mlsanityData to 14 Oct 2026

ERIS: Evolutionary Real-world Interference Scheme for Jailbreaking Audio Large Models

arXiv 2509.11128 ↗First posted 14 Sep 2025cs.SD cs.AIcited by 2

On the map: LLM safety and security → Audio jailbreaks and speech backdoors

Abstract (arXiv)

Existing Audio Large Models (ALMs) alignment focuses on clean inputs, neglecting security risks in complex environments. We propose ERIS, a framework transforming real-world interference into a strategically optimized carrier for jailbreaking ALMs. Unlike methods relying on manually designed acoustic patterns, ERIS uses a genetic algorithm to optimize the selection and synthesis of naturalistic signals. Through population initialization, crossover fusion, and probabilistic mutation, it evolves audio fusing malicious instructions with real-world interference. To humans and safety filters, these samples present as natural speech with harmless background noise, yet bypass alignment. Evaluations on multiple ALMs show ERIS significantly outperforms both text and audio jailbreak baselines. Our findings reveal that seemingly innocuous real-world interference can be leveraged to circumvent safety constraints, providing new insights for defensive mechanisms in complex acoustic scenarios.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Placed in Audio jailbreaks and speech backdoors, one of 12 directions in LLM safety and security. Builds on 26 of its 36 references that are in the map. First posted on arXiv 14 Sep 2025.

Builds on

26 of 36 references.

Closest ancestors · 4

Same direction, newest first

  1. 2025SPIRIT: Patching Speech Language Models against Jailbreak Attacks18 May
  2. 2025Jailbreak-AudioBench: In-Depth Evaluation and Analysis of Jailbreak Threats for Large Audio Language Models23 Jan
  3. 2024AdvWave: Stealthy Adversarial Jailbreak Attack against Large Audio-Language Models11 Dec
  4. 2024Audio Is the Achilles' Heel: Red Teaming Audio Large Multimodal Models31 Oct

Other references · 22

  1. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  2. 2022Robust Speech Recognition via Large-Scale Weak Supervisioncited by 4,057
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  4. 2023InstructBLIP: Towards General-purpose Vision-Language Models with Instruction Tuningcited by 2,876
  5. 2024MiniCPM-V: A GPT-4V Level MLLM on Your Phonecited by 1,079
  6. 2023Qwen-Audio: Advancing Universal Audio Understanding via Unified Large-Scale Audio-Language Modelscited by 608
  7. 2024Qwen2-Audio Technical Reportcited by 560
  8. 2023SALMONN: Towards Generic Hearing Abilities for Large Language Modelscited by 506
  9. 2023AudioPaLM: A Large Language Model That Can Speak and Listencited by 343
  10. 2018Audio Adversarial Examples: Targeted Attacks on Speech-to-Textcited by 274
  11. 2021SpeechT5: Unified-Modal Encoder-Decoder Pre-Training for Spoken Language Processingcited by 180
  12. 2019WHAM!: Extending Speech Separation to Noisy Environmentscited by 156
10 more
  1. 2023On decoder-only architecture for speech-to-text and large language model integrationcited by 145
  2. 2018Adversarial Attacks Against Automatic Speech Recognition Systems via Psychoacoustic Hidingcited by 85
  3. 2024CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completioncited by 76
  4. 2018Did you hear that? Adversarial Examples Against Automatic Speech Recognitioncited by 48
  5. 2024Breaking Down the Defenses: A Comparative Survey of Attacks on Large Language Modelscited by 44
  6. 2024Distilling an End-to-End Voice Assistant Without Instruction Training Datacited by 39
  7. 2024Large Language Models are Efficient Learners of Noise-Robust Speech Recognitioncited by 31
  8. 2025Evaluating Robustness of Large Audio Language Models to Audio Injection: An Empirical Studycited by 12
  9. 2021A Conformer-based ASR Frontend for Joint Acoustic Echo Cancellation, Speech Enhancement and Speech Separationcited by 9
  10. 2024AdaPPA: Adaptive Position Pre-Fill Jailbreak Attack Approach Targeting LLMscited by 8

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 1; 2026: 1.

2 papers.

  1. 2025Backdoor Collapse: Eliminating Unknown Threats via Known Backdoor Aggregation in Language Modelscited by 6
  2. 2026Audio Jailbreaks in Large Audio-Language Models: Taxonomy, Attack-Defense Analysis, and Cost-Aware Evaluationcited by 1

Similar, not cited

Close in wording, no citation either way

  1. 2026Acoustic Interference: A New Paradigm Weaponizing Acoustic Latent Semantic for Universal Jailbreak against Large Audio Language Models
  2. 2025`From Prompt to Perturbation': An Adaptive Framework for Voice-Based Jailbreaks on Audio LLMs
  3. 2026GRM: Utility-Aware Jailbreak Attacks on Audio LLMs via Gradient-Ratio Masking
  4. 2026AEGIS: Audio Endogenous Guarding via Internal Signals Against Large Audio-Language Model Jailbreaks
  5. 2026Sparse Tokens Suffice: Jailbreaking Audio Language Models via Token-Aware Gradient Optimization
  6. 2025"I am bad": Interpreting Stealthy, Universal and Robust Audio Jailbreaks in Audio-Language Models
  7. 2025Audio Jailbreak: An Open Comprehensive Benchmark for Jailbreaking Large Audio-Language Models
  8. 2025Multilingual and Multi-Accent Jailbreaking of Audio LLMs