CodecAttack: Constructing adversarial perturbations in the audio codec latent space to bypass lossy compression defenses

论文试图解决音频大模型（Audio LLM）在经过现实有损音频编解码信道传输时，外部对抗攻击难以存活并实现目标指令注入的问题。

• 场景与重要性：作者称语音正成为AI系统的主流交互接口，音频大模型广泛部署于消费级语音助手、企业客服中心、金融与医疗领域的智能体中。在这些实际部署场景中，音频在到达模型之前必然经过至少一次有损编解码器（如VoIP中的Opus/G.711、消息应用中的Ogg/Opus、流媒体中的AAC/MP3）。
• 现有方法的不足：既有音频对抗攻击在面对编解码压缩时存在缺陷。波形域攻击（如Sadasivan等人，2025）生成的扰动在经过轻度编解码压缩后即被滤除；而能够耐受压缩的内部表征攻击（如Ziv等人，2025）则要求攻击者在推理时修改受害模型内部的编码器隐藏状态，脱离了仅通过公开信道上传音频的现实设定。
• 核心观察与假设：作者认为过去的研究混淆了编解码器“丢弃什么”与“保留什么”。有损编解码器丢弃感知不重要的波形扰动，但编解码器保留的部分并非障碍，而是其主动传输的子空间；因此在神经编解码器自身的连续隐空间中构建的扰动，按其构造就属于编解码器旨在保留的信号类别。
• 威胁模型：
  • 攻击目标：实施目标注入（targeted injection），将隐藏命令嵌入正常载体音频（语音或音乐），迫使受害音频大模型输出攻击者指定的字符串（如转账确认、PIN码、虚假录用评语、版权标签等）。
  • 攻击者知识：拥有目标音频大模型及用于构建扰动的神经编解码器的白盒访问权限，用于离线梯度计算。
  • 攻击者能力：攻击者不修改目标模型的权重、架构或推理管线；通过全数字编解码信道传输音频，上传后无需与系统进行后续交互。
  • 受害系统：接收经有损编解码器（Opus、MP3、AAC、G.711或神经编解码器）压缩音频并执行下游操作的音频大模型系统。
• 提出的解决方案：作者提出了CodecAttack，在外部神经音频编解码器（EnCodec）的连续隐空间中优化扰动，并结合多码率直通估计（STE）的变换期望（EoT），生成无需修改受害模型即可穿透多种数字编解码器的对抗音频。

Adversarial attacks on speech transcription models

• Carlini & Wagner (2018), Yakura & Sakuma (2019), Schönherr et al. (2020), etc.—pursuing robustness of end-to-end waveform perturbations in the acoustic channel (room impulse response, speaker-microphone transfer function, ambient noise).
• Andronic et al. (2020) and WaveGuard (Hussain et al., 2021)—studied digital codec channels and used them as a defense; Andronic et al. showed that MP3 re-encoding can remove waveform perturbations against DeepSpeech, and WaveGuard turned this into a defense mechanism that detects transcription changes through a vocoder.

Jailbreak attacks on audio large models

• SpeechGuard (Peri et al., 2024), AudioJailbreak (Chen et al., 2026), Dingeto et al. (2026), etc.—by optimizing adversarial audio prefixes or suffixes to cause safety-aligned models to abandon refusal behavior and output harmful text. The authors note that these jailbreak works measure refusal suppression, while this paper focuses on target injection that forces the model to output a specified string.

Target injection attacks on audio large models

• Attacker's Noise (Sadasivan et al., 2025)—conducts injection attacks on audio large models in the waveform domain. The authors note that the paper's own ablation experiments show its perturbations are eliminated under moderate codec compression, and call neural audio codecs the "most effective defense."
• U-TLSA (Ziv et al., 2025) and WhisperInject (Dingeto et al., 2026)—perturb the hidden states or embeddings of the victim model's internal encoder. The authors note that this setting requires the attacker to modify the internal representations of the deployed model at inference time, making the attack assumption too strong.

