Pith. sign in

REVIEW 4 major objections 7 minor 3 cited by

Audio Jailbreak: An Open Comprehensive Benchmark for Jailbreaking Large Audio-Language Models

T0 review · 4 major / 7 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Large audio-language models fail safety tests under small, meaning-preserving audio tweaks.

desk verdict A useful benchmark with a real contradiction: Table 3's Policy Violation metric gets safer under APT+, undercutting the headline claim, but the dataset and perturbation pipeline are worth having. read the letter →

arxiv 2505.15406 v1 pith:RYA4KMAN submitted 2025-05-21 cs.SD cs.AIeess.AS

Zirui Song , Qian Jiang , Mingxuan Cui , Mingzhe Li , Lang Gao , Zeyu Zhang , Zixiang Xu , Yanbo Wang
show 4 more authors
Chenxi Wang Guangxian Ouyang Zhenhao Chen Xiuying Chen
This is my paper · ORCID
classification cs.SDcs.AIeess.AS
keywords audiojailbreaklargeaudio-languagemodelssafetybenchmarkadversarialperturbationsemanticconsistencyBayesianoptimizationtext-to-speechmultimodal
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that state-of-the-art large audio-language models (LAMs) are not reliably safe against jailbreak attacks delivered through audio. It introduces AJailBench, a benchmark with 1,495 adversarial audio prompts in 10 policy-violating categories, and shows that none of seven evaluated LAMs is robust across all attack types. The paper further claims that subtle audio perturbations—time, frequency, and mixing distortions that preserve the spoken meaning—can significantly reduce safety performance, even for strong models like GPT-4o and Gemini. If true, current LAM safety alignment is vulnerable not just to harmful content in speech but to acoustic tricks that bypass refusal mechanisms while leaving the user's intent intact.

What carries the argument

The central object is AJailBench, comprising a static base dataset and an optimized perturbed dataset. The load-bearing mechanism is the combination of the Audio Perturbation Toolkit (APT) and the Semantic Consistency Constraint: APT applies parameterized transformations across time, frequency, and mixing domains, while the constraint filters perturbations using a GPTScore-based threshold (average 0.638 from 150 human-rated samples) to ensure the perturbed audio retains the original jailbreak intent. Bayesian optimization (Tree-structured Parzen Estimator) then searches a two-dimensional parameter space to minimize the cosine similarity between the model's response and a set of refusal phrases, yielding perturbations that are both subtle and effective.

What would settle it

Take a random sample of AJailBench-APT+ audio samples and have independent human listeners transcribe or rate the semantic fidelity against the original jailbreak prompt. If a substantial share of samples that pass the 0.638 GPTScore threshold and trigger successful attacks are judged by humans to have changed meaning or become unintelligible, the claim that small semantically preserved perturbations cause the vulnerability collapses.

Watch

Extended reading notes

Core claim

The central claim is that LAMs can be jailbroken through semantically preserved signal-level perturbations, not only through adversarial text content spoken aloud. The paper builds AJailBench-Base from text jailbreaks converted to speech, evaluates seven LAMs, and finds that no model is consistently robust across categories. It then develops the Audio Perturbation Toolkit (APT) with seven perturbation methods, enforces a Semantic Consistency Constraint using GPTScore calibrated by human ratings, and uses Bayesian optimization to search for effective perturbation configurations. On AJailBench-APT+, models show significantly degraded safety metrics (higher attack success rate, toxicity, and policy violation) compared to the base set, with the paper arguing this reveals an underexplored attack surface beyond text-level prompts.

Load-bearing premise

The central claim rests on the assumption that the Semantic Consistency Constraint actually guarantees that perturbed audio preserves meaning: the threshold is derived from 150 human-rated samples, and if that calibration does not generalize, the attack success on APT+ audio could be caused by altered or unintelligible content rather than by acoustically bypassing safety alignment.

Editorial extensions

If this is right

  • If LAMs can be jailbroken by semantically preserved acoustic perturbations, current safety evaluations that rely on clean, transcribed speech are incomplete and may overstate real-world robustness.
  • The absence of consistent robustness across all evaluated models means that no single LAM can yet be trusted as safely aligned for audio interactions without further defense mechanisms.
  • The benchmark's semantic consistency constraint enables transferable adversarial examples across voices and accents, suggesting that acoustic jailbreaks could generalize in black-box settings.
  • The paper's proposed defenses—adversarial fine-tuning, consistency regularization, and front-end signal filtering—become concrete next steps if the vulnerability claims hold.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The finding that time-stretch and fade perturbations are most effective hints that LAM speech encoders are particularly sensitive to prosodic and temporal distortions; a testable extension would be to adversarially train audio encoders on exactly these transformations to see if robustness improves without sacrificing semantic fidelity.
  • If semantic preservation is truly satisfied, then the attack success of APT+ samples suggests that LAM alignment operates primarily at the transcribed-text level, which would motivate defenses that inspect acoustic features directly rather than post-ASR text.
  • The GPTScore threshold calibration on 150 English samples may not transfer to other languages or noisy real-world conditions, so an immediate extension is to validate the semantic consistency constraint on multilingual or accented audio before trusting cross-lingual attack results.
  • A natural next benchmark is to combine APT perturbations with text-level jailbreak diversity or with background noise found in physical environments, which would test whether the reported vulnerabilities survive in realistic voice-assistant scenarios.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper introduces AJailBench, which it claims is the first open benchmark specifically designed to evaluate jailbreak vulnerabilities in large audio-language models (LAMs). It constructs AJailBench-Base, a dataset of 1,495 text-derived jailbreak prompts converted to speech with varied TTS voices across 10 policy-violating categories, and evaluates seven LAMs with five metrics (ASR, TS, PV, Relevance, Similarity). It then proposes the Audio Perturbation Toolkit (APT), containing seven time-, frequency-, and mixing-domain perturbations, a semantic consistency constraint based on GPTScore and human calibration, and a Bayesian optimization procedure that searches for low-refusal perturbation configurations. The resulting AJailBench-APT+ is reported to cause further degradation in the safety performance of leading LAMs. The paper concludes that no evaluated model is consistently robust and that LAMs are vulnerable to both semantic and acoustically perturbed jailbreak inputs. The manuscript includes an open-source release statement and a short limitation discussion in Appendix C.

