Pith. sign in

REVIEW 4 major objections 4 minor 152 references

Investigating Vulnerabilities and Defenses Against Audio-Visual Attacks: A Comprehensive Survey Emphasizing Multimodal Models

T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This survey paper claims to be the first unified review of adversarial, backdoor, and jailbreak attacks on audio-visual models, with special attention to the newest multimodal large language models.

desk verdict A useful but under-audited survey: the unified adversarial/backdoor/jailbreak framing is genuinely new, but the scope is overstated and the citation errors need fixing before the tables can be trusted. read the letter →

arxiv 2506.11521 v1 pith:4MTYIV3B submitted 2025-06-13 cs.CR cs.AIcs.MM

Jinming Wen , Xinyi Wu , Shuai Zhao , Yanhao Jia , Yuwen Li This is my paper
classification cs.CRcs.AIcs.MM
keywords audio-visualsecurityadversarialattacksbackdoorjailbreakmultimodallargelanguagemodelsdefensemechanismssurvey
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper is a survey that sets out to unify three attack literatures—adversarial perturbations, backdoor triggers, and jailbreak prompts—under one framework for audio-visual models, with special attention to multimodal large language models (MLLMs). It argues that earlier reviews each covered a single attack type and ignored the latest MLLMs, leaving no map of the full threat surface. The paper organizes published methods into attack taxonomies and defense categories (sample detection, optimization, purification), and it reports that defenses against jailbreak attacks in the audio-visual domain are essentially absent. If the coverage is faithful, a reader gets a reliable index of what can break an audio-visual model and where the open problems are.

What carries the argument

The organizing device is a three-part attack taxonomy (adversarial, backdoor, jailbreak) matched with a three-part defense taxonomy (sample detection, optimization, purification), tied together by formal definitions in Equations 1–8. Each attack is cast as an optimization over a perturbation or query subject to a bounded-distortion constraint, and each is evaluated with the same attack-success-rate metric. The survey's tables map individual methods to their capabilities, attacker knowledge, target models, and tasks, which is what allows unimodal speech attacks and MLLM attacks to be compared in one language.

What would settle it

A documented, reproducible search of the literature that recovers audio-visual MLLM attack papers absent from Tables 1–4, or that shows most tabulated systems are unimodal speech recognizers, would falsify the claim of being the first comprehensive unified review.

Watch

Extended reading notes

Core claim

The central claim is that audio-visual model security becomes understandable only when adversarial attacks, backdoor attacks, and jailbreak attacks are treated together, and that prior surveys failed to do this. The paper defines each attack class with a shared formal frame: a constrained manipulation of an audio input that makes the model output an incorrect or unsafe result, measured by attack success rate. It then extends the same lens to the newest audio-visual-based MLLMs, where it finds that imperceptible perturbations and malicious audio queries can bypass built-in safety mechanisms. On the defense side, it groups existing work into sample detection, optimization, and purification, and identifies the absence of jailbreak-specific defenses as the clearest gap.

Load-bearing premise

The survey's coverage claim rests on the papers in Tables 1–4 being a representative sample, chosen without a documented search protocol or inclusion criteria; if that selection is biased, the 'first comprehensive unified review' claim loses most of its force.

Editorial extensions

If this is right

  • A unified taxonomy lets defense ideas travel across attack types; purification approaches from adversarial and backdoor settings are the most plausible starting point for the missing jailbreak defenses.
  • Because the latest MLLMs can be manipulated through audio instructions, safety evaluations of these models should include audio and visual channels, not just text.
  • As models grow, fine-tuning-based backdoor attacks become impractical, so no-fine-tuning attacks using poisoned instructions or in-context learning are the likely next wave.
  • The survey's gap analysis points to a concrete research target: develop jailbreak defenses for audio-visual tasks, possibly by adapting text and image defense strategies.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The 'first comprehensive unified review' claim is only as strong as the undocumented selection behind the tables, which include many unimodal speech systems; a systematic search protocol would be the natural way to test it.
  • If the taxonomy holds, it should transfer to other multimodal pairings such as image-text or video-text, where the same three attack classes are already emerging.
  • The paper's own observation that jailbreak defenses are absent suggests a practical experiment: adapt a text-domain jailbreak defense to audio prompts and measure whether attack success rates drop.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. This manuscript is a survey of security vulnerabilities in audio-visual-based multimodal models, covering adversarial attacks, backdoor attacks, and jailbreak attacks, along with defenses. It presents formal definitions in Section 2, taxonomies and summary tables in Sections 3-7, applications in Section 8, and challenges/trends in Section 9. The paper claims to be the first comprehensive and unified review of these attack types for audio-visual models, with particular emphasis on multimodal large language models (MLLMs) such as GPT-4o.

Significance. If the survey's coverage and references are reliable, it would be a useful entry point for researchers working on audio-visual model security, especially because it brings together three attack families and discusses MLLM-specific attacks that earlier surveys largely omit. The paper also compiles a large set of representative methods, datasets, and evaluation metrics, and it identifies several plausible research gaps, such as fine-tuning-free backdoor attacks and defenses against jailbreak attacks. Its value is currently conditional: the absence of a documented selection methodology and several concrete citation/scope errors make the 'first comprehensive unified review' claim difficult to verify and weaken the paper's utility as a reference guide.

major comments (4)
  1. [Section 1, Tables 1 and 2] The scope of the survey is internally inconsistent. Section 1 states that 'we consider only multimodal models that involve audio-visual modalities' and defines audio-visual tasks as involving 'audio, video, and speech.' Yet Tables 1 and 2 are dominated by unimodal audio systems: Speech Recognition, Speaker Recognition, Speech Classification, and Wake-word Detection, with models such as Wave-U-Net, LSTM, RNN, and DeepSpeech. These are not multimodal audio-visual models under the paper's own definition. The authors need to either narrow the claim to 'audio-centric and audio-visual models' or justify why unimodal audio systems are included in a review whose central contribution is unification of audio-visual security. This is load-bearing because the 'first comprehensive review of audio-visual models' claim depends on the surveyed works actually being in scope.
  2. [Table 2, Section 4.1] Several table-to-text citation mismatches undermine the reliability of the survey as a reference. In Table 2, the method 'PALETTE' is cited as [131], but Section 4.1 attributes PALETTE to Gong et al. [33], and reference [131] is actually Ze et al. (UltraBD). Similarly, Table 2 lists 'Aliasing [62]' with Task 'Speech Recognition' and Model 'Vision Transformers,' but reference [62] is Lee et al.'s aliasing backdoor attack on pretrained vision transformers in the image domain, not a speech recognition attack. These errors break the correspondence between the summary tables and the reference list, and they must be corrected before the paper can serve as a trustworthy survey.
  3. [Table 4, Section 7.1] The defense tables also contain citation mismatches. Table 4 assigns WaveGuard to reference [23], while Section 7.1 describes WaveGuard as introduced by Hussain et al. [44]; reference [23] is actually Du et al.'s unified detection framework. In addition, Table 4 lists 'Sniper [35]' as a sample-detection defense, but reference [35] is Guo et al.'s MasterKey paper, which is described in Section 4.1 as a backdoor attack. The paper should verify every row of Tables 1-4 against the cited reference and the surrounding text, since a survey's primary value is accurate attribution.
  4. [Section 1, Sections 9-10] The paper nowhere documents a search protocol, inclusion criteria, or date range for the surveyed literature. The claim of being 'the first to provide a comprehensive review of the security of audio-visual models' is therefore impossible to audit: the reader cannot tell which venues, databases, or time periods were covered, why certain works were included while other closely related ones were omitted, or how the selection relates to prior surveys [61, 119, 134] beyond a brief mention. A survey making a 'first comprehensive' claim should include a methodology subsection stating the search sources, keywords, inclusion/exclusion criteria, and screening process. Without this, the central contribution of comprehensiveness is unverified.
minor comments (4)
  1. [Section 2.4, Eq. (9)] The text preceding Eq. (9) says the attack success rate is the 'proportion of incorrect predictions,' but the formula counts cases where f(x') equals y_target; for a targeted attack y_target is the desired erroneous label, so the wording should be 'proportion of inputs successfully misclassified to the target label,' and for untargeted attacks a different definition is needed.
  2. [Section 8, Dataset paragraph] There is a typo in 'Luong et al. [78] hconstruct LlamaPartialSpoof'; 'hconstruct' should be 'construct.'
  3. [Title page] The header shows 'Jinmig Wen' while the author affiliation block lists 'Jinming Wen'; the spelling should be consistent.
  4. [Table 2, Aliasing row] Even if the reference were correct, listing Task as 'Speech Recognition' with Model 'Vision Transformers' is internally confusing; an image-domain backdoor on vision transformers cannot be a speech recognition attack without substantial explanation.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation; the survey's claims are framing claims and its self-citations are not load-bearing.

