Speech tokenizers are fragile: transferable semantic attacks and robust tokenizers

1. 01What problem does this paper attempt to solve?

   The authors argue that speech tokenizers are fragile at the semantic level, and propose a transferable semantic attack T-SemAttack and a robust tokenizer ROSETok.

   Core question: whether the semantic encoding of a speech tokenizer, as the front end of ASR and LALM, can be disrupted by small waveform perturbations, thereby degrading downstream systems, and how to train a semantically robust tokenizer.

   • Scenario and importance: The authors state that speech systems with LLM architectures generally rely on speech tokenizers to map continuous signals to discrete tokens; the tokenizer connects the continuous acoustic space and the discrete semantic space, and its robustness directly determines the reliability of the entire semantic pipeline.
   • Gaps in existing research: The authors state that existing work mainly evaluates tokenizer fragility to Gaussian noise, whereas semantic attacks can expose more severe fragility; in Figure 1, T-SemAttack causes a larger drop in downstream FSC performance than 5 dB strong Gaussian noise.
   • Core observation: The authors' analysis finds that perturbations can reduce the cosine similarity of HuBERT deep representations from 0.881 to 0.079, and that the input gradient directions of different surrogate encoders are aligned; the authors suggest that shared adversarial-sensitive directions in input space may be a key factor in cross-model transferability.
   • Paper output: Proposes the transferable semantic attack T-SemAttack, and based on the attack mechanism proposes a robust speech tokenizer ROSETok that combines noise-augmented training and robust semantic distillation.
   • Threat model (Section 3.1):
     • Goal: Generate robust adversarial examples under an acceptable-noise constraint, causing the speech system to produce incorrect transcriptions, while remaining effective against adaptive defenses such as denoising and data transformations.
     • Knowledge: Transfer-based setting; the attacker cannot access the target system's internal gradients, parameters, or tokenizer details.
     • Capability: Can access the input speech waveform and holds a set of differentiable surrogate semantic encoders; offline attack, with low real-time requirements.
     • Victim systems and defense assumptions: Open-source and commercial black-box ASR, LALM; the defender is a strong defender able to detect noise and restore audio as much as possible with existing tools.

   Collapse this answer

2. 02What related research exists?

   Related work falls into three categories: speech tokenizers, transferable ASR attacks, and defenses; the authors position this paper as a transfer attack targeting the semantic encoder of tokenizers.

   Speech tokenizers and speech foundation models

   • The paper describes a speech tokenizer as consisting of an encoder and a quantizer (decoder), adopted by systems such as Qwen3-ASR, CosyVoice and Qwen2-Audio; the authors believe security vulnerabilities in this component could directly endanger the entire speech foundation model.
   • StableToken (Song et al., 2025) — a semantic speech tokenizer aimed at noise robustness; the authors say existing research mainly evaluates vulnerability under Gaussian noise, whereas this paper focuses on semantic attacks.

   Transferable ASR attacks

   • The authors summarize that recent ASR adversarial attacks have improved transferability and input-agnostic perturbation generation, but most methods attack the entire ASR pipeline, often relying on surrogate decoding objectives such as CTC loss, which is costly to optimize and obscures the role of the front-end speech representation.
   • E2E-VGuard (Zhang et al., 2025) — adversarial protection for end-to-end speech synthesis; this paper adopts its psychoacoustic model and MFCC attack objective and uses it as an attack baseline.
   • AudioShield (Jin et al., 2025) — applies perturbations in the latent feature space to attack the audio encoder; this paper uses it as an attack baseline and aligns perceptual quality with τ=0.1.

   Defense methods

   • WaveGuard (Hussain et al., 2021) — a mitigation method for audio adversarial examples; this paper's adaptive defense experiments adopt its resampling, quantization and other transforms.
   • AudioPure (Wu et al., 2023) — purifies adversarial audio by adding noise and then denoising with a diffusion model; this paper evaluates it as a defense.
   • Denoiser (Defossez et al., 2020) and DeepFilterNet3 (Schröter et al., 2023) — speech enhancement models, used in this paper as denoising defenses.