Significance. If the empirical claims were fully supported, this would be a useful community resource: it broadens jailbreak evaluation from text to the audio modality, covers a wider category taxonomy than prior work, includes both open and closed models, and proposes a principled semantic-preservation gate for acoustic perturbations. The open release, the use of human evaluation for threshold calibration, and the combination of Bayesian optimization with audio perturbation are concrete strengths. However, the current manuscript contains internal inconsistencies that directly affect the central claim: the Policy Violation metric in Table 3 moves in the safety-improving direction under APT+, Table 3 base numbers do not match Table 2 averages, and Table 2 printed averages are not consistent with their own rows. The semantic consistency threshold is also derived from a 150-sample human study whose reported outcome conflicts with the claim of semantic preservation. These issues mean the benchmark's headline result is not yet established on the evidence presented.

major comments (4)
  1. [§4.5, Table 3] The Policy Violation (PV) results contradict the paper's central claim that APT+ 'significantly reduce[s] the safety performance of leading LAMs'. The table header defines PV (↓) as a metric where lower values indicate higher safety. Under APT+, PV decreases for every model: SALMONN 0.577→0.471, Qwen2-Audio 0.664→0.537, DiVA 0.580→0.503, Gemini-flash 0.773→0.753, and GPT-4o 0.350→0.249. That is, by the metric that most directly measures policy-violating content, all models become safer under APT+. The text in §4.5 asserts degraded safety without acknowledging this pattern. Since PV is a direct measure of harmful content and ASR is a proxy based on refusal keywords, the current data suggest that APT+ may induce non-refusal but also non-violating responses rather than actual jailbreaks. The authors should report all five metrics consistently, provide per-category PV results, and either explain the PV improvement or substantially revise the claim that APT+ degrades safety.
  2. [§4.3, Tables 2 and 3] The quantitative evidence for the headline claim is internally inconsistent. The Table 3 'Base' ASR values do not match the Table 2 audio averages for the same models: for GPT-4o, Table 2 reports an ASR average of 0.190 (with an anchored text row of 0.317) while Table 3 Base is 0.235; for SALMONN, Table 2 gives 0.137 and Table 3 gives 0.356; for Gemini-flash, Table 2 gives 0.548 (anchored 0.672) while Table 3 gives 0.611. In addition, Table 2's printed averages are not the averages of the listed per-category entries; for example, the GPT-4o TS row entries sum to 24.055, not the printed average of 2.654. The authors should state exactly which subset of prompts, which input format (audio or text), and which averaging procedure were used for each table, and should make all printed averages match the underlying rows.
  3. [§3.4, Appendix B] The Semantic Consistency Constraint is load-bearing for the claim that APT+ attacks are 'small, semantically preserved perturbations', but the calibration described in Appendix B undermines this. The human evaluation found that after 13 rounds of cumulative perturbation, the majority of audio samples were rated as difficult to understand, with intelligibility scores below 4 on a 0–10 scale. Yet the authors used the average GPTScore between original and Whisper-transcribed audio at this same 13-round point, 0.638, as the semantic safety threshold. A threshold determined at a point where human listeners find the audio largely unintelligible cannot serve as evidence of semantic preservation. The calibration is also based on only 150 samples and three raters, so generalizability is unclear. Please report the per-sample relationship between human intelligibility ratings and GPTScore, select the threshold at a point where human ratings confirm intelligibility, and show accepted APT+ examples with their human intelligibility scores.
  4. [§3.3 and §3.2.1] The relationship between the stated semantic consistency constraint and the Bayesian optimization objective is unspecified. Section 3.2.1 defines the semantically valid perturbation space Θ = {θ | S(x,T(x;θ)) ≥ τ}, but the optimization in Section 3.3 minimizes only the refusal similarity objective S(M(a_pert)) over p ∈ [0,1]^2, with no constraint or penalty term involving S(x, x'). The manuscript should clarify whether the semantic constraint is imposed by restricting parameter ranges before optimization, by filtering the optimized outputs, or through a constrained objective. Without this, the reader cannot distinguish genuine acoustic bypasses from perturbations that succeed merely by degrading intelligibility.
minor comments (7)
  1. [§3.1] The text refers to 'DeekSeek-V3'; this should be 'DeepSeek-V3'.
  2. [§4.4] The name 'AjailBench-APT++' is inconsistent with the benchmark name 'AJailBench-APT+' used elsewhere in the paper.
  3. [Table 2] The caption says that cells represent the base text-only models, but the table contains duplicate metric rows for many models with anchor symbols; the text discusses both text and audio behavior. Please clarify which rows correspond to audio inputs and which correspond to text inputs.
  4. [§4.1 and Tables 2–3] Model naming is inconsistent: 'Gemini-2.0-flash' in the text appears as 'Gemini-flash' in the tables, and 'DiV A' appears with inconsistent spacing in several places.
  5. [Figure 5] The figure labels methods as 'Noise Dropout', 'Nature Noise', and 'Volume', while Section 3.2.1 defines 'Natural Noise Injection' and 'Energy Distribution Perturbation'. Please align the terminology.
  6. [§3.2.1, Eq. (3)] The trimming operator is described with θ_Trim ≤ 0.1s, but no lower bound or sampling procedure for the start time t_0 is given; the paper should specify how these parameters are chosen.
  7. [§4.4] The statement that 'all perturbed audio samples were manually checked to ensure intelligibility' is difficult to reconcile with Appendix B, which reports that a majority of samples at the 13-round perturbation level received low human intelligibility scores; please clarify the relationship between these two checks.

