mlsanityData to 7 Oct 2026

DuplexJail: Safety Alignment Breaks Under Spoken Interruption in Full-Duplex Models

arXiv 2609.09420 ↗First posted 8 Sep 2026cs.CR cs.SDcited by 0

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

also in 1 more
Abstract (arXiv)

Full-duplex speech models accept user speech while generating responses, creating an underexplored attack surface. We introduce DuplexJail, which delivers fixed, request-independent spoken prompts through the user audio channel. We compare fixed-delay interruption after the harmful request ends with refusal-triggered interruption following a cue in the model's streaming text. Across four open-source models and 720 harmful requests from AdvBench and HarmBench, fixed-delay interruption raises whole-response attack success rates on AdvBench to 40.3% for PersonaPlex and 48.7% for PersonaPlex-RL, increases of +33.8 and +39.3 percentage points. The refusal-triggered policy reaches 35.6% and 48.6%, respectively, with all trials scored regardless of whether an interruption occurs. Selected conditions also increase FLM-Audio's harmful-response rate, while BayLing-Duplex shows decreases. These findings identify spoken interruption as a jailbreak attack vector and motivate evaluating safety throughout ongoing full-duplex interaction.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 21 of its 25 references that are in the map. First posted on arXiv 8 Sep 2026.

Builds on

21 of 25 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deep10 Jun
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 19

  1. 2022Robust Speech Recognition via Large-Scale Weak Supervisioncited by 3,972
  2. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  3. 2024Moshi: a speech-text foundation model for real-time dialoguecited by 536
  4. 2025IndexTTS2: A Breakthrough in Emotionally Expressive and Duration-Controlled Auto-Regressive Zero-Shot Text-to-Speechcited by 85
  5. 2024Best-of-N Jailbreakingcited by 71
  6. 2026PersonaPlex: Voice and Role Control for Full Duplex Conversational Speech Modelscited by 57
  7. 2025Full-Duplex-Bench v1.5: Evaluating Overlap Handling for Full-Duplex Speech Modelscited by 53
  8. 2025Full-Duplex-Bench-v2: A Multi-Turn Evaluation Framework for Duplex Dialogue Systems with an Automated Examinercited by 38
  9. 2024Audio Is the Achilles' Heel: Red Teaming Audio Large Multimodal Modelscited by 31
  10. 2025Multilingual and Multi-Accent Jailbreaking of Audio LLMscited by 25
  11. 2025MTR-DuplexBench: Towards a Comprehensive Evaluation of Multi-Round Conversations for Full-Duplex Speech Language Modelscited by 20
  12. 2025AudioJailbreak: Jailbreak Attacks against End-to-End Large Audio-Language Modelscited by 16
7 more
  1. 2025Dialogue Injection Attack: Jailbreaking LLMs through Context Manipulationcited by 13
  2. 2025FLM-Audio: Natural Monologues Improves Native Full-Duplex Chatbots via Dual Trainingcited by 9
  3. 2026Multi-Faceted Interactivity Alignment in Full-Duplex Speech Modelscited by 9
  4. 2024AdaPPA: Adaptive Position Pre-Fill Jailbreak Attack Approach Targeting LLMscited by 8
  5. 2025Investigating Safety Vulnerabilities of Large Audio-Language Models Under Speaker Emotional Variationscited by 4
  6. 2025StyleBreak: Revealing Alignment Vulnerabilities in Large Audio-Language Models via Style-Aware Audio Jailbreakcited by 4
  7. 2026BayLing-Duplex: Native Full-Duplex Speech Dialogue with a Single Autoregressive LLMcited by 3

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026SpeechJBB: Probing Safety Alignment and Comprehension in Large Audio Language Models under Code-Switched Speech
  2. 2025JALMBench: Benchmarking Jailbreak Vulnerabilities in Audio Language Models
  3. 2025SARSteer: Safeguarding Large Audio-Language Models via Safe-Ablated Refusal Steering
  4. 2025Audio Jailbreak Attacks: Exposing Vulnerabilities in SpeechGPT in a White-Box Framework
  5. 2026AOR-Bench: Do Large Audio Language Models Over-Refuse Pseudo-Harmful Queries?
  6. 2025SABER: Uncovering Vulnerabilities in Safety Alignment via Cross-Layer Residual Connection
  7. 2025"I am bad": Interpreting Stealthy, Universal and Robust Audio Jailbreaks in Audio-Language Models
  8. 2026Full-Duplex-Bench-v3: Benchmarking Tool Use for Full-Duplex Voice Agents Under Real-World Disfluency