AudioHijack：听不见的指令以 96% 的成功率劫持 AI 语音模型

浙江大学研究人员开发了 AudioHijack，这是一种攻击方法：在音频中嵌入难以察觉的命令，以 79–96% 的成功率操纵大型音频语言模型。该攻击在圣弗朗西斯科举行的第 47 届 IEEE 安全与隐私研讨会上进行了展示。AudioHijack 的工作原理是：在数字音频波形内部修改数值，这种改动对人类听众而言难以察觉，但仍会影响 AI 模型对信号的解读。研究称，被操纵的音频即使在剪辑中包含合法的用户指令，也能够覆盖或重定向模型的行为。

“训练这个信号只需要半小时，然后因为这个信号与上下文无关，你就可以在任何你想要的时候攻击目标模型，无论用户说什么，”浙江大学第一作者、博士生孟晨（Meng Chen）表示。

How AudioHijack Differs from Traditional Attacks

AudioHijack differs from traditional prompt injection attacks because it does not manipulate what the user says to the AI. Instead, it alters the audio signal itself, embedding hidden instructions inside sounds humans cannot hear. This approach makes the attack harder to defend against because it bypasses safeguards designed to detect suspicious text prompts.

Capabilities and Tested Systems

Researchers tested AudioHijack on 13 open-source AI voice models and found it could make them refuse requests, spread false information, insert harmful links, change personality, or perform actions the user never asked for, including web searches, file downloads, and emails containing personal data. The attacks also worked on commercial voice AI systems from Microsoft and Mistral that use similar technology.

Delivery Methods

Possible delivery methods include online videos, music clips, voice notes, or audio from Zoom calls uploaded to AI transcription services. The team also demonstrated similar attacks in live AI voice chats through unpublished follow-up work.

防御局限

研究人员测试的最有效防御措施是监控模型的内部注意力机制。不过，他们也发现，攻击者如果了解该防御，可以在维持攻击效果大部分的同时，削弱操纵的强度。

“这些单点防御很难抵抗我们的攻击，因为我们发现，这些模型要区分正常用户意图和我们的对抗攻击非常困难，”陈表示。

根据研究，这些研究人员正在调查该技术是否能够通过共享的开源音频组件，从 OpenAI 和 Anthropic 的封闭模型中实现攻击。