Acoustic Interference: A New Paradigm Weaponizing Acoustic Latent Semantic for Universal Jailbreak against Large Audio Language Models

Yanyun Wang, Yu Huang, Zi Liang ...Full author list in the original paper.

The Hong Kong University of Science and Technology (Guangzhou) +2 · 43rd International Conference on Machine Learning (ICML'26)

Affiliations: The Hong Kong University of Science and Technology (Guangzhou), The Hong Kong Polytechnic University, The Chinese University of Hong Kong

Paper Code

Abstract

The integration of audio modality into Large Audio Language Models (LALMs) significantly expands their attack surface. Existing jailbreak paradigms predominantly treat audio as a carrier for malicious payloads, relying on semantic optimization, acoustic parameter control, or additive perturbation to embed harmful content into the audio signal. In this work, we challenge this necessity and propose a new paradigm in which the role of audio shifts from content injection to safety alignment interference. We reveal that LALM safety alignment can be compromised solely by specific Acoustic Latent Semantics (ALS), the underlying paralinguistic features intrinsic to the priors of audio generative models. Distinct from previous works that leverage explicit acoustic parameters to merely style malicious audio, we demonstrate that interference audio, benign in content but infused with specific ALS, can serve as a universal jailbreak trigger. Leveraging this insight, we propose the Acoustic Interference Attack (AIA), which decouples the attack payload from the audio. Specifically, AIA employs a set of universal, instruction-neutral interference audio, enabling standard malicious text queries to bypass safety alignment without instance-specific optimization. Extensive experiments on 10 LALMs across five datasets demonstrate that AIA achieves the state-of-the-art attack success rate. Furthermore, our interpretability analysis uncovers the inference path drift induced by AIA and identifies the inherent effective patterns within ALS, revealing the fundamental vulnerability of cross-modal alignment in LALMs.

The following analysis is generated by AI and may contain errors. It is separate from the authors’ abstract and is not peer review.

Research summary

This paper presents a novel approach to exploiting vulnerabilities in LALMs through the use of benign acoustic interference, significantly advancing the understanding of cross-modal safety alignment. The comprehensive methodology and rigorous experimental validation contribute to the field by uncovering a new dimension of attack strategies against audio language models, emphasizing the need for enhanced safety measures in AI systems.

Methodology

The paper introduces the Acoustic Interference Attack (AIA), which innovatively shifts the paradigm from traditional malicious audio content to benign audio infused with Acoustic Latent Semantics (ALS) that disrupts safety alignment in Large Audio Language Models (LALMs). The methodology is well-structured, detailing the construction of the ALS arsenal and the decoupling of attack payloads from audio, which is a significant departure from existing methods that rely on explicit malicious audio. The interpretability analysis and the use of a 12-dimensional index system for ALS enhance the robustness of the proposed method, providing a clear framework for understanding how acoustic features can influence model behavior.

Results & evaluation

The experiments are extensive, covering 10 LALMs across five datasets, and the results demonstrate a state-of-the-art attack success rate. The comparative analysis with existing jailbreak methods highlights the effectiveness of AIA, showing significant improvements in attack success rates across various models. The use of both automatic scoring metrics and human evaluations strengthens the validity of the findings. The paper also includes ablation studies that reinforce the importance of ALS quality in the attack's success.

Reproducibility

The authors provide a clear link to the project URL, where they have made the code and the universal audio arsenal publicly available. This transparency is crucial for reproducibility. The methodology is detailed enough to allow other researchers to replicate the experiments, although the reliance on specific models and datasets may still pose challenges for broader application.

Limitations

One limitation is the potential ethical implications of the research, as it focuses on bypassing safety mechanisms in LALMs, which could lead to misuse. Additionally, while the method shows promise, its effectiveness may vary across different LALMs and real-world scenarios not covered in the experiments. The paper could also benefit from a more thorough discussion on the implications of the findings for model safety and robustness.

Broader impact

The findings have significant implications for the security of LALMs, highlighting vulnerabilities that could be exploited in real-world applications. This research could prompt further investigations into improving safety alignment mechanisms in multimodal models, as well as inspire new defensive strategies against such attacks. The introduction of ALS as a concept may also open avenues for future research in understanding paralinguistic features in audio processing. This paper presents a novel approach to exploiting vulnerabilities in LALMs through the use of benign acoustic interference, significantly advancing the understanding of cross-modal safety alignment. The comprehensive methodology and rigorous experimental validation contribute to the field by uncovering a new dimension of attack strategies against audio language models, emphasizing the need for enhanced safety measures in AI systems.

Author of this paper? Send a correction.