Prosody-driven Jailbreaks in Audio LLMs: A Controlled Study and Mechanistic Analysis

2026-07-29

AI Summary

This study investigates whether prosodic cues—such as emotion, speech rate, and perceived authority—can independently induce safety jailbreaks in audio large language models (LLMs) without altering the underlying textual content. Introducing prosody as a controlled variable, the work proposes PJ-Break, a black-box evaluation protocol, along with AdvAudio-Prosody, a benchmark dataset comprising 600 samples spanning six controllable acoustic attributes. Experiments on Qwen2-Audio reveal that prompts delivered with Panic, Anger, and Fast prosody achieve jailbreak success rates of 38/95, 35/95, and 32/95, respectively—substantially higher than the neutral condition (4/95). Notably, emotionally inflected speech alone (44/95) significantly outperforms emotionally charged text without prosody (11/95), establishing prosody as a critical factor in the safety evaluation of audio LLMs.

Abstract

Audio-capable foundation models enable end-to-end spoken interaction, but they also introduce safety risks beyond transcript content. It remains unclear how much jailbreak capability can arise from matched-text variation in speech delivery rather than from lexical rewriting or broader style transfer. We study this question by holding transcript content fixed and varying six speech-delivery presets whose acoustic attributes may co-vary. We present PJ-Break, a black-box evaluation protocol with presets targeting arousal, authority, and speaking rate, together with AdvAudio-Prosody, a 600-sample benchmark with acoustically verified attributes. On the exact post-QC Qwen2-Audio panel, the Q=1 Panic (38/95), Anger (35/95), and Fast (32/95) presets are all well above Neutral (4/95). The fixed six-query pool covers 44/95 Qwen2-Audio seeds and 15/95 GPT-4o seeds and exceeds a matched-budget StyleBreak reimplementation (27/95) on Qwen2-Audio. A same-voice pool excluding the confounded Commanding condition still reaches 40/95, and a retained-panel ablation shows emotional-delivery audio alone (44/95) is far more effective than emotional text alone (11/95). Exploratory surrogate diagnostics and pilot mitigation observations are secondary, non-core analyses. Overall, matched-text speech delivery should be treated as a first-class factor in Audio LLM safety evaluation

Problem

• prosody
• jailbreak
• audio LLMs
• speech delivery
• safety evaluation

Innovation

• prosody-driven jailbreak
• audio LLM safety
• speech delivery variation
• black-box evaluation
• AdvAudio-Prosody