{"id":"https://openalex.org/W7137934268","doi":"https://doi.org/10.48550/arxiv.2603.13847","title":"Sirens' Whisper: Inaudible Near-Ultrasonic Jailbreaks of Speech-Driven LLMs","display_name":"Sirens' Whisper: Inaudible Near-Ultrasonic Jailbreaks of Speech-Driven LLMs","publication_year":2026,"publication_date":"2026-03-14","ids":{"openalex":"https://openalex.org/W7137934268","doi":"https://doi.org/10.48550/arxiv.2603.13847"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2603.13847","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.13847","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2603.13847","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5091752980","display_name":"Zijian Ling","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ling, Zijian","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129729444","display_name":"Pingyi Hu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hu, Pingyi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129716295","display_name":"Xiuyong Gao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Gao, Xiuyong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100549428","display_name":"Xiaojing Ma","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ma, Xiaojing","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129696750","display_name":"Man Zhou","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhou, Man","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129740737","display_name":"Jun Feng","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Feng, Jun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5122117632","display_name":"Songfeng Lu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lu, Songfeng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129728480","display_name":"Dongmei Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Dongmei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5129679094","display_name":"Bin Benjamin Zhu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhu, Bin Benjamin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.7300999760627747,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.7300999760627747,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10201","display_name":"Speech Recognition and Synthesis","score":0.09619999676942825,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10860","display_name":"Speech and Audio Processing","score":0.017999999225139618,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/covert","display_name":"Covert","score":0.6148999929428101},{"id":"https://openalex.org/keywords/microphone","display_name":"Microphone","score":0.5022000074386597},{"id":"https://openalex.org/keywords/commodity","display_name":"Commodity","score":0.4361000061035156},{"id":"https://openalex.org/keywords/transmission","display_name":"Transmission (telecommunications)","score":0.40790000557899475},{"id":"https://openalex.org/keywords/channel","display_name":"Channel (broadcasting)","score":0.3955000042915344},{"id":"https://openalex.org/keywords/sort","display_name":"sort","score":0.3887999951839447},{"id":"https://openalex.org/keywords/encoding","display_name":"Encoding (memory)","score":0.3434999883174896},{"id":"https://openalex.org/keywords/sorting","display_name":"Sorting","score":0.3292999863624573}],"concepts":[{"id":"https://openalex.org/C2779338814","wikidata":"https://www.wikidata.org/wiki/Q5179285","display_name":"Covert","level":2,"score":0.6148999929428101},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6015999913215637},{"id":"https://openalex.org/C2778263558","wikidata":"https://www.wikidata.org/wiki/Q46384","display_name":"Microphone","level":3,"score":0.5022000074386597},{"id":"https://openalex.org/C2779439359","wikidata":"https://www.wikidata.org/wiki/Q317088","display_name":"Commodity","level":2,"score":0.4361000061035156},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4235000014305115},{"id":"https://openalex.org/C761482","wikidata":"https://www.wikidata.org/wiki/Q118093","display_name":"Transmission (telecommunications)","level":2,"score":0.40790000557899475},{"id":"https://openalex.org/C127162648","wikidata":"https://www.wikidata.org/wiki/Q16858953","display_name":"Channel (broadcasting)","level":2,"score":0.3955000042915344},{"id":"https://openalex.org/C88548561","wikidata":"https://www.wikidata.org/wiki/Q347599","display_name":"sort","level":2,"score":0.3887999951839447},{"id":"https://openalex.org/C125411270","wikidata":"https://www.wikidata.org/wiki/Q18653","display_name":"Encoding (memory)","level":2,"score":0.3434999883174896},{"id":"https://openalex.org/C111696304","wikidata":"https://www.wikidata.org/wiki/Q2303697","display_name":"Sorting","level":2,"score":0.3292999863624573},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.3199000060558319},{"id":"https://openalex.org/C195251586","wikidata":"https://www.wikidata.org/wiki/Q1185939","display_name":"Demodulation","level":3,"score":0.30889999866485596},{"id":"https://openalex.org/C65165936","wikidata":"https://www.wikidata.org/wiki/Q575784","display_name":"Baseband","level":3,"score":0.30709999799728394},{"id":"https://openalex.org/C28490314","wikidata":"https://www.wikidata.org/wiki/Q189436","display_name":"Speech recognition","level":1,"score":0.29440000653266907},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.290800005197525},{"id":"https://openalex.org/C197424946","wikidata":"https://www.wikidata.org/wiki/Q1165717","display_name":"Waveform","level":3,"score":0.28619998693466187},{"id":"https://openalex.org/C29024540","wikidata":"https://www.wikidata.org/wiki/Q1476964","display_name":"Covert channel","level":5,"score":0.28299999237060547},{"id":"https://openalex.org/C2776230583","wikidata":"https://www.wikidata.org/wiki/Q1322198","display_name":"Spoken language","level":2,"score":0.27000001072883606},{"id":"https://openalex.org/C2779843651","wikidata":"https://www.wikidata.org/wiki/Q7390335","display_name":"SIGNAL (programming language)","level":2,"score":0.26109999418258667},{"id":"https://openalex.org/C75291252","wikidata":"https://www.wikidata.org/wiki/Q1315756","display_name":"TRACE (psycholinguistics)","level":2,"score":0.2551000118255615}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2603.13847","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.13847","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2603.13847","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.13847","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.6616657376289368,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Speech-driven":[0],"large":[1],"language":[2],"models":[3],"(LLMs)":[4],"are":[5],"increasingly":[6],"accessed":[7],"through":[8,76],"speech":[9],"interfaces,":[10],"introducing":[11],"new":[12],"security":[13],"risks":[14],"via":[15],"open":[16],"acoustic":[17,68,174],"channels.":[18],"We":[19],"present":[20],"Sirens'":[21],"Whisper":[22],"(SWhisper),":[23],"the":[24,151,171],"first":[25],"practical":[26],"framework":[27],"for":[28,161],"covert":[29,100,173],"prompt-based":[30],"attacks":[31],"against":[32],"speech-driven":[33,116,124],"LLMs":[34,125],"under":[35,115],"realistic":[36],"black-box":[37,128],"conditions":[38],"using":[39],"commodity":[40,56],"hardware.":[41],"SWhisper":[42,133],"enables":[43,176],"robust,":[44],"inaudible":[45],"delivery":[46],"of":[47,180],"arbitrary":[48],"target":[49],"baseband":[50],"audio-including":[51],"long":[52],"and":[53,70,89,113,122,140,183],"structured":[54],"prompts-on":[55],"devices":[57,88],"by":[58],"encoding":[59],"it":[60],"into":[61],"near-ultrasound":[62],"waveforms":[63],"that":[64,109,150],"demodulate":[65],"faithfully":[66],"after":[67],"transmission":[69],"microphone":[71],"nonlinearity.":[72],"This":[73],"is":[74,155],"achieved":[75],"a":[77,104,168,177],"simple":[78],"yet":[79],"effective":[80],"approach":[81],"to":[82,136],"modeling":[83],"nonlinear":[84],"channel":[85,175],"characteristics":[86],"across":[87,119],"environments,":[90],"combined":[91],"with":[92],"lightweight":[93],"channel-inversion":[94],"pre-compensation.":[95],"Building":[96],"on":[97],"this":[98],"high-fidelity":[99,181],"channel,":[101],"we":[102],"design":[103],"voice-aware":[105],"jailbreak":[106,153],"generation":[107],"method":[108],"ensures":[110],"intelligibility,":[111],"brevity,":[112],"transferability":[114],"interfaces.":[117],"Experiments":[118],"both":[120],"commercial":[121,131],"open-source":[123],"demonstrate":[126],"strong":[127],"effectiveness.":[129],"On":[130],"models,":[132],"achieves":[134],"up":[135],"0.94":[137],"non-refusal":[138],"(NR)":[139],"0.925":[141],"specific-convincing":[142],"(SC).":[143],"A":[144],"controlled":[145],"user":[146],"study":[147],"further":[148],"shows":[149],"injected":[152],"audio":[154],"perceptually":[156],"indistinguishable":[157],"from":[158],"background-only":[159],"playback":[160],"human":[162],"listeners.":[163],"Although":[164],"jailbreaks":[165],"serve":[166],"as":[167],"case":[169],"study,":[170],"underlying":[172],"broader":[178],"class":[179],"prompt-injection":[182],"commandexecution":[184],"attacks.":[185]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-03-18T00:00:00"}