From Inaudible Inputs to Model Failures: Low-Frequency Safety Risks in LALMs

2026-08-10

AI Summary

This study reveals, for the first time, that inaudible low-frequency audio poses a security threat to large audio language models (LALMs). To address this vulnerability, the authors propose a black-box red-teaming attack termed Intermittent Low-frequency Locking (ILL), which employs a universal low-frequency waveform template to drastically reduce model accuracy—by up to 67 percentage points—while maintaining minimal human audibility (average rating of 1.33). Furthermore, they introduce a defense mechanism called Distribution Re-query Guard (DRG), which estimates active intervals via sentence-level attention scaling, generates continuous-phase low-frequency signals through frequency-domain obfuscation and transfer, and triggers conditional re-recording based on distribution shift detection. Experimental results demonstrate that DRG effectively restores model accuracy from 28.5% to 46.1% after clean re-recording, establishing a closed-loop validation of both attack and defense.

Abstract

Large audio-language models (LALMs) have demonstrated strong capabilities in understanding diverse audio inputs. This diversity includes low-frequency signals that are inaudible to humans but can still enter the model and influence its generation. However, the practical impact of such low-frequency inputs on LALMs remains largely unexplored. In this paper, we propose Intermittent Low-Frequency Lockout (ILL), an inaudible red teaming method that evaluates this risk using a universal waveform template in a black box setting. ILL uses Sentence Attention Scale Estimation to determine active intervals and Frequency Confusion Transfer to construct a low-frequency waveform with continuous phase from corpus spectral variation. To mitigate this risk, we propose Distributional Requery Guard (DRG) to detect low-frequency distribution shifts and conditionally request a second recording for semantic recovery. Across six LALMs and multiple audio understanding tasks, ILL reduces accuracy by up to 67 percentage points while receiving a mean human audibility rating of 1.33, close to 1.17 for clean audio; DRG raises mean attacked accuracy from 28.5\% to 46.1\% after clean reacquisition. These findings identify a previously overlooked safety risk for LALMs and provide a foundation for future research on robust audio understanding.

Problem

• low-frequency
• audio-language models
• inaudible inputs
• safety risks
• model failures

Innovation

• Low-frequency audio
• Red teaming
• Audio-language models
• Distribution shift detection
• Inaudible perturbation