Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agents

Abstract: LLM-driven multimodal agents are increasingly deployed to execute autonomous tasks via continuous audio interaction. While this paradigm enhances interaction naturalness, it introduces a critical yet under-explored attack surface, as audio inputs inevitably contain environmental noise beyond user control. In this paper, we investigate concurrent audio prompt injection attacks targeting multimodal agents. Distinct from traditional acoustic attacks on voice devices, we propose novel techniques for instruction augmentation and scenario concealment. These methods allow malicious audio instructions to imperceptibly "piggyback" onto user speech, thereby hijacking agents to execute malicious actions. To systematically quantify this threat, we construct AudioAgentSecurity, the first comprehensive benchmark for audio instruction injection attacks, encompassing 8 real-world task scenarios and 10 distinct attack patterns. We evaluate 11 state-of-the-art agents, including Gemini 3 Pro and GPT-4o-audio. Notably, our methods achieve an average Attack Success Rate (ASR) of 69.10\% against the advanced Gemini 3 Pro. To counter this threat, we further introduce Cascaded Audio Decoupling and Verification (CADV), a defense mechanism based on source separation and consistency analysis. Compared with existing prompt-level defenses, CADV leverages acoustic source separation and cross-modal consistency analysis to detect audio instruction injections more robustly, achieving over 90\% detection success across diverse attack vectors. Finally, real-world experiments with human volunteers on Doubao AI Smartphone in diverse dynamic real-world scenarios confirm the attacks' high stealth and efficacy, while demonstrating that our defense reliably mitigates these vulnerabilities.

• The paper formalizes concurrent audio prompt injection and evaluates 2,160 attacks across 11 multimodal agents, finding a 49.37% average attack success rate and 69.10% against Gemini-3-Pro.
• The attack combines signal enhancement with semantic anchor hijacking, enabling malicious commands involving financial actions, privacy leaks, navigation, and system control to compete with legitimate speech.
• The CADV defense substantially reduces attack success through source separation, speaker verification, and semantic filtering, but false positives reach 35% in overlapping office conversations and remain a usability challenge.

Threat model and problem statement

This paper studies a third-party attack in which malicious audio instructions are overlaid on a user's ongoing speech and interpreted by an LLM-driven multimodal agent as legitimate commands. The threat model is deliberately conservative: the attacker has black-box access only, controls nothing but the physical acoustic channel, does not require perfect temporal or spatial alignment with the victim device, and cannot modify the user's speech. The defender operates under a zero-prior-knowledge assumption—no pre-registered voiceprints or identity templates—which rules out conventional speaker verification as a security boundary. The attacker's objective is intent hijacking: inducing high-privilege actions such as financial manipulation, privacy exfiltration, or malware installation while the user remains unaware.

The authors distinguish this setting from prior acoustic attacks (DolphinAttack, NUIT) that target ASR pipelines of silent devices, from audio jailbreak work assuming a user-as-attacker, and from AudioHijack's white-box optimization on isolated samples. The defining difficulty here is twofold: the injected signal must survive the acoustic pressure of competing with dominant user speech, and it must overcome the semantic pressure of redirecting an agent already anchored to the user's intent.

Attack framework

The attack suite addresses both pressures. On the acoustic side, energy enhancement raises the power of the adversarial signal within perceptual constraints, and dynamic range compression with RMS normalization increases decodability during overlap; the mixed signal is modeled as $$y(t) = x_b(t) + \lambda \cdot \text{Boost}(x_{adv}(t))$$. On the semantic side, Concurrent Injection Prefixes implement Semantic Anchor Hijacking: prefixes such as "Task updated, execute now:" or "System Alert:" mimic system state transitions so the agent treats the injected stream as a new, higher-priority instruction rather than ambient noise.

Ten attack methods span three categories:

Category	Methods	Target environment	Samples
Inaudible (hardware vulnerability)	DolphinAttack, High Frequency	Quiet (office, library)	432
Audible–low-intelligibility	Pulse, Spectral Inversion, Spectral Scramble, Noise Texture, Whisper	Noisy (street, in-car)	1080
Audible–semantic-confusion	Speed, Foreign, Dialect	Multi-speaker (restaurant, café)	648

These are combined into the AudioAgentSecurity benchmark: 2,160 generated attack samples across 8 real-world-inspired scenarios (smart home, finance, media, development, privacy, navigation, productivity, system control), built by normalizing instruction pairs drawn from mobile/PC/browser agent datasets and expanding seed instructions with Gemini 3 Pro, then manually verifying 200 core pairs. Evaluation uses a sandboxed tool-trace environment abstracting over 50 atomic tools into four security dimensions, with Qwen-Max as an auxiliary judge—a choice the authors flag as introducing possible semantic bias rather than serving as an absolute oracle.

Vulnerability results

Across 11 agents, the average ASR is 49.37%. The headline result is that gemini-3-pro-preview reaches an average ASR of 69.10%, the highest among all evaluated models, despite also having the highest baseline utility. DolphinAttack is the most effective method overall (81.55% average ASR), followed by foreign-language injection (72.36%) and Pulse (75.50%).

A notable finding is what the authors call a capability paradox. Gemini-2.5-flash-lite records the lowest average ASR (26.95%), but its baseline Instruction Correct Rate (ICR) is also the lowest at 42.00%, dropping to 10.10% under attack—its apparent resistance partly reflects weak instruction-following rather than robust security. Conversely, gemini-3-pro-preview retains a 93.00% baseline ICR and the highest attacked ICR (41.00%). Stronger acoustic encoders thus appear correlated with greater sensitivity to adversarial features, while low ASR in weaker models should not be read as robustness. An implication is that model rankings on benign benchmarks convey little about injection resistance, and vice versa.

Prefix ablations show the "Task Complete" strategy is most potent overall (60.79% ASR), exploiting state-transition logic, whereas "Thought Bias" mimicking chain-of-thought is weakest globally (19.72%) but effective specifically against reasoning-exposing models such as gemini-3-pro-preview.

CADV defense

The proposed defense, Cascaded Audio Decoupling and Verification (CADV), operates before instruction parsing via three cascaded layers:

1. Audio track separation: Mossformer2 reconstructs independent source tracks from the single-channel mixture, gated by an RMS energy-ratio threshold.
2. Speaker consistency verification: CAM++ embeddings of the two tracks are compared via cosine similarity against an energy-aware dynamic threshold $\tau(r_e)$, flagging identity heterogeneity.
3. Semantic filtering: ASR transcription of the residual track is checked for semantic validity to exclude laughter or interjections.

Interception requires all three indicators to fire simultaneously. Against prompt-level baselines (Sandwich Defense, Explicit Defense), CADV achieves lower post-defense ASR—for example reducing High Frequency attacks from 70.55% to 2.32% and Pulse from 75.50% to 25.09%. Detection rates exceed 80% for several vectors, particularly hardware-level attacks.

The usability analysis exposes a clear limitation: false positive rates on DEMAND environmental noise are near zero in sparse-speech scenes (0.00% at public stations) but rise to 14.00% in a cafeteria and 35.00% in an office meeting with concurrent talkers. Without pre-registered voiceprints, sustained overlapping third-party speech can be mistaken for injection, requiring secondary user confirmation that imposes real usability cost. The authors also note CADV's boundary conditions explicitly: reliability degrades when background speech is dense, when the attacker replays the user's own voice, or under high-quality voice cloning.

Physical-world feasibility

Physical experiments characterize feasibility boundaries rather than assuming idealized channels. Attacks remain effective across tested distances up to and beyond 2 m, though inaudible methods degrade faster with distance because they depend on propagation strength and hardware coupling; semantic-confusion attacks (e.g., foreign-language) are comparatively resilient at range. Off-axis emission degrades success only mildly—ASR stays above 40% even at 90° arrival angle—indicating precise microphone alignment is not required. Overlap-ratio analysis over 22,000 model-runs shows ASR is stable or increases with higher temporal overlap, while ICR falls monotonically, often below 20% at overlap exceeding 75%. This reveals a stealth–effectiveness trade-off: successful hijacking also masks the user's original task.

Human evaluation and case study

A double-blind study with 20 hearing-screened volunteers (600 judgments across indoor/outdoor settings) on a Doubao AI Smartphone measured injection success, execution success, user awareness, and comprehension. Inaudible attacks achieved moderate execution (~60% ASR) with low awareness and comprehension; audible–low-intelligibility attacks attained high ASR but high awareness due to transient artifacts; audible–semantic-confusion attacks showed a gap between awareness and comprehension—subjects noticed anomalous voice but failed to grasp the malicious content. The study is explicitly scoped as a controlled perceptual evaluation, not a population-scale survey.

A case study demonstrates end-to-end impact on the commercial device: in a noisy office, a barely perceptible high-frequency injection instructs the assistant to share live location via SMS to the attacker, using energy enhancement plus a "Task updated, execute now:" prefix. Appendix case traces show agents executing severe actions—disabling anti-theft alarms, setting unlimited transaction limits, exfiltrating environment variables containing API keys, forwarding OTP SMS—in response to overlapped injections.

Limitations and open questions

The paper concedes several constraints directly. Physical-world experiments cover selected devices, layouts, and settings; generalization to AI glasses, smart speakers, and additional phone models remains untested. The human study involves 20 laboratory volunteers rather than a representative population. Several physical experiments are representative configurations rather than exhaustive sweeps over rooms, microphones, and noise levels. CADV's elevated false positives in multi-speaker scenes indicate that source separation plus speaker consistency alone is insufficient for all benign environments. Adaptive attackers using replay or voice cloning—the latter directly undermining the speaker-consistency layer—are not evaluated. Whether on-device CADV variants can balance detection, latency, energy consumption, and confirmation cost is left open, as is the question of how model-side instruction hierarchies could complement perception-layer defenses.

Conclusion

This work formalizes and quantifies concurrent third-party audio prompt injection against multimodal agents, showing that advanced models such as gemini-3-pro-preview follow overlapped malicious instructions at 69.10% average ASR in a sandboxed tool-trace environment, and that such attacks transfer to a commercial smartphone under natural conditions. The capability paradox—stronger perception correlating with higher injection sensitivity—complicates security assessment based on either ASR or utility alone. The proposed CADV defense substantially reduces attack success relative to prompt-level filtering but exhibits scene-dependent false positives, underscoring that robust protection for always-on audio agents will likely require combining acoustic verification, user confirmation, and architectural safeguards against instruction hijacking.