CodecAttack: Codec-Robust Latent-Space Prompt-Injection Attacks on Audio LLMs

Prior attacks on Audio Large Language Models (Audio LLMs) can force targeted outputs, but waveform perturbations often lose effectiveness under lossy compression, motivating codec preprocessing as a defense. We introduce CodecAttack, which optimizes bounded perturbations in a neural audio codec's continuous latent space using multi-bitrate Expectation-over-Transformation (EoT) with a straight-through estimator. Across four application settings and three Audio LLMs, CodecAttack averages 83.3% targeted attack success rate (ASR) at Opus 64 and 128 kbps over three optimization seeds, compared with 37.2% for the original codec-aware waveform baseline with the same optimizer, EoT grid, and step budget. Success requires the complete target string to appear in the response after case and whitespace normalization. The attack also survives held-out MP3 delivery, reaching up to 99.3% mean ASR at 64 kbps, while AAC-LC robustness varies by model and carrier. Decoder analysis identifies a spectral bias in the latent parameterization, but a matched-SNR waveform control restricted to ≤4 kHz remains below the latent attack on a held-out S1 subset, indicating that the tested frequency restriction alone is insufficient to reproduce its effectiveness. A separate higher-budget multi-victim stress test demonstrates nonzero targeted transfer to three held-out models across repeated optimization runs, with success varying across victims, delivery channels, and ensemble compositions. Neural re-synthesis substantially reduces ASR in the evaluated settings, although EnCodec-specific adaptation recovers substantial success through EnCodec. These results show that latent parameterization achieves higher targeted ASR after transport compression than the original codec-aware waveform baseline under the evaluated optimization configurations. They also demonstrate that transport compression alone does not reliably prevent targeted output manipulation in the evaluated white-box setting.