Pith. sign in

REVIEW 4 major objections 6 minor 35 references

Audio Jailbreak Attacks: Exposing Vulnerabilities in SpeechGPT in a White-Box Framework

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A white-box, token-level adversarial audio attack jailbreaks SpeechGPT in up to 89% of attempts across six policy-violating categories.

desk verdict First white-box token-level audio jailbreak against SpeechGPT, but the evaluation is too loose to say how much of the 89% is the mechanism versus generic audio artifacts. read the letter →

arxiv 2505.18864 v1 pith:YPBJ44ZA submitted 2025-05-24 cs.CL

Binhao Ma , Hanqing Guo , Zhengping Jay Luo , Rui Duan This is my paper
classification cs.CL
keywords audiojailbreakattacksmultimodallargelanguagemodelsspeechtokenizationwhite-boxadversarialattackgreedysearchalignmentbypassGPTdiscretetokens
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the voice interface of an aligned multimodal language model, SpeechGPT, can be broken by a fully automated, token-level attack that needs no handcrafted prompts and no gradient access. The attacker starts from a harmful spoken question, converts it to discrete speech tokens via the model's own HuBERT extractor, appends a short random token suffix, and greedily replaces those suffix tokens to minimize the loss between the model's output and a desired target response. The optimized token sequence is turned back into audio with a vocoder, and that audio is played to the model. Across six prohibited categories defined by the model's usage policy, the paper reports up to 89% attack success, higher than existing voice jailbreak baselines, with semantically meaningful audio also sounding more natural than pure noise. If correct, this means text-based alignment does not transfer to the audio token space, and voice-enabled assistants inherit a largely unexamined attack surface.

What carries the argument

The mechanism that carries the argument is a three-stage pipeline. A Discrete Unit Extractor (HuBERT) converts harmful speech into discrete tokens; a greedy search (Algorithm 1) samples candidate replacement tokens for each position of an appended adversarial suffix and keeps the candidate that minimizes the loss between the model's decoding and a predefined target response, iterating until jailbreak behavior appears; and a cluster-matching reconstruction step (Algorithm 2) synthesizes the final token sequence into a waveform with a vocoder (HiFi-GAN), then optimizes a global noise perturbation so that re-extracted clusters match the intended token sequence. The key property is that optimization happens entirely in the discrete token space using only observable loss values, with no gradients or internal parameters.

What would settle it

Run the same greedy search while withholding the scalar loss value and see whether attack success collapses; separately, take the reconstructed adversarial audio, transcribe it with an independent speech recognizer that does not use the HuBERT clusterer, and check whether the intended harmful phrase is recovered. If a separate recognizer hears different words, the attack may be exploiting an artifact of the optimized reverse-loss loop rather than the claimed token sequence.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central claim is that a discrete-token adversarial attack can bypass the safety alignment of SpeechGPT without modifying the harmful speech tokens themselves. The original harmful audio is tokenized and kept intact; only a short, randomly initialized adversarial token suffix is optimized, using repeated queries that return a scalar loss value. Because the original tokens are unchanged, the natural prosody of the harmful question survives, and the added perturbation is small. The paper further claims that this method outperforms direct harmful speech, random noise, and black-box voice jailbreak methods, reaching 0.95 on illegal activity and 0.90 on hate speech, physical harm, pornography, and privacy violations, for an average success rate of 0.89.

Load-bearing premise

The attack assumes the adversary can observe a scalar loss value between the model's output and a desired target response for arbitrary audio-token queries, and that the synthesized audio actually reaches the model as the intended token sequence--the latter verified only by an optimized reverse loss rather than an independent transcription.

Editorial extensions

If this is right

  • Voice-enabled multimodal models that inherit text-based alignment are vulnerable to automated token-level audio attacks, so safety training must be evaluated directly on audio inputs.
  • The reported success rates imply that black-box voice jailbreak baselines are weaker than white-box token-space optimization, and speech-model security benchmarks should include token-space attackers.
  • Because the attack preserves the original harmful tokens, waveform-denoising defenses may not remove the adversarial suffix without also degrading the spoken content.
  • The paper's own defense directions--denoising in the discrete audio token space, adversarial training, and aligning audio tokens with semantic expectations--follow directly from the attack's mechanism.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The attack's reliance on a scalar loss value suggests a black-box variant could be built by estimating that loss from confidence scores or a surrogate model, extending the threat beyond white-box settings.
  • Because the reconstruction step is validated only by the optimized reverse loss, the adversarial audio may be exploiting quirks of the HuBERT clusterer rather than carrying the intended spoken phrase to a human listener; that gap deserves a direct test.
  • The evaluation covers ten questions per category on one model, so the 89% figure is a proof of feasibility rather than a measured field rate; transfer to other token-based speech LLMs is plausible but not demonstrated.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper presents a white-box, token-level adversarial attack against the speech input of SpeechGPT, a multimodal LLM that represents audio via discrete HuBERT units. The attack pipeline (Algorithm 1) appends a short adversarial token sequence to the tokens of a harmful speech prompt and optimizes that sequence greedily by querying a scalar loss between the model output and a target response, without using gradients. Algorithm 2 then reconstructs a waveform from the optimized token sequence with a vocoder and adds a global noise perturbation, optimized to make the HuBERT cluster predictions on the reconstructed audio match the intended token sequence. The authors evaluate the attack on six forbidden-policy categories (illegal activity, hate speech, physical harm, fraud, pornography, privacy violation) using ten hand-picked questions per category, comparing against random noise, harmful speech, and two prior voice-jailbreak baselines. They report an average attack success rate (ASR) of 0.89, claim a significant advantage over baselines, and include additional experiments on audio quality (NISQA), noise budget, voice variation, and optimization iterations.

Significance. If the central claim holds, the paper would be one of the first systematic white-box studies of audio-token-level jailbreaks against speech-enabled LLMs, and it would demonstrate that alignment trained primarily on text can be bypassed through discrete audio perturbations without access to model gradients. The paper has several concrete strengths: it targets a timely and underexplored attack surface (voice inputs in MLLMs); it provides a completely automated, non-interactive attack pipeline; it releases code; it compares against reasonable baselines (random noise, direct harmful speech, and two prior voice-jailbreak approaches); and it examines auxiliary factors such as noise budget, voice identity, and required iterations. The significance is, however, conditional on two things that the manuscript does not yet establish: that the reconstructed audio actually reaches the model as the intended token sequence (rather than as generic noise artifacts), and that the reported performance differences are statistically meaningful despite the small manual evaluation set. If those points are resolved, the work would be a useful contribution to the security evaluation of multimodal LLMs.

major comments (4)
  1. [Section IV-B and Figure 4] The reported success rates are internally inconsistent: the abstract and Section IV-B state that the method achieves 'up to 89%' attack success rate, yet Figure 4 states 'achieving over 93% ASR at a noise level of 0.1' for the semantic audio method. Since Table II reports an average ASR of 0.89 for the same method, the reader cannot tell whether Figure 4 uses a different experimental setting (e.g., a different subset of questions or a different noise budget) or whether the numbers are simply irreconcilable. Please clarify the exact experimental configuration behind Figure 4 and ensure all reported ASR values are consistent across the abstract, Section IV-B, and the figures.
  2. [Section III-C, Algorithm 2] The validation that the synthesized audio actually delivers the intended adversarial token sequence to SpeechGPT is circular. Algorithm 2 optimizes a global noise perturbation to minimize L = D(ŷ, y), where ŷ is the HuBERT cluster prediction on the perturbed waveform and y is the target cluster sequence. The only reported check, the 'reverse loss' in Figure 4, is exactly this same objective. Since the same HuBERT model is used both to craft the perturbation and to score it, the optimization can succeed even if the actual discrete unit extractor used by SpeechGPT maps the waveform to different tokens. This is load-bearing because the paper's novelty is the token-level mechanism, and the random-noise baseline already achieves 0.83 ASR; the claimed advantage of semantic adversarial audio requires evidence that the semantic content survives reconstruction. Please provide an independent verification, for example by feeding the final waveform through SpeechGPT's own discrete unit extractor and reporting token-level agreement, or by showing that the attack fails when the token sequence is not preserved.
  3. [Section IV-A, Table II] The evaluation is too thin to support the claim that the proposed method 'significantly outperforms' baselines. Only ten questions per category (60 total) are used, and the success criteria are not defined; the paper says the evaluation is 'primarily manual' but provides no rubric, no inter-annotator agreement, and no confidence intervals. With 60 samples, the difference between an ASR of 0.89 and the random-noise baseline of 0.83 corresponds to just four additional successes, which is within the range of random fluctuation. Please report per-sample success/failure data, define the exact judging criterion, and provide confidence intervals or a statistical test (e.g., a binomial test or paired bootstrap) to demonstrate that the improvement over random noise is significant.
  4. [Section II-C and Algorithm 1] The threat model and Algorithm 1 rely on a loss function L(Model(xtemp), y_target) that is never defined. The paper states that the adversary can 'observe the scalar loss value associated with a target decoding,' but it does not specify how this loss is computed for SpeechGPT's text output — for instance, whether it is the cross-entropy of the target response under the model's output distribution, and how the target response is constructed for each forbidden question. Without this definition, the optimization procedure in Algorithm 1 is not reproducible. Please specify the loss function, the target response construction, and the values of n (adversarial token length) and k (candidate sampling size) used in the experiments.
minor comments (6)
  1. [Abstract and Section I] The abstract contains grammatical fragments: 'which effectively bypass alignment safeguards and to induce prohibited outputs' and 'and to help guide the development' should be revised.
  2. [Table II] The column header reads 'Violence' while the text and Table III use 'Privacy Violence' or 'Privacy Violation'; please standardize the category name.
  3. [Section IV-B] The sentence 'For Voice Jailbreak [9], Plot [9] improves ASR over Harmful Speech through prompt design' is unclear and likely missing a verb or comparison; please rewrite.
  4. [Section IV-B and Figure 3] Figure 3 shows NISQA scores but the figure caption is incomplete; it states 'NISQA Score Comparison of Adversarial Speech for Jailbreak Attacks' and does not explain what the boxes/whiskers represent or how many samples per question.
  5. [Section IV, Dataset Setup] The paper says ten questions were 'randomly selected' from ForbiddenQuestionSet, but the selection method is not described (e.g., were they uniformly sampled, manually curated to avoid trivial cases?). Please state the selection procedure and whether the same questions were used across all methods.
  6. [Throughout] Several hyperparameters are introduced but not reported, including the number of optimization iterations T in Algorithm 2, the learning rate for the noise update, and the exact adversarial token length n (the experiments mention n=200 for one table, but it is unclear if this is used everywhere).

