Investigating Safety Vulnerabilities of Large Audio-Language Models Under Speaker Emotional Variations

1. INTRODUCTION

• Although LALM perception, performance, reasoning, and bias have been studied, safety alignment under paralinguistic variation remains underexplored, especially for speaker emotion.Prior work has identified safety vulnerabilities involving sound effects, languages, accents, and intonation.Source: §1 · p. 1
• The study synthesizes malicious speech instructions across emotions and intensities while holding semantic content and speaker identity constant, then verifies the data with human annotation.This setup is designed to systematically investigate how speaker emotion affects LALM safety.Source: §1 · p. 1
• Safety varies across emotions, and medium intensities often provoke more unsafe behavior than low or high intensities.The authors conclude that current LALM safety alignment is not robust to emotional variation.Source: §1 · p. 1
• The authors describe this as the first study of the interaction between speaker emotion and LALM safety alignment, and report inconsistencies under emotional variation.They call for future work on training data and strategies to improve robustness to emotion-driven risks.Source: §1 · p. 1

2. RELATED WORK

• Prior work reports LALM safety failures involving spoken rather than text inputs, paralinguistic and acoustic cues, and language or accent variation.The cited examples include tone, emphasis, speaking rate, and noises, as well as languages and accents [29].Source: §2 · p. 1
• Existing benchmarks assess LALM safety alignment, but the reviewed efforts do not systematically examine whether emotional cues introduce safety vulnerabilities.The authors identify emotion as a central component of human communication.Source: §2 · p. 1
• The paper’s specific research gap is the lack of a systematic study of emotion’s role in LALM safety, despite prior work on other speech variations.The passage names emotion as the motivation for the present study.Source: §2 · p. 1

3. DATASET CONSTRUCTION

• The construction pipeline has three phases: harmful-query collection, emotional speech synthesis, and human annotation of emotion and intensity.Figure 1 summarizes the construction and subsequent safety testing.Source: §3 · pp. 1–2, Figure 1 · p. 2

3.1. Harmful Query Collection

• The study uses AdvBench’s 520 textual queries across five security categories as prompts for synthesizing malicious speech instructions.The categories are misinformation, disinformation, toxicity, spam, and sensitive information.Source: §3.1 · p. 2

3.2. Speech Query Synthesis

• CosyVoice 2 0.5B synthesizes instructions in six emotions, using CREMA-D reference speech and its emotion and intensity annotations.Speaker characteristics are held fixed; samples are manually checked for naturalness, emotional expression, and intensity-label correctness.Source: §3.2 · p. 2

3.3. Human Annotation

• Annotators check naturalness, fidelity to the text prompt, emotion, and intensity; only samples with unanimous agreement from at least three annotators are retained.Annotators must first achieve at least 95% accuracy on calibrated CREMA-D samples.Source: §3.3 · p. 2

3.4. Dataset Statistics

• The finalized dataset contains 8,320 malicious speech instructions: 520 neutral samples and 520 samples at each of three intensities for each other emotion.Table 2 reports prompt word counts and generated speech durations across emotions.Source: §3.4 · p. 2

4.1. Investigated Models

• The study evaluates open-source and proprietary LALMs on speech instructions and includes a text-only setup using the original queries; all experiments use greedy decoding.The speech instructions are accompanied by a text prompt requiring the model to respond to the speech.Source: §4.1 · pp. 2–3

4.2. Evaluation Metrics

• The evaluation reports non-refusal rate (NRR) and unsafe rate (UR), which use different definitions of an unsafe response.NRR uses pattern matching for typical refusals; UR uses an LLM judge to assess whether responses follow malicious queries and provide harmful information.Source: §4.2 · p. 3
• NRR and UR are proportions of queries judged unsafe under their respective definitions, compared across instructions with different emotions and intensities.The metrics are used to quantify how speaker emotion influences LALM safety alignment.Source: §4.2 · p. 3

5.1. Main Results

• The main results divide models into a relatively safer group with lower NRR and UR and a less safe group.The safer group includes Qwen2-Audio, Qwen2.5-Omni, DeSTA2.5-Audio, MiniCPM-o-2.6, and the Gemini series; the less safe group includes SALMONN 7B and 13B, Typhoon-audio, and SpeechGPT.Source: §5.1 · p. 3
• 67.14% NRR and 4.47% UR increases for SALMONN 7B illustrate the broader pattern of higher unsafe rates under speech than text instructions for most models.The speech values are averaged across six emotions.Source: §5.1 · p. 3
• Across emotions, SALMONN 7B and 13B show substantial NRR and UR variability, including NRR σ values of 3.08% and 2.85% and UR σ values of 5.15% and 3.78%.Their NRR ranges are 8.59% and 8.15%, and their UR ranges are 12.50% and 10.26%, respectively.Source: §5.1 · p. 4
• Emotional instability also occurs in models with lower average risk, including MiniCPM-o-2.6, Qwen2-Audio, and Gemini-2.0-flash.For Qwen2-Audio and Gemini-2.0-flash, the ranges are comparable to their average NRR and UR values.Source: §5.1 · p. 4
• No single emotion consistently triggers unsafe behavior across all models; each model has its own emotional blind spot.The authors recommend assessing this instability before real-world deployment to guide filtering and safeguarding.Source: §5.1 · p. 4

5.2. Effects of Emotion Intensity Levels

• The intensity analysis examines UR across three levels for each model’s non-neutral emotion with the highest UR.Neutral emotion is excluded because it lacks defined and annotated intensity levels.Source: §5.2 · p. 4
• Most LALMs reach their highest UR at medium intensity, while SALMONN 13B and MiniCPM-o-2.6 also show substantial variability across intensity levels.The effect is non-monotonic: stronger expressions do not necessarily increase unsafe responses, and medium intensity often elicits the most harmful responses.Source: §5.2 · p. 4
• Intensity responses differ by model: Qwen2.5-Omni remains stable, whereas MiniCPM-o-2.6 shows higher UR at high intensity than at lower levels.The authors suggest that sensitivity may reflect data-distribution biases or insufficient alignment robustness, leaving these causes for future investigation.Source: §5.2 · p. 4

• The study evaluates several current LALMs using malicious speech instructions with identical semantics and speaker characteristics but different emotional expressions and intensities.Source: §6 · p. 4
• Safety alignment varies substantially across emotions, and stronger expressions do not necessarily increase unsafe behavior; moderate intensities often pose the greatest risk.Source: §6 · p. 4
• The authors identify emotional instability as a safe-deployment challenge and call for further work on its causes and possible mitigation strategies.Source: §6 · p. 4