Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agents

arXiv:2607.28165 · cs.CR · Submitted 2026-07-30 · Read on arXiv

Mingxiao Liu, Yitong Li, Haoren Zhao, Yaoxiang Bian, Jianan Ma, Jian Zhang, Jialuo Chen, Xinhao Deng, Zhen Wang

Hangzhou Dianzi University · Hangzhou Dianzi University · Hangzhou Dianzi University · Hangzhou Dianzi University · Ant Group · Hangzhou Dianzi University · Ant Group · Ant Group · Hangzhou Dianzi University

cs.CR

Submitted: 2026-07-30

Comments: 19 pages, 8 figures, The code is publicly available at https://github.com/Limax666/AudioAgentSecurity

Code: https://github.com/Limax666/AudioAgentSecurity

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Benchmark — 24× in this paper · explained in 2 episodes
• Verification — 21× in this paper · explained in 2 episodes
• Consistency — 12× in this paper · explained in 3 episodes
• Large Language Model — 10× in this paper
• Alignment — 9× in this paper · explained in 1 episode
• Core — 9× in this paper · explained in 2 episodes
• Robustness — 9× in this paper · explained in 5 episodes
• Decoupling — 8× in this paper · explained in 2 episodes
• Benchmarking — 7× in this paper · explained in 3 episodes
• Trace — 6× in this paper · explained in 2 episodes
• Attack Success Rate — 5× in this paper
• Cascaded Audio Decoupling and Verification — 4× in this paper
• Accuracy — 3× in this paper · explained in 1 episode
• Attack Success Rate (ASR) — 3× in this paper · explained in 2 episodes
• False Positive Rate — 3× in this paper
• Instruction Correct Rate — 3× in this paper
• Actor — 2× in this paper · explained in 3 episodes
• Agentic AI — 2× in this paper · explained in 1 episode
• Foundation Model — 2× in this paper · explained in 3 episodes
• Foundation Models — 2× in this paper · explained in 7 episodes
• LLM-as-a-Judge — 2× in this paper · explained in 3 episodes
• Large Language Model (LLM) — 2× in this paper · explained in 3 episodes
• World Model — 2× in this paper · explained in 7 episodes
• AI Agents — 1× in this paper · explained in 2 episodes
• Adaptation — 1× in this paper · explained in 1 episode
• Adversarial Attacks — 1× in this paper · explained in 1 episode
• Adversarial Examples — 1× in this paper · explained in 2 episodes
• Agentic Artificial Intelligence — 1× in this paper · explained in 1 episode
• Agentic Search — 1× in this paper · explained in 1 episode
• Agentic System — 1× in this paper · explained in 2 episodes
• Anti-Spoofing Systems — 1× in this paper · explained in 2 episodes
• Chain-of-Thought (CoT) — 1× in this paper · explained in 4 episodes
• Cosine Similarity — 1× in this paper · explained in 3 episodes
• Generative AI — 1× in this paper · explained in 2 episodes
• Generative Model — 1× in this paper · explained in 2 episodes
• Generative Models — 1× in this paper · explained in 2 episodes
• Multi-Agent System — 1× in this paper · explained in 6 episodes
• Reasoning Traces — 1× in this paper · explained in 3 episodes
• Representation Learning — 1× in this paper · explained in 2 episodes
• Steering — 1× in this paper · explained in 2 episodes
• Synthetic Data Generation — 1× in this paper · explained in 5 episodes
• Task Planning — 1× in this paper · explained in 2 episodes
• Transformer — 1× in this paper · explained in 2 episodes

Sources

• Empirical Analysis of Large Vision-Language Models against Goal Hijacking via Visual Prompt Injection
• WAInjectBench: Benchmarking Prompt Injection Detections for Web Agents
• Gemini: A Family of Highly Capable Multimodal Models
• Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilities
• Hidden in the Noise: Unveiling Backdoors in Audio LLMs Alignment through Latent Acoustic Pattern Triggers
• Speech-Audio Compositional Attacks on Multimodal LLMs and Their Mitigation with SALMONN-Guard
• Qwen3-Omni Technical Report
• Qwen3 Technical Report
• AudioJailbreak: Jailbreak Attacks against End-to-End Large Audio-Language Models
• AutoGLM: Autonomous Foundation Agents for GUIs
• Hijacking Large Audio-Language Models via Context-Agnostic and Imperceptible Auditory Prompt Injection
• MAI-UI Technical Report: Real-World Centric Foundation GUI Agents
• GPT-4o System Card
• Step-Audio 2 Technical Report
• Prompt Injection Attack to Tool Selection in LLM Agents
• PromptLocate: Localizing Prompt Injection Attacks
• Beyond Pipelines: A Survey of the Paradigm Shift toward Model-Native Agentic AI
• Spectral Masking and Interpolation Attack (SMIA): A Black-box Adversarial Attack against Voice Authentication and Anti-Spoofing Systems
• Toward Efficient Agents: Memory, Tool learning, and Planning
• NoiseAttack: An Evasive Sample-Specific Multi-Targeted Backdoor Attack Through White Gaussian Noise

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs