GRM: Utility-Aware Jailbreak Attacks on Audio LLMs via Gradient-Ratio Masking
Abstract
Audio large language models (ALLMs) enable rich speech-text interaction, but they also introduce jailbreak vulnerabilities in the audio modality. Existing audio jailbreak methods mainly optimize jailbreak success while overlooking utility preservation, as reflected in transcription quality and question answering performance. In practice, stronger attacks often come at the cost of degraded utility. To study this trade-off, we revisit existing attacks by varying their perturbation coverage in the frequency domain, from partial-band to full-band, and find that broader frequency coverage does not necessarily improve jailbreak performance, while utility consistently deteriorates. This suggests that concentrating perturbation on a subset of bands can yield a better attack-utility trade-off than indiscriminate full-band coverage. Based on this insight, we propose GRM, a utility-aware frequency-selective jailbreak framework. It ranks Mel bands by their attack contribution relative to utility sensitivity, perturbs only a selected subset of bands, and learns a reusable universal perturbation under a semantic-preservation objective. Experiments on four representative ALLMs show that GRM achieves an average Jailbreak Success Rate (JSR) of 88.46% while providing a better attack-utility trade-off than representative baselines. These results highlight the potential of frequency-selective perturbation for better balancing attack effectiveness and utility preservation in audio jailbreak. Content Warning: This paper includes harmful query examples and unsafe model responses.
The following analysis is generated by AI and may contain errors. It is separate from the authors’ abstract and is not peer review.
Research summary
The main contribution of this paper is the introduction of GRM, a utility-aware frequency-selective jailbreak framework for audio LLMs, which balances attack effectiveness and utility preservation. This work represents a meaningful advancement in the understanding and mitigation of vulnerabilities in audio-based AI systems, highlighting the importance of considering utility in adversarial settings.
Methodology
The proposed method, GRM (Gradient Ratio Masking), introduces a novel framework for audio jailbreak attacks that emphasizes a utility-aware approach. By focusing on frequency-selective perturbation, the authors demonstrate a systematic method for identifying key Mel frequency bands that contribute to jailbreak effectiveness while minimizing utility degradation. The dual-gradient scoring mechanism for band selection is a unique aspect that enhances the attack-utility trade-off. The methodology is well-structured, with clear definitions and a comprehensive explanation of the optimization process, making it a significant advancement in the field of audio adversarial attacks.
Results & evaluation
The experiments are robust, involving multiple representative ALLMs and a thorough evaluation of the attack's effectiveness through metrics such as Jailbreak Success Rate (JSR), Word Error Rate (WER), and Response Quality Score (RQS). The results indicate that GRM achieves a high average JSR of 88.46% while maintaining better utility preservation compared to existing baselines. The ablation studies provide insight into the contributions of different components of the GRM framework, further validating the effectiveness of the proposed method.
Reproducibility
The paper provides detailed implementation details, including the experimental setup, datasets, model configurations, and evaluation protocols. However, the lack of a publicly accessible code repository or demo URL limits the reproducibility of the results. The authors mention using specific models and datasets, which could be challenging for other researchers to replicate without access to the same resources.
Limitations
The study acknowledges several limitations, including potential bias in the evaluation metrics due to reliance on LLM-based judges and the lack of validation in real-world environments. Additionally, the method's effectiveness is primarily model-specific, with limited cross-model transferability observed. These factors may restrict the generalizability of the findings.
Broader impact
The implications of this research are significant, particularly in the context of audio security and the safety of audio large language models (ALLMs). By improving the attack-utility trade-off, the findings could inform the development of more robust defenses against audio jailbreak attacks. The methodology could also be applied to enhance the safety and reliability of audio-based AI systems in various applications, including voice assistants and interactive systems. The main contribution of this paper is the introduction of GRM, a utility-aware frequency-selective jailbreak framework for audio LLMs, which balances attack effectiveness and utility preservation. This work represents a meaningful advancement in the understanding and mitigation of vulnerabilities in audio-based AI systems, highlighting the importance of considering utility in adversarial settings.
Author of this paper? Send a correction.