Adversarial PhoneTic Prompting (APT) Overview

• APT is a novel attack method that exploits phonetic manipulations by using homophonic substitutions to preserve sound while altering semantics.
• The approach uses phoneme extraction and optimized substitution strategies to trigger memorized audio-visual outputs from models like SUNO and Veo 3.
• Empirical evaluations show that APT prompts achieve high similarity scores across multiple metrics, exposing critical vulnerabilities in content protection systems.

Adversarial PhoneTic Prompting (APT) refers to a class of attacks on transcript-conditioned music and video generation models exploiting sub-lexical memorization by manipulating the phonetic, rather than semantic, structure of text prompts. In this attack paradigm, textual inputs—such as song lyrics—are semantically scrambled through homophonically similar substitutions, yet retain their original phonetic contours (rhyme, meter, cadence). Despite obfuscation at the word or phrase level, these phonetic attacks cause generative models (notably lyrics-to-song and text-to-video systems) to output multimodal content bearing high similarity to proprietary or copyright-protected data from the training set. The methodology, empirical evaluation, and implications of APT reveal deep-seated vulnerabilities in generative models that align sub-lexical patterns with memorized audio-visual outputs (Roh et al., 23 Jul 2025).

1. Formal Definition and Threat Model

Adversarial PhoneTic Prompting (APT) is defined as a black-box attack against transcript-conditioned generative models. The attacker rewrites known lyrics using homophonic substitutions such that the modified text diverges maximally from the source in semantic content but preserves the phonetic sequence of key lexical items. If $\pi(w)$ denotes the phoneme sequence of the word $w$, the optimal substitution $s^*$ for $w$ is: $$s^* = \arg\max_{s\in V}\left[\mathrm{phonSim}\left(\pi(w), \pi(s)\right) - \lambda\,\mathrm{semSim}(w, s)\right]$$ Here, $\mathrm{phonSim}$ quantifies phonetic proximity (e.g., by edit distance in phoneme space), while $\mathrm{semSim}$ (e.g., cosine similarity of embeddings) penalizes semantic overlap. The attacker may use automated tools (such as grapheme-to-phoneme models and LLM-based paraphrasing) but does not require access to model internals or training data, interrogating the target model (e.g., SUNO, YuE, Veo 3) solely via text prompts. The attacker's goal is to trigger sub-lexical cues retained in the model to cause regeneration of memorized (possibly copyrighted) musical or visual content (Roh et al., 23 Jul 2025).

2. Phonetic Adversarial Prompt Construction

The APT procedure comprises two primary phases:

1. Phoneme Extraction: Each lyric line is transduced into its phoneme sequence using either a pronunciation dictionary or automated grapheme-to-phoneme conversion.
2. Homophonic Substitution: For each content word, the attacker selects a substitute from a large vocabulary, maximizing phonetic similarity while minimizing semantic similarity—operationalized by the formula above. In practice, LLMs such as Claude-3.5-Haiku are prompted to paraphrase lyrics so as to maintain phonetics (especially line-end rhyme) while diverging in semantic meaning. To circumvent LLM refusals, clarification prompts referencing parody law may be appended (Roh et al., 23 Jul 2025).

3. Empirical Evaluation and Quantitative Results

APT's effectiveness is demonstrated on state-of-the-art large-scale generative models, including lyrics-to-song systems (SUNO, YuE) and text-to-video models (Veo 3), across languages and musical genres. Key evaluation metrics include:

• AudioJudge: LLM-based evaluator of melody/rhythm similarity ([0,1] scale)
• CLAP: Contrastive language–audio embedding cosine similarity
• CoverID: Fingerprint-based cover-song detection (lower is more similar)

Empirical results for rap, pop, multilingual, and Christmas genres reveal that APT prompts yield high similarity to original training content across all metrics, even when the lyric text is semantically nonsensical. For instance, SUNO-generated content from phoneme-altered variants of "DNA" and "Lose Yourself" achieves AudioJudge Melody scores up to 0.90, CLAP values up to 0.852, and CoverID scores as low as 0.119. These outputs closely approach the upper bounds established via exact-match prompt reuse (Roh et al., 23 Jul 2025).

Table 1: Rap Genre—APT Audio Similarity Metrics

Song Variant	Melody ↑	Rhythm ↑	CLAP ↑	CoverID ↓
DNA → BMA (gen1)	0.90	0.95	0.699	0.183
DNA → BMA (gen2)	0.90	0.95	0.659	0.343
Lose Yourself → Bob’s confetti	0.80	0.85	0.773	0.147
Lose Yourself (no genre)	0.70	0.65	0.683	0.255

These results generalize across genre and language, showing APT's cross-linguistic and cross-style applicability (Roh et al., 23 Jul 2025).

4. Cross-Modal Regurgitation: Phonetic-to-Visual Effects

APT uncovers "phonetic-to-visual regurgitation" in text-to-video models. Notably, Veo 3, when prompted with phonetically scrambled versions of rap lyrics (sans semantic or visual content), generates video frames that preserve original scene composition, character appearance, and lighting from the canonical music videos. For example, phoneme-altered "Lose Yourself" lyrics with no mentions of rappers or setting still induce visuals closely resembling the actual video's hooded rapper, urban backgrounds, and editing style. Similar phenomena are observed for Christmas songs, where phonetic variants lead to accurate seasonal iconography and audio (Roh et al., 23 Jul 2025).

5. Implications for Copyright, Safety, and Content Provenance

APT reveals limitations of current string-matching and semantic-filtering guardrails: these approaches cannot detect or block homophonic variants, enabling sub-lexical attacks that extract protected model content without overtly reproducing copyrighted text. This form of prompt-based sub-lexical memorization risks circumvention of content moderation and has implications for sensitive data leakage, copyright enforcement, and model accountability. The attack's success suggests that commercially deployed generative systems may inadvertently expose training data through innocuous-seeming inputs (Roh et al., 23 Jul 2025).

6. Potential Defenses and Mitigation Strategies

Mitigation against APT requires new defenses beyond conventional semantic or lexical filters:

• Phonetic Similarity Detection: Monitoring incoming prompts for high phoneme-level overlap with protected works.
• Adversarial Training/Data Augmentation: Conditioning models on homophonic variants during training with explicit suppression of memorization.
• Differential Privacy Techniques: Modifying training procedures (e.g., DP-SGD) to limit memorization of sub-lexical patterns.
• Watermarking/Post-filtering: Embedding watermarks in training data and rejecting outputs matching those patterns.
• Multimodal Guardrails: Enforcing checks across semantic, phonetic, and acoustic/modal dimensions to prevent memorized content regurgitation via any single modality (Roh et al., 23 Jul 2025).

7. Future Directions and Open Questions

APT exposes deep vulnerabilities in modern multimodal generation. Outstanding research questions include formalizing sub-lexical memorization capacity, devising scalable phoneme-level guardrails, auditing large model deployments for phonetic leakage, and balancing creative flexibility with copyright compliance. The generality of APT across language, genre, and model architectures indicates that any transcript-conditioned generative modality may require re-examination of its content-protection strategy (Roh et al., 23 Jul 2025).