Paper deep dive
Never Stop Speaking: a Denial-of-Service Attack on End-to-End Speech Language Models
Shuozhe Cheng, Kunlan Xiang, Mingxuan Li, Ji Zhang, Dongxiao Liu, Wenbo Jiang
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%
Last extracted: 8/13/2026, 5:25:29 AM
Summary
This paper proposes a novel Denial-of-Service (DoS) attack targeting End-to-End (E2E) Speech Large Language Models (ALLMs). Unlike text-based attacks that use adversarial suffixes, this method optimizes imperceptible acoustic perturbations on continuous speech waveforms to suppress the End-of-Sentence (EOS) token generation, thereby forcing the model to produce excessively long outputs and consume significant GPU resources. The attack employs a composite loss function (EOS loss, top-k logit loss, length loss, and semantic alignment loss) and uses Voice Activity Detection (VAD) to inject noise only into voiced segments for stealthiness. Experiments on models like LFM2.5-Audio, Fun-Audio-Chat, and Qwen2-Audio demonstrate high attack success rates and increased computational overhead.
Entities (9)
Relation Signals (7)
Fun-Audio-Chat-8B → istargetof → Denial-of-Service Attack
confidence 95% · We evaluate our audio adversarial attack on three recent open-source audio large models: ... Fun-Audio-Chat-8B
Qwen2-Audio-7B-Instruct → istargetof → Denial-of-Service Attack
confidence 95% · We evaluate our audio adversarial attack on three recent open-source audio large models: ... Qwen2-Audio-7B-Instruct
LFM2.5-Audio-1.5B → istargetof → Denial-of-Service Attack
confidence 95% · We evaluate our audio adversarial attack on three recent open-source audio large models: LFM2.5-Audio-1.5B
End-of-Sentence (EOS) Token → issuppressedby → Acoustic Perturbations
confidence 94% · optimizes imperceptible acoustic perturbations to directly influence the model's autoregressive generation process... suppressing EOS generation
Voice Activity Detection → isusedfor → Stealthiness Improvement
confidence 92% · To further improve stealthiness, we employ voice activity detection (VAD) to inject perturbations only into voiced regions.
OpenSLR → isusedforevaluationof → LFM2.5-Audio-1.5B
confidence 88% · For evaluation, we use two public speech datasets, OpenSLR and QCRI.
QCRI → isusedforevaluationof → LFM2.5-Audio-1.5B
confidence 88% · For evaluation, we use two public speech datasets, OpenSLR and QCRI.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Many studies have shown that specially crafted inputs can induce large language models (LLMs) to generate excessively long outputs, resulting in significant computational overhead and resource consumption. While most existing denial-of-service (DoS) attacks target text-only LLMs, end-to-end (E2E) speech LLMs are rapidly emerging. Existing text-based DoS attacks primarily rely on prompt engineering, such as adversarial suffixes or semantic inducement, which exploit the discrete nature of text inputs and therefore cannot be directly transferred to continuous speech inputs. Moreover, prior studies on speech model security mainly focus on ASR or TTS systems, leaving the DoS vulnerability of E2E speech LLMs largely unexplored. To address this gap, we propose the perturbation-based DoS attack targeting E2E speech models. Instead of inducing long outputs through prompt manipulation, our method optimizes imperceptible acoustic perturbations to directly influence the model's autoregressive generation process while preserving the original input length. Specifically, we formulate the attack as a composite optimization objective that jointly suppresses EOS generation, encourages prolonged decoding, and largely preserves semantic consistency by integrating weighted EOS loss, top-k logit loss, length loss, and semantic alignment loss. To further improve stealthiness, we employ voice activity detection (VAD) to inject perturbations only into voiced regions. Extensive experiments on three open-source E2E speech LLMs demonstrate that our method achieves stable attack success rate while significantly increasing generation length and GPU resource consumption, revealing security risks in modern ALLMs.
Tags
Links
- Source: https://arxiv.org/abs/2608.10405v1
- Canonical: https://arxiv.org/abs/2608.10405v1
Trouble viewing inline? Open PDF directly →
Full Text
45,446 characters extracted from source content.