Circularity Check

1 steps flagged · score 6.0 of 10

APT+ evaluation is partly circular: Bayesian optimization minimizes refusal similarity, then ASR reports the same construct as attack success.

  1. fitted input called prediction [Section 3.3 (Bayesian optimization objective) and Section 4.2 / Table 3 (ASR evaluation)]
    "To quantify the degree of refusal in a given output, we define a reference set of refusal phrases R ... S(r) = max r_ref∈R cos(emb(r),emb(r_ref)) ... Our objective is to minimize this refusal score: p∗ = arg min x∈[0,1]2 S(M(apert)). ... ASR indicates the model's vulnerability to adversarial prompts. Following Shen et al. (2024), we compute ASR using a refusal keyword list ... an attack is considered unsuccessful if the response contains any of these keywords."

    The APT+ perturbation parameters are fitted per model by minimizing a continuous refusal-similarity score S(r), which measures how close the model's output is to a set of refusal phrases. Table 3 then reports ASR, a binary refusal-keyword detector, as evidence that APT+ 'significantly reduce[s] the safety performance of leading LAMs.' ASR is a discretized proxy of the very objective minimized during fitting: both quantify whether the output is a refusal. The observed ASR increase is therefore substantially forced by construction rather than an independent empirical discovery. The other headline metrics are not optimized; notably PV improves for every model under APT+, so the claimed degradation rests on the metric that echoes the optimization target.

full rationale

The base benchmark is largely self-contained: AJailBench-Base is assembled from external jailbreak prompts and evaluated on seven LAMs, so the finding that 'none exhibit consistent robustness across attacks' is independent and not circular. The semantic consistency threshold is grounded in human evaluation (Appendix B), not derived from the paper's own outputs, so that constraint is also externally anchored. The main circularity is in the APT+ contribution: the perturbation parameters are optimized on the same models with an objective that minimizes refusal similarity, and the paper's headline degradation claim is then supported by ASR, a coarse refusal/non-refusal metric. Because ASR and the BO objective measure the same construct, the APT+ ASR increase is partly by construction. The paper also cites Gao et al. (2024), which includes the present authors, for the Similarity metric; this is a minor methodological self-citation but not load-bearing for the central attack-success claims. The internal inconsistency in Table 3—PV improving while the text claims degraded safety—is a correctness/validity concern rather than a circularity and is not scored as a separate circular step.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim rests on empirical assumptions about prompt representativeness, semantic similarity measurement, and metric validity. No physical entities are postulated. The only hand-set numbers are the semantic threshold, the perturbation round limit, and the refusal reference set.

free parameters (3)
  • Semantic similarity threshold τ = 0.638 GPTScore similarity
    Computed as the average similarity between Whisper transcriptions of 150 perturbed samples and originals after 13 perturbation rounds; used to filter which perturbed samples are kept. It is a fitted cutoff, not a theoretically derived one.
  • Maximum perturbation overlay rounds = 10 rounds (13 observed in human study)
    The authors observed intelligibility drops below score 4 after 13 rounds, then used 10 rounds in Bayesian optimization as a hand-selected safety margin.
  • Refusal reference set R = 142 GPT-4-generated refusal phrases
    The refusal-similarity objective used by Bayesian optimization measures maximum cosine similarity to this set; the size and content of the set is a design choice that determines what counts as a non-refusal.
assumptions (4)
  • domain assumption The 1,495 text prompts selected are a representative sample of real jailbreak attempts.
    Prompts come from published jailbreak sources and are filtered by whether they bypass ChatGPT-3.5 or ChatGPT-4; no independent diversity guarantee across the 10 categories is provided.
  • domain assumption Whisper transcription plus GPTScore similarity is a valid proxy for human-perceived semantic preservation.
    This pair is used to define semantic validity for all APT+ samples, but only 150 samples have direct human grounding (Appendix B).
  • domain assumption The refusal keyword list and GPT-4o-based toxicity and policy violation judge accurately measure harm.
    No validation of the classifier against human judgments is reported, and the exact refusal keywords are not listed in the paper.
  • standard math STFT, iSTFT, and phase vocoder transformations behave as standard invertible speech processing operations.
    The perturbation equations rely on established digital signal processing; the paper does not need to prove these foundations.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Audio Jailbreak: An Open Comprehensive Benchmark for Jailbreaking Large Audio-Language Models." pith.science (2026). https://pith.science/paper/RYA4KMAN