Circularity Check

1 steps flagged · score 1.0 of 10

No substantive circularity: the attack is a constructive token search and the ASR is judged by model outputs; only the reverse-loss sanity check is tautological.

  1. fitted input called prediction [Algorithm 2 (Section III-C) and Section IV-B, 'Effect of Noise Budget on Attack Success and Reverse Loss' (Figure 4)]
    "L ← D(ˆy, y) ; // Compute loss (e.g., cross-entropy) ... we vary the noise budget and evaluate the corresponding reverse loss, which is computed by reconstructing audio from the target tokens."

    The 'reverse loss' reported as evidence of stable audio reconstruction is exactly the loss L that Algorithm 2 minimizes via gradient descent on the perturbation. The reported metric is therefore minimized by construction and cannot independently verify that the synthesized audio carries the intended token sequence. This is a validation tautology, but it does not drive the main ASR claim, which is measured by actual model outputs.

full rationale

The central claim is an attack result, not a derivation from fitted parameters. Algorithm 1 greedily selects adversarial speech tokens by querying the model's loss against a fixed target response; the success rates in Table II are based on actual model outputs, with the paper noting a 'primarily manual evaluation process' (Section IV-A). No parameter is fitted and then renamed as a prediction, and no self-citation carries a load-bearing premise: prior voice-jailbreak work [9] is externally authored, and SpeechGPT/HuBERT are standard referenced components. The only circular-adjacent element is Algorithm 2 / Figure 4, where the reverse loss used to argue that reconstructed audio matches the target token cluster sequence is the same D(ŷ, y) objective being optimized. This makes the reconstruction check self-consistency rather than independent confirmation, weakening the mechanistic explanation of the attack, but it does not make the 89% ASR itself a renamed input. Overall circularity is minimal.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The attack depends on domain assumptions about SpeechGPT's pipeline and on several hyperparameters set by hand. No new entities are introduced.

free parameters (4)
  • Adversarial token length n = 200
    Set in Section IV-D; affects ASR and optimization cost, chosen by hand.
  • Candidate sampling size k = Not reported
    Used in Algorithm 1 to sample candidate tokens at each position; never specified.
  • Noise budget epsilon = Varied from 0.025 to 0.1
    Controls the perturbation added during audio reconstruction; main ASR numbers may depend on the chosen budget.
  • Target response y_target = Author-chosen strings
    The greedy search minimizes loss against this target response; the choice influences whether the model produces jailbroken output.
assumptions (3)
  • domain assumption SpeechGPT uses HuBERT as its discrete unit extractor and HiFi-GAN as its vocoder, and exposes a scalar loss value for queries.
    Sections II-C and IV-A assume these components and the loss are available to the adversary.
  • domain assumption The model's output loss against a target response is a reliable signal for guiding token search.
    Algorithm 1 relies on the loss to select candidate tokens; without a meaningful loss landscape the greedy search fails.
  • domain assumption Manual evaluation of whether a response is harmful is reliable and consistent.
    Section IV-B says evaluation is 'primarily manual' but no rubric or inter-annotator agreement is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Audio Jailbreak Attacks: Exposing Vulnerabilities in SpeechGPT in a White-Box Framework." pith.science (2026). https://pith.science/paper/YPBJ44ZA

