PaperlayerView exact revision on arXiv

Source-linked AI summary

Where Does the Audio Jailbreak Live? A Controlled Frequency-Depth Audit of AdvWave-P on Qwen2-Audio

Boyuan Chen, Minseok Kim, Sohaila Abdulsattar, Minghao Shao, Siddharth Garg, Ramesh Karri, Muhammad Shafique

arXiv:2610.07005v1cs.SDcs.AIcs.CRcs.LG

TL;DR

Frequency-localization claims for audio jailbreak perturbations need to be distinguished from effects of band width, energy, and removal structure. This paper audits AdvWave-P on Qwen2-Audio with STFT-domain masking and representation analysis. Its frequency findings depend on the partition, while the fine-resolution top-band result remains unresolved without a matched control.

  • Problem

    Frequency-localization claims require distinguishing band location from band width, perturbation energy, and the structure of the removed signal.

    Source: §1 · pp. 1–2

  • Method

    The study masks or retains STFT components of AdvWave-P perturbations and measures attack success and decoder audio-span representations.

    Source: §1 · p. 2

  • Results

    The apparent frequency ranking changes with partition, and band energy alone predicts the standard eight-band ranking (Spearman ρ = 0.95).

    Source: §1 · p. 2

  • Takeaways & Limitations

    Frequency claims warrant partition-aware auditing, while the fine-resolution top-band result remains unresolved without a matched control.

    Source: §1 · p. 2

    Positive findings concern one additive attack and one victim with usable margin; the protocol does not directly apply to suffix-appended, semantic, or mel-domain attacks.

    Source: §7 · p. 8

Abstract

from arXiv · show

We audit frequency and decoder-depth claims for AdvWave-P, an additive audio jailbreak, on Qwen2-Audio. The protocol masks frequency components of the perturbation in the short-time Fourier transform (STFT) domain and measures attack success and audio-span representations. On 520 AdvBench prompts, the primary judge labels 76.7% of adversarial inputs as jailbreaks. A condition-blind, single-annotator validation yields a Rogan-Gladen sensitivity estimate of 0.87 for this condition (about 0.83-0.95 with validation-rate uncertainty); this correction is not applied to masked conditions. The apparent frequency ranking depends on the partition: energy share alone predicts the standard eight-band ranking (Spearman's rho = 0.95), and equal-Hz and equal-energy partitions show that masking any tested band can sharply reduce attack success. At a finer 16-band equal-energy resolution, however, masking the narrow 7520-7960 Hz band leaves ASR at 0.10, which remains unresolved without a matched control. Matched-energy scattered-removal tests show that contiguous removal is more damaging in lower bands, while both forms approach the floor in upper bands. Global rescaling leaves ASR near baseline but tests amplitude sensitivity rather than frequency location. In a re-optimization pilot (n = 20), tested single- and two-band supports reach ASRs of 0.00, 0.25, and 0.40, while random supports covering about half the STFT bins reach a mean of 0.86. In a prompt- and energy-adjusted model, audio-span divergence is associated with band necessity, with the coefficient rising from +0.63 at the projector output to +0.93 at layer 30 (contrast +0.293, 95% CI [0.11, 0.51]). This association is not a causal localization, and single-layer patching does not establish a causal layer. The results support partition-aware auditing of frequency claims, leaving the fine-resolution top-band result and broader generality open.

1 INTRODUCTION

Audio jailbreaks can bypass refusals that hold for the same text instruction, but frequency-localization claims require controls for band width, energy, and removal structure. This audit tests those factors for AdvWave-P and examines how band importance relates to decoder representations.

