{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,11,11]],"date-time":"2026-11-11T03:09:44Z","timestamp":1794366584308,"version":"4.9.0"},"reference-count":78,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["624B2130,62572424"],"award-info":[{"award-number":["624B2130,62572424"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2023YFB3107402"],"award-info":[{"award-number":["2023YFB3107402"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/sp63933.2026.00214","type":"proceedings-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:34:20Z","timestamp":1782934460000},"page":"310-328","source":"Crossref","is-referenced-by-count":2,"title":["Hijacking Large Audio-Language Models via Context-Agnostic and Imperceptible Auditory Prompt Injection"],"prefix":"10.1109","author":[{"given":"Meng","family":"Chen","sequence":"first","affiliation":[{"name":"Zhejiang University,The State Key Laboratory of Blockchain and Data Security"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kun","family":"Wang","sequence":"additional","affiliation":[{"name":"Zhejiang University,The State Key Laboratory of Blockchain and Data Security"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Li","family":"Lu","sequence":"additional","affiliation":[{"name":"Zhejiang University,The State Key Laboratory of Blockchain and Data Security"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jiaheng","family":"Zhang","sequence":"additional","affiliation":[{"name":"National University of Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tianwei","family":"Zhang","sequence":"additional","affiliation":[{"name":"Nanyang Technological University"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"WavChat: a Survey of Spoken Dialogue Models","volume":"arXiv:2411.13577","author":"Ji","year":"2024","journal-title":"arXiv preprint"},{"key":"ref2","year":"2025","journal-title":"ChatGPT Voice Mode"},{"key":"ref3","year":"2025","journal-title":"Gemini Live: Real-time Voice Assistance from Gemini"},{"key":"ref4","year":"2025","journal-title":"Voxtral: Frontier Open-Source Speech Understanding Models"},{"key":"ref5","year":"2025","journal-title":"Empowering Innovation: The Next Generation of the Phi Family"},{"key":"ref6","year":"2025","journal-title":"Ultravox: Next-Gen Voice AI"},{"key":"ref7","year":"2024","journal-title":"GPT-4o: OpenAI\u2019s new flagship model"},{"key":"ref8","article-title":"Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilities","volume":"arXiv:2507.06261","year":"2025","journal-title":"arXiv preprint"},{"key":"ref9","article-title":"Phi-4-mini technical report: Compact yet powerful multimodal language models via mixture-of-loras","volume":"arXiv:2503.01743","year":"2025","journal-title":"arXiv preprint"},{"key":"ref10","article-title":"Voxtral","volume":"arXiv:2507.13264","year":"2025","journal-title":"arXiv preprint"},{"key":"ref11","article-title":"JALMBench: Benchmarking Jailbreak Vulnerabilities in Audio Language Models","volume":"arXiv:2505.17568","author":"Peng","year":"2025","journal-title":"arXiv preprint"},{"key":"ref12","article-title":"Voice Jailbreak Attacks Against GPT-4o","volume":"arXiv:2405.19103","author":"Shen","year":"2024","journal-title":"arXiv preprint"},{"key":"ref13","article-title":"Unveiling the Safety of GPT4o: an Empirical Study Using Jailbreak Attacks","volume":"arXiv:2406.06302","author":"Ying","year":"2024","journal-title":"arXiv preprint"},{"key":"ref14","article-title":"Best-of-N Jailbreaking","volume":"arXiv:2412.03556","author":"Hughes","year":"2024","journal-title":"arXiv preprint"},{"key":"ref15","article-title":"Jailbreak-AudioBench: In-Depth Evaluation and Analysis of Jailbreak Threats for Large Audio Language Models","volume":"arXiv:2501.13772","author":"Cheng","year":"2025","journal-title":"arXiv preprint"},{"key":"ref16","article-title":"AdvWave: Stealthy Adversarial Jailbreak Attack Against Large Audio-Language Models","volume-title":"Proceedings of ICLR","author":"Kang"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-acl.596"},{"key":"ref18","article-title":"AudioJailbreak: Jailbreak Attacks Against End-to-End Large AudioLanguage Models","volume":"arXiv:2505.14103","author":"Chen","year":"2025","journal-title":"arXiv preprint"},{"key":"ref19","article-title":"Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs","volume":"arXiv:2307.10490","author":"Bagdasaryan","year":"2023","journal-title":"arXiv