mlsanityData to 7 Oct 2026

Now You Hear Me: Audio Narrative Attacks Against Large Audio-Language Models

arXiv 2601.23255 ↗First posted 30 Jan 2026cs.CL cs.AI cs.CRcited by 5

Not on the map. Why?

Abstract (arXiv)

Large audio-language models increasingly operate on raw speech inputs, enabling more seamless integration across domains such as voice assistants, education, and clinical triage. This transition, however, introduces a distinct class of vulnerabilities that remain largely uncharacterized. We examine the security implications of this modality shift by designing a text-to-audio jailbreak that embeds disallowed directives within a narrative-style audio stream. The attack leverages an advanced instruction-following text-to-speech (TTS) model to exploit structural and acoustic properties, thereby circumventing safety mechanisms primarily calibrated for text. When delivered through synthetic speech, the narrative format elicits restricted outputs from state-of-the-art models, including Gemini 2.0 Flash, achieving a 98.26% success rate that substantially exceeds text-only baselines. These results highlight the need for safety frameworks that jointly reason over linguistic and paralinguistic representations, particularly as speech-based interfaces become more prevalent.

Key facts. Cited by 5 papers in the map (data through 7 Oct 2026). Builds on 34 of its 56 references that are in the map. First posted on arXiv 30 Jan 2026.

Builds on

34 of 56 references.

References · 34

  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  2. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  3. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,106
  4. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 533
  5. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Promptscited by 520
  6. 2022Using Large Language Models to Simulate Multiple Humans and Replicate Human Subject Studiescited by 506
  7. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 439
  8. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreakercited by 337
  9. 2023Pengi: An Audio Language Model for Audio Taskscited by 217
  10. 2024AIR-Bench: Benchmarking Large Audio-Language Models via Generative Comprehensioncited by 215
  11. 2024Mini-Omni: Language Models Can Hear, Talk While Thinking in Streamingcited by 204
  12. 2025VITA-1.5: Towards GPT-4o Level Real-Time Vision and Speech Interactioncited by 191
22 more
  1. 2024GAMA: A Large Audio-Language Model with Advanced Audio Understanding and Complex Reasoning Abilitiescited by 151
  2. 2024WavChat: A Survey of Spoken Dialogue Modelscited by 88
  3. 2024Fast Adversarial Attacks on Language Models In One GPU Minutecited by 85
  4. 2024Defending Large Language Models Against Jailbreak Attacks via Layer-specific Editingcited by 77
  5. 2024Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMscited by 47
  6. 2024Advancing Large Language Models to Capture Varied Speaking Styles and Respond Properly in Spoken Conversationscited by 45
  7. 2024Voice Jailbreak Attacks Against GPT-4ocited by 39
  8. 2024Unveiling the Safety of GPT-4o: An Empirical Study using Jailbreak Attackscited by 35
  9. 2023Paralinguistics-Enhanced Large Language Modeling of Spoken Dialoguecited by 25
  10. 2025Multilingual and Multi-Accent Jailbreaking of Audio LLMscited by 25
  11. 2023EmphAssess : a Prosodic Benchmark on Assessing Emphasis Transfer in Speech-to-Speech Modelscited by 21
  12. 2024Cognitive Biases in Large Language Models: A Survey and Mitigation Experimentscited by 20
  13. 2024Frozen Large Language Models Can Perceive Paralinguistic Aspects of Speechcited by 18
  14. 2024Comparing Discrete and Continuous Space LLMs for Speech Recognitioncited by 15
  15. 2025Exploring Jailbreak Attacks on LLMs through Intent Concealment and Diversioncited by 9
  16. 2025`From Prompt to Perturbation': An Adaptive Framework for Voice-Based Jailbreaks on Audio LLMscited by 6
  17. 2024Beyond Text: Utilizing Vocal Cues to Improve Decision Making in LLMs for Robot Navigation Taskscited by 5
  18. 2025Audio Jailbreak Attacks: Exposing Vulnerabilities in SpeechGPT in a White-Box Frameworkcited by 4
  19. 2025CantoASR: Prosody-Aware ASR-LALM Collaboration for Low-Resource Cantonesecited by 3
  20. 2025GuardVal: Dynamic Large Language Model Jailbreak Evaluation for Comprehensive Safety Testingcited by 2
  21. 2025CMDAR: A Chinese Multi-scene Dynamic Audio Reasoning Benchmark with Diverse Challengescited by 1
  22. 2025Optimizing Speech Language Models for Acoustic Consistencycited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 5.

5 papers.

  1. 2026The Interspeech 2026 Audio Reasoning Challenge: Evaluating Reasoning Process Quality for Audio Reasoning Models and Agentscited by 6
  2. 2026A Systematic Study of Cross-Modal Typographic Attacks on Audio-Visual Reasoningcited by 0
  3. 2026Audio Jailbreaks in Large Audio-Language Models: Taxonomy, Attack-Defense Analysis, and Cost-Aware Evaluationcited by 0
  4. 2026Not the Same Protector: Deployment-Dependent Protective Intervention in LLMscited by 0
  5. 2026Causal Localization of the Refusal Direction in Audio Language Modelscited by 0