PaperlayerView exact revision on arXiv

Source-linked AI summary

Multilingual and Multi-Accent Jailbreaking of Audio LLMs

Jaechul Roh, Virat Shejwalkar, Amir Houmansadr

arXiv:2504.01094v1cs.SDcs.AIcs.CLcs.CReess.AS

TL;DR

Prior audio jailbreak research has focused predominantly on English, leaving multilingual and multi-accent audio vulnerabilities less systematically examined. MULTI-AUDIOJAIL introduces a dataset and evaluation framework for these attacks. Its findings report increased JSRs under acoustic perturbations and identify non-English audio as a weak point in multimodal systems.

  • Problem

    Prior audio jailbreak studies focused predominantly on English-language vulnerabilities, leaving multilingual inputs and their linguistic and acoustic challenges less explored.

    Source: §1 · p. 1

  • Method

    MULTI-AUDIOJAIL combines a multilingual and multi-accent adversarial audio dataset with evaluation of acoustic perturbations and audio-only attacks under a black-box threat model.

    Source: §1 · p. 2, §3.1 · p. 3

  • Results

    Reverb Room and Reverb Teisco produced average JSR increases of +23.33% and +27.41%, respectively, while the conclusion identifies non-English audio as a weak point in multimodal systems.

    Source: §5.3.1 · p. 7, §8 · p. 9

  • Takeaways & Limitations

    The dataset and evaluation framework provide benchmarks for LALM robustness, and the authors identify cross-modal defenses as a research need.

    Source: §1 · p. 3, §8 · p. 9

    The study does not optimize jailbreaking prompts or develop corresponding defenses.

    Source: §7 · p. 9

Abstract

from arXiv · show

Large Audio Language Models (LALMs) have significantly advanced audio understanding but introduce critical security risks, particularly through audio jailbreaks. While prior work has focused on English-centric attacks, we expose a far more severe vulnerability: adversarial multilingual and multi-accent audio jailbreaks, where linguistic and acoustic variations dramatically amplify attack success. In this paper, we introduce Multi-AudioJail, the first systematic framework to exploit these vulnerabilities through (1) a novel dataset of adversarially perturbed multilingual/multi-accent audio jailbreaking prompts, and (2) a hierarchical evaluation pipeline revealing that how acoustic perturbations (e.g., reverberation, echo, and whisper effects) interacts with cross-lingual phonetics to cause jailbreak success rates (JSRs) to surge by up to +57.25 percentage points (e.g., reverberated Kenyan-accented attack on MERaLiON). Crucially, our work further reveals that multimodal LLMs are inherently more vulnerable than unimodal systems: attackers need only exploit the weakest link (e.g., non-English audio inputs) to compromise the entire model, which we empirically show by multilingual audio-only attacks achieving 3.1x higher success rates than text-only attacks. We plan to release our dataset to spur research into cross-modal defenses, urging the community to address this expanding attack surface in multimodality as LALMs evolve.

1 Introduction

Audio jailbreaks threaten LALM safety, but prior audio attacks have focused predominantly on English, overlooking multilingual inputs and their linguistic and acoustic challenges. MULTI-AUDIOJAIL combines multilingual and multi-accent audio with acoustic perturbations, and its evaluations report sharply increased jailbreak success rates.

1 Introduction

  • Prior audio jailbreak research has explored stealthy linguistic features, bilingual storytelling, noise injection, and accent conversion, while multilingual audio vulnerabilities remain underexplored.The paper frames this as a gap because earlier audio jailbreak studies focused predominantly on English-language vulnerabilities.Source: §1 · p. 1
  • MULTI-AUDIOJAIL introduces an adversarially perturbed multilingual and multi-accent audio dataset, investigates cross-lingual phonetic and acoustic vulnerabilities, and evaluates attacks from text-only baselines to audio perturbations.The framework uses translated harmful prompts, naturally and synthetically accented voices, and reverberation, echo, and whisper effects.Source: §1 · p. 2
  • Reverberation raised Qwen2’s German JSR by +48.08 points to 57.8%, while Kenyan natural accents reached 61.25% and Chinese synthetic accents reached 59.75%.Unperturbed multilingual audio also achieved 12.31% JSR versus 3.92% for text-only attacks in German.Source: §1 · p. 2
  • The authors argue that multimodal systems can be compromised through their weakest linguistic or acoustic input and call for cross-modal defenses as integrated modalities expand the attack surface.They aim for their multilingual adversarial dataset and analysis to support research into holistic safeguards.Source: §1 · pp. 2–3

2 Related Work

Large Audio Language Models have advanced audio processing and support varied tasks, including speech recognition, question-answering, and emotion detection. Earlier audio jailbreak studies explored several attack strategies, but this paper distinguishes its approach by examining accent variation together with multilingual input and acoustic perturbations.

2.1 Large Audio Language Models

  • LALMs combine language understanding and audio processing for tasks such as ASR, speech question-answering, and emotion detection.Examples include multilingual adaptation, speech-token approaches, and real-time applications.Source: §2.1 · p. 3

2.2 Audio-based Jailbreak Methods

  • Prior audio jailbreaks use imperceptible linguistic features, fictional storytelling, audio edits, red teaming, and Best-of-N accent or acoustic modifications.Xiao et al. (2025) report attack success rates up to 45%.Source: §2.2 · p. 3
  • MULTI-AUDIOJAIL differs from accent-only studies by systematically examining accent modifications alongside multilingual inputs and acoustic perturbations.The paper positions this combined analysis as improving jailbreak effectiveness.Source: §2.2 · p. 3

3 Threat Model and Methodology

The study assumes black-box access to a LALM and compares text-only attacks with audio-only attacks. MULTI-AUDIOJAIL synthesizes multilingual and accented prompts, then applies signal-level perturbations to evaluate vulnerabilities.

3.1 Threat Model

  • The threat model assumes black-box access, with attackers receiving textual responses to audio queries and using either text-only or audio-only attacks.Audio-only attacks use audio prompts with perturbations, linguistic alterations, or both.Source: §3.1 · p. 3

3.2 MULTI-AUDIOJAIL: Multilingual and Multi-Accent Audio Jailbreak

  • MULTI-AUDIOJAIL has two stages: multilingual and multi-accent audio synthesis followed by signal-level adversarial perturbations that simulate sound distortions and acoustic conditions.The stated goal is to evaluate LALM safety-filter resilience.Source: §3.2 · p. 4

3.2.1 Dataset Curation

  • The dataset translates harmful English prompts and synthesizes them as native-language audio or as natural and synthetic accented English, with five perturbation techniques applied to clean recordings.Natural accents use TTS trained on accented English; synthetic accents use TTS configured for other native languages to read English text.Source: §3.2.1 · p. 4

3.2.2 Audio Perturbation

  • Reverberation convolves audio with an impulse response, while echo adds a delayed, attenuated copy of the original signal.The described reverberation settings represent guitar, room, and railway acoustics; echo typically uses attenuation 0.3 and delay around 0.2 seconds.Source: §3.2.2 · p. 4
  • The whisper transformation attenuates the signal, filters high frequencies, and adds low-amplitude white noise to simulate breathiness.The paper identifies the filter cutoff frequency and roll-off sharpness, and sets the added-noise intensity at approximately 0.005.Source: §3.2.2 · pp. 4–5

4 Experimental Setting

The experiments assess jailbreak safety, transcription, and speech question-answering across a multilingual, multi-accent audio dataset. They evaluate five selected LALMs chosen for low reported jailbreak success rates and multilingual audio capabilities.

4.1 Evaluation Metrics

  • The evaluation measures JSR with Llama Guard 3, WER with Whisper-large-v3, and SQA accuracy using a Llama-3.1-8B instruct judge.SQA evaluation uses 100 commonsense questions per language, totaling 600 questions.Source: §4.1 · p. 5

4.2 Dataset and Models

  • The dataset contains 102,720 audio files derived from 520 AdvBench harmful instructions translated into five languages and rendered in multilingual, natural-accent, and synthetic-accent forms.The five evaluated languages are English, German, Italian, Spanish, French, and Portuguese; the original English is included alongside the five translations.Source: §4.2 · p. 5
  • The evaluation selects Qwen2, DiVA, MERaLiON, MiniCPM, and Ultravox based on low VoiceBench-reported JSRs and Whisper-based multilingual transcription capabilities.The listed baseline JSRs range from 1.73% for DiVA to 5.19% for MERaLiON.Source: §4.2 · p. 5

5 Results

Audio-only inputs generally yield higher jailbreak success rates than text-only inputs, and synthetic accents and acoustic perturbations further expose vulnerabilities that vary by language, accent, and model. The section also evaluates an inference-time text defense that reduces JSR for most tested models and languages.

