Search papers, labs, and topics across Lattice.
This paper investigates concurrent audio prompt injection attacks on multimodal LLM agents, revealing a significant vulnerability in their interaction with environmental noise. By introducing novel techniques for instruction augmentation and scenario concealment, the authors demonstrate that malicious audio instructions can seamlessly piggyback on user speech, achieving an average Attack Success Rate of 69.10% against advanced models like Gemini 3 Pro. To address this threat, they propose the Cascaded Audio Decoupling and Verification (CADV) defense mechanism, which effectively detects audio instruction injections with over 90% success across various attack vectors.
Malicious audio instructions can stealthily hijack multimodal agents, achieving a 69.10% success rate in real-world scenarios.
Large Language Model (LLM)-driven multimodal agents are increasingly deployed to execute autonomous tasks via continuous audio interaction. While this paradigm enhances interaction naturalness, it introduces a critical yet under-explored attack surface, as audio inputs inevitably contain environmental noise beyond user control. In this paper, we investigate concurrent audio prompt injection attacks targeting multimodal agents. Distinct from traditional acoustic attacks on voice devices, we propose novel techniques for instruction augmentation and scenario concealment. These methods allow malicious audio instructions to imperceptibly"piggyback"onto user speech, thereby hijacking agents to execute malicious actions. To systematically quantify this threat, we construct AudioAgentSecurity, the first comprehensive benchmark for audio instruction injection attacks, encompassing 8 real-world task scenarios and 10 distinct attack patterns. We evaluate 11 state-of-the-art agents, including Gemini 3 Pro and GPT-4o-audio. Notably, our methods achieve an average Attack Success Rate (ASR) of 69.10\% against the advanced Gemini 3 Pro. To counter this threat, we further introduce Cascaded Audio Decoupling and Verification (CADV), a defense mechanism based on source separation and consistency analysis. Compared with existing prompt-level defenses, CADV leverages acoustic source separation and cross-modal consistency analysis to detect audio instruction injections more robustly, achieving over 90\% detection success across diverse attack vectors. Finally, real-world experiments with human volunteers on Doubao AI Smartphone in diverse dynamic real-world scenarios confirm the attacks'high stealth and efficacy, while demonstrating that our defense reliably mitigates these vulnerabilities.
Tsinghua AI