Frequency Lockout attack that reduced the accuracy of six audio-language models by up to 67 percentage points, while human listeners rated the modified clips at 1.33 on an audibility scale, close to the 1.17 rating given to clean audio.

The framing is worth pausing on. The attack sits in a frequency band people effectively do not pick up, so to a user's ear the clip sounds normal, while the model reads it very differently. The authors also propose a mitigation, Distributional Requery Guard, but their own numbers put a ceiling on how well it works: performance recovers from 28.5% to 46.1% after clean re-recording, which is a real improvement and still well short of a fix.

That gap matters because audio is now the default input modality for a growing slice of consumer AI, from voice assistants to meeting summarizers to accessibility tooling. If an adversary can shape a signal in a sub-audible band and get it into the microphone path, whether through a nearby speaker, a compromised headset, or a modified stream, the model's behavior can be nudged without anyone in the room noticing anything unusual. Text-side red teaming does not cover this surface.

A few things the abstract does not settle: it does not name the six audio-language models tested, it does not report whether the attack survives typical smartphone or laptop microphone hardware, and it does not quantify how loud or how close an attacker would need to be. The defense also leaves a real hole, so treating Distributional Requery Guard as a solved problem would be premature.

The useful takeaway for teams shipping voice AI is less the specific attack than the reminder that the audio pipeline has an attack surface of its own. A reproducible sub-audible failure mode gives safety and product security teams something concrete to test against before the next release, which is more actionable than another leaderboard number.