full rationale

This is a survey paper, not a derivation; there are no fitted parameters, no predictions from a model, and no equations whose output is secretly an input. The formal definitions in Section 2 (Eqs. 1-10) are standard definitions of adversarial, backdoor, and jailbreak attacks, and they are not derived from the survey's own conclusions. The backdoor definition is introduced with 'Following Zhao et al.'s work [139]', which is a prior survey by co-author Shuai Zhao; however, the assumption that the attacker can access the training dataset or training process is a standard threat-model assumption, and the cited survey is not the only support for the taxonomy. Other self-citations ([138], [140], [142]-[145]) appear as examples, pointers to related work, or illustrations of research trends, not as premises that make the 'first comprehensive unified review' claim true by construction. The claimed novelty is a scope-and-framing assertion: the paper defines audio-visual tasks to include audio, video, and speech, and it surveys adversarial, backdoor, and jailbreak attacks together. Whether that claim is accurate is a completeness and correctness question, not a circularity one. The mismatch between the stated multimodal scope and some unimodal audio entries in Tables 1-3 concerns scope consistency and reference accuracy, but it does not reduce any derived claim to its own inputs. I therefore find no circular step.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

This survey introduces no fitted constants, new entities, or mathematical axioms. The only assumptions that matter are scope and selection assumptions: the grouping of audio-only, video, and speech under one 'audio-visual' label, and the representativeness of the papers chosen for the tables. These are listed as domain_assumption entries.

assumptions (3)
  • domain assumption Audio, video, and speech tasks are treated as a single 'audio-visual' domain, including unimodal audio models.
    The Section 1 footnote redefines audio-visual to include audio, video, and speech, which lets the survey include many unimodal ASR and speaker-recognition papers under the audio-visual umbrella. If that grouping is not accepted, the 'unified' scope is much narrower.
  • domain assumption The cited papers are representative and sufficient for the survey's comprehensiveness claim.
    No search protocol, inclusion criteria, date range, or quality filter is given; Tables 1-4 are presented as comprehensive, so the claim depends on an unstated selection assumption.
  • domain assumption Attacks and defenses designed for older or audio-only models transfer or inform the security analysis of audio-visual MLLMs.
    Sections 3-7 summarize many non-MLLM works and then Section 9 generalizes their lessons to MLLMs. The survey assumes this extrapolation is valid without a dedicated argument.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Investigating Vulnerabilities and Defenses Against Audio-Visual Attacks: A Comprehensive Survey Emphasizing Multimodal Models." pith.science (2026). https://pith.science/paper/4MTYIV3B

@misc{pith2026250611521,
  author       = {Pith},
  title        = {Pith review of: Investigating Vulnerabilities and Defenses Against Audio-Visual Attacks: A Comprehensive Survey Emphasizing Multimodal Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4MTYIV3B}},
  note         = {Machine review of arXiv:2506.11521}
}
read the original abstract

Multimodal large language models (MLLMs), which bridge the gap between audio-visual and natural language processing, achieve state-of-the-art performance on several audio-visual tasks. Despite the superior performance of MLLMs, the scarcity of high-quality audio-visual training data and computational resources necessitates the utilization of third-party data and open-source MLLMs, a trend that is increasingly observed in contemporary research. This prosperity masks significant security risks. Empirical studies demonstrate that the latest MLLMs can be manipulated to produce malicious or harmful content. This manipulation is facilitated exclusively through instructions or inputs, including adversarial perturbations and malevolent queries, effectively bypassing the internal security mechanisms embedded within the models. To gain a deeper comprehension of the inherent security vulnerabilities associated with audio-visual-based multimodal models, a series of surveys investigates various types of attacks, including adversarial and backdoor attacks. While existing surveys on audio-visual attacks provide a comprehensive overview, they are limited to specific types of attacks, which lack a unified review of various types of attacks. To address this issue and gain insights into the latest trends in the field, this paper presents a comprehensive and systematic review of audio-visual attacks, which include adversarial attacks, backdoor attacks, and jailbreak attacks. Furthermore, this paper also reviews various types of attacks in the latest audio-visual-based MLLMs, a dimension notably absent in existing surveys. Drawing upon comprehensive insights from a substantial review, this paper delineates both challenges and emergent trends for future research on audio-visual attacks and defense.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

152 extracted references · 54 canonical work pages

  1. [61]

    Journal of Systems Architecture 127, 102526 (2022)

    Lan, J., Zhang, R., Yan, Z., Wang, J., Chen, Y., Hou, R.: Adversarial attacks and defenses in speaker recognition systems: A survey. Journal of Systems Architecture 127, 102526 (2022)

    2022

  2. [119]

    ACM Computing Surveys 57(3), 1--35 (2024)

    Yan, B., Lan, J., Yan, Z.: Backdoor attacks against voice recognition systems: A survey. ACM Computing Surveys 57(3), 1--35 (2024)

    work page 2024

  3. [62]

    In: 32nd USENIX Security Symposium (USENIX Security 23)

    Lee, Y., Chen, K., Meng, G., Lv, P., et al.: Aliasing backdoor attacks on pre-trained models. In: 32nd USENIX Security Symposium (USENIX Security 23). pp. 2707--2724 (2023)

    2023

  4. [131]

    In: 2022 IEEE 28th International Conference on Parallel and Distributed Systems (ICPADS)

    Ze, J., Li, X., Cheng, Y., Ji, X., Xu, W.: Ultrabd: Backdoor attack against automatic speaker verification systems via adversarial ultrasound. In: 2022 IEEE 28th International Conference on Parallel and Distributed Systems (ICPADS). pp. 193--200. IEEE (2023)

    work page 2023

  5. [33]

    IEEE Transactions on Dependable and Secure Computing 21(4), 2672--2685 (2023)

    Gong, X., Fang, Z., Li, B., Wang, T., Chen, Y., Wang, Q.: Palette: Physically-realizable backdoor attacks against video recognition models. IEEE Transactions on Dependable and Secure Computing 21(4), 2672--2685 (2023)

    2023

  6. [23]

    In: Proceedings of the 28th ACM International Conference on Multimedia

    Du, X., Pun, C.M., Zhang, Z.: A unified framework for detecting audio adversarial examples. In: Proceedings of the 28th ACM International Conference on Multimedia. pp. 3986--3994 (2020)

    2020

  7. [44]

    In: 30th USENIX security symposium (USENIX Security 21)