Expand or collapse full text
Never Stop Speaking: a Denial-of-Service Attack on End-to-End Speech Language Models Shuozhe Cheng1, Kunlan Xiang, Mingxuan Li, Ji Zhang, Dongxiao Liu, Wenbo Jiang Email: sc8483629@gmail.comCorresponding author , Email:wenbo_jiang@uestc.edu.cn Abstract Many studies have shown that specially crafted inputs can induce large language models (LLMs) to generate excessively long outputs, resulting in significant computational overhead and resource consumption. While most existing denial-of-service (DoS) attacks target text-only LLMs, end-to-end (E2E) speech LLMs are rapidly emerging. Existing text-based DoS attacks primarily rely on prompt engineering, such as adversarial suffixes or semantic inducement, which exploit the discrete nature of text inputs and therefore cannot be directly transferred to continuous speech inputs. Moreover, prior studies on speech model security mainly focus on ASR or TTS systems, leaving the DoS vulnerability of E2E speech LLMs largely unexplored. To address this gap, we propose the perturbation-based DoS attack targeting E2E speech models. Instead of inducing long outputs through prompt manipulation, our method optimizes imperceptible acoustic perturbations to directly influence the model’s autoregressive generation process while preserving the original input length. Specifically, we formulate the attack as a composite optimization objective that jointly suppresses EOS generation, encourages prolonged decoding, and largely preserves semantic consistency by integrating weighted EOS loss, top-k logit loss, length loss, and semantic alignment loss. To further improve stealthiness, we employ voice activity detection (VAD) to inject perturbations only into voiced regions. Extensive experiments on three open-source E2E speech LLMs demonstrate that our method achieves stable attack success rate while significantly increasing generation length and GPU resource consumption, revealing security risks in modern ALLMs. Introduction End-to-end Audio Large Language Models (E2E ALLMs) have recently emerged as a promising paradigm for human-machine interaction, enabling direct understanding and generation of speech without relying on explicit intermediate representations. With their rapid deployment in voice assistants and conversational systems, ensuring the security and reliability of these models has become increasingly important. Among various security threats, denial-of-service (DoS) attacks pose a critical risk by forcing models to generate excessively long responses, leading to unnecessary computational consumption and service degradation. However, while DoS attacks have been extensively studied in text-based LLMs, the vulnerability of E2E ALLMs remains largely unexplored. Figure 1: The figure shows the outputs of the model with and without added noise for the same input.A clean input x(top) yields a normal speech response, while the adversarial example x+δ(bottom), crafted with a tiny perturbation, induces the model to produce excessive meaningless silent segments, drastically prolonging autoregressive decoding and incurring heavy computational overhead. Existing DoS attacks against large language models (Liu et al. 2026; Chen et al. 2026; Si et al. 2025) have been extensively studied. For example, adversarial suffix-based methods manipulate model behavior by appending carefully designed tokens, while recent approaches construct complex queries or decompose instructions into fine-grained reasoning steps to induce unnecessarily long generation. However, these strategies cannot be directly applied to end-to-end audio large language models (E2E ALLMs). Unlike text models that operate on editable discrete tokens, E2E ALLMs process continuous acoustic waveforms, making token-level manipulation infeasible. Moreover, prompt-based strategies typically rely on abnormally complex or unnatural inputs, which increase attack detectability and are difficult to transfer to speech inputs.Existing studies on ASR models (Haque et al. 2023) have explored DoS attacks by suppressing the logits of the EOS token. However, these methods mainly target the speech-to-text component and cannot address the complex generation process of E2E ALLMs. Furthermore, optimizing only EOS logits may lack sufficient constraints on other aspects of generation, potentially degrading semantic consistency or causing unstable decoding behavior. Therefore, crafting effective DoS attacks against E2E ALLMs remains challenging for three reasons. First, perturbations must be optimized in the continuous waveform space while remaining imperceptible and preserving the original input length. Second, directly optimizing discrete generation length is non-differentiable. Third, excessive suppression of termination signals may disrupt semantic consistency or generation stability, resulting in premature decoding failures rather than prolonged outputs. To address these issues, we propose an improved method based on multi-loss EOS logit suppression. Our loss function consists of the following four components: (1) Weighted EOS logit loss: On top of the basic summation of all EOS logits, we assign dynamic weights to the logits at each autoregressive step, incorporating token-wise penalties and generation process penalties. (2) top-k logit loss: We indirectly suppress the EOS output by increasing the probability of the top-k tokens output by the model. (3) Length loss: We force the model’s output length to align with max new tokens. (4) Semantic similarity loss: We maintain the semantic consistency between the original audio and the adversarial audio to ensure attack stealthiness. We show an example in Figure 1. To enhance attack stealthiness, we further employ voice activity detection (VAD) to extract voiced segments of the audio and add noise only to these voiced portions. Experimental results demonstrate that our method achieves strong performance on ALLM (Audio Large Language Model). Our contributions are as follows: • We present a novel end-to-end Denial-of-Service attacks on ALLMs, filling a critical gap in end-to-end ALLM security. • We propose a multi-objective optimization loss function to instantiate these attacks, providing a principled method for