Inaudible Audio Attacks Can Hijack AI Voice Assistants
Researchers from China and Singapore demonstrated that inaudible audio signals can be embedded in podcasts and videos to hijack AI voice assistants and access user data. The technique, called "adversarial audio," achieved success rates of 79 to 90 percent against tested AI models and reportedly works against open-source models used by major commercial providers.
What happened
Researchers from China and Singapore constructed 'adversarial audio' signals inaudible to human ears that can trick voice AI models into performing unintended actions. The researchers demonstrated that these signals can be embedded in podcasts, videos, or other audio content to hijack AI voice assistants and access connected personal information such as private photos and bank accounts.
The technique requires approximately half an hour to train a signal that is context-agnostic and can be reused across multiple attacks. The researchers created a system called AudioHijack and tested it against 13 advanced audio-based AI models, achieving success rates ranging from 79 to 90 percent.
Reported impact
The potential attacks could trick AI systems into downloading malicious files, misusing connected tools, or exposing user information through email systems. Because the malicious audio cannot be heard by people nearby, users may never realize an AI system has been manipulated.
Index analysis
The attack technique works against open-source AI models, and because many commercial AI systems are built on open-source models, the exploit was demonstrated to be effective against mainstream products by Microsoft and Mistral. Current AI safeguards largely focus on text-based prompts rather than hidden audio instructions, leaving a significant protection gap.
Governance controls
Microsoft stated it appreciates the researchers' work to advance understanding of such techniques and noted that AI models are often integrated into user applications with additional layers of protection. The company indicated it offers developers tools and guidance to implement safeguards, though the research suggests these defenses struggle to distinguish between normal user intent and adversarial attacks.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.