Sound Safeguarding Techniques

• Sound safeguarding is a collection of techniques and systems that control acoustic information flow through physical, algorithmic, and policy-driven methods.
• It encompasses physical sound shielding with acoustic metamaterials, safeguarded test signals for stable measurement, and privacy protection against eavesdropping and unauthorized ASR.
• Key design principles include selective access enforcement, threshold-based modulation, and balancing signal utility with robust protection across diverse applications.

Searching arXiv for the cited works and adjacent literature on sound safeguarding. arXiv_search(query="(Shen et al., 2017) OR (Kawahara et al., 2021) OR (Kawahara et al., 11 Jul 2025) OR (Kang et al., 10 Apr 2026) \"sound safeguarding\" audio privacy acoustic measurement", max_results=10, sort_by="submittedDate") Sound safeguarding denotes a family of techniques, systems, and evaluation frameworks that seek either to protect people and devices from harmful or unwanted acoustic phenomena, to preserve privacy in audio-mediated settings, or to make acoustic sensing and measurement more reliable without sacrificing usability. In the literature, the term spans at least four technical regimes: physical sound shielding with ventilated acoustic metamaterials; safeguarding of arbitrary audio so that it becomes a valid probe for acoustic measurement; privacy protection against recording, speech recognition, and side-channel eavesdropping; and policy-grounded safety guardrails for audio-capable foundation models and speech language systems. Across these regimes, the common objective is controlled mediation of acoustic information: deciding what should pass, what should be blocked, what should be measured, and what should be withheld (Shen et al., 2017, Kawahara et al., 2021, McKee et al., 2024, Kang et al., 10 Apr 2026).

1. Conceptual scope and major technical regimes

The expression has no single canonical meaning across the literature. In acoustic metamaterials, it refers to structures that shield incident sound while preserving steady fluid flow, as in the two-dimensional acoustic metacage built from acoustic gradient-index metasurfaces composed of open channels and shunted Helmholtz resonators (Shen et al., 2017). In acoustic measurement, it refers to converting arbitrary audio into “safeguarded test signals” by adding relatively small deterministic signals that sound like noise, thereby making music or speech suitable for stable deconvolution and simultaneous extraction of multiple acoustic attributes (Kawahara et al., 2021, Kawahara et al., 2023, Kawahara et al., 11 Jul 2025).

In privacy and security, sound safeguarding includes deliberate disruption of sensing or recognition pipelines. Examples include near-ultrasonic interference that exploits unintended demodulation in MEMS microphones to degrade ASR (McKee et al., 2024), latent-space universal adversarial perturbations that protect live voice communications against commercial and LLM-powered ASR systems (Jin et al., 1 Apr 2025), adversarial perturbations that defeat vibration-based side-channel eavesdropping (Chang et al., 2024), and privacy-preserving deepfake detection that withholds semantic content while retaining acoustic cues needed for classification (Li et al., 2024). In audio AI safety, the term expands further to policy-grounded moderation, bystander-privacy protection, and benchmark design for audio-native harms, speaker-conditioned risks, and contextual privacy leakage (Zhan et al., 6 Dec 2025, Kang et al., 10 Apr 2026, Wang et al., 16 Apr 2026).

A plausible implication is that sound safeguarding is best understood as an umbrella designation for controlled acoustic access. Some works intervene at the wave level, some at the representation level, and some at the policy or benchmark level, but all are concerned with restricting harmful or unauthorized inferences while preserving a target functionality.

2. Physical sound shielding and ventilated acoustic barriers

One major lineage concerns passive structures that attenuate sound transmission while maintaining ventilation. In "Acoustic Metacages for Omnidirectional Sound Shielding" (Shen et al., 2017), the governing condition is a sufficiently large phase gradient on a gradient-index metasurface. For an incident plane wave and transmitted wave, the generalized Snell’s law is

$$k_{0}\bigl(\sin\theta_{t}-\sin\theta_{i}\bigr)=\xi+nG,$$

with $\xi=d\phi/dx$ and $G=2\pi/d$. When the metasurface is designed such that

$$\xi>2k_{0}\quad\Longleftrightarrow\quad d<\frac{\lambda}{2},$$

the critical angle becomes non-real for zero-order diffraction, and for higher orders the transmitted wavevector component becomes imaginary. The resulting diffracted fields are evanescent, so all orders are rejected from transmitting power into the far field (Shen et al., 2017). The implemented ring-shaped metacage uses wedge-shaped unit cells, each spanning $5^\circ$, with four distinct units forming a supercell over $20^\circ$ that generates a $2\pi$ phase ramp. The total radial thickness is $65$ mm, approximately $0.47\lambda$ at $2.5$ kHz, and COMSOL Pressure Acoustics 2D simulations report normalized transmitted energy below $\xi=d\phi/dx$0 for incidence angles from $\xi=d\phi/dx$1 to $\xi=d\phi/dx$2 (Shen et al., 2017).

