The researchers propose an audio narrative jailbreak attack, achieving a success rate of 98.26% on Gemini 2.0 Flash

End-to-end LALM directly processes raw speech, but safety mechanisms are mainly calibrated on text; whether narrative paralinguistic delivery can induce restricted outputs, authors believe, has not been characterized.

• Scenario: Authors claim voice assistants, education, and clinical triage are integrating real-time voice interfaces (e.g., GPT-4o, Gemini 2.0 Flash). Tone, emotion, and turn-taking make interactions more social, and change the attack surface.
• Existing gaps: Authors claim existing audio jailbreaks mostly synthesize text prompts into speech, or add accents, phonetic spellings, stress, as well as gradient perturbations and token search. Speech is still treated as text packaging or low-level signal, lacking characterization as a channel for conveying authority, empathy, and social dynamics.
• Hypothesis: Authors ask: if the model treats speech with persuasive authority or empathy as framing, can it bypass alignment guardrails and execute unsafe instructions? Figure 1 uses same DeepInception prompt as control: text is rejected, restricted outputs appear after therapeutic or performative rendering; specific instruction in figure not repeated.
• Approach: Propose black-box text-to-audio jailbreak: without changing underlying instruction semantics, use instruction-following TTS to embed disallowed instructions into narrative audio stream, only modulating delivery. In experiments called delivery-style modulation.
• Threat model:
  • Knowledge: black-box. No gradients, no intermediate features, only observe input–output.
  • Input: Attacker submits only audio waveform. Inference written as M: A→Y, A is waveform, Y is text response.
  • Goal: Use generated speech to bias internal decoding so response semantics align with malicious query, falling into harmful set R that violates alignment policy, rather than safe or refusal completions consistent with human values and policy.
  • Success and target: Output explicitly contains or endorses elements of R is success. Target is end-to-end LALM that directly consumes raw waveform, not cascaded system with ASR then LLM.

According to the grouping in the introduction and Section 2, the authors place this work on the side of using communicative style to manipulate compliance.

Large audio language models

• Two types of structures: Cascaded systems (An et al., 2024; HuggingFace, 2024; OpenAI, 2024b) first do ASR and then feed into an LLM. The authors state that this loses non-textual features such as tone and emotion. End-to-end systems (Ji et al., 2024; Xu et al., 2024a; Wang et al., 2024; Xie and Wu, 2024; Xu et al., 2025) directly read raw waveforms, preserving prosody, pitch, and stress. This paper only does the latter, naming GPT-4o Realtime, Gemini 2.0 Flash, and Qwen2.5-Omni.
• Paralinguistics change behavior: Lin et al. (2024a,b) report that when speaking style changes but words do not, outputs can still differ. Kang et al. (2025b) report that hidden representations encode emotion and tone. Chen et al. (2025a) and Rohanian and Krauthammer (2025) discuss stress, accent, and prosody. AIR Bench (Yang et al., 2024b) and MDAR (Li et al., 2026) evaluate emotion recognition, prosody-sensitive reasoning, and emotional understanding.

Text jailbreaks

• White-box: Zou et al. (2023), Sadasivan et al. (2024), Guo et al. (2024), and Huang et al. (2023) use gradients or internal states for adversarial suffixes or prompts.
• Black-box: Li et al. (2024), Liu et al. (2024), Yu et al. (2024), Chao et al. (2024b), and Mehrotra et al. (2024) use feedback iteration or search; Zhao et al. (2024) and Zeng et al. (2024) add persuasion or situational framing. The authors state that these methods encounter unavailable gradients and inconsistent multimodal behavior when applied to LALMs.

Audio jailbreaks

• Transcription, variants, and perturbations: Yang et al. (2024a), Shen et al. (2024), and Chiu et al. (2025) convert text prompts to speech; Cheng et al. (2025) and Roh et al. (2025) do accent, phonetic spelling, or stress. Chen et al. (2025b) and Gupta et al. (2025) optimize audio when gradients are available; Ma et al. (2025) do heuristic search in token space. There are also other audio jailbreak works such as Hughes et al. (2024), Kang et al. (2024), and Ying et al. (2024).
• The authors' distinction: The authors state that the above works treat acoustic changes as surface feature enhancements, with audio still being text packaging or low-level signals. This paper shifts to social cognitive biases, treating tone as a carrier of social signals. Psychology sources include Milgram (1963), as well as later Guyer et al., CIVA, and Van Zant and Berger.