crafting adversarial inputs that disrupt ALLM behavior. • Extensive experiments demonstrate the effectiveness of our attacks, opening new research directions and highlighting practical vulnerabilities in ALLM systems. Related Work Denial-of-service attack The goal of Denial of Service (DoS) attacks is typically to break the output constraint of a model by constructing specially crafted inputs—such as adding adversarial suffixes, introducing spelling errors, or using homophones—thereby forcing the model to generate output indefinitely. As we know, each output token consumes substantial computational resources. Once a model begins generating unbounded responses, it continuously consumes server resources on the one hand; on the other hand, server resources are finite—once depleted, the server can no longer serve legitimate users. Previous research has demonstrated the effectiveness of DoS attacks. For example, Zhang et al. proposed the AutoDoS(Zhang et al. 2024) algorithm, which constructs a DoS attack tree and expands node coverage to achieve effectiveness under black-box settings. The P-DoS(Gao et al. 2024) attack injects poisoned samples during model fine-tuning to reduce the logits of the EOS token, thereby breaking the model’s output length limit. However, due to the discrete nature of text-based methods, they cannot be directly transferred to the audio domain. Existing attacks on audio models use overly simplistic loss functions and have not achieved satisfactory performance. E2E ALLM The development of the Transformer has brought transformative changes to the field of artificial intelligence. With its unique attention mechanism and contextual processing capability, it has rapidly driven the evolution of LLM architectures, demonstrating superiority across various domains. Leveraging the powerful capabilities of LLMs, many studies have explored multimodal (Latif et al. 2023) fusion architectures for text–video, text–image, and text–speech. Benefiting from this, speech models have gradually evolved from discrete cascade architectures (where speech input must pass through a text-based intermediate medium to produce output) to end-to-end (E2E) architectures centered around the Transformer. E2E ALLMs (Audio Large Language Models) have no explicit speech-to-text process internally (Dao et al. 2024). Instead, they achieve bidirectional understanding of text and speech through text–speech alignment strategies, often employing interleaved text and speech generation strategies, demonstrating powerful speech processing capabilities. VAD Voice Activity Detection aims to accurately distinguish voiced segments from silence or background noise in an audio signal, and is one of the fundamental techniques in speech processing. Traditional VAD methods are mostly based on energy thresholds, zero-crossing rates, or statistical models (B. Atal and L. Rabiner (1976); 18), but their performance is limited under low signal-to-noise ratio conditions. With the development of deep learning, neural network based VAD methods (Wilkinson and Niesler 2021; Zhang et al. 2016) have significantly improved detection robustness. In the field of adversarial attacks, VAD has been used to constrain the region where perturbations are added, for instance, adding noise only to voice activity regions to improve stealthiness while maintaining attack effectiveness. Our work adopts this idea by using VAD to extract voiced segments from the audio and adding optimized perturbations only on those segments, thereby avoiding noticeable artifacts in silent regions. Figure 2: This figure illustrates the workflow of the adversarial DoS attack targeting end-to-end speech large models. VAD is used to separate voiced and silent segments and generate a mask for adding imperceptible perturbations. Adversarial examples are synthesized by applying tiny perturbations to the original speech. In the white-box optimization loop, we construct the multi-loss function ℒmultiL_multi consisting of ℒeosL_eos, ℒTopkL_Topk, ℒlenL_len, and ℒsemL_sem, and optimize perturbations via PGD. Method In this work, we build on previous research and propose an improved method that constructs a composite loss function to achieve more precise and effective attacks. To enhance stealthiness, we employ VAD to segment the audio and add noise only to the voiced portions(Ko et al. 2026). Our optimization method uses gradient descent. Threat Model We consider a denial-of-service (DoS) threat against end-to-end ALLMs. The attacker’s goal is to degrade service availability by inducing the model to generate excessively long responses containing meaningless silent segments, thereby exhausting computational resources and increasing inference costs. We focus on the white-box attack setting, where the attacker has full access to the target model architecture and parameters and can compute gradients with respect to the input speech. However, the attacker can only introduce small, imperceptible adversarial perturbations to the input audio without modifying the model or its deployment environment. The perturbation magnitude is constrained below the human auditory perception threshold to ensure stealthiness. Attack Overview Prior work has shown that large language models (LLMs)(OpenAI 2023) are susceptible to denial-of-service (DoS) attacks. Conventional DoS methods targeting text-based models typically append adversarial suffixes to the input text—a technique that introduces discrete tokens and is thus inapplicable to the continuous audio modality. Alternative approaches craft complex semantic constructs or sub-queries to elicit longer outputs; however, naively converting such crafted text into speech and feeding it to the model lacks novelty, and our subsequent experiments confirm that this strategy is largely ineffective. Therefore, we propose our method. We consider a white-box attack scenario, where the attacker has full access to the architecture and parameters of the target end-to-end audio large language model (E2E ALLM) and can compute the gradients of the model’s output. Given an initial audio x, a white-box model F to be attacked, and a composite loss function L, we first apply VAD to segment x into voiced and silent segments. We extract all voiced segments V=x1,x2,…,xnV=\x_1,x_2,…,x_n\,and silent segments S=y1,y2,…,ynS=\y_1,y_2,…,y_n\. The goal of our attack is to generate noise N=σ1,σ2,…,σnN=\ _1, _2,…, _n\ for each voiced segment such that adding these noises to the original speech forces the model F to output as long as possible. It can be formulated as a constrained optimization problem: minσ1,σ2,…,σnℒ(F(x^)), _\ _1, _2,…, _n\ (F( x) ), (1) s.t.