Codec-Robust Attacks on Audio LLMs
Abstract
Prior attacks on Audio Large Language Models (Audio LLMs) demonstrated that carefully crafted waveform-domain perturbations can force targeted adversarial outputs. As a defense mechanism against these attacks, real-world codec compression preprocessing has been studied to both detect and remove the perturbations. Yet no existing attack has demonstrated robustness against these compressions. We introduce CodecAttack, which optimizes a perturbation in a neural audio codec's continuous latent space rather than directly perturbing the audio waveform. We show that the codec's compression channel, which discards waveform perturbations, transmits perturbations crafted in its own latent space. To further harden the attack across real-world compression channels, we apply multi-bitrate straight-through Expectation-over-Transformation (EoT), all without modifying the target model. Across three realistic Audio LLM deployment scenarios and three target models, CodecAttack achieves an average 85.5% target-substring attack success rate (ASR) on Opus at moderate bitrates, while the waveform baseline trained with identical EoT hardening does not exceed 26% at any bitrate. The attack transfers to held-out codecs, reaching up to 100% ASR on MP3 and 84% on AAC-LC without retraining. A per-band energy analysis shows that the latent perturbation concentrates below 4kHz, exactly where codecs allocate the most bits, while the waveform baseline spreads into higher frequencies that codecs discard. These results demonstrate that lossy compression is not a reliable defense against adversarial audio and that codec-aware attacks pose a practical threat to deployed Audio LLM systems.
The following analysis is generated by AI and may contain errors. It is separate from the authors’ abstract and is not peer review.
Research summary
The main contribution of this paper is the introduction of CodecAttack, a codec-aware adversarial attack that optimizes perturbations in the latent space of neural audio codecs, demonstrating that lossy compression is not a reliable defense against adversarial audio. This work significantly advances the understanding of adversarial attacks in audio systems and presents a practical threat to deployed Audio LLMs, emphasizing the need for improved security measures in this rapidly evolving field.
Methodology
The paper introduces CodecAttack, a novel approach that optimizes perturbations in the latent space of a neural audio codec rather than the waveform domain. This method leverages the codec's inherent properties to craft adversarial examples that survive codec compression, which has not been adequately addressed in prior research. The use of multi-bitrate straight-through Expectation-over-Transformation (EoT) is particularly innovative, allowing the attack to adapt to various codec settings without modifying the target model. The methodology is well-structured, with a clear focus on the codec's latent space as a viable attack surface.
Results & evaluation
The experiments are robust, evaluating CodecAttack across three distinct deployment scenarios and multiple target models. The results demonstrate a significant improvement in attack success rates (ASR) compared to traditional waveform attacks, achieving up to 100% ASR on certain codecs. The paper also includes ablation studies that isolate the contributions of various design choices, reinforcing the effectiveness of the proposed method. The evaluation metrics are appropriate for the audio domain, focusing on strict substring matches to assess the attack's effectiveness.
Reproducibility
The paper provides detailed descriptions of the experimental setup, including the codecs used, the optimization process, and the evaluation metrics. However, the absence of a demo URL or direct access to the code repository may hinder full reproducibility for other researchers. The authors do mention a GitHub repository, which is a positive step toward facilitating reproducibility.
Limitations
One limitation noted in the paper is that the attack does not transfer well across different victim models without reoptimization, which is a common challenge in adversarial attacks. Additionally, the paper acknowledges that existing codec-based defenses are bypassed by the attack, indicating a need for future work to develop defenses specifically tailored to latent-space attacks.
Broader impact
The findings of this research have significant implications for the security of audio LLMs and voice agent systems, as they highlight vulnerabilities in codec-mediated audio delivery channels. This could lead to increased awareness and development of more robust defenses against adversarial attacks in real-world applications, particularly in sensitive areas such as finance and healthcare. The main contribution of this paper is the introduction of CodecAttack, a codec-aware adversarial attack that optimizes perturbations in the latent space of neural audio codecs, demonstrating that lossy compression is not a reliable defense against adversarial audio. This work significantly advances the understanding of adversarial attacks in audio systems and presents a practical threat to deployed Audio LLMs, emphasizing the need for improved security measures in this rapidly evolving field.
Author of this paper? Send a correction.