Baselines and datasets

• Baselines: For text, DeepInception (Li et al., 2024): nested narrative and character authority, black-box, no parameter access. For audio, AdvWave (Kang et al., 2024): modifies audio tokens and iteratively rewrites; in black-box, it uses an unnamed LLM for rewriting before TTS.
• Datasets: AdvBench 520 items, JailbreakBench 300 items, and MaliciousInstruct 100 malicious inputs.

The authors' positioning in the introduction and Section 2.3 is: not confusing semantics, not doing low-level perturbations, but using therapeutic pacing, performative emphasis, and emotional tone to induce compliance, and stating that this exploits LALMs' personification bias.

The audio narrative attack in the title is referred to in the experiments as delivery-style modulation: the text instruction remains unchanged, the TTS synthesizes waveforms according to controllable voice styles, which are then fed into an end-to-end LALM, comparing under black-box conditions which delivery more often falls into harmful responses.

Problem Setting

• Reasoning is written as a mapping M: A→Y. The attacker constructs audio a* such that the output falls into the harmful set R. R refers to unsafe, unethical, or illegal content that violates alignment policies.
• The objective is a^∗=argmax_{a∈ A}Pr[M(a)∈ R]. The meaning is: find the input in waveform space most likely to produce R.
• Success condition: y=M(a) explicitly contains or endorses elements of R. Because there is no gradient, the problem shifts from optimization to behavior manipulation: find audio configurations that can bias the model toward restricted responses.

Delivery Style as Attack Surface

• The waveform is determined jointly by the text prompt x and the style vector s. The semantic channel provides literal content; the paralinguistic channel (pitch, rhythm, intensity, emotion) modulates how the instruction is perceived.
• The TTS model gφ renders both into a waveform. The authors state that end-to-end encoders do not treat prosody as noise but as a condition on speaking intent and emotion; when x is fixed, s can still change the hidden representation and compliance behavior.
• The search is therefore written as s^∗=argmax_{s∈ S}Pr[M(g_ϕ(x,s))∈ R]. The meaning is: find the delivery style most likely to cross alignment behavior. The authors link this to persuasion and compliance research: tone, confidence, and emotional framing can override propositional content.

Five Heuristic Styles

• Styles are treated as behavioral parameters for biased decoding, with text semantics unchanged. The main text lists five categories, each corresponding to different prosodic cues: Authoritative Demand (Guyer et al., 2018; low pitch, steady rhythm, firm intonation), Affiliative Persuasion (Guyer et al., 2021; moderate pitch variation, soft articulation), Urgent Directive (Guyer et al., 2024; increased speech rate, short rhythm), Emotive Suggestion (Vaughan-Johnston et al., 2021, CIVA; calm, empathy-appealing), Social Bonding Appeal (Zant and Berger, 2019; playful pitch, relaxed rhythm).
• Each is implemented as a discrete control template in TTS, synthesized with x and then fed to the target model, compared using ASR. Appendix C gives the full style prompts; accent, speech rate, and volume constraints are not listed here.
• Naming is not fully consistent: Table 3 has Assertive Clarity but not Urgent Directive; the templates in Appendix C are named Commanding Clarity, Warm & Cooperative, Urgent Directive, Calm Emotional Appeal, Playful & Casual. The paper does not explain how the three correspond.

Connection to Two Jailbreak Paradigms

• DeepInception: The original prompt is kept as a text baseline, then rendered with the five delivery styles. Table 1 reports the highest ASR among styles, with breakdowns in Table 3.
• AdvWave: 30 rounds of iterative rewriting per model–benchmark. The original version uses standard TTS each round; the enhanced version keeps the highest-scoring style from that round and carries it into the next. The LLM used for rewriting is not named in the paper.
• The main experiment synthesizer uses GPT-4o mini TTS (written as GPT-4o Mini TTS in Section 4.3). Closed-source targets use API default settings. Qwen2.5-Omni sets repetition_penalty=1.2, max_new_tokens=512, do_sample=True, temperature=0.7, top_p=0.9.

