标题： 当良好声音变得对抗性：使用良性输入破解音频-语言模型 显示英文标题

标题： When Good Sounds Go Adversarial: Jailbreaking Audio-Language Models with Benign Inputs

摘要： 随着大型语言模型日益融入日常生活，音频已成为人机交互的关键接口。 然而，这种便利性也引入了新的漏洞，使音频成为对手的潜在攻击面。 我们的研究介绍了WhisperInject，这是一种两阶段的对抗性音频攻击框架，能够操纵最先进的音频语言模型生成有害内容。 我们的方法在音频输入中使用对人类听者无害的不可察觉扰动。 第一阶段使用一种新颖的基于奖励的优化方法，基于投影梯度下降的强化学习（RL-PGD），引导目标模型绕过其自身的安全协议并生成有害的原生响应。 然后，此原生有害响应作为第二阶段的目标，即负载注入，我们使用投影梯度下降（PGD）来优化嵌入到良性音频载体中的细微扰动，例如天气查询或问候信息。 在严格的StrongREJECT、LlamaGuard以及人类评估安全评估框架下进行验证，我们的实验表明，在Qwen2.5-Omni-3B、Qwen2.5-Omni-7B和Phi-4-Multimodal上的成功率超过86%。 我们的工作展示了一类新的实用的、音频原生的威胁，超越了理论上的漏洞，揭示了一种可行且隐蔽的操控AI行为的方法。 显示英文摘要

摘要： As large language models become increasingly integrated into daily life, audio has emerged as a key interface for human-AI interaction. However, this convenience also introduces new vulnerabilities, making audio a potential attack surface for adversaries. Our research introduces WhisperInject, a two-stage adversarial audio attack framework that can manipulate state-of-the-art audio language models to generate harmful content. Our method uses imperceptible perturbations in audio inputs that remain benign to human listeners. The first stage uses a novel reward-based optimization method, Reinforcement Learning with Projected Gradient Descent (RL-PGD), to guide the target model to circumvent its own safety protocols and generate harmful native responses. This native harmful response then serves as the target for Stage 2, Payload Injection, where we use Projected Gradient Descent (PGD) to optimize subtle perturbations that are embedded into benign audio carriers, such as weather queries or greeting messages. Validated under the rigorous StrongREJECT, LlamaGuard, as well as Human Evaluation safety evaluation framework, our experiments demonstrate a success rate exceeding 86% across Qwen2.5-Omni-3B, Qwen2.5-Omni-7B, and Phi-4-Multimodal. Our work demonstrates a new class of practical, audio-native threats, moving beyond theoretical exploits to reveal a feasible and covert method for manipulating AI behavior.