Baseline methods and evaluation scenarios

• Baseline methods: The authors constructed a waveform-domain adversarial baseline (based on an extension of Carlini & Wagner, 2018, see Appendix E) using the same multi-rate Opus EoT training scheme, the same BPDA surrogate, the same two-stage warmup-hardening schedule, and the same Adam optimizer as CodecAttack, compared under matched clean-channel signal-to-noise ratio (SNR ≈5.8 dB).
• Evaluation scenarios: The paper replaced jailbreak benchmarks inherited from text LLMs and constructed three audio-video native deployment scenarios for voice agents: financial voice agent S1 (50 voice carriers), interview screening agent S2 (25 English + 24 Chinese carriers), and music industry classifier bypass S3 (40 S3a + 45 S3b carriers).

The authors position CodecAttack as an attack method in the literature that simultaneously satisfies the external attacker setting (no modification of victim model weights, architecture, or inference pipeline) and remains robust under various real codec compressions (Table 1).

The authors propose CodecAttack, which models adversarial perturbations in the continuous latent space of an external neural codec, and combines multi-bitrate straight-through estimation (STE) with expectation over transformation (EoT) and a two-stage alternating schedule to generate codec-robust adversarial audio.

Continuous Latent-Space Perturbation Modeling

• The EnCodec encoder maps a 24 kHz audio carrier x to continuous latent variables z = E(x) ∈ R^(d×F), where d is the latent dimension and F is the number of frames.
• Bypassing residual vector quantization (RVQ), a perturbation δ constrained by the infinity norm ϵ is applied directly to the continuous latent variables z, to avoid gradient truncation by discrete codebooks; true robustness is ensured through a subsequent re-encoding objective on the decoded waveform.
• The decoder D reconstructs the waveform from the latent variables, which is then fed into the target audio LLM f via a resampler R16k; the directly forward-propagated optimization objective is constrained within a ball of radius ϵ.

Straight-Through Estimation and Multi-Bitrate Expectation over Transformation (EoT)

• Opus's CELT/SILK quantization is implemented in C and is non-differentiable; the authors build a differentiable surrogate via a straight-through estimator (STE): C_b(x) = stop_grad(Opus_b(x) − x) + x whose forward pass executes the real lossy codec Opusb, and whose backward pass treats the codec as an identity mapping.
• To ensure the perturbation tolerates compression across the deployment bitrate range, the authors apply expectation over transformation (EoT) over the bitrate grid B = {16, 24, 32, 64, 128} kbps. At each step t, a single bitrate bt ~ Uniform(B) is sampled uniformly and the objective is optimized: ℒ_codec^(t) = ℒ_CE(f(R_16k(C_bt(D(z + δ)))), y^∗) A one-sentence explanation of the meaning: this objective computes the cross-entropy loss between the model output distribution and the target text y* through the compression surrogate at the sampled Opus bitrate, and sampling a single bitrate per step reduces computational cost compared to iterating over the grid.

Two-Stage Optimization Schedule with Warmup and Hardening

• Single-stage training with only the codec is unstable, because the STE gradient noise from passing through the real Opus codec at each step is large and convergence is slow.
• The algorithm uses a two-stage schedule: the first wS steps (with w=0.3 and total steps S=1000) optimize only the clean-channel cross-entropy loss to quickly establish a direct adversarial example; in the remaining (1-w)S steps, odd steps perform codec EoT updates to enhance compression resistance, and even steps perform clean-channel updates to prevent the perturbation from drifting away from the direct adversarial subspace.

Optimization Algorithm Details and Waveform Export

• Projected gradient descent (PGD) with the Adam optimizer is used, with learning rate α=0.2 and S=1000 optimization steps; after each step, the perturbation is projected back into the infinity-norm ball of radius ϵ.
• The EnCodec decoder is kept in training mode to instantiate the autograd state of its weight-normalized convolutions. After optimization, the adversarial audio waveform is reconstructed through the decoder and saved as a standard 24 kHz 16-bit PCM wav file, without attaching metadata outside the carrier.

Experimental Setup

• Models under test: Qwen2-Audio-7B-Instruct, Audio Flamingo 3 (AF3), Qwen2.5-Omni, a total of 3 open-source audio large models.
• Datasets and deployment scenarios: S1 financial voice agent (25 English bank call recordings, corresponding to 5 types of authorization bypass with a total of 50 target instructions); S2 interview screening agent (25 English and 24 Chinese unqualified interview recordings, with the target of forcing a hiring decision); S3 music industry classifier bypass (24 kHz music clips, including 40 AI-detection carriers for S3a and 45 copyright-classification carriers for S3b, with single-clause labels as targets).
• Comparison baseline: waveform-domain Carlini-Wagner adversarial baseline, trained with the same multi-bitrate Opus EoT, the same BPDA surrogate, the same warmup schedule, and the Adam optimizer, compared under matched SNR (SNR ≈5.8 dB) on the clean channel (Appendix E).
• Metrics and evaluation method: attack success rate (ASR), defined as the proportion of samples whose model output literally contains the target string (strict substring matching, compared after normalization via lowercasing, whitespace merging, and punctuation removal, not LLM-judge scoring); audio quality metrics include SNR, SI-SDR, PESQ-WB, STOI, ESTOI, LSD.
• Codec evaluation grid: training uses the Opus grid {16, 24, 32, 64, 128} kbps; evaluation includes held-out bitrate Opus 192 kbps, as well as cross-family held-out codecs MP3 and AAC-LC at their respective {64, 96, 128, 192} kbps.
• Perturbation budget and compute scale: the main experiment uses a latent-space perturbation budget of ϵ=1.0 (ablation includes 0.5 and 1.5); full evaluation costs approximately 350 GPU hours (NVIDIA A100 80GB).

Main Results

According to Table 3 (Qwen2.5-Omni cross-codec ASR at ϵ=1.0, %):

Swipe horizontally to read the table

Evaluation scenario	Clean channel	Opus 64k	Opus 128k	MP3 128k	AAC-LC 128k
S1 (financial voice)	82.0	76.0	82.0	82.0	66.0
S2 (English interview)	84.0	84.0	84.0	84.0	76.0
S2 (Chinese interview)	20.8	20.8	20.8	20.8	20.8
S3a (AI detection)	95.0	87.5	92.5	85.0	65.0
S3b (copyright classification)	100.0	93.3	100.0	100.0	84.4

• Codec resistance and cross-codec transfer: the authors report that on the training codec Opus, all English scenarios achieve ASR of at least 76.0% at ≥64 kbps (S3b reaches 100.0%); near-lossless transfer is achieved on the untrained MP3 (S3b reaches 100.0% at 128 kbps).
• Carrier type and system prompt alignment effects: a carrier-type effect appears under AAC-LC, with music carriers (S3b reaches 84.4%) retaining higher rates than voice carriers (S1 at 66.0%); Chinese interview carriers drop to 20.8% ASR when facing English system prompts due to lack of language alignment.
• Task difficulty differences across scenarios: S3's single-clause decision targets are the easiest to inject, S1's character-sensitive bank commands are the hardest, and S2 falls in between.

Latent-Space vs. Waveform Baseline Comparison

• What was tested: in the S1 scenario of Qwen2-Audio (n=50, matched SNR ≈5.8 dB), the latent-space attack trained with the same Opus EoT was compared against the waveform baseline (Table 2, Table 7).
• Results: at Opus 64 kbps, the latent-space attack achieves 80.0% ASR, while the waveform baseline achieves 24.0%; the waveform baseline never exceeds 26.0% at any bitrate; on held-out MP3, the latent-space attack maintains 74.0%–90.0%, while the waveform baseline achieves 22.0%–24.0% (Table 2). At low bitrates (16–32 kbps), the latent-space attack reaches 50.0% at Opus 32 kbps, while the waveform baseline reaches only 16.0% (Table 7).
• Authors' interpretation: the authors state that with training recipe, optimizer, and budget fully controlled, the performance gap indicates that codec robustness depends on the parameterization space of the perturbation, not the optimization procedure.

Cross-Neural-Codec Architecture Generalization and Audio Quality

• What was tested: CodecAttack was re-instantiated on two neural codecs with different architectures, Mimi and DAC (S3b task, Qwen2.5-Omni, n=19), and audio quality was evaluated (Table 4, Table 5).
• Results: latent-space perturbations generated by all three codecs survive compression (Table 4). At Opus 128 kbps, EnCodec reaches 100.0%, Mimi reaches 36.8% (limited by the clean-channel ceiling of 36.8% after removing the projection layer), and DAC reaches 36.8%. In audio quality, DAC-generated adversarial examples have the best quality (PESQ-WB 3.16, SNR 13.73 dB), Mimi is the most costly (PESQ-WB 1.95, LSD 9.35 dB), and EnCodec is in between (PESQ-WB 1.90, LSD 5.86 dB) (Table 5).
• Authors' interpretation: the authors state that latent-space perturbation tolerance to compression is not unique to EnCodec but a shared property of neural codecs; the DAC result indicates that higher audio quality operating points exist on codecs with lower projector loss.

Spectral Placement and Encoder Residual Mechanism Analysis

• What was tested: frequency-band energy distributions of latent-space and waveform perturbations, the decoder Jacobian, and normalized encoder drift R under AAC-LC compression were analyzed (Figure 3, Figure 7, Table 6).
• Results: the latent-space attack concentrates 88.4% of perturbation energy below 4 kHz (Figure 9), all 128 latent dimensions of the EnCodec decoder peak at 1.8–2.5 kHz with almost no energy above 4 kHz (Figure 6); the adversarial loss further pushes 42% of energy below 400 Hz (random latent variables have only 21%, Figure 3). Under AAC-LC, music carriers have 1.4 times more energy below 400 Hz than voice carriers (Figure 7), with correspondingly lower encoder drift R (0.060 for music vs. 0.103 for voice on Qwen2-Audio, Table 6).
• Authors' interpretation: the authors state that latent-space perturbations survive because their energy distribution aligns with the low-frequency region where the codec allocates bits, while waveform attacks fail because energy is scattered into discarded high frequencies; the broadband low-frequency energy of music carriers raises the psychoacoustic masking threshold of AAC-LC, thereby preserving more perturbation.

Other Ablations and Analyses

• Multi-bitrate EoT training ablation: without EoT, ASR drops to 0.0% at Opus ≤32 kbps, and from 47.5% to 15.0% at AAC-LC 64k (Figure 4).
• Target text length effect: on S3a music carriers, target lengths of ≤8 words saturate at 3/3 across all bitrates, decline gradually at 15–20 words, and at 32 words the PGD loss rises about 5-fold (from 0.011 to 0.052, Figure 5).
• Perturbation budget ϵ ablation: in the S1 scenario on Qwen2-Audio, as ϵ increases from 0.5 to 1.0 and 1.5, clean-channel ASR rises from 58.0% to 88.0% and 92.0%, and Opus 64k ASR rises from 48.0% to 80.0% and 92.0% (Table 8).
• Language alignment ablation: after switching the S2 scenario to Chinese carriers, Qwen2-Audio at ϵ=1.0 drops from 92.0% to 29.2% ASR on the clean channel and from 88.0% to 20.8% at Opus 64k (Table 9, Table 10).
• Audio quality and budget trade-off: for voice carriers (S1) at ϵ=0.5, 1.0, 1.5, PESQ-WB is 2.63, 1.69, 1.33, and STOI is 0.959, 0.904, 0.847, respectively (Table 12).

Negative Results and Exceptions

• Under the AAC-LC channel, when the input is a voice carrier (S1), Qwen2-Audio and AF3 both drop to ≤2.0% ASR at ϵ=1.0 (Table 8), while Qwen2.5-Omni still maintains 54.0%–66.0%; the authors attribute this to voice exceeding the 0.09 threshold of normalized encoder drift R under AAC-LC (Table 6), as well as Qwen2.5-Omni's broader audio training distribution.
• AF3 performs poorly on S1's complex multi-clause bank instruction targets (only 44.0% ASR on the clean channel and 48.0% at Opus 128k at ϵ=1.0, Table 8), but reaches 97.5%–100.0% on S3's single-clause targets (Table 11); the authors attribute this to target text complexity rather than model architecture deficiencies.