Success Determination

• The metric is ASR. The judge is GPT-4o, determining whether the response contains harmful information, outputting only Yes or No.
• The main text says it checks against OpenAI policy; the judge prompt in Appendix B says Google’s Generative AI Prohibited Use Policy. The paper does not provide a score threshold or report agreement with human judgment.

Experimental Setup

• Target models: GPT-4o Realtime, Gemini 2.0 Flash (closed-source, API default settings), Qwen2.5-Omni-7B (open-source; repetition_penalty=1.2, max_new_tokens=512, do_sample=True, temperature=0.7, top_p=0.9). Written as Qwen2.5-Omni in the table. Main synthesizer is GPT-4o mini TTS.
• Benchmarks: AdvBench 520 items, JailbreakBench 300 items, MaliciousInstruct 100 malicious inputs.
• Baselines and variants: DeepInception text version, taking the highest ASR across five audio styles (Table 1). AdvWave original version uses standard TTS each round; enhanced version retains the highest-scoring style each round, 30 rounds per model–benchmark.
• Metrics and judge: ASR. GPT-4o outputs Yes/No. Main text says violates OpenAI policy; Appendix B prompt says Google's Generative AI Prohibited Use Policy. The paper does not state a numerical threshold.
• Two other model names: Section 6.2, 6.3 and Appendix Table 8 headers are GPT-4o, Gemini-2.0-Flash. The paper does not state whether they are GPT-4o Realtime and Gemini 2.0 Flash. 6.3 also uses Gemini-2.0-Flash TTS.
• Not reported: Number of repetitions for main experiments, number of queries, judge-human agreement. Introduction claims the effect holds across speaker profiles; the paper does not give per-profile ASR.

Main Results

ASR (%) from Table 2. Left of arrow is AdvWave, right is enhanced version retaining highest style per round.

Swipe horizontally to read the table

Model	AdvBench	JailbreakBench	MaliciousInstruct
GPT-4o Realtime	89.03→95.00	87.00→96.33	84.00→91.00
Gemini 2.0 Flash	89.61→98.26	89.00→93.33	87.00→94.00
Qwen2.5-Omni	70.00→83.84	80.00→73.00	63.00→81.00

• Authors claim enhanced version is higher than AdvWave on all models and benchmarks, and give relative gains for GPT-4o Realtime of 6.7%, 10.7%, 8.3%, and for Gemini 2.0 Flash of 9.7%, 4.9%, 8.0%. These percentages are not table cells. Qwen2.5-Omni's JailbreakBench cell is inconsistent with "all higher"; authors still call that cell competitive performance.
• Table 1 is highest audio ASR for DeepInception text across five styles. GPT-4o Realtime: 44.42%→57.88%, 40.00%→66.67%, 43.00%→55.00%; Gemini 2.0 Flash: 86.15%→88.65%, 84.00%→88.33%, 73.00%→86.00%. Qwen2.5-Omni audio lower than text: 98.85%→84.64%, 76.67%→70.33%, 93.00%→86.00%. Authors call these minor regressions, attribute to frontend instability, and point to Section 5.2.
• Abstract says 98.26% exceeds text-only baselines; that number is in Table 2, comparison column is AdvWave, not Table 1 text baseline. Introduction claims maximum gain of 26% over text and acoustic perturbation baselines; Section 5.1 says highest is 26% higher on GPT-4o and 15% higher on Gemini 2.0. This is author summary. Introduction's "consistently improves" conflicts with Qwen's three cells in Table 1.