Motivation

  • Prior frequency-selection methods target different objectives: GRM ranks mel bands by attack-to-utility ratio, ALMGuard selects bins for a defense, and Gupta et al. identify a broad 1–8 kHz region [Jin et al., 2025].These approaches do not all claim that the same perturbation components are necessary.Source: §1 · p. 1

Contribution and findings

  • The standard eight-band ranking is strongly associated with band energy, while a fine equal-energy sweep leaves a narrow top-frequency result unresolved without a matched control.The depth-varying association between audio-span divergence and band necessity is not causal localization.Source: §1 · p. 2
  • The audit compares frequency rankings across partitions, perturbation energies, removal structures, and decoder representations for AdvWave-P on Qwen2-Audio.The protocol includes random-region, equal-Hz, equal-energy, scattered-removal, and global-rescaling comparisons.Source: §1 · p. 2

2 RELATED WORK

Prior work establishes audio-jailbreak risks and uses frequency regions for attack or defense, but those approaches do not necessarily claim the same perturbation components are required. This paper tests whether apparent frequency patterns persist under controls for partition, energy, and removal structure.

Audio jailbreaks and spectral structure

  • Audio attacks have demonstrated jailbreaks on AdvBench and broader vulnerabilities across attacks and audio-language models [Kang et al., 2025; Jin et al., 2025; Yang et al., 2025].Related work also studies psychoacoustic attacks and spectral structure, while AdvWave-P constrains the perturbation norm without an explicit masking-threshold objective.Source: §2 · p. 2

Frequency-domain methods

  • Frequency-selection approaches differ in purpose: GRM ranks mel bands by attack-to-utility ratio, ALMGuard selects bins for defense, and Gupta et al. use encoder attention to identify a broad 1–8 kHz region [Jin et al., 2025].The paper distinguishes these purposes from claims about which attacker-perturbation components are necessary.Source: §2 · p. 2, Figure 1 · p. 3

Removal-based attribution and interpretability

  • Removal-based attribution can depend on how removal is constructed; spectral occlusion therefore uses random-band, equal-energy, and scattered-removal controls to test dependence on band location, energy, or removal structure (Zeiler & Fergus, 2014; Hooker et al., 2019).Source: §2 · p. 3

3 METHODOLOGY

The methodology masks or retains selected frequency components of an additive perturbation, then measures behavioral importance and audio-span representation divergence across decoder layers. It defines band-level necessity and sufficiency and uses prompt- and energy-adjusted inference alongside descriptive layer-wise correlations.

3.1 SETUP AND MEL-BAND OCCLUSION

  • The study evaluates AdvWave-P perturbations on AdvBench waveforms with an ℓ∞ budget of 0.01, using contiguous mel-scale bands over 0–8 kHz on an analysis basis distinct from the victim frontend.The Qwen setup uses eight bands, with a 16-band refinement; the method masks perturbation components while leaving the clean waveform unchanged.Source: §3.1 · pp. 3–4

3.2 BEHAVIORAL IMPORTANCE

  • For each prompt and condition, behavioral importance compares adversarial ASR with masked or retained variants; necessity is the ASR drop under masking, while smaller sufficiency values indicate better attack sustainment from a retained band.The sweeps score clean, adversarial, and one masked or retained variant per band under a shared fixed seed and greedy decoding.Source: §3.2 · p. 4

3.3 LAYER-WISE REPRESENTATION PROBES

  • Audio-span hidden states are recorded from the projector output and decoder residual streams, mean-pooled by span, and compared across conditions to relate representation divergence to band-level ASR drops.The raw layer-wise Pearson correlation is descriptive and uses eight bands; Spearman correlation is a sensitivity analysis.Source: §3.3 · p. 4

3.4 STATISTICAL INFERENCE AND UNCERTAINTY

  • The judge is validated on 220 condition-blind human-labeled responses by one author, and its error-rate correction is applied only to the 520-prompt adversarial ASR, not masked conditions.The observed raw depth-curve slope does not reject the phase-randomized null (p = 0.183).Source: §3.4 · p. 4
  • A prompt-by-band mixed-effects logistic model estimates the divergence–necessity association after adjustment for prompt identity and band energy, with prompt-cluster bootstrap uncertainty.The raw eight-band correlation has a leave-one-band-out spread of 0.172, about twice the prompt-bootstrap standard error.Source: §3.4 · p. 5

4 EXPERIMENTAL SETUP

Experiments evaluate AdvWave-P on Qwen2-Audio and LLaMA-Omni using AdvBench, with primary behavioral sweeps over 520 prompts. Secondary controls use their stated sample sizes and scorers, and ASRs from different judges are interpreted separately.

