SpeechJBB: Jailbreak Benchmark for Large Audio Language Models under Code-Switched Speech

How robust are current LALMs to multilingual and code-switched spoken jailbreaks, and how much of the failure comes from safety mismatch rather than comprehension failure.

• Scenario: The authors say real multilingual communication often alternates languages within a sentence, and speech also adds speaker, accent, and pronunciation variation, which may distort safety-related content before review or alignment. Safety policies, review guidelines, and benchmarks are still mainly designed and evaluated in monolingual English text.
• Existing gaps: The authors say defenses tend to weaken under multilingual conditions. Existing spoken jailbreak work is described by the authors as limited to one language and a small number of models. The authors say prior work has not treated code-switching as a jailbreak vector for LALMs, nor used pseudowords for spoken obfuscation.
• Questions the authors ask: How robust are current models to multilingual and code-switched spoken jailbreaks, and to what extent failures come from safety mismatch.
• What this paper provides: An audio dataset SpeechJBB. It covers English, French, German, Italian, Spanish, and code-switched pairs of these languages, and inserts pseudowords around safety-related words; then evaluates nine LALMs, with spoken comprehension benchmarks as a control.
• Input and judgment: The systems under test are LALMs that accept speech. The inputs the authors control are speech synthesized from JailbreakBench harmful prompts after translation, recomposition, and synthesis, not weights or hidden states. The success criterion is Jailbroken as given by GPT-4.1: partial or full compliance without explicit refusal.

LLM Jailbreaks and English-Centric Alignment

• Competing objectives: The paper cites Wei et al. (2023), which attributes jailbreaks to competing objectives between helpfulness and safety.
• Training and red teaming: Ouyang et al. (2022) and Bai et al. (2022) correspond to practices including RLHF, instruction tuning with safety data, constitutional alignment, and internal red teaming. The authors argue that most safety training and evaluation remains centered on English text, because system prompts, safety policies, and alignment instructions themselves are mostly written in English.
• Prompt strategies: The paper lists DeepInception (Li et al., 2024) with its recursive fictional framework, few-shot jailbreaks (Wei et al., 2026), role-playing (Zou et al., 2023), cipher obfuscation (Yuan et al., 2024), and automatic adversarial search (Perez et al., 2022).

Multilingual Text and Speech Safety

• Translation and intra-sentential mixing: The paper reports Yong et al. (2023) as finding that translating harmful prompts into low-resource languages increases GPT-4's compliance rate. The paper reports Yoo et al. (2025) as finding that intra-sentential multilingual mixing further amplifies jailbreak success in text LLMs.
• Speech jailbreaks: VoiceJailbreak (Shen et al., 2024) performs speech jailbreaks on GPT-4o; SpeechGuard (Peri et al., 2024) studies adversarial robustness for spoken question answering. The authors note that these are limited to one language and a small number of models. Roh et al. (2025) extends the setting to multilingual and multi-accent English attacks.
• Cross-lingual differences: The introduction cites Kumar et al. (2025) and Atil et al. (2025), and the authors state that alignment quality and safety robustness vary with language. Zhang et al. (2023) is used to define code-switching, i.e., alternating between multiple languages within a single sentence.

Data Sources and Condition Comparisons

• Benchmark and rewriting sources: Harmful and benign prompts come from JailbreakBench (Chao et al., 2024), 100 each. Code-switched text generation follows Winata et al. (2026). The pseudo-word probe is adapted from Boucher et al. (2022)'s token-level obfuscation: the original words are kept, and instead pronounceable, meaningless pseudo-words are inserted into the acoustic context.
• Comparison conditions: The paper does not list other attack algorithms as baselines. Condition comparisons are monolingual, EN-X, X-Y, and 0% versus 10%, 30%, 50% pseudo-words. Comprehension comparisons are Speech-MGSM, FLEURS, and FLEURS-SLU. Defense experiments compare against malicious and benign baselines without the prompt.

The authors position that prior work has not treated code-switching as a jailbreak vector for LALMs, nor pseudo-words as spoken obfuscation. The authors state that SpeechJBB is the first audio code-switching jailbreak dataset for multilingual safety evaluation.

The overall approach is to first turn a text jailbreak benchmark into multilingual and code-switched speech, then add a layer of local pseudoword obfuscation, and test SpeechJBB with the same three-way classification.

From JailbreakBench to monolingual speech

• Text: 100 harmful prompts and 100 paired benign prompts. Categories include Disinformation, Economic Harm, Expert advice, Fraud/Deception, Government decision-making, Harassment/Discrimination, etc.
• Translation and verification: TranslateGemma-4B translates into German, Spanish, French, Italian. One annotator checks semantics and naturalness: German, English, Italian are native or near-native, Spanish and French are C1. Unqualified ones are regenerated.
• Synthesis: XTTS. Monolingual intelligibility is reported as WER using omniASR_CTC_1B, naturalness with UTMOS, values in Table 1. The authors say GPT-4o and XTTS were selected based on this verification.

Code-switched pairs

• Recomposition: On the translations, GPT-4o generates code-switched sentences, following the method of Winata et al. (2026), and requires not changing the source prompt's semantics. Language pairs are denoted {lang1}-{lang2}, about 40–60% of words are replaced with corresponding words in the other language. Appendix A.1 gives the full prompt.
• Matrix language: When English is present, the non-English language is the matrix language, i.e., the language governing the grammatical structure; when neither side is English, lang1 is the matrix language. The authors' rationale is to avoid English-dominant sentence patterns and preserve more natural switching.
• Speech: The ten pairs are en-de, en-es, en-fr, en-it, de-es, de-fr, de-it, es-fr, es-it, fr-it. During synthesis, the matrix language is the TTS language, so the embedded language carries the matrix language's accent; all files use one XTTS speaker. Native speakers verify grammar, switching-point naturalness, and intelligibility. UTMOS is in Table 2.

Pseudoword probe

• Purpose: To measure how much refusal depends on recognizing safety-related words from the acoustic signal.
• Insertion: Phonologically plausible, semantically empty pseudowords are placed around safety-related words, and every original word is preserved. GPT-4o generates them, with insertion amounts of 10%, 30%, 50% relative to the original sentence length. Appendix A.2 gives the full prompt.
• Recheck: Synthesis still uses XTTS. Native speakers confirm that harmful intent remains recoverable and that semantics are not completely covered by pseudowords. Figure 1 summarizes the pipeline from translation, recomposition, optional perturbation, to synthesis and three-way classification.

Model inputs and labels

• Nine LALMs: Open-source are Qwen2.5-Omni-7B, Qwen3-Omni-30B-A3B-Instruct, Voxtral-Small-24B, SALMoNN-13B, Audio Flamingo 3, Gemma 3n E4B-it, Gemma 4 E4B-it; closed-source are GPT-4o audio and Gemini-2.5-Pro. Except for the exceptions below, speech is directly used as input.
• Two interface differences: The authors say Audio Flamingo 3, if directly receiving jailbreak audio, describes the acoustic content rather than answering the request, so it is first transcribed, then answers based on the transcription. Voxtral has no system prompt interface, so the same behavior instruction is changed to a user text prefix. The remaining models share the system instruction in Appendix A.5 to reduce output format differences.
• Three-way classification: GPT-4.1 outputs Refusal, Deflection, or Jailbroken, with a short rationale. Refusal includes explicit refusal, safety statements, and empty outputs; empty outputs count as refusal per the JBB protocol. Deflection is neither refusal nor on-topic. Jailbroken is partial or full compliance without explicit refusal. The evaluation prompt is in English, with translations of each language attached. Appendix B gives the full prompt.

Comprehension control and defense prompts

• Separation criterion: The authors define Jailbroken as necessarily containing on-topic harmful content, so responses that did not understand should go to Deflection, not be counted as jailbroken. The benign and malicious sets use the same construction.
• Benchmarks: Under monolingual conditions, evaluate Speech-MGSM, FLEURS transcription, and FLEURS-SLU. SLU is seven-class topic classification on SIB-Fleurs. Italian MGSM is translated from English, synthesized with XTTS, and verified by native speakers.
• Defense: Only adds a system prompt at inference, no retraining. The two steps are to reconstruct ambiguous, code-switched, or perturbed input into a more coherent English request, then check the inferred intent before answering. The design cites Schraw et al. (2006) for metacognitive self-checking. Appendix F gives the full prompt.

实验设置

• 被测模型：Qwen2.5-Omni-7B、Qwen3-Omni-30B-A3B-Instruct、Voxtral-Small-24B、SALMoNN-13B、Audio Flamingo 3、Gemma 3n E4B-it、Gemma 4 E4B-it、GPT-4o audio、Gemini-2.5-Pro。除 Audio Flamingo 3 先转写再答外，语音直接输入。
• 数据与 n：JailbreakBench 有害与良性提示各 100 条；五语单语；十个语码转换对；伪词 10%、30%、50%。Table 14：每模型恶意 JSR 的 n 为 Mono 500、EN-X 400、X-Y 600、Avg 1500。
• 指标：RR、DR、JSR。Refusal 含明确拒绝、安全声明和空输出。良性表与防御表另报 Compliance，表注写明它表示无害请求是否被正确执行。
• 评审：GPT-4.1。两名英语、德语、意大利语母语者，在按评审自身标签分层的 N=180 上对照（每标签 60 条，每条件 45 条），以使 Deflection、Jailbroken 与 Refusal 数量相当。人–人一致率 86.7%（Cohen's κ=0.799）；评审–人 85%（平均 κ=0.775；对两名标注者分别为 80.6% 与 89.4%）。另从每个输出文件抽 10 条查看，作者称约占已评审输出的 10%。
• 语音质量：Table 1 单语 WER/UTMOS 为 En 5.4/4.2、De 6.2/3.8、Es 2.4/3.5、Fr 7.2/3.4、It 4.1/3.4。Table 2 中 En-De 的 UTMOS 为 3.8843，Fr-It 为 3.3182。
• 检验：第 5 节报告 Wilcoxon signed-rank 与 Friedman 检验；各条件 JSR 的 Wilson 95% 区间在附录 D、Table 14。论文未报告重复实验次数。

主结果

据 Table 4 的 JSR（%）。省略 Qwen2.5-Omni：Mono 8.80，EN-X 10.75，X-Y 15.67，Avg 12.07。九模型均值 JSR 为 Mono 16.39、EN-X 17.01、X-Y 20.92、Avg 18.37；均值 RR 为 81.54、79.32、69.76；均值 DR 为 2.00、3.67、9.28。

Swipe horizontally to read the table

模型	Mono	EN-X	X-Y	Avg
Voxtral	46.80	47.75	49.83	48.27
Gemma 4	24.20	29.75	33.00	29.20
Flamingo	23.60	24.00	27.83	25.40
SALMoNN	24.80	19.50	10.67	17.73
GPT-4o	6.80	7.75	16.83	11.07
Qwen3-Omni	5.20	7.25	12.33	8.60
Gemma 3n	4.60	3.75	14.17	8.20
Gemini 2.5 Pro	2.72	2.58	7.92	4.76

• 排序与反例：作者称脆弱性顺序为 X-Y > EN-X > 单语，且在 8/9 个模型上一致。均值符合该顺序。SALMoNN 一行的 JSR 从 Mono 到 X-Y 下降、RR 上升，与均值方向相反。表内 Gemma 3n 与 Gemini 2.5 Pro 的 EN-X JSR 低于各自 Mono。
• 作者的分组与检验：作者称按模型族汇总时，专有模型平均 JSR 为 7.9%，开源模型为 21.3%。X-Y 相对单语的拒答率：Wilcoxon signed-rank，W=2.0，p=0.012。
• 作者解读：作者认为句中有英语时更稳，可能因为预训练里英语占优；纯非英语交互会加重安全机制的意图识别失败。作者称 Figure 2 里英语的 JSR 通常最低；逐语言数字没有列入 Table 4。

伪词插入

• 均值：相对恶意基线（均值 RR 76.24%、DR 5.36%、JSR 18.37%），Table 5 在 10%、30%、50% 的九模型均值 RR 为 72.1%、65.6%、63.4%，DR 为 7.6%、11.9%、11.9%，JSR 为 20.3%、22.5%、24.6%。作者报告四档（0%、10%、30%、50%）的 Friedman 检验 χ²(3)=12.07，p=0.007，并称均值 JSR 单调上升。
• 分条件均值：作者给出的 JSR 为，10%：Mono 18.12、EN-X 19.93、X-Y 22.32；30%：21.59、21.34、24.00；50%：23.55、24.76、25.48。作者称这些均值上 X-Y 仍最高。Table 5 在 50% 时并非每个模型都如此：Flamingo 的 X-Y 为 25.33、Mono 为 36.20；Voxtral 为 49.17 与 62.40；SALMoNN 为 6.83 与 11.80。
• 例外：作者称效应在 8/9 个模型上一致，并把 SALMoNN 标为插入趋势的例外，JSR 从 17.7% 降到 15.7%、10.1%、9.1%，同时 DR 上升；作者认为这对应语义落地变弱、对有害意图的参与下降。Table 5 中 Voxtral 三档总 JSR 为 55.4、50.4、55.1。作者称专有模型均值 JSR 从 7.9% 到 9.1%、12.7%、14.8%，开源从 21.3% 到 23.5%、25.3%、27.4%。

