Prosody-driven Jailbreaks in Audio LLMs: A Controlled Study and Mechanistic Analysis
On the map: LLM safety and security → Audio jailbreaks and speech backdoors
Abstract (arXiv)
Audio-capable foundation models enable end-to-end spoken interaction, but they also introduce safety risks beyond transcript content. It remains unclear how much jailbreak capability can arise from matched-text variation in speech delivery rather than from lexical rewriting or broader style transfer. We study this question by holding transcript content fixed and varying six speech-delivery presets whose acoustic attributes may co-vary. We present PJ-Break, a black-box evaluation protocol with presets targeting arousal, authority, and speaking rate, together with AdvAudio-Prosody, a 600-sample benchmark with acoustically verified attributes. On the exact post-QC Qwen2-Audio panel, the Q=1 Panic (38/95), Anger (35/95), and Fast (32/95) presets are all well above Neutral (4/95). The fixed six-query pool covers 44/95 Qwen2-Audio seeds and 15/95 GPT-4o seeds and exceeds a matched-budget StyleBreak reimplementation (27/95) on Qwen2-Audio. A same-voice pool excluding the confounded Commanding condition still reaches 40/95, and a retained-panel ablation shows emotional-delivery audio alone (44/95) is far more effective than emotional text alone (11/95). Exploratory surrogate diagnostics and pilot mitigation observations are secondary, non-core analyses. Overall, matched-text speech delivery should be treated as a first-class factor in Audio LLM safety evaluation
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Audio jailbreaks and speech backdoors, one of 12 directions in LLM safety and security. Builds on 12 of its 32 references that are in the map. First posted on arXiv 29 Jul 2026.
Builds on
12 of 32 references.
Closest ancestors · 2
Same direction, newest first
- 2025Audio Jailbreak: An Open Comprehensive Benchmark for Jailbreaking Large Audio-Language Models21 May
- 2024Voice Jailbreak Attacks Against GPT-4o29 May
Other references · 10
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
- 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
- 2024Refusal in Language Models Is Mediated by a Single Directioncited by 960
- 2018Audio Adversarial Examples: Targeted Attacks on Speech-to-Textcited by 268
- 2018Style Tokens: Unsupervised Style Modeling, Control and Transfer in End-to-End Speech Synthesiscited by 257
- 2018Towards End-to-End Prosody Transfer for Expressive Speech Synthesis with Tacotroncited by 171
- 2024Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignmentcited by 42
- 2023ProsAudit, a prosodic benchmark for self-supervised speech modelscited by 24
- 2025Universal Acoustic Adversarial Attacks for Flexible Control of Speech-LLMscited by 5
- 2025StyleBreak: Revealing Alignment Vulnerabilities in Large Audio-Language Models via Style-Aware Audio Jailbreakcited by 4
Built on by
Not cited yet.