@misc{pith2026250515406,
  author       = {Pith},
  title        = {Pith review of: Audio Jailbreak: An Open Comprehensive Benchmark for Jailbreaking Large Audio-Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RYA4KMAN}},
  note         = {Machine review of arXiv:2505.15406}
}
read the original abstract

The rise of Large Audio Language Models (LAMs) brings both potential and risks, as their audio outputs may contain harmful or unethical content. However, current research lacks a systematic, quantitative evaluation of LAM safety especially against jailbreak attacks, which are challenging due to the temporal and semantic nature of speech. To bridge this gap, we introduce AJailBench, the first benchmark specifically designed to evaluate jailbreak vulnerabilities in LAMs. We begin by constructing AJailBench-Base, a dataset of 1,495 adversarial audio prompts spanning 10 policy-violating categories, converted from textual jailbreak attacks using realistic text to speech synthesis. Using this dataset, we evaluate several state-of-the-art LAMs and reveal that none exhibit consistent robustness across attacks. To further strengthen jailbreak testing and simulate more realistic attack conditions, we propose a method to generate dynamic adversarial variants. Our Audio Perturbation Toolkit (APT) applies targeted distortions across time, frequency, and amplitude domains. To preserve the original jailbreak intent, we enforce a semantic consistency constraint and employ Bayesian optimization to efficiently search for perturbations that are both subtle and highly effective. This results in AJailBench-APT, an extended dataset of optimized adversarial audio samples. Our findings demonstrate that even small, semantically preserved perturbations can significantly reduce the safety performance of leading LAMs, underscoring the need for more robust and semantically aware defense mechanisms.

Figures

Figures reproduced from arXiv: 2505.15406 by the authors.

Figure 1
Figure 1. (a) Illustration of the audio jailbreak pipeline. A benign audio prompt yields a safe response, [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Workflow of Semantic Consistency Constraint. [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Semantic Consistency Constraint Experiment’s visualization. (a) Energy Distribution [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Performance of existing LAMs across various aspects. As shown in [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Sample distribution across 7 APT techniques in AJailBench-APT+, selected via Bayesian optimization. As shown in [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. On Optimizing Multimodal Jailbreaks for Spoken Language Models

    cs.LG 2026-03 conditional novelty 6.0 of 10

    JAMA jointly optimizes GCG text suffixes and PGD audio perturbations, lifting SLM jailbreak rates 1.5–10× over unimodal attacks; a sequential approximation recovers most of the gain at 4–6× lower cost.

  2. PresentAgent: Multimodal Agent for Presentation Video Generation

    cs.CV 2025-07 reject novelty 5.0 of 10

    PresentAgent chains LLM segmentation, slide rendering, TTS, and ffmpeg to turn documents into narrated presentation videos, but the human-level claim rests on five documents and an unvalidated VLM judge.

  3. ChronosAudio: A Comprehensive Long-Audio Benchmark for Evaluating Audio-Large Language Models

    cs.SD 2026-01 reject novelty 4.0 of 10

    A long-audio benchmark claims severe performance collapse in 16 audio LLMs, but unspecified metric weights and internal inconsistencies make the headline numbers uninterpretable.

Reference graph

Works this paper leans on

57 extracted references · 15 canonical work pages · cited by 3 Pith papers

  1. [1]

    Gpt-4 technical report // arXiv preprint arXiv:2303.08774

    Achiam Josh, Adler Steven, Agarwal Sandhini, Ahmad Lama, Akkaya Ilge, Aleman Florencia Leoni, Almeida Diogo, Altenschmidt Janko, Altman Sam, Anadkat Shyamal, others . Gpt-4 technical report // arXiv preprint arXiv:2303.08774. 2023

    arXiv 2023

  2. [2]

    Audiolm: a language modeling approach to audio generation.(2022) // arXiv preprint arXiv:2209.03143

    Borsos Zal \'a n, Marinier Rapha \"e l, Vincent Damien, Kharitonov Eugene, Pietquin Olivier, Sharifi Matt, Teboul Olivier, Grangier David, Tagliasacchi Marco, Zeghidour Neil . Audiolm: a language modeling approach to audio generation.(2022) // arXiv preprint arXiv:2209.03143. 2022

    arXiv 2022

  3. [3]

    Benchlmm: Benchmarking cross-style visual capability of large multimodal models // European Conference on Computer Vision

    Cai Rizhao, Song Zirui, Guan Dayan, Chen Zhenhao, Li Yaohang, Luo Xing, Yi Chenyu, Kot Alex . Benchlmm: Benchmarking cross-style visual capability of large multimodal models // European Conference on Computer Vision. 2025. 340--358

    work page 2025

  4. [4]

    Jailbreakbench: An open robustness benchmark for jailbreaking large language models // arXiv preprint arXiv:2404.01318

    Chao Patrick, Debenedetti Edoardo, Robey Alexander, Andriushchenko Maksym, Croce Francesco, Sehwag Vikash, Dobriban Edgar, Flammarion Nicolas, Pappas George J, Tramer Florian, others . Jailbreakbench: An open robustness benchmark for jailbreaking large language models // arXiv preprint arXiv:2404.01318. 2024

    arXiv 2024

  5. [5]

    X-llm: Bootstrapping advanced large language models by treating multi-modalities as foreign languages // arXiv preprint arXiv:2305.04160

