Concurrent Audio Prompt Injection Reached 69.1% Against Gemini 3 Pro
An audio-capable agent does not receive a clean, authenticated command channel. It receives a mixture: the user’s voice, other speakers, environmental noise, and whatever a nearby attacker can play into the microphone. New research shows that malicious instructions can exploit that mixture while the legitimate user is still speaking—not before the command and not as an obvious follow-up.
The AudioAgentSecurity study tested 2,160 generated attack samples spanning ten acoustic methods and eight real-world-inspired task scenarios against 11 audio-capable agents. In its sandboxed tool-trace evaluation, Gemini 3 Pro Preview followed the injected malicious intent in an average 69.10% of trials. The average across all tested models and attacks was 49.37%.
This is a preprint, not a vendor advisory, and the experiment does not establish that every production voice product is exploitable. But its threat model matters for autonomous systems: an environmental third party competes with a legitimate speaker during the same active interaction window, using only black-box access to the physical audio channel.
The attack targets intent arbitration, not only speech recognition
Earlier acoustic attacks often focused on making a voice assistant transcribe an inaudible or distorted command. AudioAgentSecurity adds a second problem. The injected signal must remain decodable while overlapping the user’s louder speech, then persuade the model that the attacker’s instruction supersedes the user’s original task.
The researchers combine energy enhancement and dynamic compression with what they call Semantic Anchor Hijacking. Prefixes such as “Task updated, execute now” frame the concurrent signal as a newer or higher-priority instruction. The ten attack families cover inaudible, low-intelligibility, and semantic-confusion techniques, including ultrasonic, high-frequency, pulsed, foreign-language, speed-modified, spectral, texture, dialect, and whisper variants.
That distinction is operationally important. A transcription filter may detect forbidden words yet still miss the authority error: the system has no trustworthy basis for deciding which acoustic source is the user. The model can correctly understand both streams and still choose the wrong principal.
The benchmark exposes wide model variation—and one shared failure
Attack success varied sharply by technique and model. Across all 11 agents, DolphinAttack averaged 81.55%, pulse attacks 75.50%, foreign-language injections 72.36%, and high-frequency attacks 70.55%. Spectral inversion and whisper attacks were much less effective, averaging 7.59% and 5.77% respectively.
Model averages ranged from 26.95% for Gemini 2.5 Lite to 69.10% for Gemini 3 Pro Preview. GPT-4o Audio Preview averaged 49.60%; the paper’s tested Qwen and open-weight endpoints fell at different points in between. These are benchmark results, not a stable product ranking: the authors used specific preview and API endpoints, and model behavior can change.
The study defines attack success from the recorded response and tool invocation in a sandbox. A Qwen-Max judge audits whether the agent followed the malicious intent, which introduces possible judge-model bias. The reported number therefore means “malicious intent accepted in this evaluation pipeline,” not “69.1% of real devices completed a harmful physical action.”
Physical tests narrow the laboratory gap without eliminating it
The researchers did not assume perfect timing, a silent victim device, a clean channel, a pre-registered user voiceprint, or control over the legitimate speaker. They tested distance, arrival angle, overlap, movement, noise, and multiple speakers. Audible semantic-confusion attacks remained more resilient over longer distances than attacks that depended on ultrasonic propagation and hardware coupling.
A separate double-blind study used a commercial Doubao AI Smartphone and 20 laboratory volunteers aged 20 to 40. Each participant completed trials across inaudible, low-intelligibility, and semantic-confusion modalities in indoor and outdoor settings. The paper says the researchers disclosed findings to Doubao and Qwen, but explicitly does not claim vendor confirmation or remediation.
The scope limits are significant. Physical experiments covered selected devices, rooms, speakers, microphones, and noise levels. The human study was a focused perceptual experiment, not a population-scale survey. The authors call for broader testing on AI glasses, smart speakers, more phones, adaptive replay, and voice-cloning attackers before generalizing the results.
CADV moves the control in front of semantic interpretation
The proposed defense, Cascaded Audio Decoupling and Verification (CADV), separates the mixed audio into tracks, extracts acoustic fingerprints, and checks whether instruction-bearing speech is consistent with the apparent user. It does not require a previously enrolled voiceprint. That design puts a security decision at the perception layer, before a prompt-only rule must reason over an already-combined transcript.
In the paper’s evaluation, CADV cut high-frequency attack success from 70.55% to 2.32%, pulse attacks from 75.50% to 25.09%, DolphinAttack from 81.55% to 33.95%, and foreign-language attacks from 72.36% to 29.00%. The abstract reports detection accuracy of up to 96% for the tested attacks. Prompt-only “explicit instruction” and sandwich defenses reduced some attacks but were less effective than CADV on the evaluated Qwen3 Omni Flash setting.
The defense is not free. False-positive rates were below 1.5% in the tested station, traffic, bus, and park noise, then rose to 14% for cafeteria audio and 35% for an office meeting with several concurrent talkers. Without a known voiceprint, benign overlapping speech can look like an injection. The paper recommends secondary confirmation in those scenes, which trades autonomy and latency for assurance.
Voice agents need a source-authentication boundary
The deeper lesson is that a microphone is an untrusted multi-principal input bus. Treating the entire acoustic scene as “the user” recreates the same confused-deputy problem seen when an email, web page, or tool result can inject instructions into a text agent. The modality changes; the missing authority boundary does not.
This also extends earlier AudioHijack research on hidden audio prompt injection. The new work focuses on a weaker third-party attacker who overlaps the real user and evaluates a perception-layer defense. It also reinforces the design principle from computer-use race-condition research: approval is meaningful only if the system binds the approved intent to the exact input source and action that executes.
What defensive engineering teams should change
- Classify ambient audio as hostile content. Microphone access authenticates a sensor, not every speaker or instruction captured by it.
- Separate perception from authority. Detect overlapping speakers and source changes before combining speech into one trusted prompt.
- Bind consequential actions to a principal. Payments, messages, navigation changes, unlocks, purchases, and credential use should require proof that the authorized user requested the exact action.
- Reconfirm on acoustic ambiguity. Multiple speakers, abrupt instruction updates, source inconsistency, inaudible energy, or unusual modulation should force a visible or user-specific confirmation channel.
- Keep policy outside the model. A semantic claim such as “task updated” must never elevate authority by itself. Enforce capabilities, destinations, amounts, and data access in deterministic controls.
- Test mixtures, not clean clips. Red-team with overlapping speech, televisions, calls, public announcements, adversarial speakers, replay, cloned voices, distance, angle, and device-specific microphone behavior.
- Measure security and denial cost together. Report attack success alongside false positives, benign-task completion, confirmation frequency, latency, and accessibility impact.
- Log the pre-action evidence. Preserve source-separation results, transcript timing, model decisions, confirmation events, and tool calls so responders can reconstruct which signal obtained authority.
AudioAgentSecurity does not prove that source separation solves voice-agent security. Its own meeting-room false positives show why that would be premature. It does show that prompt-level alignment begins too late once an agent has merged several acoustic principals into one instruction stream. For voice agents with real authority, the defensible default is not “the model heard a command.” It is “the system can establish who issued it, what they authorized, and whether that authorization still matches the action about to run.”
Sources: