Audio injection hijacks Gemini 3 Pro 69% of the time

A new attack embeds malicious instructions inside a user's own speech, hijacking Gemini 3 Pro in 69.1% of tests, according to a paper posted to arXiv.

Always-listening assistants are built to trust whatever the user says, and this attack breaks that assumption without touching a line of code. Researchers tested it against eleven agents, then took it off the bench onto a live Doubao AI smartphone with volunteers in real rooms.

The method, called instruction augmentation with scenario concealment, layers commands into audio overlapping the user's own speech, per the paper. That overlap is what makes the injection imperceptible, instead of an obvious separate sound.

There's a defense. CADV, which separates audio sources and checks them for consistency across channels, catches over 90% of these attacks. Prompt-level filtering misses them completely, per the paper.

The takeaway

CADV already catches over 90% of these attacks, so the technology isn't the hard part. What's unresolved is whether shipped products add anything like it. Doubao AI's phone assistant already proved the attack works in real rooms. The open question is whether it gets a defense like CADV before shipping teams keep trusting prompt-level filtering alone.