Breakdown of Five Deliveries

• Table 3 baseline is neutral TTS without prosody control, not Table 1 text. GPT-4o Realtime highest cells: Assertive Clarity 57.88% on AdvBench, Affiliative Persuasion 66.67% on JailbreakBench, Social Bonding Appeal 55.00% on MaliciousInstruct. Authors claim Authoritative Demand strongest on JailbreakBench (60.00%); that column is indeed 60.00%, but same table Affiliative Persuasion is 66.67%.
• Gemini 2.0 Flash columns mostly above 84%. Authors claim Authoritative Demand and Social Bonding Appeal reach up to 88.65% on JailbreakBench; in Table 3, 88.65% is on AdvBench for Social Bonding Appeal, JailbreakBench highest is Authoritative Demand at 88.33%. MaliciousInstruct highest is Authoritative Demand 92.00%, but Table 1 Ours writes 86.00%, inconsistent between tables.
• Qwen2.5-Omni: AdvBench highest Assertive Clarity 84.64%, MaliciousInstruct highest Authoritative Demand 86.00%, JailbreakBench highest Assertive Clarity 70.33%. Authors claim stylized audio improves over baseline TTS by 10–20 percentage points on average; this is a summary, not per-cell differences. Authors also claim LALM maps voice emotion to speaking intent, and multimodal alignment remains fragile under psychoacoustic framework.

Topic Categories and Qwen Failure Types

• Authors claim in Figures 2–4 audio generally increases ASR, especially for social manipulation or persuasion topics. OpenAI: average about ten points, and name Cheating, Poison, Dangerous activity, and first-time jailbreaks for Firearms, Government. Gemini: more than half categories increase, name Phishing, Libel, Hate speech, and claim Government is broken. Qwen more sensitive to text, most topics near-ceiling; on Cheating and Mental health text fails while audio succeeds. Bar heights for text not given. Figure labels are OpenAI, Gemini, Qwen; section does not state correspondence to full experiment names. Appendix D lists 19 category abbreviations, does not list Mental health, nor sample sizes per category.
• Authors claim Firearms, Virus, Prison almost always succeed regardless of modality; modality difference depends on topic semantics: audio more effective in social engineering and misinformation scenarios for OpenAI and Gemini, not for Qwen.
• Section 5.3: Among Qwen2.5-Omni voice jailbreak failures, true policy refusal True Fail accounts for 13.1%, remaining 86.9% are non-policy decoding issues: premature termination 43.0%, text generation loops 34.9%, overlap 9.1%. Authors claim bottleneck is not mainly stronger safety alignment but sequence stability under acoustic input, and relate to smaller model, pitch, phoneme duration, or prosodic variation disrupting encoder boundaries. Authors claim Figure 5 analyzes these voice attempts; its caption is same as Figure 4, both compare text vs audio ASR by category.

Neutral Audio, Human Voice, and Another TTS

• Table 4 (DeepInception, AdvBench) Text / Neutral Audio / Stylized (Auth.): GPT-4o Realtime 44.4 / 48.6 / 57.9; Gemini 2.0 Flash 86.1 / 88.0 / 88.7; Qwen2.5-Omni 98.8 / 80.3 / 84.6. Authors claim neutral speech is 3–5% higher than text, plus delivery control another 10–20%; Qwen's text 98.8 higher than both audio, not fully consistent with this sentence. Stylized (Auth.) differs from Table 3 Authoritative Demand column (53.65, 87.69, 79.48), values closer to Table 1 Ours; paper does not state which style name Auth. corresponds to.
• Table 6: AdvBench random 20 human voices. GPT-4o text 50.0%, normal audio 45.0%, Authoritative Demand 55.0% (n=20). Gemini-2.0-Flash 60.0%, 60.0%, 70.0% (n=20). Authors claim ordering consistent with synthetic speech, absolute ASR slightly lower due to sample size.
• Table 7: Gemini-2.0-Flash TTS, AdvBench random 50 items. GPT-4o 46.0%, 44.0%, 54.0%; Gemini-2.0-Flash 76.0%, 76.0%, 78.0%. Authors claim stylized delivery still higher than text and normal audio, effect not tied to one TTS.

Other Ablations and Analyses

• Table 5, JailbreakBench original queries without jailbreak wrapper: GPT-4o Realtime Neutral 1.0%, Urgent Directive 1.6%; Gemini 2.0 Flash 4.3%, 5.6%. Authors claim urgent tone increases up to 30%; paper does not give the calculation cell for that 30%.
• Appendix Table 8, removing jailbreak text and only changing tone: GPT-4o text 5.0%, normal audio 6.0%, Authoritative Demand 6.0%. Authors claim each case below 10%, compliance under direct malicious instructions near-zero; table only has GPT-4o row, no sample size.