∥σi∥p≤ϵi,∀i∈1,2,…,n, s.t. \| _i\|_p≤ _i, ∀ i∈\1,2,…,n\, (2) x^=Concat(xi+σii=1n,S) x=Concat ( \x_i+ _i \_i=1^n,\ S ) (3) where ℒL is our proposed composite loss function detailed in the next subsection. By minimizing ℒL, the optimized perturbation effectively suppresses the End-of-Sentence (EOS) token probability while preserving semantic coherence, leading to prolonged autoregressive generation. Figure 2 illustrates the overall workflow of our attack. Noise Optimization Based on Composite Loss Function Optimization Pipeline Given the initial audio x and the target model F, we iteratively optimize the perturbation via gradient descent. At the beginning of each iteration, we concatenate the perturbed voiced segments (initialized with random Gaussian noise) with the unaltered silent segments to reconstruct the full adversarial waveform x x. We then feed x x into the speech encoder of the target model to extract acoustic features, followed by the autoregressive decoder. During the decoding process, we record three types of outputs at each step: the logit of the EOS token, the logits of the top-K tokens, and the final total generation length N. After the generation finishes (either by emitting EOS or reaching the maximum limit), we compute the composite loss ℒDoSL_DoS using the recorded values. The gradient of ℒDoSL_DoS with respect to the perturbation is calculated via backpropagation, and the perturbation is updated using Projected Gradient Descent (PGD)(Madry et al. 2018). This optimization loop repeats until the generated response reaches the preset maximum token limit NmaxN_ or the maximum iteration count is exhausted. The overall composite loss is defined as: ℒDoS=ℒeos+ℒtopk+ℒlen+ℒsemL_DoS=L_eos+L_topk+L_len+L_sem (4) In this loss function, the terms can be mainly divided into direct losses and indirect losses. The direct losses focus on controlling the generation length of the model by suppressing the EOS logits and stretching the length of the speech tokens output by the model. The indirect losses achieve indirect suppression of the EOS logits and smooth the model behavior by increasing the probability of top‑k token outputs and preserving semantic invariance of the noisy speech, thereby raising the probabilities of other tokens and preventing premature termination caused by semantic issues. Direct losses. The direct losses consist of two parts. The first is the EOS logits loss. Unlike the traditional approach of simply summing all EOS logits, we assign a weight to each EOS logit as follows: ℒeos=1N∑t=1NwtℓEOS,tL_eos= 1N _t=1^Nw_t _EOS,t (5) The weight consists of a sign-based gating component and a dynamically growing component. The gating component depends on the sign of the logit value. Since a non-positive EOS logit implies that the EOS token is almost impossible to be output, we set its weight to zero to completely exclude such uninformative steps from the optimization. Only steps with positive EOS logits are assigned a positive weight, directing the optimizer toward positions where EOS suppression is actually meaningful. The dynamic component depends on the depth of the autoregressive step. It is known that the probability of outputting the EOS token increases as generation proceeds. Therefore, this component gradually increases with the autoregressive step, and we adopt exponential growth to make the optimization pay more attention to later stages of the model output. wt=whighexp(tNκ),ℓEOS,t>00,ℓEOS,t≤0 w_t= casesw_high ( tNκ ),& _EOS,t>0\\ 0,& _EOS,t≤ 0 cases To encourage long generation sequences, we introduce a differentiable length loss. Since the generated audio token length is determined by the EOS prediction during autoregressive decoding, directly optimizing the discrete output length is not feasible. Therefore, we estimate the expected generation length based on the probability distribution of EOS termination at each generation step. Let ztz_t denote the EOS logit at the t-th generation step and pt=σ(zt)p_t=σ(z_t) be the corresponding EOS probability. The probability that the generation terminates at step t is computed by considering that no EOS token is generated before step t and an EOS token is generated at step t. The expected generation length is then formulated as: [L]=∑t=1Nt(pt∏i=1t−1(1−pi))E[L]= _t=1^Nt (p_t _i=1^t-1(1-p_i) ) (6) where N is the maximum generation length. The length loss is defined as: ℒLen=(Nmax−[L])2Nmax.L_Len= (N_ -E[L])^2N_ . (7) This formulation encourages the expected generation length to approach the maximum allowed length while maintaining a comparable scale with other loss terms. Indirect losses. The indirect losses also consist of two parts. The first is the top‑k loss. At each generation step, the model samples the output from the top‑k tokens. Therefore, the top‑k loss focuses on increasing the logits of the top‑k tokens. The increase in top‑k logits indirectly reduces the EOS logits. At the same time, increasing the top‑k logits helps preserve the coherence of the synthesized audio. ℒtopk=−1N∑t=1N1K∑k=1Kℓtopk,t(k)L_topk=- 1N _t=1^N 1K _k=1^K _topk,t^(k) (8) Finally, we introduce a semantic alignment loss. For the original speech and the noise‑added speech, we extract their features using a speech encoder and compute the cosine similarity between the two feature vectors. This ensures that the perturbation does not affect the semantics of the audio, thereby eliminating the possibility that changes in output length are caused by semantic alteration. ℒsem=1−⟨s(x),s(x+δ)⟩‖s(x)‖2‖s(x+δ)‖2L_sem=1- s(x),s(x+δ) \|s(x)\|_2\|s(x+δ)\|_2 (9) Experiment Experiment Setup Model and Datasets We evaluate our audio adversarial attack on three recent open‑source audio large models: LFM2.5‑Audio‑1.5B(AI 2025),Fun‑Audio‑Chat‑8B(Tan et al. 2025) and Qwen2‑Audio‑7B‑Instruct(Chu et al. 