Source-linked AI summary
DuplexJail: Spoken Interruption Attacks on Full-Duplex Speech Models
Jaechul Roh, Deepak Chandran, Amir Houmansadr, Andrea Fanelli
TL;DR
Full-duplex speech lets users interrupt a model while it is responding, making spoken-jailbreak timing relevant to safety. DUPLEXJAIL tests fixed spoken prompts at different timings and finds effects vary by timing and model.
Problem
Because full-duplex models accept speech during generation, the effect of spoken-jailbreak timing cannot be assessed only at turn boundaries.
Source: §1 · p. 1Method
DUPLEXJAIL delivers fixed, request-independent spoken prompts through the user audio channel and compares fixed-delay and refusal-triggered interruption with timing controls.
Source: §1 · p. 1Results
33.8 and 39.3 percentage-point baseline gains yield AdvBench whole-response ASR of 40.3% and 48.7% for PersonaPlex and PersonaPlex-RL; HarmBench gains are 14.7 and 12.3 points.
Source: §1 · p. 1Takeaways & Limitations
Spoken-jailbreak effectiveness depends on delivery timing and model, motivating safety evaluation throughout full-duplex interaction.
Source: §1 · p. 1, §5 · p. 4Fixed delays do not guarantee acoustic overlap because response latency varies.
Source: §3.1 · p. 2
Abstract
from arXiv · showhide
Full-duplex speech models accept user speech while generating responses, making input timing a potential safety concern. We introduce DuplexJail, which delivers fixed, request-independent spoken jailbreak prompts through the user audio channel. Across four open-source models and 720 harmful requests from AdvBench and HarmBench, we compare fixed-delay and refusal-triggered interruption with request-end and post-response controls. On AdvBench, Guided Completion at a 1.0 s delay raises whole-response attack success rates to 40.3% for PersonaPlex and 48.7% for PersonaPlex-RL, increases of 33.8 and 39.3 percentage points over baseline. On HarmBench, which was not used for prompt selection, the same prompt at a 0.5 s delay increases ASR by 14.7 and 12.3 points, respectively. Effects vary across models: selected conditions increase FLM-Audio's harmfulness, while BayLing-Duplex shows decreases. These results show that spoken-jailbreak effectiveness depends on delivery timing and motivate safety evaluation across stages of full-duplex interaction.
1. INTRODUCTION
Full-duplex speech lets users interrupt ongoing responses, making the timing of spoken jailbreaks a safety question. DUPLEXJAIL tests fixed spoken prompts at different points in the interaction and finds effectiveness varies by timing and model.
1. INTRODUCTION
- Because users can speak while full-duplex models generate, jailbreak timing may fall before, during, or after a response, so turn-boundary-only evaluation may miss vulnerabilities during generation.The study holds prompts fixed while systematically varying their entry timing.Source: §1 · p. 1
- DUPLEXJAIL delivers fixed, request-independent spoken prompts through the user audio channel using fixed-delay or refusal-triggered interruption, with request-end and post-response controls.Fixed delay uses the harmful-request end; refusal-triggered delivery waits for a refusal expression in streaming text.Source: §1 · p. 1
- On 720 harmful requests from AdvBench, Guided Completion at a 1.0 s delay raises whole-response ASR by 33.8 and 39.3 percentage points for PersonaPlex and PersonaPlex-RL, respectively.On HarmBench, not used for prompt selection, the same prompt at 0.5 s increases ASR by 14.7 and 12.3 points, respectively. Selected conditions increase FLM-Audio’s harmful-response rate, while BayLing-Duplex shows decreases.Source: §1 · p. 1
2. RELATED WORK
Prior work evaluates full-duplex turn-taking, overlap, and safety under interruptions, while audio-jailbreak studies examine variations in spoken input. DUPLEXJAIL focuses on the timing of fixed spoken prompts in full-duplex models.
2. RELATED WORK
- Full-duplex benchmarks cover turn-taking, overlap, and safety under interruptions or conversational pressure.Related work also reports safety degradation for PersonaPlex trained on Fisher [19].Source: §2 · p. 1
- Audio-jailbreak studies examine language, accent, emotion, speaking style, and acoustic transformations [10] [11].Prior work also optimizes audio suffixes and discusses interruption during generation.Source: §2 · p. 2
- Text-based attacks exploit response prefilling and dialogue-context manipulation, while this work studies timing of fixed spoken jailbreak prompts in full-duplex models.DUPLEXJAIL's overview depicts request-end fixed-delay and refusal-triggered delivery through the user audio channel (Fig. 1).Source: §2 · p. 2, Figure 1 · p. 2
3. DUPLEXJAIL: FULL-DUPLEX INTERRUPTION ATTACKS
DUPLEXJAIL sends fixed prerecorded prompts through the user audio channel using several interruption timings and controls. Its evaluation measures whole-response harmfulness across benchmark trials, including those without an interruption.
3. DUPLEXJAIL: FULL-DUPLEX INTERRUPTION ATTACKS
- DUPLEXJAIL keeps three prerecorded spoken prompts fixed across requests, models, and timing conditions, comparing interruption strategies with request-end and post-response controls.The prompts enter through the user audio channel.Source: §3 · p. 2
3.1. Fixed-Delay Interruption Attack
- Fixed-delay delivery occurs 0.5 or 1.0 s after the harmful request ends, using no model text or internal state, but response-latency variation means acoustic overlap is not guaranteed.Offsets were selected by manually inspecting 100 responses and positioned relative to model speech using matched no-interruption recordings.Source: §3.1 · p. 2
- Table 2 reports single-run ASR prompt screening on PersonaPlex and AdvBench under refusal-triggered interruption, with changes measured against a 6.2% default-seed baseline.The selected prompts remain fixed for subsequent experiments.Source: Table 2 · p. 2
3.2. Refusal-Triggered Interruption and Timing Controls
- Refusal-triggered delivery follows a fixed refusal expression in streaming text; request-end and post-response controls deliver at the request end or after 0.9 s of model-audio silence.The first refusal-expression match triggers delivery on the next 80 ms decoding frame; without a match, no interruption occurs.Source: §3.2 · pp. 2–3
- Table 3 reports whole-response ASR across spoken-interruption conditions, with means over three runs and percentage-point changes from each corresponding baseline.The highest mean is marked for each model, benchmark, and prompt; ASR includes trials without interruption.Source: Table 3 · p. 3
3.3. Evaluation
- Whole-response ASR is the percentage of all benchmark trials classified as harmful, including trials without interruption, and is reported as mean ± standard deviation over three decoding runs.Responses are recorded to completion and transcribed with Whisper-Large-v3.Source: §3.3 · p. 3
4. EXPERIMENTS
The experiments evaluate four open-source models on AdvBench and HarmBench, selecting fixed spoken prompts before testing fixed-delay and refusal-triggered interruption. Guided Completion produces substantial PersonaPlex-family ASR increases, while effects vary by model and timing condition.
4.1. Experimental Setup
- The study evaluates PersonaPlex, PersonaPlex-RL, FLM-Audio, and BayLing-Duplex on 520 AdvBench behaviors and 200 HarmBench behaviors, using three decoding runs for main experiments.PersonaPlex models use a refusal-oriented system prompt; FLM-Audio lacks system-prompt support, and BayLing-Duplex is tested without that prompt because it caused decoding failures.Source: §4.1 · p. 3
4.2.1. Baseline and Prompt Selection
- Prompt screening on PersonaPlex/AdvBench selected Guided Completion, which yielded the largest increase at +31.7 points over a matched 6.2% baseline.HarmBench tests transfer to requests not used for prompt selection.Source: §4.2.1 · p. 3
4.2.2. Fixed-Delay and Refusal-Triggered Interruption
- Speech spans estimated from matched no-interruption recordings contain the 0.5/1.0 s offsets in 100/100% of PersonaPlex and PersonaPlex-RL trials, but may include pauses.The estimates do not establish active speech or refusal onset at the interruption timestamp.Source: §4.2.2 · p. 4
- Guided Completion peaks near a 1 s delay for PersonaPlex and PersonaPlex-RL, while FLM-Audio stays near baseline from 1 s onward and BayLing-Duplex initially decreases.At 2 s, offsets fall within baseline speech spans in 97.5–100% of trials across the four models, but those spans alone do not explain ASR differences.Source: §4.2.2 · p. 4, Figure 2 · p. 4
- 35.6% and 48.6% refusal-triggered ASR on AdvBench for PersonaPlex and PersonaPlex-RL exceed baseline by 29.1 and 39.2 percentage points, respectively.ASR includes all trials, including those without an interruption.Source: §4.2.2 · p. 4
- BayLing-Duplex has lower ASR than baseline under every tested fixed-delay condition, whereas FLM-Audio’s strongest increase comes from Spoken Prefilling at 0.5 s.The FLM-Audio increases are 10.3 and 13.7 percentage points on AdvBench and HarmBench, respectively; BayLing-Duplex’s decreases alone do not establish stronger safety.Source: §4.2.2 · p. 4
4.2.3. Request-End and Post-Response Controls
- On AdvBench, 1.0 s fixed-delay delivery exceeds post-response ASR by 9.1 and 10.8 percentage points for the PersonaPlex models, but does not consistently outperform both controls on HarmBench.BayLing-Duplex post-response ASR exceeds both fixed-delay conditions on both benchmarks but remains below baseline.Source: §4.2.3 · p. 4, Table 4 · p. 4
5. CONCLUSION
The study examines spoken interruption as an attack surface in full-duplex interaction. DUPLEXJAIL substantially increases whole-response harmfulness in the PersonaPlex family, with mixed or decreased effects in other models and effectiveness that varies with timing.
5. CONCLUSION
- DUPLEXJAIL substantially increases whole-response harmfulness in the PersonaPlex family, while effects are mixed for FLM-Audio and decrease under tested fixed-delay conditions for BayLing-Duplex.The same prompt can also increase harmfulness as a post-response follow-up, and its effectiveness varies with delivery timing and model.Source: §5 · p. 4
6. COMPLIANCE WITH ETHICAL STANDARDS
The study uses public benchmark text to synthesize speech and evaluates open-source models for controlled AI safety and security research, without human or animal subjects or personally identifiable data.
6. COMPLIANCE WITH ETHICAL STANDARDS
- The study involves no human or animal subjects or personally identifiable data.It synthesizes speech from public benchmark text and evaluates open-source models solely for controlled AI safety and security research.Source: §6 · p. 5