Never Stop Speaking: a Denial-of-Service Attack on End-to-End Speech Language Models

2026-08-10

AI Summary

This work addresses the underexplored vulnerability of end-to-end speech large language models (Speech-LLMs) to denial-of-service (DoS) attacks. We propose the first DoS attack method tailored for Speech-LLMs, leveraging inaudible acoustic perturbations optimized via a multi-objective loss function that combines end-of-sequence (EOS) loss, top-k logit loss, length loss, and semantic alignment loss, integrated with voice activity detection (VAD). The attack preserves the input’s semantic content and duration while effectively disrupting the model’s autoregressive generation process, causing it to generate excessively long outputs. Evaluated on three open-source Speech-LLMs, our approach achieves high attack success rates, significantly prolongs output sequences, and substantially increases GPU resource consumption, thereby exposing critical security risks inherent in these models.

Abstract

Many studies have shown that specially crafted inputs can induce large language models (LLMs) to generate excessively long outputs, resulting in significant computational overhead and resource consumption. While most existing denial-of-service (DoS) attacks target text-only LLMs, end-to-end (E2E) speech LLMs are rapidly emerging. Existing text-based DoS attacks primarily rely on prompt engineering, such as adversarial suffixes or semantic inducement, which exploit the discrete nature of text inputs and therefore cannot be directly transferred to continuous speech inputs. Moreover, prior studies on speech model security mainly focus on ASR or TTS systems, leaving the DoS vulnerability of E2E speech LLMs largely unexplored. To address this gap, we propose the perturbation-based DoS attack targeting E2E speech models. Instead of inducing long outputs through prompt manipulation, our method optimizes imperceptible acoustic perturbations to directly influence the model's autoregressive generation process while preserving the original input length. Specifically, we formulate the attack as a composite optimization objective that jointly suppresses EOS generation, encourages prolonged decoding, and largely preserves semantic consistency by integrating weighted EOS loss, top-k logit loss, length loss, and semantic alignment loss. To further improve stealthiness, we employ voice activity detection (VAD) to inject perturbations only into voiced regions. Extensive experiments on three open-source E2E speech LLMs demonstrate that our method achieves stable attack success rate while significantly increasing generation length and GPU resource consumption, revealing security risks in modern ALLMs.

Problem

• Denial-of-Service
• End-to-End Speech LLMs
• Security Vulnerability
• Acoustic Perturbations
• Resource Consumption

Innovation

• denial-of-service attack
• end-to-end speech LLM
• acoustic perturbation
• autoregressive generation
• voice activity detection