Multimodal-agent security needs to authenticate and separate human speech from machine-readable acoustic instructions rather than assuming audible equivalence.
Read the implicationsCase · DiggingBeagle record
Sirens’Whisper injected near-ultrasonic prompts into speech-driven LLMs
A 2026 research framework used near-ultrasonic audio to deliver covert prompts and jailbreaks to speech-driven LLM interfaces under black-box conditions with commodity hardware.
Scope
Research demonstration of covert prompt injection into speech-driven LLMs. It establishes an input channel, not autonomous model escape.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
Basis and provenance
The paper's acoustic/microphone path and user study establish a tested covert input channel. Effects remain specific to tested hardware and interfaces, not model escape or universal exploitation. Assessment is a desk review of the retained canonical Claims and cited Source metadata at their recorded cutoff, not a new external verification. Impact remains ungraded.
Assessed Sep 24, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-SIRENS-EVAL · CLM-SIRENS-MECHANISM · Sirens’Whisper: Inaudible Near-Ultrasonic Jailbreaks of Speech-Driven LLMs
At a glance
Results are specific to tested devices, acoustic environments and model interfaces and should not be generalized to every microphone or speech model.
Limits and uncertaintyTimeline
- 2026-03 (month precision)Event type unspecified
Sirens’Whisper published as a 2026 research preprint.
Claims & evidence
CLM-SIRENS-EVALThe authors report black-box effectiveness against commercial and open-source speech-driven LLMs and a user study in which the injected audio was perceptually indistinguishable from background-only playback.supported
Basis: reported finding
- supportsSirens’Whisper: Inaudible Near-Ultrasonic Jailbreaks of Speech-Driven LLMsrole not specified
Abstract, evaluation and user-study summary
CLM-SIRENS-MECHANISMSirens’Whisper encodes target baseband audio into near-ultrasonic waveforms that can demodulate after acoustic transmission and microphone nonlinearity, enabling covert prompts to speech-driven LLMs.supported
Basis: reported finding
- supportsSirens’Whisper: Inaudible Near-Ultrasonic Jailbreaks of Speech-Driven LLMsrole not specified
Abstract
Implications
Multimodal-agent security needs to authenticate and separate human speech from machine-readable acoustic instructions rather than assuming audible equivalence.
Controls and mitigations
- Near-ultrasonic filtering and microphone hardening
- Authenticate command provenance rather than treating all decoded speech as human-authorized
- Adversarial testing across devices and environments
- Require confirmation for high-impact actions
Unknowns and contradictions
- Results are specific to tested devices, acoustic environments and model interfaces and should not be generalized to every microphone or speech model.
Sources and citation
Material revision history
- Sep 19, 2026 · Published version · first publication · revision 15
- Sep 25, 2026 · Published version · material revision · revision 39Public fields changed: assessment_profile