   Baselines and benchmarks: attack baselines are Gaussian Noise, E2E-VGuard, AudioShield; tokenizer baselines are SNAC, XY-Tokenizer, X-Codec 2, DAC, MOSS-Audio-Tokenizer, StableToken; evaluation datasets are LibriTTS, Seed-TTS-Eval, AIR-Bench, FSC (XARES/XARES-LLM protocol).

   The authors position the difference between this paper and existing work as: focusing on the semantic encoder inside the speech tokenizer, systematically analyzing how small waveform perturbations cause semantic representation drift, token-level collapse and downstream LALM attention interference, rather than attacking the entire ASR pipeline.

   Collapse this answer

3. 03How does the paper address this problem?

   T-SemAttack jointly perturbs four surrogate semantic encoders and adds psychoacoustic constraints; ROSETok uses two-stage training with noise-augmented training plus Whisper semantic distillation.

   Overall approach: T-SemAttack does not attack the entire ASR/LALM pipeline, but jointly perturbs the representation spaces of multiple surrogate semantic encoders, causing semantic representations to drift and tokens to change, thereby transferring to unseen target models; ROSETok, following the attack mechanism, uses noise-augmented training and semantic distillation to improve the tokenizer's semantic stability.

   Problem formulation

   • Given original audio x, construct xadv = x + δ, with optimization objective min_δ L = λ_sem L_sem + λ_psy L_psy + λ₂ |δ|², subject to ∥δ∥∞ ≤ ϵ; the three terms measure semantic representation shift, psychoacoustic masking, and perturbation magnitude, respectively.
   • Hyperparameters: λsem = 100, λpsy = 1e-3, λ2 = 0.1, ϵ = 8/255 (Appendix E.1 Table 9).
   • The authors target the continuous representation before quantization: hard quantization is locally constant within a region and non-differentiable at boundaries, whereas representation drift can both change continuous interface features and change discrete tokens when crossing quantization boundaries.

   Semantic attack loss and surrogate branches

   • The semantic loss is the sum of frame-wise average cosine similarities between clean and perturbed representations over K surrogate encoders, L_sem = ∑_k CosSim(f_k(x), f_k(xadv)); minimizing it simultaneously drives drift in multiple semantic spaces.
   • Four surrogate branches: S3Tokenizer (simulating the semantic encoding of a discrete tokenizer), HuBERT (self-supervised deep semantics), Whisper encoder (ASR-pretrained semantics), MFCC (low-level attack target).
   • The transfer mechanism given by the authors: although multiple semantic encoders have different training objectives, they share similar Mel input bottlenecks and semantic structure; disrupting the shared semantic representations of surrogate models often also disrupts the corresponding representations of unseen target models.

   Psychoacoustic constraint and optimization

   • The psychoacoustic loss is applied only when the perturbation power spectrum exceeds the masking threshold computed from the short-time spectrum of the original audio, so that perturbations preferentially hide in frequency bands or time-domain regions where the original speech is stronger.
   • Optimization uses PGD-style projected updates, projecting the perturbation back into the ℓ∞ ball at each step; SGD optimizer with plateau learning rate schedule, initial lr 1e-3, minimum 1e-6, 500 steps total (Table 9).

   ROSETok: robust speech tokenizer

   • Architecture: Based on DAC; the encoder outputs a 1280-dimensional latent representation, which passes through a 9-layer RVQ quantizer (1024 8-dimensional entries per layer) and a decoder to reconstruct the waveform; training introduces a frozen Whisper large-v3 encoder as Semantic Teacher and a multi-period discriminator (Appendix E.3).
   • Semantic preservation: Uses the Whisper teacher to supervise the encoder, aligning the representation of noisy input with the clean audio representation, rather than forcing tokens to remain unchanged; the authors state that token changes do not necessarily imply semantic degradation (Appendix A Q3).
   • Two-stage training: In the first stage, on Emilia Chinese-English data, with Gaussian-noise-corrupted speech as input, clean audio as reconstruction target, and semantic distillation added, lr 1e-4, yielding ROSETok-Base; in the second stage, 2,000 sentences randomly selected from LibriSpeech are used to generate perturbed inputs with T-SemAttack for Attack-Aware Fine-Tuning (AAF), lr 5e-6, yielding ROSETok-AAF.
   • Training objective: L_tok = λ_distill L_distill + λ_recon L_recon + λ_cb L_cb + λ_commit L_commit + L_adv + L_fm, weights {5.0, 15, 1.0, 0.25}, with Ladv and Lfm both weighted 1.