Experimental setup

  • The study attacks 520 AdvBench prompts with AdvWave-P and evaluates Qwen2-Audio-7B-Instruct and LLaMA-Omni; the primary Qwen K=8 sweeps and depth estimators use all 520 prompts.Secondary controls use their respective sample sizes and scorers, and ASRs from different judges are not pooled; the primary judge is GPT-4o-mini at temperature 0.Source: §4 · p. 5

5 RESULTS AND DISCUSSION

On Qwen2-Audio, AdvWave-P achieves high judged attack success, but its apparent frequency ranking changes with the analysis partition. Energy-adjusted audio-span divergence rises with decoder depth, while controls leave fine-band and causal-localization claims unresolved.

5 RESULTS AND DISCUSSION

  • 0.767 adversarial ASR was judged on 520 AdvBench prompts; validation estimates about 0.87 (0.83–0.95), a correction not applied to masked conditions.Source: §5 · p. 5

5.2 PROTOCOL DIAGNOSTICS: OCCLUSION FIDELITY AND THE ENERGY CONFOUND

  • Matched-energy contiguous removal leaves lower ASR than scattered removal in every band, with the largest difference at low frequencies; both approach the floor at the top.Global rescaling leaves ASR near baseline as an amplitude check, not a location control; prior-support comparisons were inconclusive.Source: §5.2 · pp. 6–7

5.3 PER-LAYER REPRESENTATIONAL IMPORTANCE AND THE ALIGNMENT TREND

  • Among 399 prompts, the energy-adjusted divergence coefficient rises from +0.63 at the projector output to +0.93 at layer 30; the contrast is +0.29 (95% CI [0.11, 0.51]).The raw depth trend does not reject its surrogate null (p = 0.183), and the adjusted association is not causal localization.Source: §5.3 · p. 7

5.4 ACTIVATION PATCHING IS A NULL FOR LOCALIZATION

  • Single-layer patching restores the attack only near the decoder entrance and cannot establish where representations form; restoration falls from 0.83 to zero at layers 18–30.The full audio span is patched, not a specific band, and the experiment is a design-limited null.Source: §5.4 · p. 7, §5.3 · p. 7

5.5 ADDITIONAL FINDINGS: GEOMETRY, TRANSFER, DETECTOR, AND ROBUSTNESS

  • A supervised input-space classifier matches the depth probe’s detection AUROC, while gradient attribution (ρ = 0.97) and energy share (ρ = 0.95) recover the standard band ranking.The low-band mask reduces ASR from 0.77 to 0.24; the perturbation-only notch is not a validated defense and may suppress useful speech.Source: §5.5 · p. 7

5.1 PER-BAND BEHAVIORAL IMPORTANCE

  • 0.054 residual ASR after masking b8, down from 0.767 (drop 0.714, 95% CI [0.671, 0.754]), does not establish a stable frequency ranking across partitions.Equal-energy K=8 masks leave residual ASR of 0.07–0.16; the K=16 top band leaves 0.10, but lacks a matched control.Source: §5.1 · pp. 5–6, Figure 2 · p. 8

5.5 ADDITIONAL FINDINGS: GEOMETRY, TRANSFER, DETECTOR, AND ROBUSTNESS

  • Only the JailbreakBench K=8 sweep uses the full jailbroken pool; the other corpus sweeps use highest-necessity subsets and do not independently replicate the ranking.In the n=20 re-optimization pilot, some random supports covering about half the STFT bins sustain the attack, but establish no general sufficiency threshold.Source: §5.5 · p. 8
  • LLaMA-Omni has judged clean ASR 0.41 and adversarial ASR 0.61, leaving limited headroom; cross-model transfer tests identify no transferable band or depth signature.Source: §5.5 · p. 8, Figure 2 · p. 8

6 CONCLUSION

The audit finds that apparent frequency importance changes with partition and removal structure, while the fine-resolution near-Nyquist result remains unresolved. The adjusted association between audio-span divergence and band necessity is not a causal localization, and broader generality remains open.

