Freeze confidence and fall back to a human at the slightest doubt.
The threat
the attacker exploits transcription limits (errors, multilingual confusion, adversarial spoken phrases) to make the system read something other than what is said.
Blind spotWhy classic frameworks miss it
transcription is not a validated form field; a misunderstood utterance can trigger a high-impact action without any classic injection.
MitigationProposed approach
explicit transcription confidence threshold, language detection, human fallback on sensitive intents, deterministic validation before the critical path.
The proposed control
a low-confidence transcription does not trigger a sensitive action.
Expected evidence
demonstrate that an adversarial phrase never reaches the critical decision.
SourcesReferences and public research
MITRE ATLAS 2026.07AML.T0092 Manipulate User LLM Chat History
Public researchPublic research sources: MITRE ATLAS 2026.07 (verified technique mapping), OWASP GenAI (model abuse categories), and the public risk-voicebot (aivansoul/risk-voicebot) template defining the 20 checkpoints. No client registry data: generic card, no rating, no verdict.