In some implementations, a method includes receiving output audio data that is provided to a speaker of a device and that represents audio for output by the device, receiving, after the output audio data is provided to the speaker of the device, input audio data that represents audio detected by a microphone of the device, determining, by an output hotword detection model, that the output audio data that is provided to the speaker of the device includes a representation of a hotword, determining, by an input hotword detection model that is less accepting of hotwords than the output hotword detection model, that the input audio data that represents audio detected by a microphone of the device includes a representation of a hotword, and, in response, blocking use of the input audio data to initiate a command.