The unit-cell physics is governed by shunted Helmholtz resonators. Their fundamental resonance is

$\xi=d\phi/dx$3

where $\xi=d\phi/dx$4 is neck cross-sectional area, $\xi=d\phi/dx$5 is cavity volume, and $\xi=d\phi/dx$6 is effective neck length. By tuning these dimensions, the units realize prescribed phase shifts in steps of $\xi=d\phi/dx$7 while remaining deep-subwavelength in thickness (Shen et al., 2017). Measurements on a 3D-printed ABS prototype yielded transmission loss of approximately $\xi=d\phi/dx$8–$\xi=d\phi/dx$9 dB between $G=2\pi/d$0 and $G=2\pi/d$1 kHz, independent of airflow, while airflow transmission retained $G=2\pi/d$2 of the reference flow, with $G=2\pi/d$3 m/s through the cage versus $G=2\pi/d$4 m/s without it (Shen et al., 2017).

A related mechanism appears in "Omnidirectional Ventilated Acoustic Barrier" (Zhang et al., 2017), but with Fano-type interference rather than phase-gradient rejection. There, a discrete narrowband Fabry–Pérot resonance from a coiled-labyrinth metastructure interferes with a broadband transmission path through open hollow pipes. The total transmitted amplitude is the coherent sum of resonant and background channels, yielding a canonical Fano lineshape with a near-zero dip (Zhang et al., 2017). The device has planar thickness $G=2\pi/d$5, corresponding to approximately $G=2\pi/d$6 mm at $G=2\pi/d$7 kHz, and the measured airflow throughput is $G=2\pi/d$8, from $G=2\pi/d$9 m/s with the barrier against $$\xi>2k_{0}\quad\Longleftrightarrow\quad d<\frac{\lambda}{2},$$0 m/s without it (Zhang et al., 2017). Across incidence angles up to $$\xi>2k_{0}\quad\Longleftrightarrow\quad d<\frac{\lambda}{2},$$1, the transmission dip remains below about $$\xi>2k_{0}\quad\Longleftrightarrow\quad d<\frac{\lambda}{2},$$2, corresponding to better than $$\xi>2k_{0}\quad\Longleftrightarrow\quad d<\frac{\lambda}{2},$$3 dB shielding (Zhang et al., 2017).

Later metamaterial work applies passive acoustic safeguarding directly to voice-assistant security. "MetaGuardian" (Ning et al., 13 Aug 2025) combines an inaudible-attack defense metamaterial based on coupled Helmholtz-style resonators and an adversarial-attack defense metamaterial based on a coiled-space labyrinth. The coupled resonator array is engineered to cover $$\xi>2k_{0}\quad\Longleftrightarrow\quad d<\frac{\lambda}{2},$$4–$$\xi>2k_{0}\quad\Longleftrightarrow\quad d<\frac{\lambda}{2},$$5 kHz, with three resonators of cavity depths $$\xi>2k_{0}\quad\Longleftrightarrow\quad d<\frac{\lambda}{2},$$6 mm, $$\xi>2k_{0}\quad\Longleftrightarrow\quad d<\frac{\lambda}{2},$$7 mm, and $$\xi>2k_{0}\quad\Longleftrightarrow\quad d<\frac{\lambda}{2},$$8 mm and spacing $$\xi>2k_{0}\quad\Longleftrightarrow\quad d<\frac{\lambda}{2},$$9 mm; the reported effect is attenuation above $5^\circ$0 dB across that ultrasonic band with transmission coefficients below $5^\circ$1 (Ning et al., 13 Aug 2025). The labyrinth structure has an effective coiled path length of approximately $5^\circ$2 mm and a center resonant frequency near $5^\circ$3 Hz, with a COMSOL peak gain of about $5^\circ$4 (Ning et al., 13 Aug 2025). In controlled evaluation, MetaGuardian reports $5^\circ$5 command recognition for legitimate human and TTS voice commands, while protection success rate exceeds $5^\circ$6 at $5^\circ$7 m for five adversarial techniques, exceeds $5^\circ$8 at $5^\circ$9 m for inaudible attacks, and reaches $20^\circ$0 light-blocking coefficients for laser attacks (Ning et al., 13 Aug 2025).

These physical systems show two distinct safeguarding principles. One rejects transmission by enforcing evanescence through subwavelength phase-gradient design; the other exploits destructive interference or impedance shaping. This suggests that physical sound safeguarding has diversified from architectural noise control into passive security for always-listening devices.