6 CONCLUSION

  • On Qwen2-Audio, the standard eight-band ranking is closely predicted by band energy, but its apparent location changes with the analysis partition; matched-energy scattered-removal tests show contiguous removal is more damaging in lower bands.A finer equal-energy sweep singles out a narrow band near Nyquist, but the absence of a matched control leaves that result unresolved.Source: §6 · p. 8
  • Contiguous removal is more damaging in lower bands than matched-energy scattered removal, while both approaches the floor in upper bands.Global rescaling leaves ASR near baseline but tests amplitude sensitivity rather than frequency location.Source: §6 · p. 8
  • In re-optimization pilots, tested single-band supports and their union perform poorly, while random supports covering about half the STFT bins reach mean ASR 0.86.Source: §6 · p. 8
  • A prompt- and energy-adjusted model estimates a depth-varying association between audio-span divergence and band necessity, but single-layer patching does not establish a causal layer.The raw depth trend is partition-sensitive.Source: §6 · p. 8
  • The findings motivate partition-aware controls and leave open generalization to other attacks, victims, or perturbation domains.Source: §6 · p. 8

7 LIMITATIONS

The positive findings are bounded to AdvWave-P at ϵ = 0.01 on Qwen2-Audio, and the protocol targets additive perturbations aligned with the clean waveform. Several measurements remain constrained by judge uncertainty, removal design, and unresolved depth localization.

7 LIMITATIONS

  • Positive findings come from one attack, AdvWave-P at ϵ = 0.01, on one victim with a usable margin, Qwen2-Audio.The protocol does not directly apply to suffix-appended, semantic, or mel-domain attacks.Source: §7 · p. 8
  • Attacks optimized at ϵ = 0.005 and 0.02 were unstable under cold-start re-inference, so behavioral results use ϵ = 0.01.Their ASRs fell from 0.84 and 0.76 during optimization to 0.32 and 0.40 at inference on n = 50 prompts; the cause was not isolated.Source: §7 · p. 9
  • The adversarial-condition Rogan-Gladen correction is 0.87, but it cannot be transferred to masked conditions, so condition-level comparisons use uncorrected scores.Validation used one author-annotator, and the second annotator was unavailable.Source: §7 · p. 9
  • Perturbation occlusion isolates perturbation structure but does not test a deployable filter, which must process the clean-plus-adversarial mixture.Global rescaling is only an amplitude check because its displacement is 3.8–7.3 times smaller than band masking.Source: §7 · p. 9
  • At K = 16, masking the near-Nyquist band b15 = [7520, 7960] Hz leaves residual ASR 0.10, but no matched random control makes this unresolved.At K = 8, residual ASR ranges from 0.07 to 0.16; this supports disruption from masking any band, not equal importance.Source: §7 · p. 9
  • The adjusted depth result is an association, not causal localization, and single-layer patching cannot test effects that develop cumulatively across layers.Cross-corpus depth curves use existing 50-prompt highest-necessity samples, and none rejects the phase-randomized null.Source: §7 · p. 9

ETHICAL CONSIDERATIONS

The study uses public methods, corpora, and victim models without introducing a new attack, corpus, or model. It shares analysis materials to support re-derivation but withholds the optimized adversarial waveforms and perturbations.

ETHICAL CONSIDERATIONS

  • Optimized adversarial waveforms and perturbations are not included in the release; the repository will provide code, seeds, hyperparameters, renderer details, prompt identifiers, responses, and judge scores for re-derivation.Source: ETHICAL CONSIDERATIONS · p. 9
  • The analysis is intended to inform defense, though frequency-level findings may also help characterize existing attacks.Source: ETHICAL CONSIDERATIONS · p. 9

A.1 METHODOLOGY

The protocol removes or retains a perturbation frequency band, reconstructs the waveform, and evaluates attack behavior and decoder representations.

