AudioHijack Attack Framework

Paper context

Paper title: Hijacking Large Audio-Language Models via Context-Agnostic and Imperceptible Auditory Prompt Injection Abstract: Modern Large audio-language models (LALMs) power intelligent voice interactions by tightly integrating audio and text. This integration, however, expands the attack surface beyond text and introduces vulnerabilities in the continuous, high-dimensional audio channel. While prior work studied audio jailbreaks, the security risks of malicious audio injection and downstream behavior manipulation remain underexamined. In this work, we reveal a previously overlooked threat, auditory prompt injection, under realistic constraints of audio data-only access and strong perceptual stealth. To systematically analyze this threat, we propose \textit{AudioHijack}, a general framework that generates context-agnostic and imperceptible adversarial audio to hijack LALMs. \textit{AudioHijack} employs sampling-based gradient estimation for end-to-end optimization across diverse models, bypassing non-differentiable audio tokenization. Through attention supervision and multi-context training, it steers model attention toward adversarial audio and generalizes to unseen user contexts. We also design a convolutional blending method that modulates perturbations into natural reverberation, making them highly imperceptible to users. Extensive experiments on 13 state-of-the-art LALMs show consistent hijacking across 6 misbehavior categories, achieving average success rates of 79\%-96\% on unseen user contexts with high acoustic fidelity. Real-world studies demonstrate that commercial voice agents from Mist Passages referencing this figure: ntermediary and audio serves as input and output interfaces. This pipeline involves several independent modules for modality transformation between audio and text, leading to acoustic information loss and considerable latency. To address these challenges, recent LALMs have shifted to an end-to-end paradigm, directly processing audio inputs and outputs within a single multimodal model. As shown in Figure 1 , end-to-end LALMs integrate audio and text inputs through different schemes. To align with LLM token processing, the discrete-token scheme [ 76 , 74 , 39 , 14 ] converts audio signals into discrete tokens and combines them with text tokens as input to the LLM backbone. During audio tokenization, LALMs extract acoustic features from raw audio signals and then apply vector quantization tec hybrid scheme [ 30 ] fuses tokenized audio embeddings and projected acoustic features with text embeddings as the LLM input. Given the integrated input, listening-only LALMs [ 13 , 12 , 22 , 24 , 32 , 62 , 21 ] generate text response. Full-duplex LALMs generate both text and audio tokens in a parallel [ 14 , 17 , 18 , 68 , 19 ] or interleaved [ 76 , 74 , 39 ] manner, followed by speech synthesis. Figure 1 : Different audio-text integration schemes in LALMs (speech synthesis process omitted). In practice, LALMs are predominantly employed in two fundamental task categories [ 12 ] : (1) audio analysis: LALMs process speech, sound, or music signals alongside text instructions to perform audio understanding or reasoning. In this task, LALMs consume the audio input as data for analysis; (2) voic