3. Safeguarded test signals for acoustic measurement

A second major regime reinterprets safeguarding as a measurement-theoretic operation. In "Safeguarding test signals for acoustic measurement using arbitrary sounds" (Kawahara et al., 2021), the starting point is an arbitrary signal $20^\circ$1, a deterministic safeguarding signal $20^\circ$2, and the safeguarded transmit signal $20^\circ$3. The observed microphone measurement is

$20^\circ$4

and in the discrete periodic setting of period $20^\circ$5 the DFT-domain model is $20^\circ$6 (Kawahara et al., 2021). The safeguarding signal is chosen to have a spike-like autocorrelation, for example using pseudorandom binary sequences, Gold codes, periodic velvet noise, or CAPRICEP variants. The desired property is that $20^\circ$7 is approximately zero away from $20^\circ$8, enabling recovery of $20^\circ$9 by matched filtering or frequency-domain division (Kawahara et al., 2021).

The paper also gives a frequency-domain flooring method that directly “safeguards” an arbitrary spectrum by enforcing a threshold $2\pi$0 in every DFT bin. If $2\pi$1 falls below threshold, it is raised to the threshold while preserving phase, and if $2\pi$2, the safeguarded bin is set to $2\pi$3 (Kawahara et al., 2021). The power ratio $2\pi$4 is selected so that the safeguarding signal is masked by the original content, with $2\pi$5 stated as typical for music (Kawahara et al., 2021). After playback and recording, the impulse response can be estimated as

$2\pi$6

or by correlating $2\pi$7 with $2\pi$8 to isolate $2\pi$9 (Kawahara et al., 2021). Repeated measurements support decomposition into temporally stable, random, time-varying, and signal-dependent deviations (Kawahara et al., 2021).

The general framework is extended in "Simultaneous Measurement of Multiple Acoustic Attributes Using Structured Periodic Test Signals Including Music and Other Sound Materials" (Kawahara et al., 2023). There, arbitrary audio is safeguarded by a frequency-dependent threshold $65$0 and inverted to a periodic playback signal; repeated observations yield estimates of the linear time-invariant response, the random and time-varying disturbance variance, and signal-dependent time-invariant deviations (Kawahara et al., 2023). Swept-sine and MLS are explicitly presented as special cases of the same framework, arising when $65$1 and the test signal already has suitable spectral properties (Kawahara et al., 2023).

"Sound Safeguarding for Acoustic Measurement Using Any Sounds: Tools and Applications" (Kawahara et al., 11 Jul 2025) systematizes this direction into a software toolchain. Using the unitary DFT, the paper writes the noiseless output as $65$2 and the naive estimate as $65$3, then shows that division blows up where $65$4 is small (Kawahara et al., 11 Jul 2025). Sound safeguarding therefore enforces a lower-limit threshold $65$5 on each DFT bin, yielding $65$6 and the bound

$65$7

This formulation explicitly ties safeguarding to stable deconvolution (Kawahara et al., 11 Jul 2025).

The RHAPSODEE toolbox implements the method in four modules: Preparation Module, Interactive Measurement Module, Real-Time Measurement Daemon, and Report Generation Module (Kawahara et al., 11 Jul 2025). Reported performance includes frequency-response deviation under $65$8 dB from swept-sine reference across $65$9 Hz–$0.47\lambda$0 kHz when $0.47\lambda$1 is set $0.47\lambda$2 dB above the measured noise floor, $0.47\lambda$3 estimates within $0.47\lambda$4 s of ISO-3382 measurements for rooms with $0.47\lambda$5 between $0.47\lambda$6 and $0.47\lambda$7 s, computational latency of $0.47\lambda$8–$0.47\lambda$9 ms for $2.5$0-point blocks on a standard desktop, and robustness in a café environment with SNR as low as $2.5$1 dB in portions of the spectrum (Kawahara et al., 11 Jul 2025). Classroom trials also report safeguarded speech recordings achieving direct-to-reverberant energy ratios $2.5$2 within $2.5$3 dB of reference MLS-based measurements (Kawahara et al., 11 Jul 2025).

Within this measurement literature, safeguarding does not block sound; it regularizes excitation so that acoustical inference becomes possible under practical listening constraints. The term therefore denotes an inversion-stabilizing intervention on the probe signal rather than a defense against external attack.

4. Privacy protection, anti-eavesdropping, and anti-ASR safeguarding

A third regime uses sound safeguarding to prevent unauthorized capture, inference, or transcription. "Safeguarding Voice Privacy: Harnessing Near-Ultrasonic Interference To Protect Against Unauthorized Audio Recording" (McKee et al., 2024) analyzes the unintended demodulation behavior of MEMS microphones. The microphone is modeled as a second-order system with resonance near $2.5$4 kHz, and nonlinear transduction yields cross-terms when an audible signal $2.5$5 and ultrasonic carrier $2.5$6 jointly drive the diaphragm. The total pressure is $2.5$7, and the second-order term produces $2.5$8, generating sum and difference frequencies. The paper states that these aliased components pass to the ASR front end and corrupt recognition (McKee et al., 2024). On the Amazon Echo Dot, baseline WER of $2.5$9 rises to $\xi=d\phi/dx$00, $\xi=d\phi/dx$01, $\xi=d\phi/dx$02, and $\xi=d\phi/dx$03 at carrier frequencies $\xi=d\phi/dx$04, $\xi=d\phi/dx$05, $\xi=d\phi/dx$06, and $\xi=d\phi/dx$07 kHz respectively, with mean $\xi=d\phi/dx$08WER over all phonemes at $\xi=d\phi/dx$09 ft of $\xi=d\phi/dx$10 and PER increases up to $\xi=d\phi/dx$11 for “s,” “sh,” and “th” (McKee et al., 2024). The paper describes a portable jamming unit that drives ultrasound at $\xi=d\phi/dx$12 dB SPL at $\xi=d\phi/dx$13 m in the $\xi=d\phi/dx$14–$\xi=d\phi/dx$15 kHz band, while monitoring audible leakage to keep sub-$\xi=d\phi/dx$16 kHz components below $\xi=d\phi/dx$17 dB SPL (McKee et al., 2024).

"AudioShield" (Jin et al., 1 Apr 2025) moves from hardware-level exploitation to learned perturbations for live voice communications. Audio is encoded into a latent vector $\xi=d\phi/dx$18, perturbed with a universal $\xi=d\phi/dx$19, and decoded back to waveform as $\xi=d\phi/dx$20 (Jin et al., 1 Apr 2025). The objective combines ASR loss, a latent-space similarity term encouraging target feature adaptation, Gaussian noise for robustness, and optional room impulse response convolution for over-the-air transfer (Jin et al., 1 Apr 2025). Evaluated on four commercial ASR APIs, three voice assistants, two LLM-powered ASR systems, and Whisper-large-v3, AudioShield reports protection success rates of $\xi=d\phi/dx$21, $\xi=d\phi/dx$22, $\xi=d\phi/dx$23, and $\xi=d\phi/dx$24 on Google, Amazon, iFlytek, and Alibaba respectively, and average PSR of $\xi=d\phi/dx$25 across Qwen-Audio, MooER, and Whisper (Jin et al., 1 Apr 2025). In a real-time end-to-end scenario, latency is $\xi=d\phi/dx$26 ms per utterance with average PSR $\xi=d\phi/dx$27, CER $\xi=d\phi/dx$28, MOS $\xi=d\phi/dx$29, and NISQA $\xi=d\phi/dx$30 (Jin et al., 1 Apr 2025).

"WaveGuard" (Hussain et al., 2021) addresses the complementary problem of detecting adversarial audio directed at ASR rather than generating it. It defines a detection score

$\xi=d\phi/dx$31

where $\xi=d\phi/dx$32 is an audio transformation such as quantization, down-up sampling, shelf filtering, Mel extraction plus inversion, or LPC synthesis (Hussain et al., 2021). A threshold $\xi=d\phi/dx$33 is tuned on held-out benign-adversarial pairs, and the detector declares the input adversarial if $\xi=d\phi/dx$34 (Hussain et al., 2021). On non-adaptive attacks, Mel-extraction plus inversion and LPC achieve AUC values of $\xi=d\phi/dx$35 against Carlini, Qin-I, and Qin-R, and $\xi=d\phi/dx$36 and $\xi=d\phi/dx$37 respectively against Universal perturbations, with accuracies of $\xi=d\phi/dx$38 and $\xi=d\phi/dx$39 for the Mel-based transform on Carlini and Universal (Hussain et al., 2021). Under adaptive white-box attacks, naive transforms collapse, but Mel inversion and LPC retain AUC around $\xi=d\phi/dx$40–$\xi=d\phi/dx$41 and accuracy about $\xi=d\phi/dx$42–$\xi=d\phi/dx$43 (Hussain et al., 2021).

"SafeEar" (Li et al., 2024) safeguards privacy in deepfake detection by decoupling semantics from acoustics. A neural codec-based decoupling model uses eight residual vector quantizers, with VQ1 dedicated to semantic tokens and VQ2–VQ8 to acoustic tokens (Li et al., 2024). After training with reconstruction, adversarial, commitment, and semantic-distillation losses, only shuffled acoustic tokens are released to the detector (Li et al., 2024). Detection performance reaches EER $\xi=d\phi/dx$44 on ASVspoof 2019, $\xi=d\phi/dx$45 on ASVspoof 2021, and $\xi=d\phi/dx$46 on CVoiceFake, while content recovery attacks on acoustic tokens yield WER values above $\xi=d\phi/dx$47, STOI near $\xi=d\phi/dx$48, and user-study human-ear WER around $\xi=d\phi/dx$49–$\xi=d\phi/dx$50 (Li et al., 2024).