    Hussain, S., Neekhara, P., Dubnov, S., McAuley, J., Koushanfar, F.: Waveguard: Understanding and mitigating audio adversarial examples. In: 30th USENIX security symposium (USENIX Security 21). pp. 2273--2290 (2021)

    2021

  8. [139]

    Transactions on Machine Learning Research (2025)

    Zhao, S., Jia, M., Guo, Z., Gan, L., XU, X., Wu, X., Fu, J., Yichao, F., Pan, F., Luu, A.T.: A survey of recent backdoor attacks and defenses in large language models. Transactions on Machine Learning Research (2025)

    work page 2025

  9. [35]

    In: Proceedings of the 29th Annual International Conference on Mobile Computing and Networking

    Guo, H., Chen, X., Guo, J., Xiao, L., Yan, Q.: Masterkey: Practical backdoor attack against speaker verification systems. In: Proceedings of the 29th Annual International Conference on Mobile Computing and Networking. pp. 1--15 (2023)

    2023

Show all 152 references
  1. [1]

    arXiv preprint arXiv:1908.03173 (2019)

    Abdoli, S., Hafemann, L.G., Rony, J., Ayed, I.B., Cardinal, P., Koerich, A.L.: Universal adversarial audio perturbations. arXiv preprint arXiv:1908.03173 (2019)

    2019 arXiv

  2. [2]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Al Kader Hammoud, H.A., Liu, S., Alkhrashi, M., Albalawi, F., Ghanem, B.: Look listen and attack: Backdoor attacks against video action recognition. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 3439--3450 (2024)

    2024

  3. [3]

    arXiv preprint arXiv:2409.12553 (2024)

    Bartolini, J., Stoyanov, T., Giaretta, A.: Hidden in plain sound: Environmental backdoor poisoning attacks on whisper, and mitigations. arXiv preprint arXiv:2409.12553 (2024)

    2024 arXiv

  4. [4]

    arXiv preprint arXiv:2211.08697 (2022)

    Cai, H., Zhang, P., Dong, H., Xiao, Y., Ji, S.: Pbsm: backdoor attack against keyword spotting based on pitch boosting and sound masking. arXiv preprint arXiv:2211.08697 (2022)

    2022 arXiv

  5. [5]

    arXiv preprint arXiv:2212.10103 (2022)

    Cai, H., Zhang, P., Dong, H., Xiao, Y., Ji, S.: Vsvc: backdoor attack against keyword spotting based on voiceprint selection and voice conversion. arXiv preprint arXiv:2212.10103 (2022)

    2022 arXiv

  6. [6]

    IEEE Transactions on Information Forensics and Security (2024)

    Cai, H., Zhang, P., Dong, H., Xiao, Y., Koffas, S., Li, Y.: Towards stealthy backdoor attacks against speech recognition via elements of sound. IEEE Transactions on Information Forensics and Security (2024)

    2024

  7. [7]

    In: Proceedings of the 32nd ACM International Conference on Multimedia

    Cai, Z., Ghosh, S., Adatia, A.P., Hayat, M., Dhall, A., Gedeon, T., Stefanov, K.: Av-deepfake1m: A large-scale llm-driven audio-visual deepfake dataset. In: Proceedings of the 32nd ACM International Conference on Multimedia. pp. 7414--7423 (2024)

    2024

  8. [8]

    In: 2018 IEEE Security and Privacy Workshops (SPW)

    Carlini, N., Wagner, D.: Audio adversarial examples: Targeted attacks on speech-to-text. In: 2018 IEEE Security and Privacy Workshops (SPW). pp. 1--7. IEEE (2018)

    2018

  9. [9]

    In: 2020 25th Asia and South Pacific Design Automation Conference (ASP-DAC)

    Chang, K.H., Huang, P.H., Yu, H., Jin, Y., Wang, T.C.: Audio adversarial examples generation with recurrent neural networks. In: 2020 25th Asia and South Pacific Design Automation Conference (ASP-DAC). pp. 488--493. IEEE (2020)

    2020

  10. [10]

    IEEE Transactions on Dependable and Secure Computing 20(5), 3970--3987 (2022)

    Chen, G., Zhao, Z., Song, F., Chen, S., Fan, L., Wang, F., Wang, J.: Towards understanding and mitigating audio adversarial examples for speaker recognition. IEEE Transactions on Dependable and Secure Computing 20(5), 3970--3987 (2022)

    2022

  11. [11]

    IEEE Transactions on Artificial Intelligence 5(3), 1302--1315 (2023)

    Chen, H., Zhang, J., Chen, K., Zhang, W., Yu, N.: Model access control based on hidden adversarial examples for automatic speech recognition. IEEE Transactions on Artificial Intelligence 5(3), 1302--1315 (2023)

    2023

  12. [12]

    IEEE Transactions on Information Forensics and Security 19, 1948--1962 (2023)

    Chen, M., Lu, L., Yu, J., Ba, Z., Lin, F., Ren, K.: Advreverb: Rethinking the stealthiness of audio adversarial examples to human perception. IEEE Transactions on Information Forensics and Security 19, 1948--1962 (2023)

    2023

  13. [13]

    In: 33rd USENIX Security Symposium (USENIX Security 24)

    Chen, M., Xu, X., Lu, L., Ba, Z., Lin, F., Ren, K.: Devil in the room: triggering audio backdoors in the physical world. In: 33rd USENIX Security Symposium (USENIX Security 24). pp. 7285--7302 (2024)

    2024

  14. [14]

    In: Proceedings of the 20th ACM Conference on Embedded Networked Sensor Systems

    Chen, Q., Chen, M., Lu, L., Yu, J., Chen, Y., Wang, Z., Ba, Z., Lin, F., Ren, K.: Push the limit of adversarial example attack on speaker recognition in physical domain. In: Proceedings of the 20th ACM Conference on Embedded Networked Sensor Systems. pp. 710--724 (2022)

    2022

  15. [15]

    In: GLOBECOM 2023-2023 IEEE Global Communications Conference

    Chen, Y.W., Ke, B.H., Chen, B.Z., Chiu, S.R., Tu, C.W., Kuo, J.J.: Knowledge distillation based defense for audio trigger backdoor in federated learning. In: GLOBECOM 2023-2023 IEEE Global Communications Conference. pp. 4271--4276. IEEE (2023)

    2023

  16. [16]

    In: Proceedings of the 2024 IEEE Symposium on Security and Privacy (SP)

    Cheng, P., Wang, Y., Huang, P., Ba, Z., Lin, X., Lin, F., Lu, L., Ren, K.: Alif: Low-cost adversarial audio attacks on black-box speech platforms using linguistic features. In: Proceedings of the 2024 IEEE Symposium on Security and Privacy (SP). pp. 1628--1645. IEEE (2024)

    2024

  17. [17]

    arXiv e-prints pp

    Chiu, C.W., Huang, L., Li, B., Chen, H.: Do as i say not as i do': A semi-automated approach for jailbreak prompt attack against multimodal llms. arXiv e-prints pp. arXiv--2502 (2025)

    2025

  18. [18]

    IEEE Access (2024)

    Choi, H., Jung, J.H., Yoon, J.W.: Ghost in the radio: An audio adversarial attack using environmental noise through radio. IEEE Access (2024)

    2024

  19. [19]

    arXiv preprint arXiv:2402.05668 (2024)

    Chu, J., Liu, Y., Yang, Z., Shen, X., Backes, M., Zhang, Y.: Comprehensive assessment of jailbreak attacks against llms. arXiv preprint arXiv:2402.05668 (2024)

    2024 arXiv

  20. [20]

    arXiv preprint arXiv:2311.07919 (2023)

    Chu, Y., Xu, J., Zhou, X., Yang, Q., Zhang, S., Yan, Z., Zhou, C., Zhou, J.: Qwen-audio: Advancing universal audio understanding via unified large-scale audio-language models. arXiv preprint arXiv:2311.07919 (2023)

    2023 arXiv

  21. [21]

    In: Proceedings of the 1st ACM Workshop on Large AI Systems and Models with Privacy and Safety Analysis

    Dou, Z., Hu, X., Yang, H., Liu, Z., Fang, M.: Adversarial attacks to multi-modal models. In: Proceedings of the 1st ACM Workshop on Large AI Systems and Models with Privacy and Safety Analysis. pp. 35--46 (2023)

    2023

  22. [22]

    IEEE Transactions on Multimedia 24, 4381--4393 (2021)

    Du, X., Pun, C.M.: Robust audio patch attacks using physical sample simulation and adversarial patch noise generation. IEEE Transactions on Multimedia 24, 4381--4393 (2021)

    2021

  23. [24]

    Artificial Intelligence Review 57(8), 218 (2024)

    Du, X., Zhang, Q., Zhu, J., Liu, X.: Adaptive unified defense framework for tackling adversarial audio attacks. Artificial Intelligence Review 57(8), 218 (2024)

    2024

  24. [25]

    IEEE Transactions on Information Forensics and Security 15, 2147--2159 (2019)

    Esmaeilpour, M., Cardinal, P., Koerich, A.L.: A robust approach for securing audio classification against adversarial attacks. IEEE Transactions on Information Forensics and Security 15, 2147--2159 (2019)

    2019

  25. [26]

    arXiv preprint arXiv:2409.06666 (2024)

    Fang, Q., Guo, S., Zhou, Y., Ma, Z., Zhang, S., Feng, Y.: Llama-omni: Seamless speech interaction with large language models. arXiv preprint arXiv:2409.06666 (2024)

    2024 arXiv

  26. [27]

    In: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security

    Fang, Z., Wang, T., Zhao, L., Zhang, S., Li, B., Ge, Y., Li, Q., Shen, C., Wang, Q.: Zero-query adversarial attack on black-box automatic speech recognition systems. In: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security. pp. 630--644 (2024)

    2024

  27. [28]

    arXiv preprint arXiv:2501.11902 (2025)

    Farooq, M.U., Khan, A., Uddin, K., Malik, K.M.: Transferable adversarial attacks on audio deepfake detection. arXiv preprint arXiv:2501.11902 (2025)

    2025 arXiv

  28. [29]

    In: Proceedings of the 35th annual computer security applications conference

    Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D.C., Nepal, S.: Strip: A defence against trojan attacks on deep neural networks. In: Proceedings of the 35th annual computer security applications conference. pp. 113--125 (2019)

    2019

  29. [30]

    IEEE Transactions on Information Forensics and Security 18, 3647--3661 (2023)

    Ge, Y., Zhao, L., Wang, Q., Duan, Y., Du, M.: Advddos: Zero-query adversarial attacks against commercial speech recognition systems. IEEE Transactions on Information Forensics and Security 18, 3647--3661 (2023)

    2023

  30. [31]

    IEEE/ACM Transactions on Audio, Speech, and Language Processing (2024)

    Gong, C., Wang, X., Cooper, E., Wells, D., Wang, L., Dang, J., Richmond, K., Yamagishi, J.: Zmm-tts: Zero-shot multilingual and multispeaker speech synthesis conditioned on self-supervised discrete speech representations. IEEE/ACM Transactions on Audio, Speech, and Language Pr...

    2024

  31. [32]

    In: 2019 18th IEEE International Conference On Machine Learning And Applications (ICMLA)

    Gong, T., Ramos, A.G.C., Bhattacharya, S., Mathur, A., Kawsar, F.: Audidos: Real-time denial-of-service adversarial attacks on deep audio models. In: 2019 18th IEEE International Conference On Machine Learning And Applications (ICMLA). pp. 978--985. IEEE (2019)

    2019

  32. [34]

    Cybersecurity 6(1), 40 (2023)

    Guo, F., Sun, Z., Chen, Y., Ju, L.: Towards the universal defense for query-based audio adversarial attacks on speech recognition system. Cybersecurity 6(1), 40 (2023)

    2023

  33. [36]

    In: Proceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses

    Guo, H., Wang, G., Wang, Y., Chen, B., Yan, Q., Xiao, L.: Phantomsound: Black-box, query-efficient audio adversarial attack via split-second phoneme injection. In: Proceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses. pp. 366--380 (2023)

    2023

  34. [37]

    In: Proceedings of the 2022 ACM SIGSAC conference on computer and communications security

    Guo, H., Wang, Y., Ivanov, N., Xiao, L., Yan, Q.: Specpatch: Human-in-the-loop adversarial audio spectrogram patch attack on speech recognition. In: Proceedings of the 2022 ACM SIGSAC conference on computer and communications security. pp. 1353--1366 (2022)

    2022

  35. [38]

    i am bad

    Gupta, I., Khachaturov, D., Mullins, R.: " i am bad": Interpreting stealthy, universal and robust audio jailbreaks in audio-language models. arXiv preprint arXiv:2502.00718 (2025)

    2025 arXiv

  36. [39]

    In: 2024 IEEE Symposium on Security and Privacy (SP)

    Han, X., Wu, Y., Zhang, Q., Zhou, Y., Xu, Y., Qiu, H., Xu, G., Zhang, T.: Backdooring multimodal learning. In: 2024 IEEE Symposium on Security and Privacy (SP). pp. 3385--3403. IEEE (2024)

    2024

  37. [40]

    In: ICLR 2025 Workshop on Building Trust in Language Models and Applications (2025)

    Hu, W., Gu, S., Wang, Y., Hong, R.: Videojail: Exploiting video-modality vulnerabilities for jailbreak attacks on multimodal large language models. In: ICLR 2025 Workshop on Building Trust in Language Models and Applications (2025)

    2025

  38. [41]

    arXiv preprint arXiv:2501.01042 (2025)

    Huang, L., Jiang, X., Wang, Z., Mo, W., Xiao, X., Han, B., Yin, Y., Zheng, F.: Image-based multimodal models as intruders: Transferable multimodal attacks on video-based mllms. arXiv preprint arXiv:2501.01042 (2025)

    2025

  39. [42]

    arXiv preprint arXiv:2412.03556 (2024)

    Hughes, J., Price, S., Lynch, A., Schaeffer, R., Barez, F., Koyejo, S., Sleight, H., Jones, E., Perez, E., Sharma, M.: Best-of-n jailbreaking. arXiv preprint arXiv:2412.03556 (2024)

    2024 arXiv

  40. [43]

    arXiv preprint arXiv:2410.21276 (2024)

    Hurst, A., Lerer, A., Goucher, A.P., Perelman, A., Ramesh, A., Clark, A., Ostrow, A., Welihinda, A., Hayes, A., Radford, A., et al.: Gpt-4o system card. arXiv preprint arXiv:2410.21276 (2024)

    2024 arXiv

  41. [45]

    arXiv preprint arXiv:2502.05863 (2025)

    Jia, Y., Wu, X., Li, H., Zhang, Q., Hu, Y., Zhao, S., Fan, W.: Uni-retrieval: A multi-style retrieval framework for stem's education. arXiv preprint arXiv:2502.05863 (2025)

    2025 arXiv

  42. [46]

    arXiv preprint arXiv:2505.17050 (2025)

    Jia, Y., Wu, X., Zhang, Q., Qin, Y., Xiao, L., Zhao, S.: Towards robust evaluation of stem education: Leveraging mllms in project-based learning. arXiv preprint arXiv:2505.17050 (2025)

    2025

  43. [47]

    arXiv preprint arXiv:2505.11217 (2025)

    Jia, Y., Xie, J., Jivaganesh, S., Li, H., Wu, X., Zhang, M.: Seeing sound, hearing sight: Uncovering modality bias and conflict of ai models in sound localization. arXiv preprint arXiv:2505.11217 (2025)

    2025

  44. [48]

    In: The Thirteenth International Conference on Learning Representations (2024)

    Kang, M., Xu, C., Li, B.: Advwave: Stealthy adversarial jailbreak attack against large audio-language models. In: The Thirteenth International Conference on Learning Representations (2024)

    2024

  45. [49]

    In: Proceedings of the 3rd ACM Workshop on Wireless Security and Machine Learning

    Kasher, M., Zhao, M., Greenberg, A., Gulati, D., Kokalj-Filipovic, S., Spasojevic, P.: Inaudible manipulation of voice-enabled devices through backdoor using robust adversarial audio attacks. In: Proceedings of the 3rd ACM Workshop on Wireless Security and Machine Learning. pp...

