From Inaudible Inputs to Model Failures: Low-Frequency Safety Risks in LALMs
2026-08-10 • Sound
SoundArtificial Intelligence
AI summaryⓘ
The authors studied how large audio-language models (LALMs) can be affected by very low-frequency sounds that humans can't hear. They created a method called Intermittent Low-Frequency Lockout (ILL) to test if these inaudible sounds can confuse the models. They found that ILL can significantly lower the models' accuracy without humans noticing the sounds. To fix this, the authors proposed a way called Distributional Requery Guard (DRG) that detects abnormal low-frequency sounds and asks for a new audio input, which improves the model's performance. Overall, the study reveals a hidden safety risk in audio AI systems and suggests ways to make them more reliable.
Large Audio-Language ModelsLow-Frequency SignalsBlack Box TestingSentence Attention Scale EstimationFrequency Confusion TransferAudio SecurityAdversarial AttacksDistributional Shift DetectionSemantic RecoveryAudio Understanding
Authors
Yuanhe Zhang, Weiliu Wang, Jie Ren, Liang Lin, Zhenhong Zhou, Haoran Gao, Kun Wang, Chen Li, Li Sun, Sen Su
Abstract
Large audio-language models (LALMs) have demonstrated strong capabilities in understanding diverse audio inputs. This diversity includes low-frequency signals that are inaudible to humans but can still enter the model and influence its generation. However, the practical impact of such low-frequency inputs on LALMs remains largely unexplored. In this paper, we propose Intermittent Low-Frequency Lockout (ILL), an inaudible red teaming method that evaluates this risk using a universal waveform template in a black box setting. ILL uses Sentence Attention Scale Estimation to determine active intervals and Frequency Confusion Transfer to construct a low-frequency waveform with continuous phase from corpus spectral variation. To mitigate this risk, we propose Distributional Requery Guard (DRG) to detect low-frequency distribution shifts and conditionally request a second recording for semantic recovery. Across six LALMs and multiple audio understanding tasks, ILL reduces accuracy by up to 67 percentage points while receiving a mean human audibility rating of 1.33, close to 1.17 for clean audio; DRG raises mean attacked accuracy from 28.5\% to 46.1\% after clean reacquisition. These findings identify a previously overlooked safety risk for LALMs and provide a foundation for future research on robust audio understanding.