    Chen Feilong, Han Minglun, Zhao Haozhi, Zhang Qingyang, Shi Jing, Xu Shuang, Xu Bo . X-llm: Bootstrapping advanced large language models by treating multi-modalities as foreign languages // arXiv preprint arXiv:2305.04160. 2023

    arXiv 2023

  6. [6]

    Unveiling the power of language models in chemical research question answering // Communications Chemistry

    Chen Xiuying, Wang Tairan, Guo Taicheng, Guo Kehan, Zhou Juexiao, Li Haoyang, Song Zirui, Gao Xin, Zhang Xiangliang . Unveiling the power of language models in chemical research question answering // Communications Chemistry. 2025. 8, 1. 4

    work page 2025

  7. [7]

    Qwen2-audio technical report // arXiv preprint arXiv:2407.10759

    Chu Yunfei, Xu Jin, Yang Qian, Wei Haojie, Wei Xipin, Guo Zhifang, Leng Yichong, Lv Yuanjun, He Jinzheng, Lin Junyang, others . Qwen2-audio technical report // arXiv preprint arXiv:2407.10759. 2024

    arXiv 2024

  8. [8]

    Qwen-audio: Advancing universal audio understanding via unified large-scale audio-language models // arXiv preprint arXiv:2311.07919

    Chu Yunfei, Xu Jin, Zhou Xiaohuan, Yang Qian, Zhang Shiliang, Yan Zhijie, Zhou Chang, Zhou Jingren . Qwen-audio: Advancing universal audio understanding via unified large-scale audio-language models // arXiv preprint arXiv:2311.07919. 2023

    arXiv 2023

Show all 57 references
  1. [9]

    Pengi: An audio language model for audio tasks // Advances in Neural Information Processing Systems

    Deshmukh Soham, Elizalde Benjamin, Singh Rita, Wang Huaming . Pengi: An audio language model for audio tasks // Advances in Neural Information Processing Systems. 2023. 36. 18090--18108

    2023

  2. [10]

    The phase vocoder: A tutorial // Computer Music Journal

    Dolson Mark . The phase vocoder: A tutorial // Computer Music Journal. 1986. 10, 4. 14--27

    1986

  3. [11]

    When does contrastive learning preserve adversarial robustness from pretraining to finetuning? // Advances in neural information processing systems

    Fan Lijie, Liu Sijia, Chen Pin-Yu, Zhang Gaoyuan, Gan Chuang . When does contrastive learning preserve adversarial robustness from pretraining to finetuning? // Advances in neural information processing systems. 2021. 34. 21480--21492

    2021

  4. [12]

    LLaMA-Omni: Seamless Speech Interaction with Large Language Models // arXiv preprint arXiv:2409.06666

    Fang Qingkai, Guo Shoutao, Zhou Yan, Ma Zhengrui, Zhang Shaolei, Feng Yang . LLaMA-Omni: Seamless Speech Interaction with Large Language Models // arXiv preprint arXiv:2409.06666. 2024

    2024 arXiv

  5. [13]

    Prompting large language models with speech recognition abilities // ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

    Fathullah Yassir, Wu Chunyang, Lakomkin Egor, Jia Junteng, Shangguan Yuan, Li Ke, Guo Jinxi, Xiong Wenhan, Mahadeokar Jay, Kalinli Ozlem, others . Prompting large language models with speech recognition abilities // ICASSP 2024-2024 IEEE International Conference on Acoustics, ...

    2024

  6. [14]

    A tutorial on Bayesian optimization // arXiv preprint arXiv:1807.02811

    Frazier Peter I . A tutorial on Bayesian optimization // arXiv preprint arXiv:1807.02811. 2018

    2018 arXiv

  7. [15]

    Fu Jinlan, Ng See Kiong, Jiang Zhengbao, Liu Pengfei . GPTScore: Evaluate as You Desire // Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers). 2024. 6556--6576

    2024

  8. [16]

    Shaping the Safety Boundaries: Understanding and Defending Against Jailbreaks in Large Language Models // arXiv preprint arXiv:2412.17034

    Gao Lang, Zhang Xiangliang, Nakov Preslav, Chen Xiuying . Shaping the Safety Boundaries: Understanding and Defending Against Jailbreaks in Large Language Models // arXiv preprint arXiv:2412.17034. 2024

    2024 arXiv

  9. [17]

    GAMA: A Large Audio-Language Model with Advanced Audio Understanding and Complex Reasoning Abilities // arXiv preprint arXiv:2406.11768

    Ghosh Sreyan, Kumar Sonal, Seth Ashish, Evuru Chandra Kiran Reddy, Tyagi Utkarsh, Sakshi S, Nieto Oriol, Duraiswami Ramani, Manocha Dinesh . GAMA: A Large Audio-Language Model with Advanced Audio Understanding and Complex Reasoning Abilities // arXiv preprint arXiv:2406.11768. 2024

    2024 arXiv

  10. [18]

    Listen, think, and understand // arXiv preprint arXiv:2305.10790

    Gong Yuan, Luo Hongyin, Liu Alexander H, Karlinsky Leonid, Glass James . Listen, think, and understand // arXiv preprint arXiv:2305.10790. 2023

    2023 arXiv

  11. [19]

    MedINST: Meta Dataset of Biomedical Instructions // arXiv preprint arXiv:2410.13458

