The Instruction Hidden in the Input Path
This series examines the security of speech-driven large language models when an instruction can arrive through the physical acoustic channel rather than through a visible text box. Its opening question is where the security boundary really begins: at the transcript, at the model, or earlier, in the microphone that turns pressure in the air into data. The concrete understanding this supports is simple but consequential: a voice interface is not only a language system. It is an end-to-end input path, and each conversion along that path can change what the system is asked to do.
The focal attack study is SWhisper, a framework presented as a way to deliver covert, voice-compatible prompts through near-ultrasonic audio using commodity speakers and microphones. The related defensive study is NormDetect, which treats inaudible voice attacks as anomalies and learns patterns of benign audio instead of trying to enumerate every possible attack signature. They are not two measurements of the same outcome. SWhisper asks whether a hidden signal can carry an effective prompt into speech-driven systems; NormDetect asks whether a receiver can recognize that an input does not resemble normal benign speech. Their relationship makes the larger subject visible: the same acoustic boundary can be both an attack surface and a place for defense.
The boundary is wider than the transcript
A text-only interaction offers a visible object that people and software can inspect: the characters sent to a model, the system instructions that surround them, and the response that comes back. A speech-driven system inserts several transformations before the model makes its decision. Sound travels through an environment, reaches a microphone, becomes an electrical and then digital signal, and may be transcribed before it is passed to a language model. Other systems process raw audio more directly through an audio-native model. In either case, the model receives the result of a physical and computational pipeline, not an untouched human intention.
That distinction matters because each stage owns a different kind of state. The environment carries pressure waves. The microphone determines which portions of those waves become a recorded signal. A speech recognizer decides which words, if any, are present in that signal. An audio-native model may infer meaning without exposing a conventional transcript. Finally, the LLM or assistant applies its own policies and may connect the response to an action such as controlling a device, answering a question, or initiating a task. A failure at one stage does not automatically imply a failure at the next. A signal can be recovered accurately and still be refused; a model can behave unsafely even when the acoustic delivery itself was ordinary. Keeping those possibilities separate is essential to understanding the evidence.
The diagram also shows why “the model refused” is an incomplete security story. A policy check sits after capture and interpretation. If an attacker can influence the input before that check, the policy layer is still necessary, but it is no longer the only place where security must be considered. The system needs to know what entered, how the receiver transformed it, and what authority the resulting instruction has. That is a broader question than whether the final response contains a refusal phrase.
Speech interfaces make the question especially important because they are often used when attention is elsewhere. Voice interaction supports hands-free driving, home automation, accessibility, and on-device operation. These benefits also encourage systems to respond quickly and to treat a short acoustic event as an instruction. Spoken exchanges may not leave a user-visible record before execution, reducing the chance for someone to inspect the input or intervene. A hidden command does not need to persuade a person if it can reach the processing path that the assistant already trusts.
This does not mean that every voice assistant is automatically vulnerable, or that every inaudible sound becomes a command. The two studies do not establish either conclusion. They establish a narrower and more useful point: the acoustic interface deserves the same security attention as other input boundaries. Its behavior depends on physical hardware, software stages, environmental conditions, and the authority granted to the downstream system. Those dependencies determine both whether a covert prompt arrives intact and whether it can produce a consequential result.
When “inaudible” is not “absent”
Human hearing is not the same thing as machine sensing. An acoustic signal can be difficult for nearby listeners to notice while still interacting with a microphone’s physical components. The relevant phenomenon is microphone nonlinearity. An ideal microphone would respond proportionally to its input, preserving the intended frequencies without creating new ones. Real microphone front ends can behave differently when exposed to high-frequency excitation. Their nonlinear response can create additional frequency components, including components in the audible or speech-relevant range.
In an inaudible voice attack, the hidden content is carried on a high-frequency carrier. When the carrier reaches a nonlinear microphone, the interaction can produce a lower-frequency component that resembles the original voice signal. Later filtering may remove much of the high-frequency carrier while retaining this recovered baseband. The downstream speech recognizer or audio model can then receive something that was not audible as an ordinary command at the source. The key transition is therefore physical: the receiver changes the signal before the model evaluates it.
This is why calling the phenomenon “an LLM being tricked by silence” is misleading. There is no requirement that the microphone record nothing. Nor is the microphone merely a neutral window onto the room. It is an active part of the transformation. The recovered signal still has to pass through the rest of the interface, and the model still has to respond in the way the attacker wants. But a model-level safeguard cannot reason about an acoustic event it never observes as a distinct, trustworthy input. The boundary has already shifted before tokenization or response generation.