A.1 METHODOLOGY

  • Figure 1 summarizes a pipeline that decomposes δ in the STFT domain, removes or retains one band, reconstructs the waveform, and evaluates it with the victim and judge.The analysis then compares each band’s behavioral importance with audio-span divergence across decoder layers.Source: §A.1 · p. 13

A.2 REPRESENTATION-SPACE VISUALIZATIONS

The supplemental visualizations compare audio-span representations across clean, adversarial, and band-masked conditions.

A.2 REPRESENTATION-SPACE VISUALIZATIONS

  • The analysis supplements Section 5.5 with linear CKA heatmaps and PCA and t-SNE projections of pooled audio-span states.The heatmaps cover K+2 clean, adversarial, and band-masked conditions at layer 30.Source: §A.2 · p. 13

A.3 SUPPLEMENTAL ANALYSES AND DIAGNOSTICS

Supplemental analyses test the robustness and scope of the frequency and depth findings, including judge validation, attribution baselines, seed checks, transfer, and cross-corpus evidence. Several controls constrain interpretation: patching does not localize a causal layer, and the cross-corpus evidence is partial and descriptive.

A.3 SUPPLEMENTAL ANALYSES AND DIAGNOSTICS

  • Single-layer restoration decreases from 0.83 at the projector output to zero at layers 18–30, and the control follows a similar pattern.The authors note that single-layer patching cannot test effects emerging cumulatively because downstream positions have already processed occluded audio.Source: §A.3 · p. 13

A.3.2 JUDGE-MISCLASSIFICATION CORRECTION (ROGAN-GLADEN)

  • The corrected adversarial ASR estimate is about 0.87, with an approximate 0.83–0.95 range; this correction is not applied to masked conditions.Validation used one annotator.Source: §A.3.2 · p. 13

A.3.6 CROSS-MODEL TRANSFER

  • The cross-model transfer result is a two-directional null, while cross-corpus K=8 rankings agree only in selected samples outside JailbreakBench.The additional depth curves do not reject the phase-randomized null; the authors characterize the cross-corpus evidence as partial, not full replication.Source: §A.3.6 · p. 14, §A.11 · p. 16

A.6 GRADIENT BAND-ATTRIBUTION BASELINE

  • Gradient ranking correlates with occlusion ranking at Spearman ρ = 0.97, while energy share alone predicts the n=520 ranking at ρ = 0.95.The authors conclude that occlusion’s added value is its controls for bandwidth, energy, and removal structure.Source: §A.6 · p. 14

A.7 DECODING AND OPTIMIZATION SEED STABILITY

  • Across three optimization seeds, all 20 prompts place the largest energy share in b8, but this does not establish frequency-specific necessity.In stochastic decoding, the tested top-band mask leaves mean ASR 0.07, versus 0.24 for the tested low-band mask; these checks do not establish a full ranking.Source: §A.7 · p. 14

A.8 AN ARBITRARY SINGLE NOTCH AS A DEFENSE HYPOTHESIS

  • Masking b1 reduces ASR from 0.77 to 0.24, but the tested notch is not a validated defense and speech utility was not measured.A practical filter would act on the mixture and could remove speech fundamentals.Source: §A.8 · p. 15

A.9 RESOLUTION LADDER ACROSS K

  • Raw depth increments vary by partition—+0.36 at K=8, +0.13 at K=16, and +0.094 at K=20—and are descriptive rather than resolution-independent evidence.Energy-adjusted partial correlations at K=8 were omitted because near-collinearity produced invalid estimates.Source: §A.9 · p. 15

A.10 AUDIT OF NAMED PRIOR BAND-SELECTIVITY CLAIMS

  • The named-support pilots are inconclusive: ALMGuard’s ASR 0.15 falls within the matched-random range [0.150, 0.187], and GRM’s 0.75 is at the lower edge of its random range.Neither pilot evaluates the original methods or shows their selections are ineffective.Source: §A.10 · p. 15
Loading 2610.07005v1…