preprint"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.52202\/068431-1280"},{"key":"ref21","first-page":"2667","article-title":"Devil\u2019s Whisper: a General Approach for Physical Adversarial Attacks Against Commercial Black-Box Speech Recognition Devices","volume-title":"Proceedings of USENIX Security","author":"Chen"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00004"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00009"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423348"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3345639"},{"key":"ref26","article-title":"FunAudioLLM: Voice Understanding and Generation Foundation Models for Natural Interaction Between Humans and LLMs","volume":"arXiv:2407.04051","year":"2024","journal-title":"arXiv preprint"},{"key":"ref27","year":"2024","journal-title":"Voice Agents"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-emnlp.1055"},{"key":"ref29","article-title":"GLM-4-Voice: Towards Intelligent and Human-Like End-toEnd Spoken Chatbot","volume":"arXiv:2412.02612","author":"Zeng","year":"2024","journal-title":"arXiv preprint"},{"key":"ref30","article-title":"VITA-Audio: Fast Interleaved Cross-Modal Token Generation for Efficient Large Speech-Language Model","volume":"arXiv:2505.03739","author":"Long","year":"2025","journal-title":"arXiv preprint"},{"key":"ref31","article-title":"Moshi: a Speech-Text Foundation Model for Real-Time Dialogue","volume":"arXiv:2410.00037","author":"D\u00e9fossez","year":"2024","journal-title":"arXiv preprint"},{"key":"ref32","article-title":"LlamaOmni: Seamless Speech Interaction with Large Language Models","volume-title":"Proceedings of ICLR","author":"Fang"},{"key":"ref33","first-page":"18617","article-title":"Llama-Omni2: LLM-Based Real-Time Spoken Chatbot with Autoregressive Streaming Speech Synthesis","volume-title":"Proceedings of ACL","author":"Fang"},{"key":"ref34","article-title":"Mini-Omni: Language Models Can Hear, Talk While Thinking in Streaming","volume":"arXiv:2408.16725","author":"Xie","year":"2024","journal-title":"arXiv preprint"},{"key":"ref35","article-title":"LLaSM: Large Language and Speech Model","volume":"arXiv:2308.15930","author":"Shu","year":"2023","journal-title":"arXiv preprint"},{"key":"ref36","article-title":"Qwen-Audio: Advancing Universal Audio Understanding via Unified Large-Scale Audio-Language Models","volume":"arXiv:2311.07919","author":"Chu","year":"2023","journal-title":"arXiv preprint"},{"key":"ref37","article-title":"Qwen2-Audio Technical Report","volume-title":"arXiv preprint","volume":"arXiv:2407.10759","author":"Chu","year":"2024"},{"key":"ref38","year":"2024","journal-title":"Gemma 3n Model Overview"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-emnlp.263"},{"key":"ref40","article-title":"Audio Flamingo: a Novel Audio Language Model with Few-Shot Learning and Dialogue Abilities","volume-title":"Proceedings of ACM ICML","author":"Kong"},{"key":"ref41","article-title":"SALMONN: Towards Generic Hearing Abilities for Large Language Models","volume-title":"Proceedings of ICLR","author":"Tang"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.emnlp-main.361"},{"key":"ref43","article-title":"MinMo: a Multimodal Large Language Model for Seamless Voice Interaction","volume":"arXiv:2501.06282","year":"2025","journal-title":"arXiv preprint"},{"key":"ref44","article-title":"Kimi-Audio Technical Report","volume-title":"arXiv preprint","volume":"arXiv:2504.18425","year":"2025"},{"key":"ref45","article-title":"Lessons from Defending Gemini Against Indirect Prompt Injections","volume":"arXiv:2505.14534","author":"Shi","year":"2025","journal-title":"arXiv preprint"},{"key":"ref46","first-page":"79","article-title":"Not What You\u2019ve Signed Up for: Compromising RealWorld LLM-Integrated Applications with Indirect Prompt Injection","volume-title":"Proceedings of ACM CCS","author":"Abdelnabi"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.naacl-long.470"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3670388"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.24188"},{"key":"ref50","article-title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","volume":"arXiv:2307.15043","author":"Zou","year":"2023","journal-title":"arXiv preprint"},{"key":"ref51","article-title":"DeepInception: Hypnotize