Search papers, labs, and topics across Lattice.
This paper introduces a novel perturbation-based denial-of-service (DoS) attack specifically targeting end-to-end (E2E) speech language models, addressing a critical gap in the security landscape of these emerging systems. By optimizing imperceptible acoustic perturbations, the method effectively influences the autoregressive generation process to extend output length while maintaining semantic consistency. Experimental results on three open-source E2E speech LLMs show that the attack significantly increases generation length and GPU resource consumption, highlighting substantial security vulnerabilities in modern speech models.
E2E speech models are vulnerable to a stealthy DoS attack that can drastically increase their output length and resource consumption without altering the original input.
Many studies have shown that specially crafted inputs can induce large language models (LLMs) to generate excessively long outputs, resulting in significant computational overhead and resource consumption. While most existing denial-of-service (DoS) attacks target text-only LLMs, end-to-end (E2E) speech LLMs are rapidly emerging. Existing text-based DoS attacks primarily rely on prompt engineering, such as adversarial suffixes or semantic inducement, which exploit the discrete nature of text inputs and therefore cannot be directly transferred to continuous speech inputs. Moreover, prior studies on speech model security mainly focus on ASR or TTS systems, leaving the DoS vulnerability of E2E speech LLMs largely unexplored. To address this gap, we propose the perturbation-based DoS attack targeting E2E speech models. Instead of inducing long outputs through prompt manipulation, our method optimizes imperceptible acoustic perturbations to directly influence the model's autoregressive generation process while preserving the original input length. Specifically, we formulate the attack as a composite optimization objective that jointly suppresses EOS generation, encourages prolonged decoding, and largely preserves semantic consistency by integrating weighted EOS loss, top-k logit loss, length loss, and semantic alignment loss. To further improve stealthiness, we employ voice activity detection (VAD) to inject perturbations only into voiced regions. Extensive experiments on three open-source E2E speech LLMs demonstrate that our method achieves stable attack success rate while significantly increasing generation length and GPU resource consumption, revealing security risks in modern ALLMs.