"SceneGuard" (Sang et al., 20 Nov 2025) instead protects speech at training time against voice cloning by adding scene-consistent audible background noise. The protected audio is

$\xi=d\phi/dx$51

with SNR constrained to $\xi=d\phi/dx$52 dB and a loss combining speaker similarity and regularization (Sang et al., 20 Nov 2025). Using PANNs for acoustic scene classification and a TAU Urban Acoustic Scenes noise library, SceneGuard reports speaker similarity $\xi=d\phi/dx$53 relative to the clean baseline of $\xi=d\phi/dx$54, corresponding to a $\xi=d\phi/dx$55 degradation, with WER $\xi=d\phi/dx$56, PESQ $\xi=d\phi/dx$57, and STOI $\xi=d\phi/dx$58 (Sang et al., 20 Nov 2025). Robustness evaluation shows the defended similarity remains low or decreases further after MP3 compression, spectral subtraction, lowpass filtering, and downsampling (Sang et al., 20 Nov 2025).

"EveGuard" (Chang et al., 2024) targets vibration-based side channels rather than microphones. It combines a learned FIR perturbation branch with low-frequency adversarial perturbation, trained end-to-end through an Eve-GAN translator that maps audio into side-channel domains such as mmWave, optical vibrometry, or IMU capture (Chang et al., 2024). On a mmWave baseline, undefended playback yields MCD $\xi=d\phi/dx$59, WER $\xi=d\phi/dx$60, and digit detection rate $\xi=d\phi/dx$61, whereas EveGuard raises MCD to $\xi=d\phi/dx$62, WER to $\xi=d\phi/dx$63, and reduces digit detection rate to $\xi=d\phi/dx$64, with PESQ $\xi=d\phi/dx$65 on the human-audible signal (Chang et al., 2024). Comparable degradation is reported for optical and IMU eavesdropping, with WER $\xi=d\phi/dx$66 and $\xi=d\phi/dx$67 and digit detection rate $\xi=d\phi/dx$68 and $\xi=d\phi/dx$69 respectively (Chang et al., 2024).

Taken together, these works establish privacy-oriented sound safeguarding as a broad design space. Some methods inject acoustic energy into the environment, some perturb latent representations, some alter data release formats, and some instrument detection of adversarial manipulation. Their shared criterion is not silence but selective failure: authorized listeners or tasks should remain viable while unauthorized sensing pipelines degrade.

5. Guardrails and benchmarks for audio foundation models

With the rise of LALMs, ALMs, and SLMs, sound safeguarding has acquired a policy-grounded meaning centered on model behavior rather than only signal propagation. "Protecting Bystander Privacy via Selective Hearing in LALMs" (Zhan et al., 6 Dec 2025) introduces SH-Bench, containing $\xi=d\phi/dx$70 multi-speaker audio mixtures, $\xi=d\phi/dx$71 hours, and approximately $\xi=d\phi/dx$72k multiple-choice questions over general and selective operating modes (Zhan et al., 6 Dec 2025). The central metric is Selective Efficacy,

$\xi=d\phi/dx$73

a harmonic-mean-style aggregate that is high only when the model both understands multi-speaker content and refuses bystander-related queries in selective mode (Zhan et al., 6 Dec 2025). Bystander Privacy Fine-Tuning uses a 1:1 ratio of main- to bystander-question examples, LoRA rank $\xi=d\phi/dx$74, and a summed cross-entropy objective across general and selective prompts (Zhan et al., 6 Dec 2025). Step-Audio-2-mini + BPFT achieves SE $\xi=d\phi/dx$75, Qwen-2.5-Omni 7B + BPFT achieves $\xi=d\phi/dx$76, and both exceed $\xi=d\phi/dx$77 accuracy in refusing bystander queries while retaining approximately $\xi=d\phi/dx$78–$\xi=d\phi/dx$79 main-speaker accuracy (Zhan et al., 6 Dec 2025).