    Han Wenhan, Fang Meng, Zhang Zihan, Yin Yu, Song Zirui, Chen Ling, Pechenizkiy Mykola, Chen Qingyu . MedINST: Meta Dataset of Biomedical Instructions // arXiv preprint arXiv:2410.13458. 2024

    2024 arXiv

  12. [20]

    Distilling an end-to-end voice assistant without instruction training data // arXiv preprint arXiv:2410.02678

    Held William, Li Ella, Ryan Michael, Shi Weiyan, Zhang Yanzhe, Yang Diyi . Distilling an end-to-end voice assistant without instruction training data // arXiv preprint arXiv:2410.02678. 2024

    2024 arXiv

  13. [21]

    On the trustworthiness of generative foundation models: Guideline, assessment, and perspective // arXiv preprint arXiv:2502.14296

    Huang Yue, Gao Chujie, Wu Siyuan, Wang Haoran, Wang Xiangqi, Zhou Yujun, Wang Yanbo, Ye Jiayi, Shi Jiawen, Zhang Qihui, others . On the trustworthiness of generative foundation models: Guideline, assessment, and perspective // arXiv preprint arXiv:2502.14296. 2025 a

    2025 arXiv

  14. [22]

    Breaking Focus: Contextual Distraction Curse in Large Language Models // arXiv preprint arXiv:2502.01609

    Huang Yue, Wang Yanbo, Xu Zixiang, Gao Chujie, Wu Siyuan, Ye Jiayi, Chen Xiuying, Chen Pin-Yu, Zhang Xiangliang . Breaking Focus: Contextual Distraction Curse in Large Language Models // arXiv preprint arXiv:2502.01609. 2025 b

    2025

  15. [23]

    Best-of-n jailbreaking // arXiv preprint arXiv:2412.03556

    Hughes John, Price Sara, Lynch Aengus, Schaeffer Rylan, Barez Fazl, Koyejo Sanmi, Sleight Henry, Jones Erik, Perez Ethan, Sharma Mrinank . Best-of-n jailbreaking // arXiv preprint arXiv:2412.03556. 2024

    2024 arXiv

  16. [24]

    AdvWave: Stealthy Adversarial Jailbreak Attack against Large Audio-Language Models // arXiv preprint arXiv:2412.08608

    Kang Mintong, Xu Chejian, Li Bo . AdvWave: Stealthy Adversarial Jailbreak Attack against Large Audio-Language Models // arXiv preprint arXiv:2412.08608. 2024

    2024 arXiv

  17. [25]

    On generative spoken language modeling from raw audio // Transactions of the Association for Computational Linguistics

    Lakhotia Kushal, Kharitonov Eugene, Hsu Wei-Ning, Adi Yossi, Polyak Adam, Bolte Benjamin, Nguyen Tu-Anh, Copet Jade, Baevski Alexei, Mohamed Abdelrahman, others . On generative spoken language modeling from raw audio // Transactions of the Association for Computational Linguis...

    2021

  18. [26]

    Appagent v2: Advanced agent for flexible mobile interactions // arXiv preprint arXiv:2408.11824

    Li Yanda, Zhang Chi, Yang Wanqi, Fu Bin, Cheng Pei, Chen Xin, Chen Ling, Wei Yunchao . Appagent v2: Advanced agent for flexible mobile interactions // arXiv preprint arXiv:2408.11824. 2024

    2024

  19. [27]

    The unlocking spell on base llms: Rethinking alignment via in-context learning // arXiv preprint arXiv:2312.01552

    Lin Bill Yuchen, Ravichander Abhilasha, Lu Ximing, Dziri Nouha, Sclar Melanie, Chandu Khyathi, Bhagavatula Chandra, Choi Yejin . The unlocking spell on base llms: Rethinking alignment via in-context learning // arXiv preprint arXiv:2312.01552. 2023

    2023 arXiv

  20. [28]

    Deepseek-v3 technical report // arXiv preprint arXiv:2412.19437

    Liu Aixin, Feng Bei, Xue Bing, Wang Bingxuan, Wu Bochao, Lu Chengda, Zhao Chenggang, Deng Chengqi, Zhang Chenyu, Ruan Chong, others . Deepseek-v3 technical report // arXiv preprint arXiv:2412.19437. 2024 a

    2024 arXiv

  21. [29]

    From a tiny slip to a giant leap: An llm-based simulation for fake news evolution // arXiv preprint arXiv:2410.19064

    Liu Yuhan, Song Zirui, Zhang Xiaoqing, Chen Xiuying, Yan Rui . From a tiny slip to a giant leap: An llm-based simulation for fake news evolution // arXiv preprint arXiv:2410.19064. 2024 b

    2024 arXiv

  22. [30]

    Semi-Supervised Audio Classification with Consistency-Based Regularization

    Lu Kangkang, Foo Chuan-Sheng, Teh Kah Kuan, Tran Huy Dat, Chandrasekhar Vijay Ramaseshan . Semi-Supervised Audio Classification with Consistency-Based Regularization. // INTERSPEECH. 1. 2019. 3654--3658

    2019

  23. [31]

    Spoken Question Answering and Speech Continuation Using Spectrogram-Powered LLM // arXiv preprint arXiv:2305.15255