   Success criteria

   • Attack effectiveness is measured by the WER of the target model transcribing adversarial audio; higher WER means more severe semantic disruption; perceptual quality uses SNR and MOS; efficiency uses RTF.

   Collapse this answer

4. 04What experiments did the paper conduct?

   Evaluates the attack on 9 ASR and 4 LALM, covering adaptive defenses, tokenizer reconstruction and downstream robustness, ablation, and a 20-person subjective listening test.

   Experimental setup

   • ASRs under test (9): open-source HuBERT-Large, Whisper-Large, Qwen3-ASR-0.6B, VibeVoice-ASR, FireRedASR, Fun-ASR-Nano; commercial black-box iFlytek, Doubao-ASR, GPT-4o-mini-transcribe. The encoders of HuBERT-Large and Whisper-Large are also the surrogate branches of the attack; in Table 1 these two columns' target models are the surrogate models themselves.
   • LALMs under test (4): Qwen2-Audio, Qwen3-Omni, Audio-Flamingo-3 (open-source) and Gemini-3-Flash-Preview (black-box), all with a system prompt requiring verbatim transcription.
   • Datasets: LibriTTS (single-speaker English, sample size not stated in the paper); Seed-TTS-Eval randomly samples 200 English sentences and 200 Chinese sentences; AIR-Bench randomly takes 100 items for QA.
   • Baselines and metrics: attack baselines Gaussian Noise (σ=0.01), E2E-VGuard, AudioShield (τ=0.1); metrics WER (higher means stronger attack), RTF, SNR, MOS, RQS, STOI, PESQ.
   • Evaluation method: QA tasks are scored with DeepSeek-V4-Flash for Response Quality Score (RQS); in the subjective experiment 20 subjects rate 0–5 MOS, reporting 95% confidence intervals.
   • Number of repetitions: not reported in the paper; attack ablation uses 30 samples, shared-direction analysis uses 30 samples.

   Main results

   According to Table 1, the average WER (%) of T-SemAttack against 9 ASR systems on three datasets:

   Swipe horizontally to read the table

   Method	LibriTTS	Seed-TTS (EN)	Seed-TTS (ZH)
   Clean	2.503	2.598	1.678
   Gaussian Noise	3.376	5.182	4.301
   E2E-VGuard	8.473	23.154	11.261
   AudioShield	13.908	52.927	27.621
   T-SemAttack	61.348	81.872	50.814

   • The authors say T-SemAttack achieves a better balance among efficiency, perceptual quality and attack strength: RTF 21.800 is lower than E2E-VGuard's 26.797, SNR 16.319–17.652; AudioShield's SNR is around -2.440, which the authors say almost destroys audio quality.
   • WER is highest on the surrogate models themselves: on LibriTTS, HuBERT 156.913%, Whisper 111.367%; on Seed-TTS (EN), HuBERT 189.289%. On black-box systems, iFlytek 49.607%, GPT-4o-mini-transcribe 46.089% (LibriTTS).
   • The authors say cross-lingual attacks hold on the Chinese subset because the surrogate models Whisper and S3Tokenizer were trained on multilingual data; on the Chinese set Doubao is only 6.298%, and the authors say commercial systems differ in robustness in Chinese scenarios.

   LALM evaluation

   • ASR task: the authors report T-SemAttack averages WER 58.30% across 11 dataset-model combinations, higher than E2E-VGuard's 16.76% and AudioShield's 38.66%; on LibriTTS, Qwen2-Audio rises from 2.982% to 97.280%, and on the Chinese set Qwen2-Audio is 79.259% and Gemini3-Flash 81.300% (Figure 4 and main text).
   • QA task: on 100 AIR-Bench samples, the average RQS of the four LALMs drops from 7.58 on clean input to 5.48 after attack (Table 3); the authors say the attack also degrades audio question answering quality.
   • The authors' interpretation: the authors say that once the semantic tokenizer produces wrong tokens, the subsequent LALM struggles to recover the original semantics through language modeling; the single-sample attention analysis in Appendix F.2 shows attacked audio tokens weaken the model's reliance on audio context, with cross-modal attention shifting more toward the text itself.

