Skip to content

[Security] Size Whisper audio dummies from processor chunk_length - #56979

Open
jperezdealgaba wants to merge 4 commits into
vllm-project:mainfrom
jperezdealgaba:fix/audio-dummy-processor-chunk-length
Open

jperezdealgaba wants to merge 4 commits into
vllm-project:mainfrom
jperezdealgaba:fix/audio-dummy-processor-chunk-length

Conversation

@jperezdealgaba

Copy link
Copy Markdown
Contributor

Summary

Whisper-style audio dummy inputs and Qwen2-Audio token budgets were sized with a hardcoded 30-second cap even when the processor declared a longer chunk_length. Valid audio at that declared maximum therefore produced more encoder tokens than profiling reserved. This change sizes dummy waveforms and the shared audio token estimate from the processor chunk_length so the profiled budget covers the inputs the model actually accepts.

Changes

  • vllm/model_executor/models/qwen2_audio.py: get_mm_max_tokens_per_item uses the processor chunk_length instead of min(chunk_length, 30).
  • vllm/model_executor/models/qwen2_5_omni_thinker.py: Omni dummy audio (also used by Qwen3-Omni) uses the same processor duration.
  • vllm/model_executor/models/kimi_audio.py: Kimi-Audio dummy audio uses the processor duration.
  • vllm/model_executor/models/qwen3_asr.py: Qwen3-ASR dummy audio uses the processor duration.
  • tests/models/multimodal/processing/test_whisper_audio_dummy.py: regression coverage for the token estimate and dummy lengths.

Codepath coverage

  • Chat / completions / messages / responses / invocations / gRPC generate all size encoder cache from these model dummy/token helpers, so they are covered by the shared change.
  • Qwen2.5-Omni and Qwen3-Omni token estimates go through Qwen2AudioProcessingInfo.get_mm_max_tokens_per_item.
  • Qwen3-Omni dummy builder is an alias of the Qwen2.5-Omni builder.
  • Kimi-Audio and Qwen3-ASR have no separate token-estimate override; dummy length is the budget source.
  • Qwen2-Audio dummy already used processor chunk_length; only the token estimate was capped.

Duplicate-work check

Searched open and merged PRs for qwen2_audio.py, qwen2_5_omni_thinker.py, kimi_audio.py, target_audio_length, and dummy chunk_length. No open PR removes the 30-second cap. Merged #35994 added an audio token estimate for Omni but kept the 30-second clamp, which is the remaining mismatch.

Tests

  • test_qwen2_audio_max_tokens_uses_processor_chunk_length — 300 s processor budget is 7500 tokens, not the 30 s value.
  • test_qwen2_audio_max_tokens_matches_thirty_second_processor — 30 s processors still estimate 750 tokens.
  • test_qwen2_audio_dummy_uses_processor_chunk_length
  • test_qwen2_5_omni_dummy_uses_processor_chunk_length
  • test_qwen3_omni_dummy_builder_is_qwen2_5_omni_builder
  • test_kimi_audio_dummy_uses_processor_chunk_length
  • test_qwen3_asr_dummy_uses_processor_chunk_length

Commands:

.venv/bin/python -m pytest tests/models/multimodal/processing/test_whisper_audio_dummy.py -v
.venv/bin/pre-commit run --files vllm/model_executor/models/qwen2_audio.py vllm/model_executor/models/qwen2_5_omni_thinker.py vllm/model_executor/models/kimi_audio.py vllm/model_executor/models/qwen3_asr.py tests/models/multimodal/processing/test_whisper_audio_dummy.py

Results: 7 passed; pre-commit hooks passed.

AI assistance

This PR was developed with AI assistance.

Made with Cursor

Profiling and token budgets used a 30-second cap while some processors declare a longer chunk, so valid audio could exceed the profiled encoder budget.

Co-authored-by: Cursor Agent
Signed-off-by: Juan Pérez de Algaba <jperezde@redhat.com>

@claude claude Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

@mergify mergify Bot added multi-modality Related to multi-modality (#4194) qwen Related to Qwen models kimi labels Sep 15, 2026
@DarkLight1337

DarkLight1337 commented Sep 15, 2026 •

Copy link
Copy Markdown
Member

Could you run the startup e2e to confirm there are no significant regressions in terms of startup time and memory usage?

@jperezdealgaba

Copy link
Copy Markdown
Contributor Author

/ci run

@github-actions

Copy link
Copy Markdown

❌ This PR is 16 commits behind upstream main. Your branch must contain every commit currently on upstream main. No new CI build was started. Merge or rebase onto the latest main, then rerun /ci run. To test this branch at your own risk, use /ci run --allow-stale.

@jperezdealgaba

Copy link
Copy Markdown
Contributor Author

/ci run

@github-actions

Copy link
Copy Markdown

❌ This PR is 1 commit behind upstream main. Your branch must contain every commit currently on upstream main. No new CI build was started. Merge or rebase onto the latest main, then rerun /ci run. To test this branch at your own risk, use /ci run --allow-stale.

@jperezdealgaba

Copy link
Copy Markdown
Contributor Author

/ci run

@github-actions

Copy link
Copy Markdown

✅ Triggered Buildkite CI #89115 for commit 827e935a02fa.

@jperezdealgaba

Copy link
Copy Markdown
Contributor Author

/ci run

@github-actions

Copy link
Copy Markdown

✅ Triggered Buildkite CI #89305 for commit 9b76b06c18b1.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

kimi multi-modality Related to multi-modality (#4194) qwen Related to Qwen models

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants