{"slug": "stealthy-concurrent-audio-prompt-injections-against-multimodal-llm-agents", "title": "Stealthy Concurrent Audio Prompt Injections Against Multimodal LLM Agents", "summary": "Researchers have demonstrated that malicious audio instructions can be hidden in environmental noise to hijack multimodal LLM agents, achieving an average Attack Success Rate of 69.10% against Gemini 3 Pro. The team introduced AudioAgentSecurity, the first benchmark for audio instruction injection attacks, covering 8 real-world task scenarios and 10 attack patterns, and proposed a defense mechanism called Cascaded Audio Decoupling and Verification (CADV) that detects such attacks with over 90% success. The findings highlight a critical security vulnerability in AI agents that rely on continuous audio interaction.", "body_md": "# Computer Science > Cryptography and Security\n\n[Submitted on 30 Jul 2026]\n\n# Title:Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agents\n\n[View PDF](/pdf/2607.28165)\n\n[HTML (experimental)](https://arxiv.org/html/2607.28165v1)\n\nAbstract:Large Language Model (LLM)-driven multimodal agents are increasingly deployed to execute autonomous tasks via continuous audio interaction. While this paradigm enhances interaction naturalness, it introduces a critical yet under-explored attack surface, as audio inputs inevitably contain environmental noise beyond user control. In this paper, we investigate concurrent audio prompt injection attacks targeting multimodal agents. Distinct from traditional acoustic attacks on voice devices, we propose novel techniques for instruction augmentation and scenario concealment. These methods allow malicious audio instructions to imperceptibly \"piggyback\" onto user speech, thereby hijacking agents to execute malicious actions. To systematically quantify this threat, we construct AudioAgentSecurity, the first comprehensive benchmark for audio instruction injection attacks, encompassing 8 real-world task scenarios and 10 distinct attack patterns. We evaluate 11 state-of-the-art agents, including Gemini 3 Pro and GPT-4o-audio. Notably, our methods achieve an average Attack Success Rate (ASR) of 69.10\\% against the advanced Gemini 3 Pro. To counter this threat, we further introduce Cascaded Audio Decoupling and Verification (CADV), a defense mechanism based on source separation and consistency analysis. Compared with existing prompt-level defenses, CADV leverages acoustic source separation and cross-modal consistency analysis to detect audio instruction injections more robustly, achieving over 90\\% detection success across diverse attack vectors. Finally, real-world experiments with human volunteers on Doubao AI Smartphone in diverse dynamic real-world scenarios confirm the attacks' high stealth and efficacy, while demonstrating that our defense reliably mitigates these vulnerabilities.\n\n### References & Citations\n\nLoading...\n\n# Bibliographic and Citation Tools\n\nBibliographic Explorer\n\n*(*[What is the Explorer?](https://info.arxiv.org/labs/showcase.html#arxiv-bibliographic-explorer))\nConnected Papers\n\n*(*[What is Connected Papers?](https://www.connectedpapers.com/about))\nLitmaps\n\n*(*[What is Litmaps?](https://www.litmaps.co/))\nscite Smart Citations\n\n*(*[What are Smart Citations?](https://www.scite.ai/))# Code, Data and Media Associated with this Article\n\nalphaXiv\n\n*(*[What is alphaXiv?](https://alphaxiv.org/))\nCatalyzeX Code Finder for Papers\n\n*(*[What is CatalyzeX?](https://www.catalyzex.com))\nDagsHub\n\n*(*[What is DagsHub?](https://dagshub.com/))\nGotit.pub\n\n*(*[What is GotitPub?](http://gotit.pub/faq))\nHugging Face\n\n*(*[What is Huggingface?](https://huggingface.co/huggingface))\nScienceCast\n\n*(*[What is ScienceCast?](https://sciencecast.org/welcome))# Demos\n\n# Recommenders and Search Tools\n\nInfluence Flower\n\n*(*[What are Influence Flowers?](https://influencemap.cmlab.dev/))\nCORE Recommender\n\n*(*[What is CORE?](https://core.ac.uk/services/recommender))# arXivLabs: experimental projects with community collaborators\n\narXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.\n\nBoth individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.\n\nHave an idea for a project that will add value for arXiv's community? [ Learn more about arXivLabs](https://info.arxiv.org/labs/index.html).", "url": "https://wpnews.pro/news/stealthy-concurrent-audio-prompt-injections-against-multimodal-llm-agents", "canonical_source": "https://arxiv.org/abs/2607.28165", "published_at": "2026-07-31 14:02:19+00:00", "updated_at": "2026-07-31 14:22:40.222655+00:00", "lang": "en", "topics": ["ai-safety", "ai-research", "artificial-intelligence"], "entities": ["Gemini 3 Pro", "GPT-4o-audio", "AudioAgentSecurity", "Cascaded Audio Decoupling and Verification (CADV)", "Doubao AI Smartphone"], "alternates": {"html": "https://wpnews.pro/news/stealthy-concurrent-audio-prompt-injections-against-multimodal-llm-agents", "markdown": "https://wpnews.pro/news/stealthy-concurrent-audio-prompt-injections-against-multimodal-llm-agents.md", "text": "https://wpnews.pro/news/stealthy-concurrent-audio-prompt-injections-against-multimodal-llm-agents.txt", "jsonld": "https://wpnews.pro/news/stealthy-concurrent-audio-prompt-injections-against-multimodal-llm-agents.jsonld"}}