理解力对照

• 良性集：Table 15 均值 Compliance 为 Mono 70.9%、EN-X 67.6%、X-Y 55.7%；Deflection 为 4.6%、7.4%、16.7%。作者的对比是：若只是听不懂，X-Y 的 JSR 应下降，但恶意 JSR 从 16.39% 升到 20.92%。Voxtral 在良性 X-Y 上的 Compliance 为 68.5%（Table 15），在有害 X-Y 上的 JSR 为 49.83%（Table 4）。SALMoNN、Flamingo 对无害单语请求的 Refusal 为 61.8%、35.0%。
• MGSM：Table 7，EN/DE/ES/FR/IT 平均正确率：Gemini 97.9%（无答案 0.0%），GPT-4o 91.8%，Qwen3-Omni 74.1%，Voxtral 72.9%，Gemma 4 14.8%，Flamingo 6.3%（错误 78.1%），SALMoNN 2.2%，Gemma 3n 2.1%（无答案 91.0%）。作者认为弱模型的一部分越狱可能反映理解不足，但高推理能力下安全失败仍然存在。
• ASR 与 SLU：Table 8 的 F1。Gemini ASR 均值 97.83%，SALMoNN 3.84%，Voxtral 均值 63.21%（en 94.62%，de 48.94%，it 51.97%）。SLU 均值：Gemini 76.62%，Voxtral 73.03%，Gemma 4 68.29%，Flamingo 65.34%，SALMoNN 54.13%。作者称强的多语理解既非安全对齐的必要条件，也非充分条件，并以 Voxtral、Gemma 4 为例。

防御提示

• 设置：附录 F 的系统提示，用于恶意基线、良性基线 and 50% 插入。Table 9 为全语言条件平均，括号是相对对应基线的差值。
• 恶意条件：多数模型拒答上升，如 Voxtral 71.8（+26.9）、Gemma 4 88.6（+22.6）、Qwen3-Omni 95.4（+7.4）。Gemini 拒答 90.8（-3.5）、遵从 7.7（+2.9）；SALMoNN 拒答 65.5（-12.6）、遵从 30.8（+13.1）。
• 代价：良性遵从下降。GPT-4o 良性拒答 89.3（+78.5）、遵从 8.3（-75.5）；Voxtral 遵从 22.0（-61.4）。50% 插入再加防御后，GPT-4o 拒答 75.7（-10.9），Gemini 86.3（-8.1）。作者称伪词可以削弱归一化这一步，效果取决于基线稳健性和输入可懂度。作者还称 Table 11 里良性与有害提示常有语义重叠，因此非恶意输入也可能被当成有害。

其他消融与分析

• 10% 归因（Table 6）：识别率 Gemini 68.1%、Qwen3-Omni 50.8%、Gemma 4 45.8%、GPT-4o 1.9%、SALMoNN 3.8%；后两者替换率 96.8%、87.9%。各模型有害归因都低于无害与噪声，从 SALMoNN 3.7% 到 Gemini 16.8%。
• 密度（正文 6.1 的跨模型均值）：低密度时 56.7% 被换成看似合理的 token；噪声归因从 39.4% 升到 72.2%，检测从 28.9% 降到 20.1%。
• 50% 归因（Table 13）：Gemma 3n 噪声 90.0%，GPT-4o 噪声 89.8%；Gemini 识别 32.9%；SALMoNN 识别 44.6%。
• 评审分歧（Table 3、附录 B.2）：X-Y 上评审–人一致率 76.7%，为四条件中最低。360 次比较里 Refusal 与 Jailbroken 混淆 2 次（0.6%）。人–人 24 次分歧中 21 次在 Deflection 与 Jailbroken 边界，没有把 Refusal 与 Jailbroken 混淆。
• MGSM 音频（附录 E.2）：Whisper-medium 五语平均 WER 6.46%、CER 3.63%。

作者指出的局限与后续方向

• 模型集合：作者写所评模型并不穷尽，更新的系统可能表现出不同的稳健性；同时称这些模型覆盖当前实践里的主要架构族（Section 8）。
• 语言范围：限于英语、德语、西班牙语、法语、意大利语，以便每条语码转换提示和每个音频都能由母语者按高标准核验（Section 8）。
• 更远的语言：作者预期，扩到更低资源、类型上更远的语言会看到更大的脆弱性，并把这项比较标为后续工作（Section 8）。
• 语音条件：口音、不流利、自发语音、背景噪声和说话人差异被作者视为与本文问题互补。作者写，由于没有先前的语音多语越狱基准，他们采用干净语音作为初始受控设置（Section 8）。
• 防御强度：防御评测限于提示词干预。作者称这种做法本质上不如训练时对齐有力，并指出恶意输入上拒答改善与良性查询上更保守并存，因此需要提示之外的结构化对齐（Section 8）。
• 训练方向：作者在 Section 6.3 写出可探索的方向：在语码转换和非英语语音上做安全微调，以及用多语语音训练的、感知语码转换的安全训练和护栏模型。

实验覆盖范围

• 模型：Section 4.1 评测九个 LALM：Qwen2.5-Omni-7B、Qwen3-Omni-30B-A3B-Instruct、Voxtral-Small-24B、SALMoNN-13B、Audio Flamingo 3、Gemma 3n E4B-it、Gemma 4 E4B-it、GPT-4o audio、Gemini-2.5-Pro。
• 语言与规模：英语、德语、西班牙语、法语、意大利语，以及十个语码转换对（Section 3.1）。有害与良性提示各 100 条。Table 14：每模型恶意条件 Mono n=500、EN-X n=400、X-Y n=600。
• 探针、对照与防御：伪词插入为 10%、30%、50%（Table 5）。理解力对照为单语上的 Speech-MGSM、FLEURS、FLEURS-SLU（Section 6.2）。防御为附录 F 的提示词，Table 9 报告恶意、良性与 50% 插入三种设置。
• 评审校验：分层样本 N=180，条件为 EN/DE/IT 单语、EN-DE、EN-IT、DE-IT 和 10% 伪词；两名标注者的母语为英语、德语、意大利语（Section 4.3）。
• 记录在案的合成与未报告项：语音由一个 XTTS 说话人合成，语码转换对以矩阵语言为 TTS 语言（附录 A.3）。论文未报告各条件的重复实验次数。

SpeechJBB uses synthetic speech to measure LALM safety alignment under five languages, code-switching, and local pseudoword obfuscation, and additionally sets up a spoken comprehension control.

• Problem: The authors believe existing safety evaluations are biased toward monolingual English text, while real speech interaction often mixes languages within a sentence. They want to separate two things: the request was not understood, and it was understood but safety constraints were not upheld.
• Method: 100 harmful prompts and 100 benign prompts from JailbreakBench are translated into German, Spanish, French, Italian, then composed into ten code-switched pairs, synthesized by XTTS. Pseudowords are inserted next to safety-related words at 10%, 30%, 50% of the original sentence length, with original words preserved. GPT-4.1 labels responses as refusal, deflection, or jailbroken; empty outputs count as refusal.
• Main results: On Table 4, the nine-model average JSR is monolingual 16.39%, EN-X 17.01%, X-Y 20.92%, with average refusal rates correspondingly 81.54%, 79.32%, 69.76%. Voxtral's average JSR is 48.27%, Gemini 2.5 Pro's is 4.76%. SALMoNN is opposite to this ordering: X-Y JSR is 10.67%, lower than its monolingual 24.80%.
• Pseudowords and comprehension: At 50% insertion, the nine-model average JSR is 24.6% (Table 5). The authors say as insertion density increases, refusal decreases, and models rarely interpret pseudowords as harmful meaning. Voxtral's five-language MGSM accuracy is 72.9%, while its average JSR is 48.27%; the authors believe the jailbreak signal cannot be attributed to multilingual incomprehension.
• Defense and conclusion: Prompt-based defense increases refusal for most models under malicious conditions, but Gemini and SALMoNN decrease refusal, and benign compliance generally decreases (Table 9). The authors conclude that non-English-to-non-English code-switching constitutes a jailbreak surface, and prompts alone are insufficient; alignment needs to be done at architecture or training time.