    2021

  46. [50]

    In: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

    Keller, L., Glava s , G.: Speechtaxi: On multilingual semantic speech classification. In: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). pp. 1--5 (2025)

    2025

  47. [51]

    Information Fusion p

    Kheddar, H., Hemis, M., Himeur, Y.: Automatic speech recognition using advanced deep learning approaches: A survey. Information Fusion p. 102422 (2024)

    2024

  48. [52]

    Pattern Recognition 137, 109286 (2023)

    Kim, H., Park, J., Lee, J.: Generating transferable adversarial examples for speech classification. Pattern Recognition 137, 109286 (2023)

    2023

  49. [53]

    Computers & Security 128, 103168 (2023)

    Ko, K., Kim, S., Kwon, H.: Multi-targeted audio adversarial example for use against speech recognition systems. Computers & Security 128, 103168 (2023)

    2023

  50. [54]

    In: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

    Koffas, S., Pajola, L., Picek, S., Conti, M.: Going in style: Audio backdoors through stylistic transformations. In: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). pp. 1--5 (2023)

    2023

  51. [55]

    In: Proceedings of the 2022 ACM Workshop on Wireless Security and Machine Learning

    Koffas, S., Xu, J., Conti, M., Picek, S.: Can you hear it? backdoor attacks via ultrasonic triggers. In: Proceedings of the 2022 ACM Workshop on Wireless Security and Machine Learning. pp. 57--62 (2022)

    2022

  52. [56]

    In: Proc

    Kong, Y., Zhang, J.: Adversarial audio: A new information hiding method. In: Proc. Interspeech 2020. pp. 2287--2291 (2020)

    2020

  53. [57]

    IEEE Transactions on Information Forensics and Security 15, 526--538 (2019)

    Kwon, H., Kim, Y., Yoon, H., Choi, D.: Selective audio adversarial example in evasion attack on speech recognition system. IEEE Transactions on Information Forensics and Security 15, 526--538 (2019)

    2019

  54. [58]

    Computers & Security 126, 103061 (2023)

    Kwon, H., Nam, S.H.: Audio adversarial detection through classification score on speech recognition systems. Computers & Security 126, 103061 (2023)

    2023

  55. [59]

    In: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security

    Kwon, H., Yoon, H., Park, K.W.: Poster: Detecting audio adversarial example through audio modification. In: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security. pp. 2521--2523 (2019)

    2019

  56. [60]

    In: Proceedings of the 2024 IEEE Symposium on Security and Privacy (SP)

    Lan, J., Wang, J., Yan, B., Yan, Z., Bertino, E.: Flowmur: A stealthy and practical audio backdoor attack with limited knowledge. In: Proceedings of the 2024 IEEE Symposium on Security and Privacy (SP). pp. 1646--1664. IEEE (2024)

    2024

  57. [63]

    In: International Symposium on Emerging Information Security and Applications

    Li, H., Jia, P., Li, W., Ma, B., Li, B., Wu, D., Li, H.: Towards efficient universal adversarial attack on audio classification models: A two-step method. In: International Symposium on Emerging Information Security and Applications. pp. 20--37. Springer (2023)

    2023

  58. [64]

    arXiv preprint arXiv:2403.13507 (2024)

    Li, J., Gao, K., Bai, Y., Zhang, J., Xia, S.t., Wang, Y.: Fmm-attack: A flow-based multi-modal adversarial attack on video-based llms. arXiv preprint arXiv:2403.13507 (2024)

    2024 arXiv

  59. [65]

    Advances in Neural Information Processing Systems 32 (2019)

    Li, J., Qu, S., Li, X., Szurley, J., Kolter, J.Z., Metze, F.: Adversarial music: Real world audio adversary against wake-word detection system. Advances in Neural Information Processing Systems 32 (2019)

    2019

  60. [66]

    In: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security

    Li, X., Li, K., Zheng, Y., Yan, C., Ji, X., Xu, W.: Safeear: Content privacy-preserving audio deepfake detection. In: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security. pp. 3585--3599 (2024)

    2024

  61. [67]

    IEEE Internet of Things Journal 11(8), 13108--13124 (2023)

    Li, X., Ze, J., Yan, C., Cheng, Y., Ji, X., Xu, W.: Enrollment-stage backdoor attacks on speaker recognition systems via adversarial ultrasound. IEEE Internet of Things Journal 11(8), 13108--13124 (2023)

    2023

  62. [68]

    In: Proceedings of the 21st international workshop on mobile computing systems and applications

    Li, Z., Shi, C., Xie, Y., Liu, J., Yuan, B., Chen, Y.: Practical adversarial attacks against speaker recognition systems. In: Proceedings of the 21st international workshop on mobile computing systems and applications. pp. 9--14 (2020)

    2020

  63. [69]

    Visual Intelligence 2(1), 23 (2024)

    Liao, J., Yi, L., Shi, W., Yang, W., Fang, Y., Yang, X.: Imperceptible backdoor watermarks for speech recognition model copyright protection. Visual Intelligence 2(1), 23 (2024)

    2024

  64. [70]

    In: 2024 IEEE International Conference on Signal Processing, Communications and Computing (ICSPCC)

    Liu, M., Li, X., Wang, M., Zhang, X.L., Rahardja, S.: Mtbv: Multi-trigger backdoor attacks on speaker verification. In: 2024 IEEE International Conference on Signal Processing, Communications and Computing (ICSPCC). pp. 1--5. IEEE (2024)

    2024

  65. [71]

    In: 2022 26th International Conference on Pattern Recognition (ICPR)

    Liu, P., Zhang, S., Yao, C., Ye, W., Li, X.: Backdoor attacks against deep neural networks by personalized audio steganography. In: 2022 26th International Conference on Pattern Recognition (ICPR). pp. 68--74. IEEE (2022)

    2022

  66. [72]

    In: Proceedings of the 30th ACM International Conference on Multimedia

    Liu, Q., Zhou, T., Cai, Z., Tang, Y.: Opportunistic backdoor attacks: Exploring human-imperceptible vulnerabilities on speech recognition systems. In: Proceedings of the 30th ACM International Conference on Multimedia. pp. 2390--2398 (2022)

    2022

  67. [73]

    In: 2023 IEEE Symposium on Security and Privacy (SP)

    Liu, T., Lin, F., Wang, Z., Wang, C., Ba, Z., Lu, L., Xu, W., Ren, K.: Magbackdoor: Beware of your loudspeaker as a backdoor for magnetic injection attacks. In: 2023 IEEE Symposium on Security and Privacy (SP). pp. 3416--3431. IEEE (2023)

    2023

  68. [74]