5.1 Robustness to Multilingual Text vs. Audio Inputs

  • Audio-only inputs generally yield higher JSRs than text-only inputs across languages and models, with English the exception.German audio reaches 12.31% versus 3.92% for text; the passage also reports an overall audio-based vulnerability pattern.Source: §5.1 · p. 6

5.2 Robustness of Natural vs. Synthetic Accents

  • Synthetic accents average approximately 11.42% JSR, compared with approximately 2.54% for natural accents.Natural-accent JSRs remain relatively low across models, while synthetic accents increase JSR across all models.Source: §5.2 · pp. 6–7, Figure 3 · p. 6

5.3.1 Multilingual Audio Perturbation

  • Reverb Teisco increases multilingual JSR by an average of +27.41 percentage points, while Reverb Room averages +23.33 points.Qwen2's German JSR rises from 9.71% to 57.79% under Reverb Teisco, a +48.08% absolute increase.Source: Table 1 · p. 7, §5.3.1 · p. 7
  • Whisper raises Ultravox's German JSR by +42.21% but English by only +0.14%, while Echo raises Qwen2's Portuguese JSR by +19.81%.The authors hypothesize that differences in language training data, safety conditioning, and phonetic or prosodic characteristics may contribute to varying vulnerability.Source: §5.3.1 · p. 7

5.3.2 Multi-Accent Audio Perturbation

  • Reverb-based modifications increase natural-accent JSR by +32.85 points on average and synthetic-accent JSR by +23.27 points; MERaLiON's natural-accent increase peaks at +57.25 points with Reverb Room.For synthetic Chinese-accented audio, the reported average JSR is 57.38%, a +55.00% increase from baseline.Source: §5.3.2 · p. 8, Table 2 · p. 8, Table 3 · p. 8
  • Natural accents have a 35.39% average JSR versus 34.74% for synthetic accents, but synthetic-accent increases are more consistent (+23.27 ± 7.3 vs. +32.85 ± 9.1).MERaLiON shows increases across both accent types, while DiVA is comparatively robust to natural-accent modifications; Whisper effects are asymmetric across Kenyan natural and Korean synthetic accents.Source: §5.3.2 · p. 8

5.4 Defense Methods and Results

  • An inference-time text defense generally reduces JSR for most tested models in German and Italian, though MiniCPM does not consistently benefit.MERaLiON's JSR drops by 14.23 percentage points in German and 12.50 in Italian; Qwen2 drops by 5.48% and 19.91%, respectively.Source: §5.4 · p. 9

6 Ablation Study

Echo delay and decay changes affect jailbreak success rates differently across models. Higher decay improves JSR for several models, while lower decay reduces it across all models.

6 Ablation Study

  • At decay 0.9, JSR reaches 40.38% for Qwen2, 41.63% for MERaLiON, and 31.54% for Ultravox.These are the models particularly improved by the higher decay rate.Source: §6 · p. 9
  • At delay 0.1, JSR is 30.00% for Qwen2 and 35.19% for MiniCPM, versus 23.56% for DiVA compared with 18.94% at the baseline delay of 0.3.The lower delay increases JSR for Qwen2 and MiniCPM but reduces it for DiVA.Source: §6 · p. 9
  • At delay 0.6, Qwen2’s JSR reaches 35.87%, while other models show only modest changes.A reduced decay rate of 0.1 yields lower JSR across all models.Source: §6 · p. 9

7 Limitation

The study does not optimize audio jailbreaking prompts or develop corresponding defenses. Its findings are therefore from a black-box setting with attacks limited to manipulating the original audio input.

7 Limitation

  • The study does not use optimization techniques to fine-tune audio jailbreak prompts or develop corresponding defenses.The authors note such methods could potentially yield higher JSRs across languages, models, and scenarios.Source: §7 · p. 9
  • The work examines LALM vulnerabilities and cross-language disparities in a black-box setting.The authors characterize this setting as practical and challenging for attackers.Source: §7 · p. 9
  • Even when adversaries manipulate only the original audio input, the study reports a significant increase in JSRs.Source: §7 · p. 9

8 Conclusion

The conclusion presents adversarially perturbed multilingual, multi-accent audio as a vulnerability for LALMs, with acoustic perturbations exacerbating cross-lingual ambiguities. It also highlights a dedicated dataset and hierarchical evaluation framework as benchmarks for robustness.

8 Conclusion

  • Acoustic perturbations, including reverberation, echo, and whisper effects, exacerbate cross-lingual ambiguities and increase JSRs.Source: §8 · p. 9
  • The work introduces a multilingual, multi-accent adversarial audio dataset and a hierarchical evaluation framework as benchmarks for LALM robustness.Source: §8 · p. 9
  • The conclusion identifies non-English audio inputs as weak points through which attackers can achieve JSRs far beyond those of text-based attacks.Source: §8 · p. 9

Ethics Statement

The ethics statement limits release of attack materials while making the curated dataset and some audio-modification code available. The appendix snippets include reverb and whisper functions that write transformed audio outputs.