2024). LFM2.5‑Audio is a lightweight end‑to‑end foundation model designed for low‑latency real‑time speech conversation; Fun‑Audio‑Chat and Qwen2‑Audio are medium‑sized audio‑language dialogue models optimized for general speech interaction and audio analysis. We evaluate on two primary models and further report Qwen2-Audio results in Appendix. For evaluation, we use two public speech datasets, OpenSLR and QCRI. Attack Setup During the attack phase, we adopt the Projected Gradient Descent (PGD) framework to optimize adversarial perturbations, aiming to induce the target model to generate longer outputs. Specifically, we randomly sample 100 clean audio samples from each dataset, add the adversarial perturbations (generated by our method) to the original audio, and feed the perturbed audio into the target models to measure the attack success rate. Due to limited computational resources, we set Nmax=1024N_ =1024. The hyperparameters are set as follows. For ℒeosL_eos, we set the whigh=4w_high=4 and the exponential growth parameter κ=4κ=4. For ℒtopkL_topk, we set k=3k=3. During optimization, we run PGD for 200 iterations per sample, with the perturbation magnitude constrained by an ℓ∞ _∞ norm bound of ϵ=10−4ε=10^-4. Table 1: Attack performance comparison across different models and baselines. All experiments are performed on the OpenSLR and QCRI datasets across evaluated models. Model Method ASR (↑ ) AVG. Output Length (↑ ) Memory Usage (GB) Liquid Audio (1.5B) Clean audio 0.00 198.34 8.89/47.99 Random Noise 0.00 205.51 8.58/47.99 Simple Loss 0.79 857.38 10.56/47.99 Crabs 0.34 545.72 9.96/47.99 ExtendAttack 0.29 496.37 10.18/47.99 Our method 0.87 941.88 10.78/47.99 FunAudioChat (8B) Clean audio 0.00 213.57 20.26/47.99 Random Noise 0.00 210.83 20.29/47.99 Simple Loss 0.77 869.52 21.74/47.99 Crabs 0.36 594.38 21.50/47.99 ExtendAttack 0.48 607.54 21.16/47.99 Our method 0.84 920.24 21.93/47.99 Table 2: Ablation study on loss components ℒsemL_sem, ℒlenL_len (length loss), ℒeosL_eos, and ℒtopkL_topk. ℒsemL_sem ℒlenL_len ℒeosL_eos ℒtopkL_topk VAD ASR (↑ ) Avg.Output Length (↑ ) Response Quality (↑ ) ✓ ✓ ✓ ✓ 0.80 893.47 4.46 ✓ ✓ ✓ ✓ 0.12 289.43 4.71 ✓ ✓ ✓ ✓ 0.79 867.65 4.70 ✓ ✓ ✓ ✓ 0.83 937.81 3.92 ✓ ✓ ✓ ✓ 0.84 945.33 4.52 ✓ ✓ ✓ ✓ ✓ 0.84 950.24 4.75 Metrics To comprehensively evaluate the effectiveness and resource cost of our attack method across different baselines and all reported results are averaged over 100 samples. We adopt the following three metrics: • Attack Success Rate (ASR): The proportion of adversarial samples that successfully force the target model to generate audio token sequences reaching the maximum generation length limit. • Output Token Length: The number of tokens in the model’s generated response. We report the average output length over all test samples, which helps analyze how the attack influences the model’s generative behavior. • Peak GPU Memory Usage: The maximum GPU memory allocated during a single forward inference pass (without gradient computation), measured in MB or GB. This metric indicates the practical computational overhead and feasibility of the attack, especially for edge-side audio models. • Response Quality: We extract the generated text tokens from clean and adversarial inputs and use ChatGPT 5.5(OpenAI 2025) as an evaluator to assess semantic consistency and response quality. The final score is averaged over all samples on a 1-5 scale. The evaluation prompt is provided in Appendix A. To demonstrate the effectiveness of our proposed attack method, we compare it with the following three baselines: (1) using clean original audio or audio with random noise as input; (2) a conventional method that relies solely on naive eos logits; (3) a noise injection approach that operates on the entire global audio without employing Voice Activity Detection (VAD). (4) Crabs(Zhang et al. 2024), a kind of DoS attack on natural LLM (5) ExtendAttack(Zhu et al. 2025),a kind of dos attack on LRM Main Result Table 1 summarizes the attack performance under the default top-k sampling strategy. Our method consistently achieves the strongest DoS capability across different E2E ALLMs, demonstrating its effectiveness in manipulating autoregressive generation behaviors. On LFM2.5-Audio and FunAudioChat, our method achieves attack success rates of 87% and 84%, respectively, significantly outperforming all baseline methods. Meanwhile, the generated output length is extended to 941.88 and 920.24 tokens, which is more than four times longer than clean inputs and substantially exceeds random noise and existing DoS baselines. This indicates that the optimized acoustic perturbations can effectively prevent normal termination and force the model to continue decoding for an extended period, thereby introducing considerable computational overhead. Compared with the simple EOS suppression baseline, our method achieves higher ASR and longer outputs on both models. This improvement demonstrates that directly optimizing EOS logits alone is insufficient for reliable DoS attacks, while jointly modeling termination suppression, generation length, token distribution, and semantic consistency provides a more effective optimization objective. In addition, text-based DoS attacks, including Crabs and ExtendAttack, exhibit limited effectiveness when transferred to the audio domain, achieving much lower ASR and shorter outputs. These results further verify that discrete token manipulation strategies designed for text LLMs cannot be directly applied to continuous speech inputs. Beyond generation length, our attack also introduces practical computational costs. As shown in Table 1, the increased output length leads to substantial GPU memory consumption during inference, with our method requiring 10.78 GB and 21.93 GB on LFM2.5-Audio and FunAudioChat, respectively, compared with only 8.89 GB and 17.26 GB for clean inputs. These results reveal that carefully optimized acoustic perturbations can effectively exploit the autoregressive generation mechanism of E2E ALLMs and cause significant resource consumption while preserving the original input semantics. To further evaluate the robustness of our method, we additionally test different decoding strategies and the Qwen2-Audio