"AudioGuard" (Kang et al., 10 Apr 2026) develops a broader audio safety guardrail around a policy-grounded risk taxonomy, AudioSafetyBench, and a modular system that fuses waveform-level and transcript-level signals. SoundGuard uses a fixed pretrained encoder, SpeechBrain ECAPA-TDNN by default, with an MLP head that outputs a multi-label score vector over speaker-aware cues and audio-native event cues (Kang et al., 10 Apr 2026). ContentGuard transcribes audio with Whisper-Large-v3, then applies an instruction-tuned Gemma-3-it model fine-tuned for semantic risk scoring (Kang et al., 10 Apr 2026). The modules are integrated through explicit logic rules,

$\xi=d\phi/dx$80

which map to Allow, Block, or Review actions (Kang et al., 10 Apr 2026). On AudioSafetyBench and complementary benchmarks, AudioGuard achieves average joint accuracy $\xi=d\phi/dx$81 versus $\xi=d\phi/dx$82 for Gemini 3 and $\xi=d\phi/dx$83 for GPT-Audio, with latency $\xi=d\phi/dx$84 s versus $\xi=d\phi/dx$85 s and $\xi=d\phi/dx$86 s respectively (Kang et al., 10 Apr 2026). SoundGuard alone reaches sound-only accuracy $\xi=d\phi/dx$87 on Speech, Non-Speech, and ElevenLabs splits, demonstrating the need for explicit audio-native detection (Kang et al., 10 Apr 2026).

"VoxSafeBench" (Wang et al., 16 Apr 2026) reframes safeguarding as social alignment in speech LLMs across safety, fairness, and privacy. Its Two-Tier design separates content-centric risks from audio-conditioned risks in which the transcript is benign but the response should depend on speaker identity, paralinguistic cues, or environment (Wang et al., 16 Apr 2026). For generative tasks it uses DAR, WAR, RtA, and SKIP labels, with Safety Awareness Rate defined as $\xi=d\phi/dx$88 and Overlap-Induced Conversion measuring audio-based jailbreaks (Wang et al., 16 Apr 2026). Across 22 tasks in English and Chinese, the benchmark reports that text safeguards often degrade in speech: for example, Child Voice, Emotion, and Child Presence tasks show audio SAR roughly in the range $\xi=d\phi/dx$89–$\xi=d\phi/dx$90 while the text reference is $\xi=d\phi/dx$91–$\xi=d\phi/dx$92 depending on task, and overlap jailbreaks induce unsafe behavior in $\xi=d\phi/dx$93–$\xi=d\phi/dx$94 of unsafe overlap cases that are safe in isolation (Wang et al., 16 Apr 2026). Probe tasks show that models can detect child or background cues at $\xi=d\phi/dx$95–$\xi=d\phi/dx$96 accuracy yet still fail to ground policy, a phenomenon the paper terms a speech grounding gap (Wang et al., 16 Apr 2026).

"ALMGuard" (Jin et al., 30 Oct 2025) proposes inference-time defense for ALMs through universal Shortcut Activation Perturbations applied on Mel-spectrograms. It optimizes a perturbation $\xi=d\phi/dx$97 to drive malicious inputs toward a fixed safe refusal sequence under an $\xi=d\phi/dx$98 constraint while controlling benign-task error (Jin et al., 30 Oct 2025). To preserve utility, it introduces a Mel-Gradient Sparse Mask based on the ratio of safety-loss sensitivity to ASR-loss sensitivity for each Mel bin (Jin et al., 30 Oct 2025). Across four models and six attacks, average success rate of attack falls from $\xi=d\phi/dx$99 without defense to $G=2\pi/d$00 with ALMGuard; on AdvWave, success rate drops from $G=2\pi/d$01 to $G=2\pi/d$02, and on unseen Gupta attacks from $G=2\pi/d$03 to $G=2\pi/d$04 (Jin et al., 30 Oct 2025). Benign WER on Qwen2-Audio rises from $G=2\pi/d$05 to $G=2\pi/d$06, while response quality score declines from $G=2\pi/d$07 to $G=2\pi/d$08 (Jin et al., 30 Oct 2025).

These benchmark and guardrail papers shift sound safeguarding from acoustics alone to normative control over audio-capable AI systems. The problem is no longer only what acoustic energy enters a microphone, but also whether a model grounds policy in speaker, scene, overlap, and non-speech sound events.

6. Human-centered safeguarding, monitoring, and situational awareness

Another branch of the literature uses sound safeguarding to preserve awareness or to characterize exposure in vulnerable settings. "Mobile Sound Recognition for the Deaf and Hard of Hearing" (Fanzeres et al., 2018) treats safeguarding as on-device environmental sound recognition that compensates for lost auditory access. The system samples $G=2\pi/d$09 kHz, $G=2\pi/d$10-bit mono audio, uses non-overlapping $G=2\pi/d$11-sample Hann-windowed frames, applies event detection through RMS and spectral entropy thresholds, extracts a 54-dimensional feature vector including spectral rolloff, spectral flux, compactness, MFCCs, and LPC coefficients, and benchmarks four classifiers (Fanzeres et al., 2018). Reported cross-validation accuracy reaches $G=2\pi/d$12 for k-NN and $G=2\pi/d$13 for Random Forest, while the final mobile app uses Naive Bayes for the speed-accuracy trade-off, achieving recognition latency of approximately $G=2\pi/d$14 s on a Sony Xperia C1604 (Fanzeres et al., 2018). The application also computes a Group Pertinence Index to expose confidence to users and presents visual cues, timestamps, and importance labels for recognized sounds (Fanzeres et al., 2018). Here safeguarding means augmenting situational awareness rather than suppressing sound itself.

A related problem arises in wearable audio devices with active noise control, where acoustic isolation can mask critical events. "Enhancing Situational Awareness in Wearable Audio Devices Using a Lightweight Sound Event Localization and Detection System" (Yeow et al., 18 Sep 2025) proposes an ASC-conditioned SELD pipeline. A lightweight monophonic ASC front-end with about $G=2\pi/d$15K parameters and $G=2\pi/d$16M MACs predicts one of three scenes, and a multi-channel SALSA-Lite-based CRNN back-end with about $G=2\pi/d$17K parameters and $G=2\pi/d$18M MACs performs sound event localization and detection (Yeow et al., 18 Sep 2025). Conditioning is realized through scene-dependent thresholds $G=2\pi/d$19 applied to ACCDOA norms rather than through FiLM or attention layers (Yeow et al., 18 Sep 2025). Test ASC accuracy is $G=2\pi/d$20, and location-dependent $G=2\pi/d$21 rises from $G=2\pi/d$22 for a fixed-threshold baseline to $G=2\pi/d$23 with ASC conditioning and $G=2\pi/d$24 with oracle scene labels (Yeow et al., 18 Sep 2025). End-to-end latency on a Raspberry Pi 4 is about $G=2\pi/d$25 ms for a $G=2\pi/d$26 s audio block (Yeow et al., 18 Sep 2025). This suggests a safeguarding model in which selective restoration of relevant ambient sounds coexists with ANC.

The clinical monitoring literature provides a different interpretation. "Do neonates hear what we measure? Assessing neonatal ward soundscapes at the neonates ears" (Lam et al., 1 Feb 2025) argues that safeguarding in neonatal intensive care depends on microphone placement and psychoacoustic characterization. Binaural microphones were affixed to the ears of neonate manikins, while standard microphones were placed outside or inside incubators (Lam et al., 1 Feb 2025). The paper computes ISO 1996-1:2016 A- and C-weighted metrics, tonality index, and transient-event occurrence rates, then analyzes effects with LME-ART-ANOVA (Lam et al., 1 Feb 2025). Significant differences are reported between binaural and standard placements: in the HD ward, the standard microphone recorded A-weighted levels $G=2\pi/d$27 dB higher than binaural microphones on average, whereas in NICU-A the binaural measurement exceeded the standard microphone by $G=2\pi/d$28 dB for LA50, with $G=2\pi/d$29 and $G=2\pi/d$30 (Lam et al., 1 Feb 2025). NICU-A also exceeded HD-A by $G=2\pi/d$31 dB in LAeq and by $G=2\pi/d$32 dB in CSmax, and tonality occurrence rates were approximately $G=2\pi/d$33 at NICU beds (Lam et al., 1 Feb 2025). The recommended safeguarding practice is binaural monitoring at neonate ear level, continuous long-term monitoring for at least $G=2\pi/d$34 h, and reporting of A-, C-weighted, and psychoacoustic indices (Lam et al., 1 Feb 2025).

"Control Barrier Functions with Audio Risk Awareness for Robot Safe Navigation on Construction Sites" (Mootz et al., 12 Feb 2026) extends the idea into robotics. A lightweight jackhammer detector based on signal envelope and periodicity produces a binary state $G=2\pi/d$35 using thresholds $G=2\pi/d$36 dB, $G=2\pi/d$37 dB, $G=2\pi/d$38, and $G=2\pi/d$39, with debouncing delays of $G=2\pi/d$40 ms and $G=2\pi/d$41 ms (Mootz et al., 12 Feb 2026). The resulting exogenous audio risk cue inflates CBF safety margins by increasing obstacle radii or ellipse axes (Mootz et al., 12 Feb 2026). In simulation, the CBF safety filter eliminates safety violations across all trials; under audio-modulated elliptical CBF, safety is maintained with $G=2\pi/d$42 success, path length about $G=2\pi/d$43 m, and completion time about $G=2\pi/d$44 s (Mootz et al., 12 Feb 2026). Here the safeguarding object is robot navigation, with audio serving as an exogenous risk cue that changes the controller’s safe set.

