title: Audio Jailbreak: An Open Comprehensive Benchmark for Jailbreaking Large
    Audio-Language Models
summary: The rise of Large Audio Language Models (LAMs) brings both potential and
  risks, as their audio outputs may contain harmful or unethical content.
  However, current research lacks a systematic, quantitative evaluation of LAM
  safety especially against jailbreak attacks, which are challenging due to the
  temporal and semantic nature of speech. To bridge this gap, we introduce
  AJailBench, the first benchmark specifically designed to evaluate jailbreak
  vulnerabilities in LAMs. We begin by constructing AJailBench-Base, a dataset of
  1,495 adversarial audio prompts spanning 10 policy-violating categories,
  converted from textual jailbreak attacks using realistic text to speech
  synthesis. Using this dataset, we evaluate several state-of-the-art LAMs and
  reveal that none exhibit consistent robustness across attacks. To further
  strengthen jailbreak testing and simulate more realistic attack conditions, we
  propose a method to generate dynamic adversarial variants. Our Audio
  Perturbation Toolkit (APT) applies targeted distortions across time, frequency,
  and amplitude domains. To preserve the original jailbreak intent, we enforce a
  semantic consistency constraint and employ Bayesian optimization to efficiently
  search for perturbations that are both subtle and highly effective. This
  results in AJailBench-APT, an extended dataset of optimized adversarial audio
  samples. Our findings demonstrate that even small, semantically preserved
  perturbations can significantly reduce the safety performance of leading LAMs,
  underscoring the need for more robust and semantically aware defense
  mechanisms.
paper_authors._id: 682f0439adae717195c35dd3
paper_authors.name: Zirui Song
paper_authors._id: 682f0439adae717195c35dd4
paper_authors.name: Qian Jiang
paper_authors._id: 682f0439adae717195c35dd5
paper_authors.name: Mingxuan Cui
paper_authors._id: 682f0439adae717195c35dd6
paper_authors.name: Mingzhe Li
paper_authors._id: 682f0439adae717195c35dd7
paper_authors.name: Lang Gao
paper_authors._id: 682f0439adae717195c35dd8
paper_authors.name: Zeyu Zhang
paper_authors._id: 682f0439adae717195c35dd9
paper_authors.name: Zixiang Xu
paper_authors._id: 682f0439adae717195c35dda
paper_authors.name: Yanbo Wang
paper_authors._id: 682f0439adae717195c35ddb
paper_authors.name: Chenxi Wang
paper_authors._id: 682f0439adae717195c35ddc
paper_authors.name: Guangxian Ouyang
paper_authors._id: 682f0439adae717195c35ddd
paper_authors.name: Zhenhao Chen
paper_authors._id: 682f0439adae717195c35dde
paper_authors.name: Xiuying Chen
paper_title: Audio Jailbreak: An Open Comprehensive Benchmark for Jailbreaking Large
    Audio-Language Models
paper_summary: The rise of Large Audio Language Models (LAMs) brings both potential and
  risks, as their audio outputs may contain harmful or unethical content.
  However, current research lacks a systematic, quantitative evaluation of LAM
  safety especially against jailbreak attacks, which are challenging due to the
  temporal and semantic nature of speech. To bridge this gap, we introduce
  AJailBench, the first benchmark specifically designed to evaluate jailbreak
  vulnerabilities in LAMs. We begin by constructing AJailBench-Base, a dataset of
  1,495 adversarial audio prompts spanning 10 policy-violating categories,
  converted from textual jailbreak attacks using realistic text to speech
  synthesis. Using this dataset, we evaluate several state-of-the-art LAMs and
  reveal that none exhibit consistent robustness across attacks. To further
  strengthen jailbreak testing and simulate more realistic attack conditions, we
  propose a method to generate dynamic adversarial variants. Our Audio
  Perturbation Toolkit (APT) applies targeted distortions across time, frequency,
  and amplitude domains. To preserve the original jailbreak intent, we enforce a
  semantic consistency constraint and employ Bayesian optimization to efficiently
  search for perturbations that are both subtle and highly effective. This
  results in AJailBench-APT, an extended dataset of optimized adversarial audio
  samples. Our findings demonstrate that even small, semantically preserved
  perturbations can significantly reduce the safety performance of leading LAMs,
  underscoring the need for more robust and semantically aware defense
  mechanisms.
paper_ai_summary: AJailBench evaluates jailbreak vulnerabilities in Large Audio Language Models using a dataset of adversarial audio prompts, revealing consistent safety weaknesses and the effectiveness of semantically preserved perturbations.
paper_ai_keywords: Large Audio Language Models jailbreak attacks AJailBench AJailBench-Base adversarial audio prompts policy-violating categories text to speech synthesis state-of-the-art LAMs dynamic adversarial variants Audio Perturbation Toolkit APT targeted distortions time domain frequency domain amplitude domain semantic consistency constraint Bayesian optimization AJailBench-APT