model. We also test the attack transferability. The results under greedy decoding, on Qwen2-Audio and the transferability are reported in the Appendix. Figure 3: Waveform comparison between (a) clean output and (b) attacked output. The clean audio exhibits continuous voiced segments with high-amplitude oscillations, whereas the attacked output shows sparsely distributed speech fragments separated by extended flat silent regions Output Audio Analysis To further understand the mechanism behind output elongation, we analyze the generated waveforms and intermediate text responses from successfully attacked samples, as shown in Figure 3. The transcribed responses remain largely consistent with those generated from clean inputs, indicating that our attack does not significantly affect the model’s semantic understanding capability. However, waveform analysis reveals that attacked outputs contain substantially more low-energy silent regions compared with clean outputs. This phenomenon is mainly caused by the joint optimization of LEOSL_EOS and LlenL_len, which encourages the model to continue autoregressive decoding beyond its normal termination point. As generation extends beyond meaningful response ranges, the additional tokens tend to correspond to low-information speech segments, resulting in prolonged outputs and increased computational consumption. Ablation Study Effectiveness of Loss Components. To investigate the contribution of each component in our composite objective, we conduct ablation experiments by removing each loss term from LDoSL_DoS individually while keeping all other settings unchanged. The results are summarized in Table 2. Removing LEOSL_EOS leads to a significant degradation in attack performance, reducing the ASR from 0.84 to 0.12 and the average output length from 950.24 to 289.43 tokens. This demonstrates that weighted EOS suppression is the primary factor driving prolonged generation, as it directly prevents premature termination during autoregressive decoding. Without LlenL_len, the ASR decreases slightly to 0.79 and the output length drops to 867.65 tokens, indicating that the length loss provides additional optimization guidance toward the maximum generation boundary. Similarly, removing LtopkL_topk causes a moderate reduction in ASR and output length, while noticeably degrading response quality. This suggests that LtopkL_topk mainly improves generation stability by redistributing token probabilities and indirectly suppressing EOS prediction. Removing LsemL_sem slightly improves ASR and output length, but results in a substantial decline in response quality (from 4.75 to 3.92). This indicates that semantic alignment is not essential for maximizing output length, but plays a critical role in preserving the original speech semantics and ensuring attack stealthiness. Overall, the ablation results verify that each component serves a complementary purpose: LEOSL_EOS provides the fundamental attack capability, LlenL_len and LtopkL_topk enhance generation extension and stability, while LsemL_sem maintains semantic consistency. Effectiveness of the VAD Strategy. To evaluate the contribution of the VAD-based perturbation strategy, we compare our full method with a variant that applies perturbations to the entire waveform without VAD. As shown in TableAblation Study, removing VAD results in a similar attack success rate (0.84) and slightly shorter output length, indicating that restricting perturbations to voiced regions does not compromise the attack effectiveness. Meanwhile, the response quality decreases from 4.75 to 4.52 without VAD, suggesting that perturbing silent regions introduces unnecessary acoustic interference and affects semantic preservation. These results demonstrate that VAD provides a better trade-off between attack effectiveness and stealthiness by concentrating perturbations on informative speech regions. Effect of the exponential growth parameter κ. We further investigate the impact of the exponential growth parameter κ in LeosL_eos. As shown in Table 3, the attack performance first improves and then decreases as κ increases, with κ=4κ=4 achieves the best or comparable performance across all evaluated models. When κ is relatively small, the dynamic EOS weighting grows slowly, limiting the emphasis on later autoregressive steps where EOS prediction becomes more critical. Consequently, the optimizer may fail to sufficiently suppress EOS probabilities within the fixed optimization budget. In contrast, overly large κ values cause the EOS weights to increase too rapidly, which may introduce excessively large gradients and make the optimization unstable. Moreover, an excessively dominant LeosL_eos term can weaken the contributions of other loss components, such as length guidance and semantic preservation, resulting in degraded attack effectiveness. Therefore, we select κ=4κ=4 as it provides a balanced trade-off between effective EOS suppression and stable multi-objective optimization. Table 3: Ablation study on the exponential growth parameter κ in LeosL_eos. Model κ=2κ=2 κ=3κ=3 κ=4κ=4 κ=5κ=5 κ=6κ=6 LFM2.5-Audio 82% 84% 87% 86% 79% FunAudioChat 80% 82% 84% 82% 76% Qwen2-Audio 81% 83% 83% 79% 77% Attack Robustness We further evaluate the robustness of our adversarial perturbations against additional random noise. Specifically, after generating adversarial examples, we add extra noise η with different magnitudes relative to the original perturbation constraint ϵε, i.e., ‖η‖∞=αϵ\|η\|_∞=αε, and measure the resulting ASR. As shown in Fig. 4(a), our attack remains effective under small additional perturbations, indicating that the optimized perturbations can tolerate moderate input variations. It is worth noting that αϵαε represents the noise scale relative to the predefined perturbation bound rather than the actual magnitude of the optimized perturbation. Since the final perturbations generated by PGD may occupy different magnitude ranges across different models, the point at which additional noise starts to disrupt the attack varies among models. When the added noise reaches a comparable magnitude level to the optimized perturbation, the attack effectiveness gradually decreases, as the original adversarial direction is