Sirens’ Whisper: When a Microphone Hears a Command You Don’t
Researchers used near-ultrasonic sound and consumer audio hardware to deliver hidden prompts to speech-driven AI. The jailbreak is one result. The covert audio channel is the bigger security issue.
Published: August 15, 2026
Estimated reading time: 6.5 minutes
Most of us assume a speaker, a listener and a microphone receive roughly the same sound.
They do not.
Human hearing, speaker hardware and microphone electronics each respond differently at the upper edge of the audible range. A research team behind Sirens’ Whisper used that mismatch to send spoken instructions through the air in a form that people in a controlled study could not reliably distinguish from ordinary background playback, while tested microphones recovered audio that software could process.
The researchers used the channel to deliver hidden jailbreak prompts to speech-driven AI systems. That makes for a dramatic demonstration, but it is not the full result.
The more important finding is that near-ultrasonic sound can carry a long, structured audio signal to commodity microphone hardware without presenting the same meaningful message to a nearby listener.
That is a new input-security problem, not evidence that every microphone-equipped device can now be silently controlled.
A microphone and a human ear do not receive the same signal
Sirens’ Whisper, which the researchers call SWhisper, starts with an ordinary baseband audio waveform—the spoken message before it is shifted into a higher frequency range. The system applies channel compensation and moves that waveform into the 17–22 kHz near-ultrasonic band for playback.
That band sits at and beyond the upper edge of human hearing. Whether a person can perceive anything there depends on age, hearing, playback equipment and the surrounding environment, so “inaudible” should be understood as a measured result under the study’s conditions rather than a universal property of every listener and every setup.
The receiving microphone is not simply acting as a better ear. Microphone diaphragms and front-end electronics are imperfectly linear. When the near-ultrasonic signal reaches compatible hardware, those nonlinearities can create a lower-frequency reconstruction of the original audio. Speech recognition or an audio-native model can then process that recovered waveform as speech.
The microphone is not intentionally decoding a secret protocol. Its physical response is doing the demodulation.
Near-ultrasonic injection itself is not new. Earlier work, including the 2023 Near-Ultrasound Inaudible Trojan study, demonstrated hidden voice commands using consumer speakers. The advance claimed by the SWhisper team is more faithful delivery: its channel model and inversion-based pre-compensation are designed to counter distortion introduced by the speaker, room and receiving hardware.
Why longer audio changes the problem
Previous acoustic-injection demonstrations often focused on short commands or transcription changes. A long prompt is harder. Small distortions accumulate, words are lost and the recovered message may no longer mean what the sender intended.
SWhisper is designed to carry what the paper calls “arbitrary target baseband audio,” including longer, structured prompts. Here, “arbitrary” refers to the target audio waveform. The research does not establish a general-purpose high-speed data network for any kind of digital file.
That distinction still leaves a broad security consequence. A high-fidelity hidden audio channel could carry more than a wake word or a single command. It could deliver context, instructions and prompt-injection text detailed enough for modern speech software to interpret.
The team’s AI jailbreak is therefore best understood as a demanding test of the channel. If a hidden signal survives acoustic transmission well enough for a language model to follow a structured adversarial prompt, the microphone did more than register a strange tone. It recovered meaningful content.
What the AI experiment showed
The researchers evaluated both speech-to-text pipelines connected to language models and end-to-end models that process audio directly. Their targets included open-source and commercial systems, and the attacks were performed in black-box settings where the target models’ internal parameters were unavailable.
The paper reports commercial-model scores as high as 0.94 for non-refusal and 0.925 for specific, convincing harmful output. Those are normalized StrongREJECT evaluation scores, not proof of a 94 percent takeover rate across voice assistants. They measure whether the tested models refused harmful requests and whether their responses contained detailed harmful content under the study’s evaluation design.
That boundary matters. A successful jailbreak shows that hidden audio influenced model behavior. It does not by itself demonstrate access to accounts, operating-system privileges, door locks, vehicles or industrial controls.
The paper argues that the same acoustic channel could support other prompt-injection and command-injection attacks. That is a credible direction for further research, not a finding that all of those downstream attacks have already been demonstrated.
What the physical tests actually covered
In the default experiment, the team used a HiVi M200MKIII+ loudspeaker and an iPhone 14 Pro microphone one meter apart in a relatively quiet 36–38 dB environment. It then varied conditions, testing distances from one to four meters, source angles, several noise environments and three receiving devices: an iPhone 14 Pro, a Redmi Note 12 and a HIKVISION-DS-VM1 microphone.
The results did not collapse when the researchers changed those conditions, although performance varied by target model and receiving device. That supports the claim that the method is more than a single perfectly aligned laboratory trick. It does not erase the dependence on hardware, room acoustics, speaker response and microphone processing.
The human-perception result came from an IRB-approved study with 32 participants between ages 21 and 63. In an ABX test conducted from approximately one meter at about 70 dB, participants compared background-only playback with background audio containing an SWhisper signal across quiet, office, restaurant, park and street soundscapes. Their identification accuracy stayed near chance, and the researchers found no statistically significant evidence that participants could distinguish the two conditions in the tested setup.
That is stronger evidence than simply asserting that the signal was inaudible. It is still evidence from a controlled study with specific audio levels, equipment and participants—not a guarantee that no person or animal will notice any near-ultrasonic transmission.
What this research does not establish
Sirens’ Whisper is not a universal remote-control technique for every phone, computer, smart speaker or vehicle.
An attack needs a suitable near-ultrasonic waveform to be played into the target’s environment. The receiving hardware must respond in a way that reconstructs usable baseband audio, and the target system must be listening and willing to process it. Speaker bandwidth, distance, angle, room reflections, front-end filters and software processing can all change the result.
The researchers also used channel modeling and an averaged transfer function to improve reliability across devices and environments. Their own discussion identifies adaptive channel modeling and stronger cross-model transfer as areas for future improvement.
The correct conclusion is not that any silent sound can control any listening device. It is that a microphone’s effective input space can include machine-readable signals that nearby humans do not recognize as instructions.
The defense has to extend beyond the transcript
SWhisper exposes a physical-layer weakness and an application-layer weakness at the same time. The microphone can recover hidden speech, and the software may treat that speech as an authorized instruction.
The paper discusses signal-based detection, but notes that defenses relying on surviving high-frequency evidence behave inconsistently across microphone front ends. Some tested devices filtered away the near-ultrasonic components that a detector would want to inspect even though lower-frequency content had already been reconstructed.
Model-level filtering can still reject malicious prompts, but jailbreak defenses remain an arms race. More durable protection comes from limiting what a voice input can authorize on its own. Sensitive actions should require explicit confirmation, strong identity checks and narrow permissions even when the speech recognizer is confident about what it heard.
The broader design lesson is simple: a microphone is an external input port. Systems should not assume that every intelligible signal captured by that port was audible to, understood by or authorized by the person standing nearby.
The bottom line
Sirens’ Whisper did not prove that the air has become an invisible universal hacking network.
It demonstrated something narrower and more useful: with tested commodity speakers and microphones, near-ultrasonic transmission and microphone nonlinearity can carry structured spoken content that software recovers while human listeners do not reliably recognize a message.
AI made the experiment vivid because a language model could interpret the recovered prompt. The lasting security issue is bigger than one model or one jailbreak. As microphones become interfaces to increasingly capable software, the gap between what a machine receives and what a person perceives becomes part of the threat model.
Sound is already a data channel. Sirens’ Whisper shows why systems must account for the messages people never realize were sent.