    Nachmani Eliya, Levkovitch Alon, Hirsch Roy, Salazar Julian, Asawaroengchai Chulayuth, Mariooryad Soroosh, Rivlin Ehud, Skerry-Ryan RJ, Ramanovich Michelle Tadmor . Spoken Question Answering and Speech Continuation Using Spectrogram-Powered LLM // arXiv preprint arXiv:2305.15255. 2023

    2023 arXiv

  24. [32]

    GPT-4o System Card

    OpenAI . GPT-4o System Card . 2024. https://openai.com/index/gpt-4o

    2024

  25. [33]

    Robust speech recognition via large-scale weak supervision // International conference on machine learning

    Radford Alec, Kim Jong Wook, Xu Tao, Brockman Greg, McLeavey Christine, Sutskever Ilya . Robust speech recognition via large-scale weak supervision // International conference on machine learning. 2023. 28492--28518

    2023

  26. [34]

    Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context // arXiv preprint arXiv:2403.05530

    Reid Machel, Savinov Nikolay, Teplyashin Denis, Lepikhin Dmitry, Lillicrap Timothy, Alayrac Jean-baptiste, Soricut Radu, Lazaridou Angeliki, Firat Orhan, Schrittwieser Julian, others . Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context // arXiv...

    2024 arXiv

  27. [35]

    Sentence-bert: Sentence embeddings using siamese bert-networks // arXiv preprint arXiv:1908.10084

    Reimers Nils, Gurevych Iryna . Sentence-bert: Sentence embeddings using siamese bert-networks // arXiv preprint arXiv:1908.10084. 2019

    1908 arXiv

  28. [36]

    do anything now

    Shen Xinyue, Chen Zeyuan, Backes Michael, Shen Yun, Zhang Yang . " do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models // arXiv preprint arXiv:2308.03825. 2023

    2023 arXiv

  29. [37]

    Voice Jailbreak Attacks Against GPT-4o // arXiv preprint arXiv:2405.19103

    Shen Xinyue, Wu Yixin, Backes Michael, Zhang Yang . Voice Jailbreak Attacks Against GPT-4o // arXiv preprint arXiv:2405.19103. 2024

    2024 arXiv

  30. [38]

    Mmac-copilot: Multi-modal agent collaboration operating system copilot // arXiv preprint arXiv:2404.18074

    Song Zirui, Li Yaohang, Fang Meng, Chen Zhenhao, Shi Zecheng, Huang Yuan, Chen Ling . Mmac-copilot: Multi-modal agent collaboration operating system copilot // arXiv preprint arXiv:2404.18074. 2024 a

    2024 arXiv

  31. [39]

    Hazards in Daily Life? Enabling Robots to Proactively Detect and Resolve Anomalies // arXiv preprint arXiv:2411.00781

    Song Zirui, Ouyang Guangxian, Fang Meng, Na Hongbin, Shi Zijing, Chen Zhenhao, Fu Yujie, Zhang Zeyu, Jiang Shiyu, Fang Miao, others . Hazards in Daily Life? Enabling Robots to Proactively Detect and Resolve Anomalies // arXiv preprint arXiv:2411.00781. 2024 b

    2024 arXiv

  32. [40]

    Injecting Domain-Specific Knowledge into Large Language Models: A Comprehensive Survey // arXiv preprint arXiv:2502.10708

    Song Zirui, Yan Bin, Liu Yuhan, Fang Miao, Li Mingzhe, Yan Rui, Chen Xiuying . Injecting Domain-Specific Knowledge into Large Language Models: A Comprehensive Survey // arXiv preprint arXiv:2502.10708. 2025 a

    2025 arXiv

  33. [41]

    Geolocation with Real Human Gameplay Data: A Large-Scale Dataset and Human-Like Reasoning Framework // arXiv preprint arXiv:2502.13759

    Song Zirui, Yang Jingpu, Huang Yuan, Tonglet Jonathan, Zhang Zeyu, Cheng Tao, Fang Meng, Gurevych Iryna, Chen Xiuying . Geolocation with Real Human Gameplay Data: A Large-Scale Dataset and Human-Like Reasoning Framework // arXiv preprint arXiv:2502.13759. 2025 b

    2025

  34. [42]

    FunAudioLLM: Voice Understanding and Generation Foundation Models for Natural Interaction Between Humans and LLMs // arXiv preprint arXiv:2407.04051

    SpeechTeam Tongyi . FunAudioLLM: Voice Understanding and Generation Foundation Models for Natural Interaction Between Humans and LLMs // arXiv preprint arXiv:2407.04051. 2024

    2024 arXiv

  35. [43]

    Uncertainty-aware audiovisual activity recognition using deep bayesian variational inference // Proceedings of the IEEE/CVF international conference on computer vision

    Subedar Mahesh, Krishnan Ranganath, Meyer Paulo Lopez, Tickoo Omesh, Huang Jonathan . Uncertainty-aware audiovisual activity recognition using deep bayesian variational inference // Proceedings of the IEEE/CVF international conference on computer vision. 2019. 6301--6310

    2019

  36. [44]

    Salmonn: Towards generic hearing abilities for large language models // arXiv preprint arXiv:2310.13289

    Tang Changli, Yu Wenyi, Sun Guangzhi, Chen Xianzhao, Tan Tian, Li Wei, Lu Lu, Ma Zejun, Zhang Chao . Salmonn: Towards generic hearing abilities for large language models // arXiv preprint arXiv:2310.13289. 2023

    2023 arXiv

  37. [45]