disturbed. Limitation Our robustness analysis reveals that lossy compression can affect the effectiveness of adversarial perturbations, as shown in Fig 4(b). This phenomenon is mainly because compression algorithms(Brandenburg 1995; Valin et al. 2012) transform the original waveform representation by removing or quantizing fine-grained acoustic details, which may distort the optimized perturbation patterns. Similar effects can also be observed in other signal-level transformations, such as resampling, filtering, or noise injection, which modify the input distribution and consequently interfere with the adversarial directions. However, these transformations introduce additional processing overhead and may degrade speech quality. Moreover, adaptive attackers may optimize perturbations considering the preprocessing pipeline, potentially reducing the robustness of such defenses. Therefore, developing practical defense mechanisms that can effectively disrupt adversarial perturbations while maintaining low latency and preserving speech quality remains an important future direction. (a) ASR under additional noise (b) Compression robustness Figure 4: (a) Attack performance under different additional noise. (b) Attack robustness against MP3 compression. Conclusion In this paper, we present a systematic study of denial-of-service (DoS) attacks against end-to-end audio large language models (E2E ALLMs). We propose a white-box adversarial attack framework that leverages VAD-based perturbation and a multi-component optimization objective to suppress EOS prediction and induce prolonged autoregressive generation. Extensive experiments on multiple E2E ALLMs demonstrate that the proposed method can effectively increase output lengths, achieve high attack success rates, and introduce substantial inference overhead while largely preserving the semantic information of the original speech. Through comprehensive ablation studies, we analyze the contribution of each loss component and show that weighted EOS suppression, length guidance, token distribution optimization, and semantic alignment jointly improve attack effectiveness and stealthiness. Furthermore, our robustness analysis reveals that the attack can tolerate moderate input perturbations, while signal transformations such as compression may significantly reduce its effectiveness. These findings highlight the potential security risks of current E2E ALLMs and motivate the development of practical defense mechanisms against audio-domain adversarial DoS attacks. References L. AI (2025) LFM2 technical report. arXiv preprint arXiv:2511.23404. Cited by: Model and Datasets. B. Atal and L. Rabiner (1976) A pattern recognition approach to voiced-unvoiced-silence classification with applications to speech recognition. IEEE Transactions on Acoustics, Speech, and Signal Processing 24 (3), p. 201–212. External Links: Document Cited by: VAD. K. Brandenburg (1995) The mpeg audio layer-3 coding standard. Proceedings of the IEEE 83 (4), p. 1260–1263. Cited by: Limitation. Y. Chen, Z. Li, X. Yue, R. T. Tan, and H. Li (2026) NaturalSloth: revisiting denial-of-service attacks on large language models. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), M. Liakata, V. P. Moreira, J. Zhang, and D. Jurgens (Eds.), San Diego, California, United States, p. 19685–19702. External Links: Link, Document, ISBN 979-8-89176-390-6 Cited by: Introduction. Y. Chu, J. Xu, Q. Yang, H. Wei, X. Wei, Z. Guo, Y. Leng, Y. Lv, J. He, J. Lin, C. Zhou, and J. Zhou (2024) Qwen2-audio technical report. arXiv preprint arXiv:2407.10759. Cited by: Model and Datasets. A. Dao, D. B. Vu, and H. H. Ha (2024) Ichigo: mixed-modal early-fusion realtime voice assistant. External Links: 2410.15316 Cited by: E2E ALLM. K. Gao, T. Pang, C. Du, Y. Yang, S. Xia, and M. Lin (2024) Denial-of-service poisoning attacks against large language models. External Links: 2410.10760, Document Cited by: Denial-of-service attack. M. Haque, R. Shah, S. Chen, B. Şişman, C. Liu, and W. Yang (2023) SlothSpeech: denial-of-service attack against speech recognition models. External Links: 2306.00794, Document Cited by: Introduction. K. Ko, S. Kim, and H. Kwon (2026) Audio adversarial example with no noise in the silent area for speech recognition system. IEEE Access 14 (), p. 2924–2938. External Links: Document Cited by: Method. S. Latif, M. Shoukat, F. Shamshad, M. Usama, Y. Ren, H. Cuay’ahuitl, W. Wang, X. Zhang, R. Togneri, E. Cambria, and B. W. Schuller (2023) Sparks of large audio models: a survey and outlook. External Links: 2308.12792 Cited by: E2E ALLM. X. Liu, X. Wang, Y. Zhang, S. Kariyappa, C. Xiang, M. Chen, G. E. Suh, and C. Xiao (2026) ReasoningBomb: a stealthy denial-of-service attack by inducing pathologically long reasoning in large reasoning models. External Links: 2602.00154, Document Cited by: Introduction. A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu (2018) Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, External Links: Link Cited by: Noise Optimization Based on Composite Loss Function. OpenAI (2023) Periodic outages across ChatGPT and API. Note: Accessed on 16/03/2024 External Links: Link Cited by: Attack Overview. OpenAI (2025) GPT-5.5 technical report. Note: OpenAI Technical Report External Links: Link Cited by: 4th item. W. M. Si, M. Li, M. Backes, and Y. Zhang (2025) Excessive reasoning attack on reasoning llms. External Links: 2506.14374v1, Link Cited by: Introduction. C. Tan, Q. Chen, W. Wang, C. Deng, Q. Zhang, L. Cheng, H. Yu, X. Zhang, X. Lv, T. Zhao, C. Zhang, Y. Ma, Y. Chen, H. Wang, J. Liu, X. Li, and J. Ye (2025) DrVoice: parallel speech-text voice conversation model via dual-resolution speech representations. External Links: 2506.09349, Link Cited by: Model and Datasets. J. Valin, K. Vos, and T. B. Terriberry (2012) Definition of the opus audio codec. Technical report Technical Report RFC 6716, Internet Engineering Task Force. Cited by: Limitation. [18] (2024) WebRTC voice activity detector. Note: https://webrtc.org/Open-source real-time voice activity detection algorithm widely adopted in speech processing pipelines Cited by: VAD. N. Wilkinson and T. Niesler (2021) A hybrid cnn-bilstm voice activity detector. In ICASSP 2021 - 