    In: Proceedings of the AAAI Conference on Artificial Intelligence

    Liu, X., Wan, K., Ding, Y., Zhang, X., Zhu, Q.: Weighted-sampling audio adversarial example attack. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 34, pp. 4908--4915 (2020)

    2020

  69. [75]

    arXiv preprint arXiv:2411.09259 (2024)

    Liu, X., Cui, X., Li, P., Li, Z., Huang, H., Xia, S., Zhang, M., Zou, Y., He, R.: Jailbreak attacks and defenses against multimodal generative models: A survey. arXiv preprint arXiv:2411.09259 (2024)

    2024 arXiv

  70. [76]

    In: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

    Lu, K., Nguyen, M.C., Xu, X., Foo, C.S.: On adversarial robustness of audio classifiers. In: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). pp. 1--5 (2023)

    2023

  71. [77]

    In: International Conference on Information Security Practice and Experience

    Luo, Y., Tai, J., Jia, X., Zhang, S.: Practical backdoor attack against speaker recognition system. In: International Conference on Information Security Practice and Experience. pp. 468--484. Springer (2022)

    2022

  72. [78]

    In: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

    Luong, H.T., Li, H., Zhang, L., Lee, K.A., Chng, E.S.: Llamapartialspoof: An llm-driven fake speech dataset simulating disinformation generation. In: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). pp. 1--5 (2025)

    2025

  73. [79]

    In: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

    Ma, P., Petridis, S., Pantic, M.: Detecting adversarial attacks on audiovisual speech recognition. In: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). pp. 6403--6407 (2021)

    2021

  74. [80]

    Journal of Systems Architecture 104, 101696 (2020)

    Mao, J., Zhu, S., Liu, J.: An inaudible voice attack to context-based device authentication in smart iot systems. Journal of Systems Architecture 104, 101696 (2020)

    2020

  75. [81]

    arXiv preprint arXiv:2412.16555 (2024)

    Mao, Y., Liu, P., Cui, T., Liu, C., You, D.: Divide and conquer: A hybrid strategy defeats multimodal large language models. arXiv preprint arXiv:2412.16555 (2024)

    2024 arXiv

  76. [82]

    arXiv preprint arXiv:2401.01537 (2024)

    Mengara, O.: The art of deception: Robust backdoor attack using dynamic stacking of triggers. arXiv preprint arXiv:2401.01537 (2024)

    2024 arXiv

  77. [83]

    IEEE Access (2024)

    Mengara, O.: A backdoor approach with inverted labels using dirty label-flipping attacks. IEEE Access (2024)

    2024

  78. [84]

    arXiv preprint arXiv:2406.10719 (2024)

    Mengara, O.: Trading devil: Robust backdoor attack via stochastic investment models and bayesian approach. arXiv preprint arXiv:2406.10719 (2024)

    2024 arXiv

  79. [85]

    Advances in Neural Information Processing Systems 37, 63858--63872 (2024)

    Miao, Y., Zhu, Y., Yu, L., Zhu, J., Gao, X.S., Dong, Y.: T2vsafetybench: Evaluating the safety of text-to-video generative models. Advances in Neural Information Processing Systems 37, 63858--63872 (2024)

    2024

  80. [86]

    IEEE Access 10, 23532--23544 (2022)

    Mun, H., Seo, S., Son, B., Yun, J.: Black-box audio adversarial attack using particle swarm optimization. IEEE Access 10, 23532--23544 (2022)

    2022

  81. [87]

    In: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

    Olivier, R., Raj, B., Shah, M.: High-frequency adversarial defense for speech and audio. In: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). pp. 2995--2999 (2021)

    2021

  82. [88]

    Advances in Neural Information Processing Systems 35, 30058--30070 (2022)

    O'Reilly, P., Bugler, A., Bhandari, K., Morrison, M., Pardo, B.: Voiceblock: Privacy through real-time adversarial attacks with audio-to-audio models. Advances in Neural Information Processing Systems 35, 30058--30070 (2022)

    2022

  83. [89]

    ACM Transactions on Privacy and Security 27(2), 1--26 (2024)

    Park, N., Kim, J.: Toward robust asr system against audio adversarial examples using agitated logit. ACM Transactions on Privacy and Security 27(2), 1--26 (2024)

    2024

  84. [90]

    In: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

    Qi, G., Chen, Y., Zhu, Y., Hui, B., Li, X., Mao, X., Zhang, R., Xue, H.: Transaudio: Towards the transferable adversarial audio attack via learning contextualized perturbations. In: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (IC...

    2023

  85. [91]

    In: 2024 IEEE 36th International Conference on Tools with Artificial Intelligence (ICTAI)

    Qiu, S., You, X., Rong, W., Huang, L., Liang, Y.: Boosting imperceptibility of adversarial attacks for environmental sound classification. In: 2024 IEEE 36th International Conference on Tools with Artificial Intelligence (ICTAI). pp. 790--797. IEEE (2024)

    2024

  86. [92]

    In: Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining

    Qu, X., Wei, P., Gao, M., Sun, Z., Ong, Y.S., Ma, Z.: Synthesising audio adversarial examples for automatic speech recognition. In: Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. pp. 1430--1440 (2022)

    2022

  87. [93]

    Expert Systems with Applications 250, 123941 (2024)

    Rabhi, M., Bakiras, S., Di Pietro, R.: Audio-deepfake detection: Adversarial attacks and countermeasures. Expert Systems with Applications 250, 123941 (2024)

    2024

  88. [94]

    In: Proceedings of the 15th Annual International Conference on Mobile Systems, Applications, and Services

    Roy, N., Hassanieh, H., Roy Choudhury, R.: Backdoor: Making microphones hear inaudible sounds. In: Proceedings of the 15th Annual International Conference on Mobile Systems, Applications, and Services. pp. 2--14 (2017)

    2017

  89. [95]

    In: Proceedings of the 2024 Workshop on Artificial Intelligence and Security

    Schoof, C., Koffas, S., Conti, M., Picek, S.: Emoback: Backdoor attacks against speaker identification using emotional prosody. In: Proceedings of the 2024 Workshop on Artificial Intelligence and Security. pp. 137--148 (2024)

    2024

  90. [96]

    arXiv preprint arXiv:2405.19103 (2024)

    Shen, X., Wu, Y., Backes, M., Zhang, Y.: Voice jailbreak attacks against gpt-4o. arXiv preprint arXiv:2405.19103 (2024)

    2024 arXiv

  91. [97]

    In: Proceedings of the 28th Annual International Conference on Mobile Computing And Networking

    Shi, C., Zhang, T., Li, Z., Phan, H., Zhao, T., Wang, Y., Liu, J., Yuan, B., Chen, Y.: Audio-domain position-independent backdoor attack via unnoticeable triggers. In: Proceedings of the 28th Annual International Conference on Mobile Computing And Networking. pp. 583--595 (2022)

    2022

  92. [98]

    In: 2024 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS)

    Sun, X., Zhang, Y., Tang, X., Bedi, A.S., Bera, A.: Trustnavgpt: Modeling uncertainty to improve trustworthiness of audio-guided llm-based robot navigation. In: 2024 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS). pp. 8794--8801. IEEE (2024)

    2024

  93. [99]

    In: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

    Takahashi, N., Inoue, S., Mitsufuji, Y.: Adversarial attacks on audio source separation. In: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). pp. 521--525 (2021)

    2021

  94. [100]

    Pattern Recognition Letters 177, 103--109 (2024)

    Tang, Y., Sun, L., Xu, X.: Silenttrig: An imperceptible backdoor attack against speaker identification with hidden triggers. Pattern Recognition Letters 177, 103--109 (2024)

    2024

  95. [101]