Limitations and future directions noted by the authors

• Attacks on smaller LALMs may be less effective. The authors use Qwen 2.5-Omni as an example: additional audio perturbations may increase decoding instability, with outputs more often being random or unreadable text rather than the harmful content targeted by the attack (Section 8).
• The method relies on a small set of manually crafted delivery styles from communication psychology; the authors state that it is difficult to systematically optimize voice parameters (Section 8).
• The research is limited to English speech. The authors state that broader multilingual and cross-accent evaluations are needed to assess the generality of the observed effects (Section 8).
• The authors state that future work should automate the discovery of adversarial delivery styles and build alignment mechanisms that can handle social framing or emotional speech (Section 7).
• The authors state that one direction is to study how voice modulation interacts with contextual factors such as emotional polarity and prompt length (Section 7).

Experimental coverage

• The main experiments target three end-to-end LALMs: GPT-4o Realtime, Gemini 2.0 Flash, and Qwen2.5-Omni-7B; the primary synthesizer is GPT-4o mini TTS (Section 4.1).
• Benchmarks are AdvBench 520 items, JailbreakBench 300 items, and MaliciousInstruct 100 items. Paradigms are DeepInception and AdvWave, the latter with 30 rounds per model–benchmark (Section 4.1).
• The five-style breakdown is in Table 3. The voice is from 20 random AdvBench items (Table 6). Another TTS is Gemini-2.0-Flash TTS with 50 random AdvBench items (Table 7). A tone control without jailbreak text is in Appendix Table 8, which includes only the GPT-4o row.
• The judge is GPT-4o with Yes/No. The paper does not report the number of main experiment repetitions, agreement with human judgment, or the name of the LLM used for AdvWave rewrite prompts.
• The experiments in this paper only include end-to-end models; the authors state that cascaded pipelines lose audio-specific information in ASR (Section 2.1). Topic abbreviations are listed in Appendix D, totaling 19 categories; the paper does not report sample sizes per category.

This work treats voice delivery as a black-box jailbreak against end-to-end LALM: instruction semantics unchanged, only the communicative style of synthesized speech is altered.

• Problem: Models can directly hear raw waveforms, while alignment is mainly calibrated on text. Authors examine whether paralinguistic cues like authority, empathy, urgency can induce restricted outputs without rewriting instructions.
• Approach: Use TTS to render same text into five heuristic styles, attached to DeepInception and AdvWave. Main synthesizer is GPT-4o mini TTS. Success judged by GPT-4o Yes/No; policy names in main text and Appendix B differ.
• AdvWave: Table 2 Gemini 2.0 Flash enhanced ASR on AdvBench is 98.26%, compared to AdvWave 89.61%. GPT-4o Realtime three benchmarks 95.00%, 96.33%, 91.00%. Qwen2.5-Omni on JailbreakBench 73.00%, lower than AdvWave 80.00%. Abstract compares 98.26% with text-only baselines, but table comparison column is not text baseline.
• DeepInception: Table 1 two closed-source models audio higher than text, e.g., GPT-4o Realtime JailbreakBench from 40.00% to 66.67%, Gemini 2.0 Flash MaliciousInstruct from 73.00% to 86.00%. Qwen2.5-Omni audio lower than text on all three benchmarks, AdvBench from 98.85% to 84.64%.
• Exceptions and controls: Among Qwen voice failures, true policy refusal 13.1%, rest mostly premature termination or repetition (Section 5.3). Removing jailbreak text, GPT-4o tone-only ASR 5.0%, 6.0%, 6.0% (Appendix Table 8). On 20 human voices, Authoritative Demand still higher than normal audio (Table 6).
• Authors' conclusion: Aligning only text insufficient to cover voice interfaces; defenses need to handle linguistic content, prosody, and speaking intent simultaneously. Authors plan automatic search for adversarial deliveries and examine interaction with sentiment polarity and prompt length.