Across these human-centered systems, sound safeguarding means ensuring that relevant environmental sound is either detected, interpreted, or measured at the right locus. Unlike privacy-oriented methods, these works aim to preserve or enhance actionable acoustic awareness.

7. Recurring design principles, trade-offs, and unresolved issues

Several recurrent principles cut across the literature. One is selective access rather than uniform attenuation. Metacages and ventilated barriers block incident sound while allowing airflow (Shen et al., 2017, Zhang et al., 2017). SH-Bench and BPFT require models to answer main-speaker questions while refusing bystander queries (Zhan et al., 6 Dec 2025). AudioGuard separates waveform-level detection from semantic policy moderation (Kang et al., 10 Apr 2026). SafeEar withholds semantic tokens while preserving acoustic cues for deepfake detection (Li et al., 2024). Wearable ASC-conditioned SELD suppresses irrelevant events by raising scene-dependent thresholds and lowers thresholds for salient ones (Yeow et al., 18 Sep 2025).

A second principle is thresholding or margin enforcement. Acoustic measurement safeguarding raises low-energy DFT bins above thresholds $G=2\pi/d$45 or $G=2\pi/d$46 to control deconvolution error (Kawahara et al., 2021, Kawahara et al., 2023, Kawahara et al., 11 Jul 2025). AudioGuard compares cue confidences against $G=2\pi/d$47 and $G=2\pi/d$48 within interpretable logic rules (Kang et al., 10 Apr 2026). WaveGuard declares inputs adversarial when CER drift exceeds tuned $G=2\pi/d$49 (Hussain et al., 2021). SceneGuard constrains protection to an SNR window of $G=2\pi/d$50–$G=2\pi/d$51 dB (Sang et al., 20 Nov 2025). Robot audio-risk CBFs enlarge safe boundaries by a user-chosen inflation magnitude when the detector activates (Mootz et al., 12 Feb 2026).

A third principle is the tension between utility and protection. AudioShield explicitly optimizes perturbations in latent space to preserve perceptual quality while degrading ASR (Jin et al., 1 Apr 2025). ALMGuard restricts perturbations to Mel bins that are sensitive to jailbreaks but insensitive to speech understanding (Jin et al., 30 Oct 2025). SceneGuard degrades speaker similarity while keeping STOI near $G=2\pi/d$52 (Sang et al., 20 Nov 2025). SafeEar accepts EER slightly behind full-access baselines in exchange for preventing semantic leakage (Li et al., 2024). In measurement settings, safeguarding seeks perturbations that are perceptually negligible yet sufficient to stabilize inversion (Kawahara et al., 11 Jul 2025).

Common misconceptions are directly addressed by the papers. One is that strong audio understanding implies privacy protection; SH-Bench shows the opposite, reporting substantial privacy leakage before BPFT and emphasizing that strong audio understanding does not translate into selective protection of bystander privacy (Zhan et al., 6 Dec 2025). Another is that transcript-only moderation is adequate for audio systems; AudioSafetyBench and VoxSafeBench both show that risks can arise from non-speech events, speaker attributes, paralinguistic cues, and background context even when transcript content is benign (Kang et al., 10 Apr 2026, Wang et al., 16 Apr 2026). A further misconception is that safeguarding always implies inaudible or imperceptible perturbation; SceneGuard deliberately uses audible, scene-consistent noise, and near-ultrasonic shielding exploits hardware nonlinearities rather than semantic perturbation (McKee et al., 2024, Sang et al., 20 Nov 2025).

Several unresolved issues recur. Current BPFT focuses on single main-speaker scenarios, with multi-party dialogues remaining untested (Zhan et al., 6 Dec 2025). AudioGuard notes speaker fairness and privacy concerns around identity detection, as well as open problems in adversarial robustness, streaming, and expanded taxonomies (Kang et al., 10 Apr 2026). VoxSafeBench identifies a persistent speech grounding gap in which models can perceive cues but fail to apply the correct norm (Wang et al., 16 Apr 2026). SceneGuard, SafeEar, and EveGuard all imply an ongoing arms race with denoisers, reconstruction models, and adaptive attackers (Sang et al., 20 Nov 2025, Li et al., 2024, Chang et al., 2024). In physical metamaterials, scaling, multi-frequency operation, and geometric adaptation remain application-dependent engineering challenges (Shen et al., 2017, Ning et al., 13 Aug 2025).

This suggests that sound safeguarding is evolving from isolated signal-processing tricks into a layered systems discipline. Physical acoustics, robust measurement, privacy engineering, assistive perception, and policy-grounded AI moderation are increasingly connected by a shared question: how should acoustic information be structured so that the intended recipient, task, or environment remains functional while harmful or unauthorized pathways are denied?