    In: Proceedings of the 2019 IEEE security and privacy workshops (SPW)

    Taori, R., Kamsetty, A., Chu, B., Vemuri, N.: Targeted adversarial examples for black box audio systems. In: Proceedings of the 2019 IEEE security and privacy workshops (SPW). pp. 15--20. IEEE (2019)

    2019

  96. [102]

    IEEE/ACM Transactions on Audio, Speech, and Language Processing 31, 3981--3992 (2023)

    Tong, C., Zheng, X., Li, J., Ma, X., Gao, L., Xiang, Y.: Query-efficient black-box adversarial attacks on automatic speech recognition. IEEE/ACM Transactions on Audio, Speech, and Language Processing 31, 3981--3992 (2023)

    2023

  97. [103]

    Computers & Security 112, 102495 (2022)

    Vadillo, J., Santana, R.: On the human evaluation of universal audio adversarial perturbations. Computers & Security 112, 102495 (2022)

    2022

  98. [104]

    arXiv preprint arXiv:2211.10661 (2022)

    Wang, J., Chen, Z., Yin, Z., Yang, Q., Liu, X.: Phonemic adversarial attack against audio recognition in real world. arXiv preprint arXiv:2211.10661 (2022)

    2022 arXiv

  99. [105]

    IEEE Transactions on Information Forensics and Security 18, 351--364 (2022)

    Wang, S., Zhang, Z., Zhu, G., Zhang, X., Zhou, Y., Huang, J.: Query-efficient adversarial attack with low perturbation against end-to-end speech recognition systems. IEEE Transactions on Information Forensics and Security 18, 351--364 (2022)

    2022

  100. [106]

    IEEE transactions on information forensics and security 15, 2282--2294 (2020)

    Wu, J., Chen, B., Luo, W., Fang, Y.: Audio steganography based on iterative adversarial attacks against convolutional neural networks. IEEE transactions on information forensics and security 15, 2282--2294 (2020)

    2020

  101. [107]

    In: The Eleventh International Conference on Learning Representations (2023)

    Wu, S., Wang, J., Ping, W., Nie, W., Xiao, C.: Defending against adversarial audio via diffusion model. In: The Eleventh International Conference on Learning Representations (2023)

    2023

  102. [108]

    In: 32nd USENIX Security Symposium (USENIX Security 23)

    Wu, X., Ma, S., Shen, C., Lin, C., Wang, Q., Li, Q., Rao, Y.: Kenku: Towards efficient and stealthy black-box adversarial attacks against asr systems. In: 32nd USENIX Security Symposium (USENIX Security 23). pp. 247--264 (2023)

    2023

  103. [109]

    Future Generation Computer Systems 160, 433--441 (2024)

    Wu, Y., Chen, J., Lei, T., Yu, J., Hossain, M.S.: Web 3.0 security: Backdoor attacks in federated learning-based automatic speaker verification systems in the 6g era. Future Generation Computer Systems 160, 433--441 (2024)

    2024

  104. [110]

    arXiv preprint arXiv:2501.13772 (2025)

    Xiao, E., Cheng, H., Shao, J., Duan, J., Xu, K., Yang, L., Gu, J., Xu, R.: Tune in, act up: Exploring the impact of audio modality-specific edits on large audio language models in jailbreak. arXiv preprint arXiv:2501.13772 (2025)

    2025

  105. [111]

    IEEE Transactions on Affective Computing (2025)

    Xiao, L., Mao, R., Zhao, S., Lin, Q., Jia, Y., He, L., Cambria, E.: Exploring cognitive and aesthetic causality for multimodal aspect-based sentiment analysis. IEEE Transactions on Affective Computing (2025)

    2025

  106. [112]

    In: National Conference on Man-Machine Speech Communication

    Xiao, Y., Yao, W., Li, Z., Yang, J., Wen, W.: Phoneme semantic backdoor attacks with multiple task learning for speech classification task. In: National Conference on Man-Machine Speech Communication. pp. 79--90. Springer (2024)

    2024

  107. [113]

    In: Proceedings of the AAAI conference on Artificial Intelligence

    Xie, Y., Li, Z., Shi, C., Liu, J., Chen, Y., Yuan, B.: Enabling fast and universal audio adversarial attack using generative model. In: Proceedings of the AAAI conference on Artificial Intelligence. vol. 35, pp. 14129--14137 (2021)

    2021

  108. [114]

    In: 2024 International Joint Conference on Neural Networks (IJCNN)

    Xin, J., Lv, X.: Speechguard: Online defense against backdoor attacks on speech recognition models. In: 2024 International Joint Conference on Neural Networks (IJCNN). pp. 1--8. IEEE (2024)

    2024

  109. [115]

    In: International Conference on Machine Learning for Cyber Security

    Xin, J., Lyu, X., Ma, J.: Natural backdoor attacks on speech recognition models. In: International Conference on Machine Learning for Cyber Security. pp. 597--610. Springer (2022)

    2022

  110. [116]

    In: 2024 IEEE 36th International Conference on Tools with Artificial Intelligence (ICTAI)

    Xiong, B., Xing, Z., Wen, W.: Phoneme substitution: A novel approach for backdoor attacks on speech recognition systems. In: 2024 IEEE 36th International Conference on Tools with Artificial Intelligence (ICTAI). pp. 540--547. IEEE (2024)

    2024

  111. [117]

    Cluster Computing 28(3), 158 (2025)

    Xu, W., Xu, Y., Zhang, S.: Sample-independent federated learning backdoor attack in speaker recognition. Cluster Computing 28(3), 158 (2025)

    2025

  112. [118]

    In: Findings of the Association for Computational Linguistics ACL 2024

    Xu, Z., Liu, Y., Deng, G., Li, Y., Picek, S.: A comprehensive study of jailbreak attack versus defense for large language models. In: Findings of the Association for Computational Linguistics ACL 2024. pp. 7432--7449 (2024)

    2024

  113. [120]

    arXiv preprint arXiv:2410.23861 (2024)

    Yang, H., Qu, L., Shareghi, E., Haffari, G.: Audio is the achilles' heel: Red teaming audio large multimodal models. arXiv preprint arXiv:2410.23861 (2024)

    2024 arXiv

  114. [121]

    arXiv preprint arXiv:2411.14842 (2024)

    Yang, W., Li, Y., Fang, M., Wei, Y., Zhou, T., Chen, L.: Who can withstand chat-audio attacks? an evaluation benchmark for large language models. arXiv preprint arXiv:2411.14842 (2024)

    2024 arXiv

  115. [122]

    arXiv preprint arXiv:2408.15508 (2024)

    Yao, W., Chen, Z.X., Liu, J., Wen, W., et al.: Emoattack: Utilizing emotional voice conversion for speech backdoor attacks on deep speech classification models. arXiv preprint arXiv:2408.15508 (2024)

    2024 arXiv

  116. [123]

    Neurocomputing 614, 128779 (2025)

    Yao, W., Yang, J., He, Y., Liu, J., Wen, W.: Imperceptible rhythm backdoor attacks: Exploring rhythm transformation for embedding undetectable vulnerabilities on speech recognition. Neurocomputing 614, 128779 (2025)

    2025

  117. [124]

    In: Proceedings of the Interspeech 2023

    Ye, Z., Mao, T., Dong, L., Yan, D.: Fake the real: Backdoor attack on deep speech classification via voice conversion. In: Proceedings of the Interspeech 2023. pp. 4923--4927 (2023)

    2023

  118. [125]

    IEEE Signal Processing Letters 30, 1057--1061 (2023)

    Ye, Z., Yan, D., Dong, L., Deng, J., Yu, S.: Stealthy backdoor attack against speaker recognition using phase-injection hidden trigger. IEEE Signal Processing Letters 30, 1057--1061 (2023)