Limitations and Future Directions Noted by the Authors

• Model-specific optimization and cross-model transfer: in Section 6.2, the authors note that adversarial perturbations generated for a single victim model cannot transfer to other models without re-optimization; a future direction is to explore ensemble-victim optimization, averaging losses over multiple candidate models to improve generality.
• Lack of dedicated defense evaluation against latent-space attacks: in Section 6.2, the authors note that traditional codec-based defenses are directly bypassed by this attack; the authors list potential defense directions against latent-space attacks, including adversarial training, detection via resynthesis with codecs of different architectures, and input randomization at the audio preprocessing layer, but systematic evaluation against adaptive attackers is left for future work.
• Small sample size in target-length evaluation: in Section 5.4, the authors note that in the target-length capacity ablation, only 3 samples were tested per length (n=3), and the small sample size limits confidence in conclusions about the failure boundary between word count and bitrate.

Experimental Coverage

• Target models tested: evaluation covers Qwen2-Audio-7B-Instruct, Audio Flamingo 3, and Qwen2.5-Omni, a total of 3 open-source audio large models, all with white-box single-model optimization; black-box commercial models and multi-model ensemble optimization were not tested.
• Application scenarios and audio carriers: evaluation covers financial customer service (S1, 25 English recordings), interview screening (S2, 25 English and 24 Chinese recordings), and music detection (S3, 40 S3a and 45 S3b music clips); target instruction lengths in the main experiment are all within 20 words.
• Codec channel coverage: training optimization uses only 5 Opus bitrates (16, 24, 32, 64, 128 kbps); test channels include Opus 192 kbps and 4 bitrates each of MP3 and AAC-LC (64, 96, 128, 192 kbps); transmission is fully digital, without an over-the-air acoustic channel.
• Neural codec parameterization: the main experiment optimizes perturbations entirely in EnCodec's (24 kHz) continuous latent space; cross-architecture generalization experiments cover Mimi and DAC on a 19-sample subset of the S3b scenario.
• Unreported and unevaluated information: evaluation uses strict substring matching, and the paper does not report the actual end-to-end completion rate of downstream automated tool invocation; in the AAC-LC encoder residual analysis, AF3's intermediate embedding drift values are not reported due to runtime environment compatibility issues (Section D.1).

CodecAttack is a study of codec-robust adversarial injection attacks against audio large language models (Audio LLMs).

• Problem framing: in real voice agent deployments, audio necessarily passes through lossy codecs (e.g., Opus, MP3, AAC). Existing waveform-domain adversarial perturbations are easily eliminated during compression, making it difficult for external attackers to penetrate real channels and perform targeted instruction injection without modifying the victim model.
• Core method: the authors find that lossy codecs discard waveform perturbations while actively preserving their own latent-space representations, and accordingly propose constructing perturbations in the continuous latent space of the external neural codec EnCodec; using a straight-through estimator (STE) combined with expectation over transformation (EoT) over multi-bitrate Opus, and a two-stage optimization schedule with warmup and alternating hardening, they generate adversarial waveforms without modifying the victim model.
• Main experimental results:
  1. In the S1 financial scenario of Qwen2-Audio, CodecAttack achieves 88.0% ASR at Opus 128 kbps and 88.0% at MP3 128 kbps under matched SNR (≈5.8 dB), while the waveform baseline trained with the same EoT never exceeds 26.0% at any bitrate (Table 2).
  2. Across three target models and three real deployment scenarios, CodecAttack achieves an average ASR of 85.5% at medium Opus bitrates and maintains lossless transfer of 74.0%–90.0% on held-out MP3 (Table 3).
  3. In the S3 music industry scenario, target instruction injection reaches up to 100.0% ASR on Opus and MP3; re-instantiation on the architecturally different Mimi and DAC codecs still verifies the compression survivability of latent-space perturbations (Table 4).
  4. Spectral analysis shows that the EnCodec decoder structurally confines perturbations below 4 kHz, and the adversarial loss concentrates 42% of energy below 400 Hz, where the codec allocates the most bits, thereby achieving compression robustness (Figure 3).
• Authors' conclusions and implications: the authors argue that codec robustness is an inherent property of the perturbation parameterization space, not a product of the optimization procedure; lossy audio compression, rather than serving as a reliable barrier against adversarial audio, constitutes an attack surface that is easily exploited.