Semantic anchor prefix injection achieves 69.10% ASR against Gemini 3 Pro via capability paradox

Auto-published from arXiv:2607.28165 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.82, flags: [possible-zero-day])

Category

indirect-prompt-injection

Model

Gemini 3 Pro

Surface

Multimodal audio agent (agent harness with audio input)

Setup

An attacker mixes an audible but low-intelligibility adversarial audio track—processed with pulse compression, spectral scrambling, or whisper-style transformation—into the acoustic environment during a user voice session. The adversarial track begins with a semantic anchor prefix such as 'Task Updated, execute now:' or 'Thinking Complete, Start New Command:' followed by a malicious instruction. The overlay exploits the model's instruction-following sensitivity to priority-signaling prefixes. No verbatim malicious command string is published in the paper's main text.

Observed behavior

Gemini 3 Pro followed injected instructions at a 69.10% average ASR while maintaining a 93% baseline instruction-completion rate (ICR) on benign commands. The paper identifies a 'capability paradox': stronger models show increased susceptibility because their superior degraded-speech parsing allows them to decode adversarial audio that weaker models would discard as noise.

Expected behavior

The model should treat ambiguous or low-intelligibility overlapping audio as environmental noise, refuse to act on instructions conflicting with the verified user's speech, and surface uncertainty to the user rather than resolving it by executing a novel command.

Reproducibility

medium

Threat model

A malicious actor who can introduce audio into a user's environment (compromised smart speaker, nearby phone, physical proximity) silently redirects a Gemini 3 Pro agent to perform unintended actions across domains including smart home control and financial asset management. The capability paradox means defensive gains from model quality improvements are offset by increased attack surface.

Novelty

Quantifies the counterintuitive capability paradox: frontier models' improved degraded-speech parsing makes them more vulnerable to low-intelligibility adversarial audio injection than weaker models—a trade-off not previously demonstrated at benchmark scale.

Source

• arXiv: 2607.28165
• PDF: https://arxiv.org/pdf/2607.28165
• Categories: cs.CR
• Authors: Mingxiao Liu, Yitong Li, Haoren Zhao, Yaoxiang Bian, Jianan Ma, Jian Zhang, Jialuo Chen, Xinhao Deng, Zhen Wang

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 3
• triage reason: Systematic red-team demonstrating audio prompt injection attacks on frontier agents (69% ASR on Gemini 3 Pro via AudioAgentSecurity benchmark with 8 scenarios, 10 attack patterns) and real-world human validation; no explicit vendor pre-disclosure mentioned.

─────────────────────────────────────────────────────────────────────