2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Vol. , p. 6803–6807. External Links: Document Cited by: VAD. Y. Zhang, Y. Wang, and J. Glass (2016) Feature learning with raw-waveform cldnns for voice activity detection. In Interspeech, p. 3542–3546. Cited by: VAD. Y. Zhang, Z. Zhou, W. Zhang, X. Wang, X. Jia, Y. Liu, and S. Su (2024) Crabs: consuming resource via auto-generation for llm-dos attack under black-box settings. arXiv preprint arXiv:2412.13879. Note: arXiv:2412.13879v4 [cs.CL] Cited by: Denial-of-service attack, Metrics. Z. Zhu, Y. Liu, Z. Xu, Y. Ma, H. Gao, N. Chen, Y. Guo, W. Qu, H. Xu, Z. Kang, X. Zhu, and J. Zhang (2025) ExtendAttack: attacking servers of lrms via extending reasoning. External Links: 2506.13737, Link Cited by: Metrics. Appendix A Response Quality Evaluation Prompt To evaluate response quality, we use an LLM-as-a-Judge strategy. The generated text responses from clean and adversarial inputs are provided to ChatGPT for evaluation. Each response is assigned a score from 1 to 5, and the final Response Quality score is calculated by averaging the scores over all test samples. Prompt for Response Quality Evaluation Instruction: You are an evaluator for speech language model responses. Given a reference response generated from clean audio and an adversarial response generated from perturbed audio, evaluate whether the adversarial response preserves the semantic information and task completion ability of the reference response. Please assign an integer score from 1 to 5: 5: The adversarial response fully preserves the semantic content and quality of the reference response. 4: The adversarial response is mostly consistent with the reference response with minor degradation. 3: The adversarial response preserves the main information but has noticeable degradation. 2: The adversarial response has significant semantic differences or missing information. 1: The adversarial response fails to preserve the original meaning or task requirement. Only output the score. Figure 5: Prompt used for LLM-based response quality evaluation. Table 4: Attack performance under greedy decoding strategies Model Method ASR (↑ ) AVG. Output Length (↑ ) Memory Usage (GB) Liquid Audio (1.5B) Clean audio 0.00 162.52 8.07/47.99 Random Noise 0.00 161.28 8.96/47.99 Simple Loss 0.77 832.58 10.46/47.99 Crabs 0.34 538.24 9.92/47.99 Our method 0.86 927.69 10.27/47.99 FunAudioChat (8B) Clean audio 0.00 187.22 20.53/47.99 Random Noise 0.00 195.79 20.76/47.99 Simple Loss 0.76 852.34 21.19/47.99 Crabs 0.38 613.72 21.07/47.99 Our method 0.84 905.36 21.44/47.99 QwenAudio(7B) Clean audio 0.00 182.35 18.37/47.99 Random Noise 0.00 181.43 18.12/47.99 Simple Loss 0.74 807.75 19.09/47.99 Crabs 0.43 643.35 20.07/47.99 Our method 0.85 934.02 20.14/47.99 Appendix B Attack Performance under Greedy Decoding In the main experiments, we adopt top-k sampling as the default decoding strategy. To investigate whether the effectiveness of our attack depends on stochastic sampling behaviors, we further evaluate our method under greedy decoding, where the token with the highest probability is selected at each generation step. As shown in Table 3, our method maintains strong attack performance under deterministic decoding. Specifically, it achieves ASRs of 86%, 84%, and 85% on Liquid Audio, FunAudioChat, and Qwen2-Audio, respectively, while extending the average output length to over 900 tokens across all evaluated models. These results demonstrate that the proposed perturbations do not rely on sampling randomness, but instead directly influence the autoregressive generation process by suppressing termination and encouraging continuous decoding. The consistent performance between top-k sampling and greedy decoding further verifies the robustness of our optimization objective, showing that the attack can generalize across different decoding strategies and effectively expose the inherent generation-control vulnerability of E2E ALLMs. Table 5: Attack performance on Qwen2-Audio Model Method ASR (↑ ) AVG. Output Length (↑ ) Memory Usage (GB) Qwen-Audio(7B) Clean audio 0.00 187.13 18.42/47.99 Random Noise 0.00 179.46 18.37/47.99 Simple Loss 0.80 846.53 20.01/47.99 Crabs 0.42 665.19 19.07/47.99 Our method 0.83 913.07 19.94/47.99 Appendix C Evaluation under Qwen2-Audio To further evaluate the generality of our attack across different E2E ALLM architectures, we conduct additional experiments on Qwen2-Audio-7B-Instruct. As shown in Table 4, our method achieves an ASR of 83% and increases the average output length to 913.07 tokens, significantly outperforming clean inputs and random noise baselines. Meanwhile, the generated responses consume 19.94 GB GPU memory during inference, demonstrating that the optimized perturbations can effectively induce prolonged decoding and introduce additional computational overhead. Compared with the simple EOS suppression baseline, our method achieves higher attack effectiveness and longer generated sequences. This indicates that relying solely on EOS logit optimization is insufficient for stable DoS attacks, while jointly optimizing termination suppression, generation length, token distribution, and semantic consistency provides a more reliable attack objective. The consistent performance across Qwen2-Audio and the other evaluated E2E ALLMs demonstrates that our approach can effectively exploit the shared autoregressive generation mechanism of different audio language models. Figure 6: attack transferability Attack Transferability To evaluate the black-box transferability of our attack, we generate adversarial perturbations on one source model and directly apply them to other unseen target models. As shown in Fig6, the diagonal entries represent white-box attacks, achieving ASRs of 87%, 81%, and 83% on LFM2.5-Audio, FunAudioChat, and Qwen2-Audio, respectively. For cross-model transfer, the perturbations achieve non-zero ASRs across all settings, with transfer rates ranging from 7% to 13%. Models with similar scales exhibit relatively higher transferability, indicating that the optimized perturbations capture partially shared generation characteristics among E2E audio models. These results demonstrate the feasibility of our method in practical black-box scenarios.