perturbations engineered into the inaudible band that steer a model's behavior while a human hears nothing wrong. The residual — what the model attends to and you can't — turned into an attack surface.