Ethics Statement

  • The full MULTI-AUDIOJAIL attack framework is withheld, while the curated adversarial dataset and part of the audio-modification code are released.The authors state this is intended to support defense research without providing turnkey exploit tools.Source: Ethics Statement · p. 10
  • Experiments target publicly available LALMs under controlled conditions, and affected vendors were notified of critical vulnerabilities.Source: Ethics Statement · p. 10
  • The ethics statement frames increased model flexibility, such as multilingual support, as expanding attack surfaces disproportionately.It connects quantifying these risks and providing defensive benchmarks with the aim of supporting proactive safeguards.Source: Ethics Statement · p. 10

A.1 Audio Perturbation Code

  • The appendix code defines reverb and whisper functions and writes their transformed audio outputs to files.Source: §A.1 · p. 13

A.2 Dataset Details

The dataset contains 102,720 audio jailbreaking prompts, and the evaluation examines LALM transcription and multilingual question-answering capabilities. Across perturbed audio, stronger reverberation is associated with higher transcription error and jailbreak success rates.

A.2 Dataset Details

  • The dataset provides 102,720 prompts across natural, synthetic, and native scenarios, with five perturbation techniques increasing perturbed audio files fivefold.The perturbations include echo, whisper, and three reverberations.Source: Table 4 · p. 13

A.3 Model Details (Whisper Model Utilization)

  • The evaluated models use different Whisper components: Qwen2-Audio derives from Whisper-v3, while DiVA, MERaLiON, MiciCPM, and UltraVox use Whisper decoders or encoders.Their respective Whisper bases are Whisper-v3, Whisper-large-v2, Whisper-medium-300M, and Whisper-large-v3-turbo.Source: §A.3 · pp. 13–14

B.1 LALM General Capability Evaluation

  • The general-capability evaluation measures transcription and multilingual SQA, assessing audio understanding and responses to clean, safe questions.Transcription capability is measured with Whisper-v3-large, which is incorporated in all evaluated models.Source: §B.1 · p. 14

B.1.1 Transcription Accuracy

  • Reverb Railway and Reverb Room produce average multilingual WERs of 1.581 and 1.490, versus 0.743 for Echo and 0.245 for Whisper effect.Across multi-accent inputs, Reverb Railway averages 0.744 WER versus 0.131 for Echo; higher WER degradations align with higher JSRs.Source: §B.1.1 · p. 14, Table 5 · p. 14, Table 6 · p. 14

B.1.2 Evaluation of Multilingual SQA Performance in LALMs

LALMs perform strongly on English audio questions but less well across other languages, while multilingual audio attacks generally yield higher JSRs than text-only attacks. The evaluation also reports reduced JSRs for most models under a text-based defense and validates its multilingual safety evaluator.

B.1.2 Evaluation of Multilingual SQA Performance in LALMs

  • English SQA accuracy averages 90.4%, compared with 58.0% for French and 65.8% for Spanish; model averages range from 59.7% for Qwen2 to 73.5% for MERaLiON.The evaluation uses 100 multilingual speech commonsense questions.Source: §B.1.2 · p. 15, Table 7 · p. 15

B.2 Multilingual Text-only vs. Audio-only Input

  • Audio-only multilingual inputs yield higher average JSRs than text-only inputs for most LALMs.Table 8 also reports per-language averages across five models.Source: Table 8 · p. 15

B.3 Defense

  • After the text-based defense, most models show lower JSRs for German and Italian Reverb Teisco inputs, with MiniCPM the exception.The passage does not quantify the changes.Source: Table 9 · p. 15

B.4 Llama Guard 3 Accuracy

  • Llama Guard 3’s manual validation across six native languages reports a 3.0% average FN rate and a 1.6% FP rate on 50 checked responses.The authors report that alternatives had significantly higher false-positive and false-negative rates, especially on non-English inputs.Source: §B.4 · p. 16, Table 10 · p. 16

B.5 Robustness of Natural vs. Synthetic Accent

  • Natural accents average around 2.92% JSR, compared with around 11.42% for synthetic accents.The table compares JSRs for natural and synthetic multi-accent audio inputs.Source: Table 11 · p. 16

B.6 Impact of Delay and Decay Rate (Echo Perturbation) in JSRs

  • Across most perturbations and languages, JSRs increase; MERaLiON averages 22.16% (+19.62 percentage points) on natural accents and 30.84% (+20.26 percentage points) on synthetic accents.German echo results vary by model across delay and decay settings.Source: Table 13 · p. 17, Table 12 · p. 17, Table 14 · p. 18
Loading 2504.01094v1…