The attack works by learning a prefix that goes at the boundary of every input. This design is different from older attacks that had to be tuned to each sentence and had to start exactly at a specific instant. GhostPrefix also uses a new optimization that keeps the effect stable no matter what the speaker says after the prefix.

In computer‑based tests, the attack succeeded on average 97.6 % of the time when the goal was to steer the language model (prompted steering) and 93.4 % when the goal was to force the model to produce a specific target phrase. When the attack was used more generally, it increased the word‑error‑rate to just 1.18. In physical‑world (over‑the‑air) tests the success rates were 91.5 % for steering and 89.5 % for targeting. These mis‑interpretations then spread through downstream tools such as voice assistants and AI note‑taking.

The result shows that careful prefix design can reliably manipulate real‑time speech recognition in practical environments. However, the evaluation was limited to open‑source models in controlled settings and does not address how the attack would perform on proprietary, constantly updated services.