标题： “我不好”：在音频-语言模型中解释隐蔽、通用和鲁棒的音频越狱攻击 显示英文标题

标题： "I am bad": Interpreting Stealthy, Universal and Robust Audio Jailbreaks in Audio-Language Models

摘要： 多模态大语言模型的兴起引入了创新的人机交互范式，但也给机器学习安全带来了重大挑战。 音频-语言模型（ALMs）尤其相关，因为口语交流的直观性，但关于它们的失败模式了解甚少。 本文探讨针对ALMs的音频越狱攻击，重点关注其绕过对齐机制的能力。 我们构建了在提示、任务甚至基础音频样本中具有泛化能力的对抗性扰动，展示了音频模态中的首个通用越狱攻击，并表明这些攻击在模拟的真实世界条件下仍然有效。 除了展示攻击的可行性外，我们分析了ALMs如何解释这些音频对抗性示例，并揭示它们能够编码难以察觉的第一人称有害言论——这表明最有效的引发有害输出的扰动特别在音频信号中嵌入了语言特征。 这些结果对于理解多模态模型中不同模态之间的相互作用具有重要意义，并为增强防御对抗性音频攻击提供了可行的见解。 显示英文摘要

摘要： The rise of multimodal large language models has introduced innovative human-machine interaction paradigms but also significant challenges in machine learning safety. Audio-Language Models (ALMs) are especially relevant due to the intuitive nature of spoken communication, yet little is known about their failure modes. This paper explores audio jailbreaks targeting ALMs, focusing on their ability to bypass alignment mechanisms. We construct adversarial perturbations that generalize across prompts, tasks, and even base audio samples, demonstrating the first universal jailbreaks in the audio modality, and show that these remain effective in simulated real-world conditions. Beyond demonstrating attack feasibility, we analyze how ALMs interpret these audio adversarial examples and reveal them to encode imperceptible first-person toxic speech - suggesting that the most effective perturbations for eliciting toxic outputs specifically embed linguistic features within the audio signal. These results have important implications for understanding the interactions between different modalities in multimodal models, and offer actionable insights for enhancing defenses against adversarial audio attacks.