Large Language Model to be Jailbreaker","volume":"arXiv:2311.03191","author":"Li","year":"2023","journal-title":"arXiv preprint"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.773"},{"key":"ref53","article-title":"Jailbreak and Guard Aligned Language Models with Only Few in-Context Demonstrations","volume":"arXiv:2310.06387","author":"Wei","year":"2023","journal-title":"arXiv preprint"},{"key":"ref54","first-page":"5231","article-title":"Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition","volume-title":"Proceedings of PMLR ICML","author":"Qin"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23288"},{"key":"ref56","first-page":"1419","article-title":"PhoneyTalker: An Out-of-theBox Toolkit for Adversarial Example Attack on Speaker Recognition","volume-title":"Proceedings of IEEE INFOCOM","author":"Chen"},{"key":"ref57","first-page":"11908","article-title":"Adversarial Music: Real world Audio Adversary against Wake-word Detection System","volume-title":"Proceedings of NeurIPS","author":"Li"},{"key":"ref58","year":"2025","journal-title":"ChatGPT Record Mode"},{"key":"ref59","year":"2025","journal-title":"Zoom AI Companion 3.0"},{"key":"ref60","year":"2026","journal-title":"Openclaw: Personal ai assistant"},{"key":"ref61","article-title":"Formalizing and Benchmarking Prompt Injection Attacks and Defenses","volume-title":"Proceedings of USENIX Security, Philadelphia, PA, USA","author":"Liu"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1063\/5.0222987"},{"key":"ref63","article-title":"Ignore Previous Prompt: Attack Techniques for Language Models","volume":"arXiv:2211.09527","author":"Perez","year":"2022","journal-title":"arXiv preprint"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/3689932.3694764"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref66","article-title":"Categorical Reparameterization with Gumbel-Softmax","volume-title":"Proceedings of ICLR","author":"Jang"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.109"},{"key":"ref68","article-title":"Voicebench: Benchmarking LLM-Based Voice Assistants","volume":"arXiv:2410.17196","author":"Chen","year":"2024","journal-title":"arXiv preprint"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1186\/s13634-016-0306-6"},{"key":"ref70","first-page":"2309","article-title":"Dompteur: Taming Audio Adversarial Examples","volume-title":"Proceedings of USENIX Security","author":"Eisenhofer"},{"key":"ref71","article-title":"Earnings-22: A Practical Benchmark for Accents in the Wild","volume":"arXiv:2203.15591","author":"Rio","year":"2022","journal-title":"arXiv preprint"},{"key":"ref72","article-title":"Jailbreak and Guard Aligned Language Models with Only Few in-Context Demonstrations","volume":"arXiv:2310.06387","author":"Wei","year":"2023","journal-title":"arXiv preprint"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1145\/3690624.3709179"},{"key":"ref74","article-title":"LLM Self Defense: by Self Examination, LLMs Know They Are Being Tricked","volume-title":"Proceedings of ICLR","author":"Phute"},{"key":"ref75","first-page":"2273","article-title":"WaveGuard: Understanding and Mitigating Audio Adversarial Examples","volume-title":"Proceedings of USENIX Security","author":"Hussain"},{"key":"ref76","first-page":"7303","article-title":"FraudWhistler: a Resilient, Robust and Plug-and-Play Adversarial Example Detection Method for Speaker Recognition","volume-title":"Proceedings of USENIX Security","author":"Wang"},{"key":"ref77","article-title":"Characterizing Audio Adversarial Examples Using Temporal Dependency","volume-title":"Proceedings of ICLR","author":"Yang"},{"key":"ref78","article-title":"UniGuardian: a Unified Defense for Detecting Prompt Injection, Backdoor Attacks and Adversarial Attacks in Large Language Models","volume":"arXiv:2502.13141","author":"Lin","year":"2025","journal-title":"arXiv preprint"}],"event":{"name":"2026 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["2026 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11573355\/11573356\/11573415.pdf?arnumber=11573415","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T05:37:12Z","timestamp":1782970632000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11573415\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":78,"URL":"https:\/\/doi.org\/10.1109\/sp63933.2026.00214","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}