   Adaptive defenses

   • Setup: on Seed-TTS-EN, evaluate denoising (Denoiser, DeepFilterNet3), WaveGuard-based adversarial defenses (Resample, Mel, Q-D), the diffusion defense AudioPure and audio transforms (Speed, PS, Band-filter), with targets Whisper and VibeVoice-ASR (Table 2).
   • Results: after Denoiser, T-SemAttack WER is 96.763% on Whisper and 42.901% on VibeVoice-ASR; after DeepFilterNet3, 113.997% and 37.805%; the most effective defense is AudioPure, with WER dropping to 21.571%; under the Speed transform it is still 89.898%. Under the same defenses, E2E-VGuard and AudioShield WER is mostly 7%–16%.
   • The authors' interpretation: the authors believe T-SemAttack's perturbation is not noise that conventional speech enhancement can remove, and speech enhancement alone is insufficient to restore the token sequence, so noise robustness and semantic consistency need to be explicitly modeled at the tokenizer level.

   ROSETok evaluation

   • Reconstruction (Table 4, Seed-TTS EN, STOI): ROSETok-Base is 0.966, 0.950, 0.842 on clean, Gaussian noise and T-SemAttack inputs; ROSETok-AAF rises to 0.903 on attacked input, with 0.945 and 0.937 on clean and noisy inputs.
   • Downstream semantics (Table 4, XARES-LLM protocol, SmolLM2-135M + FSC): StableToken is 96.7 clean, 95.4 under Gaussian noise, and only 35.0 under attack; ROSETok-Base is 62.4 under attack, ROSETok-AAF 77.9. The authors say robustness to Gaussian noise is insufficient to guarantee downstream semantic understanding.
   • Noise levels (Figure 5): under Gaussian noise amplitudes 1/255–24/255, DAC drops from 0.943 clean to 0.770 at 24/255, and ROSETok-Base has STOI 0.920 at 24/255.

   Other ablations and analyses

   • Attack components (Figure 6a/6b, 30 samples): removing Lsem leaves attack success rate at only about 1.556%; removing Lpsy and L2 drops SNR to 8.5 and PESQ below 2.08.
   • λpsy sensitivity (Figure 6c/6d): at λpsy ≤ 1e-3 the attack effect no longer improves while SNR keeps dropping, so 1e-3 is chosen.
   • ROSETok components (Table 5, trained on LibriSpeech for 100k steps): removing noise-augmented training drops STOI on noisy input from 0.931 to 0.879 and the FSC noise score from 60.032 to 11.363; removing Ldistill drops the FSC clean score to 7.118.
   • Semantic teacher (Table 6): replacing Whisper with HuBERT gives similar reconstruction scores, but FSC drops from 73.90 to 31.48.
   • Mechanism analysis: HuBERT layer-by-layer similarity drops from 0.881 at the input embedding layer to 0.079 at the last layer, and Whisper's last layer drops to 0.854 (Figure 3a); using only the rank-1 shared direction gives WER 155.02% on HuBERT, the full ensemble 191.64%, and the residual direction 26.38% (30 samples); raising α from 0.5 to 1 raises HuBERT WER from 59.05% to 192.84%, and S3Tokenizer TER reaches 99.88% (Figure 3b and Section 4).
   • Appendix results: perturbation inside S3Tokenizer amplifies from waveform-level RD 0.154 to encoder output 1.520 (9.87×), with VQ token-level TER 99.7% (Table 12); in the TTS protection case, the average WER of three TTS systems rises from 4.267 to 69.550 and SIM drops from 0.736 to 0.280 (Table 7); in the subjective experiment T-SemAttack MOS-Q 3.01±0.28, MOS-C 4.32±0.19, MOS-S 3.87±0.25, with 20 subjects (Table 8).