    2023

  119. [126]

    In: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

    Ye, Z., Yan, D., Dong, L., Shen, K.: Breaking speaker recognition with paddingback. In: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). pp. 4435--4439 (2024)

    2024

  120. [127]

    arXiv preprint arXiv:2406.06302 (2024)

    Ying, Z., Liu, A., Liu, X., Tao, D.: Unveiling the safety of gpt-4o: An empirical study using jailbreak attacks. arXiv preprint arXiv:2406.06302 (2024)

    2024 arXiv

  121. [128]

    In: 32nd USENIX Security Symposium (USENIX security 23)

    Yu, Z., Chang, Y., Zhang, N., Xiao, C.: \ SMACK \ : Semantically meaningful adversarial audio attack. In: 32nd USENIX Security Symposium (USENIX security 23). pp. 3799--3816 (2023)

    2023

  122. [129]

    In: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security

    Yu, Z., Zhai, S., Zhang, N.: Antifake: Using adversarial audio to prevent unauthorized speech synthesis. In: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. pp. 460--474 (2023)

    2023

  123. [130]

    Yun, Z., Ao, J., Ko, T., Ronen, E., Sharif, M.: Sounding the alarm: Backdooring acoustic foundation models for physically realizable triggers (2024)

    2024

  124. [132]

    In: Proceedings of the Twenty-Ninth International Conference on International Joint Conferences on Artificial Intelligence

    Zhang, H., Yan, Q., Zhou, P., Liu, X.Y.: Generating robust audio adversarial examples with temporal dependency. In: Proceedings of the Twenty-Ninth International Conference on International Joint Conferences on Artificial Intelligence. pp. 3167--3173 (2021)

    2021

  125. [133]

    In: 2024 IEEE 48th Annual Computers, Software, and Applications Conference (COMPSAC)

    Zhang, M., Ji, S., Cai, H., Dong, H., Zhang, P., Li, Y.: Audio steganography based backdoor attack for speech recognition software. In: 2024 IEEE 48th Annual Computers, Software, and Applications Conference (COMPSAC). pp. 1208--1217. IEEE (2024)

    2024

  126. [134]

    ACM Computing Surveys 57(4), 1--35 (2024)

    Zhang, S., Pan, Y., Liu, Q., Yan, Z., Choo, K.K.R., Wang, G.: Backdoor attacks and defenses targeting multi-domain ai models: A comprehensive review. ACM Computing Surveys 57(4), 1--35 (2024)

    2024

  127. [135]

    In: Proceedings of the 30th Annual International Conference on Mobile Computing and Networking

    Zhang, T., Phan, H., Tang, Z., Shi, C., Wang, Y., Yuan, B., Chen, Y.: Inaudible backdoor attack via stealthy frequency trigger injection in audio spectrogram. In: Proceedings of the 30th Annual International Conference on Mobile Computing and Networking. pp. 31--45 (2024)

    2024

  128. [136]

    In: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

    Zhang, W., Zhao, S., Liu, L., Li, J., Cheng, X., Zheng, T.F., Hu, X.: Attack on practical speaker verification system using universal adversarial perturbations. In: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). pp. 2575--...

    2021

  129. [137]

    In: The Thirteenth International Conference on Learning Representations (2025)

    Zhang, Z., Liang, S., Shimada, D., Xu, C.: Rethinking audio-visual adversarial vulnerability from temporal and modality perspectives. In: The Thirteenth International Conference on Learning Representations (2025)

    2025

  130. [138]

    In: Findings of the Association for Computational Linguistics: NAACL 2024

    Zhao, S., Gan, L., Tuan, L.A., Fu, J., Lyu, L., Jia, M., Wen, J.: Defending against weight-poisoning backdoor attacks for parameter-efficient fine-tuning. In: Findings of the Association for Computational Linguistics: NAACL 2024. pp. 3421--3438 (2024)

    2024

  131. [140]

    In: Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing

    Zhao, S., Jia, M., Tuan, L.A., Pan, F., Wen, J.: Universal vulnerabilities in large language models: Backdoor attacks for in-context learning. In: Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing. pp. 11507--11522 (2024)

    2024

  132. [141]

    IEEE Transactions on Emerging Topics in Computational Intelligence (2024)

    Zhao, S., Tian, J., Fu, J., Chen, J., Wen, J.: Feamix: Feature mix with memory batch based on self-consistency learning for code generation and code translation. IEEE Transactions on Emerging Topics in Computational Intelligence (2024)

    2024

  133. [142]

    IEEE/ACM Transactions on Audio, Speech, and Language Processing (2024)

    Zhao, S., Tuan, L.A., Fu, J., Wen, J., Luo, W.: Exploring clean label backdoor attacks and defense in language models. IEEE/ACM Transactions on Audio, Speech, and Language Processing (2024)

    2024

  134. [143]

    In: Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing

    Zhao, S., Wen, J., Luu, A., Zhao, J., Fu, J.: Prompt as triggers for backdoor attack: Examining the vulnerability in language models. In: Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing. pp. 12303--12317 (2023)

    2023

  135. [144]

    arXiv preprint arXiv:2410.14425 (2024)

    Zhao, S., Wu, X., Nguyen, C.D., Jia, Y., Jia, M., Feng, Y., Tuan, L.A.: Unlearning backdoor attacks for llms with weak-to-strong knowledge distillation. arXiv preprint arXiv:2410.14425 (2024)

    2024 arXiv

  136. [145]

    Expert Systems with Applications 265, 125856 (2025)

    Zhao, S., Xu, X., Xiao, L., Wen, J., Tuan, L.A.: Clean-label backdoor attack and defense: An examination of language model vulnerability. Expert Systems with Applications 265, 125856 (2025)

    2025

  137. [146]

    In: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security

    Zheng, B., Jiang, P., Wang, Q., Li, Q., Shen, C., Wang, C., Ge, Y., Teng, Q., Zhang, S.: Black-box adversarial attacks on commercial speech platforms with minimal information. In: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. pp. 86--107 (2021)

    2021

  138. [147]

    In: Proceedings of the 31st ACM International Conference on Multimedia

    Zheng, Z., Li, X., Yan, C., Ji, X., Xu, W.: The silent manipulator: A practical and inaudible backdoor attack against speech recognition systems. In: Proceedings of the 31st ACM International Conference on Multimedia. pp. 7849--7858 (2023)

    2023

  139. [148]

    arXiv preprint arXiv:2502.01152 (2025)

    Zhou, N., Lin, W., Liu, L.: Gradient norm-based fine-tuning for backdoor defense in automatic speech recognition. arXiv preprint arXiv:2502.01152 (2025)

    2025 arXiv

  140. [149]

    IEEE access 10, 114016--114023 (2022)

    Zhu, J., Chen, L., Xu, D., Zhao, W.: Backdoor defence for voice print recognition model based on speech enhancement and weight pruning. IEEE access 10, 114016--114023 (2022)

    2022

  141. [150]

    In: 2023 IEEE Symposium on Security and Privacy (SP)

    Zong, W., Chow, Y.W., Susilo, W., Do, K., Venkatesh, S.: Trojanmodel: A practical trojan attack against automatic speech recognition systems. In: 2023 IEEE Symposium on Security and Privacy (SP). pp. 1667--1683. IEEE (2023)

    2023

  142. [151]

    Reference title

    Author A, Author B, Author C. Reference title. Journal, Year, Vol: Number or pages

  143. [152]

    Reference title

    Author A, Author B, Author C, et al. Reference title. In: Proceedings of Conference, Place, Year. Number or pages

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.