    Word Form Matters: LLMs' Semantic Reconstruction under Typoglycemia // arXiv preprint arXiv:2503.01714

    Wang Chenxi, Gu Tianle, Wei Zhongyu, Gao Lang, Song Zirui, Chen Xiuying . Word Form Matters: LLMs' Semantic Reconstruction under Typoglycemia // arXiv preprint arXiv:2503.01714. 2025 a

    2025 arXiv

  38. [46]

    Viola: Unified codec language models for speech recognition, synthesis, and translation // arXiv preprint arXiv:2305.16107

    Wang Tianrui, Zhou Long, Zhang Ziqiang, Wu Yu, Liu Shujie, Gaur Yashesh, Chen Zhuo, Li Jinyu, Wei Furu . Viola: Unified codec language models for speech recognition, synthesis, and translation // arXiv preprint arXiv:2305.16107. 2023

    2023 arXiv

  39. [47]

    Wang Yanbo, Ye Jiayi, Wu Siyuan, Gao Chujie, Huang Yue, Chen Xiuying, Zhao Yue, Zhang Xiangliang . TRUSTEVAL: A Dynamic Evaluation Toolkit on Trustworthiness of Generative Foundation Models // Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Ass...

    2025

  40. [48]

    Tree-structured parzen estimator: Understanding its algorithm components and their roles for better empirical performance // arXiv preprint arXiv:2304.11127

    Watanabe Shuhei . Tree-structured parzen estimator: Understanding its algorithm components and their roles for better empirical performance // arXiv preprint arXiv:2304.11127. 2023

    2023 arXiv

  41. [49]

    On decoder-only architecture for speech-to-text and large language model integration // 2023 IEEE Automatic Speech Recognition and Understanding Workshop (ASRU)

    Wu Jian, Gaur Yashesh, Chen Zhuo, Zhou Long, Zhu Yimeng, Wang Tianrui, Li Jinyu, Liu Shujie, Ren Bo, Liu Linquan, others . On decoder-only architecture for speech-to-text and large language model integration // 2023 IEEE Automatic Speech Recognition and Understanding Workshop ...

    2023

  42. [50]

    Next-gpt: Any-to-any multimodal llm // arXiv preprint arXiv:2309.05519

    Wu Shengqiong, Fei Hao, Qu Leigang, Ji Wei, Chua Tat-Seng . Next-gpt: Any-to-any multimodal llm // arXiv preprint arXiv:2309.05519. 2023 b

    2023 arXiv

  43. [51]

    Tune In, Act Up: Exploring the Impact of Audio Modality-Specific Edits on Large Audio Language Models in Jailbreak // arXiv preprint arXiv:2501.13772

    Xiao Erjia, Cheng Hao, Shao Jing, Duan Jinhao, Xu Kaidi, Yang Le, Gu Jindong, Xu Renjing . Tune In, Act Up: Exploring the Impact of Audio Modality-Specific Edits on Large Audio Language Models in Jailbreak // arXiv preprint arXiv:2501.13772. 2025

    2025

  44. [52]

    MedTrinity-25M: A Large-scale Multimodal Dataset with Multigranular Annotations for Medicine

    Xie Yunfei, Zhou Ce, Gao Lang, Wu Juncheng, Li Xianhang, Zhou Hong-Yu, Liu Sheng, Xing Lei, Zou James, Xie Cihang, Zhou Yuyin . MedTrinity-25M: A Large-scale Multimodal Dataset with Multigranular Annotations for Medicine. 2025

    2025

  45. [53]

    Mini-Omni: Language Models Can Hear, Talk While Thinking in Streaming // arXiv preprint arXiv:2408.16725

    Xie Zhifei, Wu Changqiao . Mini-Omni: Language Models Can Hear, Talk While Thinking in Streaming // arXiv preprint arXiv:2408.16725. 2024

    2024 arXiv

  46. [54]

    Audio Is the Achilles' Heel: Red Teaming Audio Large Multimodal Models // arXiv preprint arXiv:2410.23861

    Yang Hao, Qu Lizhen, Shareghi Ehsan, Haffari Gholamreza . Audio Is the Achilles' Heel: Red Teaming Audio Large Multimodal Models // arXiv preprint arXiv:2410.23861. 2024

    2024 arXiv

  47. [55]

    Unveiling the Safety of GPT-4o: An Empirical Study using Jailbreak Attacks // arXiv preprint arXiv:2406.06302

    Ying Zonghao, Liu Aishan, Liu Xianglong, Tao Dacheng . Unveiling the Safety of GPT-4o: An Empirical Study using Jailbreak Attacks // arXiv preprint arXiv:2406.06302. 2024

    2024 arXiv

  48. [56]

    Speechgpt: Empowering large language models with intrinsic cross-modal conversational abilities // arXiv preprint arXiv:2305.11000

    Zhang Dong, Li Shimin, Zhang Xin, Zhan Jun, Wang Pengyu, Zhou Yaqian, Qiu Xipeng . Speechgpt: Empowering large language models with intrinsic cross-modal conversational abilities // arXiv preprint arXiv:2305.11000. 2023

    2023 arXiv

  49. [57]

    Universal and transferable adversarial attacks on aligned language models // arXiv preprint arXiv:2307.15043

    Zou Andy, Wang Zifan, Kolter J Zico, Fredrikson Matt . Universal and transferable adversarial attacks on aligned language models // arXiv preprint arXiv:2307.15043. 2023

    2023 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.