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors state that the attack's real-time performance needs improvement and ROSETok is not a complete defense; experiments cover Chinese and English, 9 ASR and 4 LALM.

   Limitations and future directions noted by the authors

   • Real-time performance: T-SemAttack targets offline scenarios; the authors state that although its time efficiency is already better than E2E-VGuard, improving real-time performance remains a future direction, e.g., multi-GPU parallelism (Appendix A Q2).
   • Not complete defense: ROSETok should not be understood as complete mitigation against all semantic attacks; its robustness depends on the training distribution and threat model, and deployed systems should combine tokenizer-level robustness with additional monitoring, denoising, adversarial evaluation, and system-level protection (Appendix B).
   • Perceptual goal: The authors state that what T-SemAttack pursues is "harmlessness" that does not disrupt normal use of the audio, rather than true imperceptibility (Appendix A Q1).
   • Dual-use risk: The authors state that the technique could be misused to degrade transcription quality, evade speech moderation, etc., and position it as a safety research output, with a disclaimer to be attached before code release (Appendix B).

   Experimental coverage

   • Attack evaluation covers three datasets in total: English single-speaker (LibriTTS), English and Chinese multi-speaker (Seed-TTS-Eval, 200 sentences each), with 9 ASR systems and 4 LALMs (Section 6.1).
   • Adaptive defense evaluation includes Denoiser, DeepFilterNet3, WaveGuard-family transformations, AudioPure, and audio transformations, conducted only on Seed-TTS-EN (Section 7.3).
   • QA evaluation uses 100 randomly sampled items from AIR-Bench, with DeepSeek-V4-Flash as the judge model; subjective listening test with 20 subjects and 16 audio clips (Appendix D).
   • ROSETok training uses approximately 96.7k hours of Emilia Chinese-English data; the AAF stage uses 2,000 LibriSpeech sentences; downstream semantic evaluation covers only the FSC task with a SmolLM2-135M probe (Section 7.4).
   • The paper does not report the number of repetitions or variance for attack experiments, nor the agreement between the judge model and human judgments.

   Collapse this answer

6. 06Summarize the main content of the paper

   The authors propose a transferable semantic attack against speech tokenizers, T-SemAttack, and train a robust tokenizer ROSETok based on it.

   An attack-and-defense paper on the security of speech tokenizers: the authors argue that speech tokenizers, as the front end of ASR and LALM, are fragile at the semantic level and are the security bottleneck of the entire semantic pipeline.

   • Problem: Small waveform perturbations can disrupt the tokenizer's semantic encoding, degrading downstream ASR and LALM performance; the authors state that existing research mainly focuses on Gaussian noise, and the fragility exposed by semantic attacks is more severe.
   • Method: T-SemAttack jointly perturbs four surrogate branches—S3Tokenizer, HuBERT, Whisper encoder, and MFCC—minimizing the cosine similarity between clean and perturbed representations, while using psychoacoustic masking constraints to preserve perceptual quality; the transfer hypothesis is that the encoders share a Mel input bottleneck and semantic structure.
   • Attack results: On 9 ASR systems, Seed-TTS (EN) average WER is 81.872%, higher than E2E-VGuard's 23.154% (Table 1); on 11 dataset-LALM combinations, average WER is 58.30%; high WER is maintained after defenses such as Denoiser and AudioPure (Table 2).
   • Mechanism findings: Perturbations reduce HuBERT deep representation similarity from 0.881 to 0.079; within S3Tokenizer the perturbation is amplified stage by stage, with a token error rate of 99.7%; the authors suggest that shared adversarial-sensitive directions may be key to transferability.
   • Defense: ROSETok is trained in two stages with noise-augmented training plus Whisper semantic distillation; ROSETok-AAF reconstructs STOI 0.903 and FSC downstream score 77.9 under attack input, higher than StableToken's 35.0 (Table 4).
   • Authors' conclusion: Speech tokenizers are a key security bottleneck of modern speech foundation models, and defense should not stop at the whole-model level; the authors also note that the attack targets offline scenarios and ROSETok is not a complete defense against all semantic attacks.

   Collapse this answer

Related papers