The receiver is also not uniform across products. The NormDetect study reports that ordinary speech recordings from different devices are comparatively similar in speech-relevant bands, while recordings of the same inaudible command can differ substantially from one device to another. The study attributes this contrast to differences in microphone frequency response, particularly outside the range for which microphones are commonly calibrated for speech and telecommunications. A command that is clear after one device’s transformation may be noisy, distorted, or poorly reconstructed after another’s.
That variability has two implications. For an attacker, it makes reliable delivery harder: the signal must survive a channel whose behavior depends on hardware and surroundings. For a defender, it makes a fixed signature less dependable: a feature learned from one microphone may not describe the same attack on another. Propagation adds more uncertainty through absorption, multipath, dispersion, distance, and angle. Small physical changes can alter the signal that reaches the receiver. The acoustic path is therefore not a single switch between “heard” and “unheard.” It is a variable transformation with success and failure conditions.
The practical security question is consequently not whether a high-frequency signal exists in the abstract. It is whether a system can be made to carry a semantically meaningful instruction through that transformation, under conditions where people do not reliably notice it, and whether a receiver or downstream control can identify and constrain it. Those are separate requirements. A demonstration that produces a short unintended command is not automatically a robust prompt-injection channel. Conversely, a strong model refusal does not prove that the physical input path is safe.
One attack study, one defensive question
SWhisper makes the attack problem explicit by combining two layers that are often discussed separately. Its case study is a jailbreak, but the underlying delivery mechanism is presented as more general: it can carry prompt-based commands whose meaning survives the acoustic path. The first layer concerns the prompt itself. A text attack must remain intelligible when spoken, fit within the short duration expected by voice interfaces, and transfer from an offline surrogate model to a black-box target. The second layer concerns the channel. The spoken waveform must remain recoverable after propagation, microphone capture, and nonlinear distortion. A successful result requires both layers to work together.
The SWhisper paper therefore treats inaudibility as only one property of a practical attack. The hidden prompt must preserve semantic content, and the target system must process it in a way that produces the measured undesirable behavior. This is a more demanding claim than simply placing energy outside the range of ordinary human hearing. It also explains why the paper emphasizes commodity hardware and a single-query setting: the threat model is intended to test whether a covert input can be useful under constraints that a real voice interface imposes, not merely whether a specialized laboratory instrument can generate an unusual waveform.
NormDetect approaches the same boundary from the opposite direction. Its authors observe that attack patterns are diverse because receivers are diverse, while benign speech provides a more stable reference. The proposed detector is trained on normal audio and uses reconstruction-based anomaly scoring. In broad terms, it tries to learn what ordinary inputs look like for the system, then flags inputs that cannot be represented as normal as easily. This does not make the detector omniscient. Noise, speech content, speakers, thresholds, unseen devices, and adaptive attackers still affect the result. But it changes the defensive question from “Which exact attack signature should be blocked?” to “What behavior should a benign receiver consistently recognize?”
The distinction between the studies should remain visible. SWhisper’s non-refusal and specific-convincing scores concern the response of tested models to harmful prompts; its word error rate concerns whether the spoken prompt remains intelligible; its user study concerns whether people can distinguish playback samples. NormDetect’s AUC, false-acceptance rate, false-rejection rate, latency, and successful defense rate concern classification and operational overhead. None of these numbers can stand in for the others. Together, however, they support a connected judgment: the security of a speech-driven LLM cannot be assessed at only one layer.
A responsible reading also keeps the evidence within its boundaries. The SWhisper results come from controlled experiments on selected open-source, commercial, and audio-native targets, with performance varying across models. The NormDetect results come from a large but still study-specific corpus and a defined set of devices and adaptive attacks. Neither paper evaluates every assistant, every microphone, every environment, or a complete production authorization stack. The studies make the acoustic input path impossible to dismiss as merely theoretical; they do not eliminate the need for deployment-specific testing.
The next question follows from the receiver itself. If microphone behavior can transform a barely noticeable signal into a machine-readable instruction, then understanding that transformation is the foundation for judging both the attack and the defense. The crucial boundary is not only between audible and inaudible sound. It is between what a person perceives, what a microphone reconstructs, what a model interprets, and what an application is permitted to do with the result.