@misc{pith2026250518864,
  author       = {Pith},
  title        = {Pith review of: Audio Jailbreak Attacks: Exposing Vulnerabilities in SpeechGPT in a White-Box Framework},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YPBJ44ZA}},
  note         = {Machine review of arXiv:2505.18864}
}
read the original abstract

Recent advances in Multimodal Large Language Models (MLLMs) have significantly enhanced the naturalness and flexibility of human computer interaction by enabling seamless understanding across text, vision, and audio modalities. Among these, voice enabled models such as SpeechGPT have demonstrated considerable improvements in usability, offering expressive, and emotionally responsive interactions that foster deeper connections in real world communication scenarios. However, the use of voice introduces new security risks, as attackers can exploit the unique characteristics of spoken language, such as timing, pronunciation variability, and speech to text translation, to craft inputs that bypass defenses in ways not seen in text-based systems. Despite substantial research on text based jailbreaks, the voice modality remains largely underexplored in terms of both attack strategies and defense mechanisms. In this work, we present an adversarial attack targeting the speech input of aligned MLLMs in a white box scenario. Specifically, we introduce a novel token level attack that leverages access to the model's speech tokenization to generate adversarial token sequences. These sequences are then synthesized into audio prompts, which effectively bypass alignment safeguards and to induce prohibited outputs. Evaluated on SpeechGPT, our approach achieves up to 89 percent attack success rate across multiple restricted tasks, significantly outperforming existing voice based jailbreak methods. Our findings shed light on the vulnerabilities of voice-enabled multimodal systems and to help guide the development of more robust next-generation MLLMs.

Figures

Figures reproduced from arXiv: 2505.18864 by the authors.

Figure 1
Figure 1. This pipeline presents a greedy search-based adversarial audio token attack targeting speech models such as SpeechGPT. Harmful speech, which [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Example of an audio jailbreak in SpeechGPT [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 4
Figure 4. Effect of Noise Budget on Attack Success and Reverse Loss [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

35 extracted references · 8 canonical work pages

  1. [1]

    Visual instruction tuning,

    H. Liu, C. Li, Q. Wu, and Y . J. Lee, “Visual instruction tuning,” Advances in neural information processing systems, vol. 36, pp. 34 892– 34 916, 2023

    2023

  2. [2]

    Gpt-4 technical report,

    J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkat et al. , “Gpt-4 technical report,” arXiv preprint arXiv:2303.08774 , 2023

    arXiv 2023

  3. [3]

    Speechgpt: Empowering large language models with intrinsic cross- modal conversational abilities,

    D. Zhang, S. Li, X. Zhang, J. Zhan, P. Wang, Y . Zhou, and X. Qiu, “Speechgpt: Empowering large language models with intrinsic cross- modal conversational abilities,” arXiv preprint arXiv:2305.11000, 2023

    arXiv 2023

  4. [4]

    Next-gpt: Any-to-any multimodal llm,

    S. Wu, H. Fei, L. Qu, W. Ji, and T.-S. Chua, “Next-gpt: Any-to-any multimodal llm,” in Forty-first International Conference on Machine Learning, 2024

    2024

  5. [5]

    Gpt-4o system card,

    A. Hurst, A. Lerer, A. P. Goucher, A. Perelman, A. Ramesh, A. Clark, A. Ostrow, A. Welihinda, A. Hayes, A. Radford et al., “Gpt-4o system card,” arXiv preprint arXiv:2410.21276 , 2024

    arXiv 2024

  6. [6]

    Introducing copilot+ pcs,

    A. Narayanaswamy, “Introducing copilot+ pcs,” in Microsoft Copilot for Windows 11: Understanding the AI-Powered Features in Windows 11 . Springer, 2024, pp. 265–271

    work page 2024

  7. [7]

    People are suddenly flocking to chatgpt plus on mobile – here’s why,

    A. Murray, “People are suddenly flocking to chatgpt plus on mobile – here’s why,” March 2024, accessed: 2025-04-03. [Online]. Available: https://www.zdnet.com/article/people-are-suddenly-flocking- to-chatgpt-plus-on-mobile-heres-why/

    work page 2024

  8. [8]

    Apple is finalizing a deal with openai to put chatgpt on the iphone, while talks with google to use gemini are ongoing,

    D. Meyer, “Apple is finalizing a deal with openai to put chatgpt on the iphone, while talks with google to use gemini are ongoing,” May 2024, accessed: 2025-04-03. [Online]. Available: https://fortune.com/2024/05/11/apple-openai-chatgpt-iphone- ios-18-google-gemini-ai-chatbot/

    work page 2024

Show all 35 references
  1. [9]

    V oice jailbreak attacks against gpt-4o,

    X. Shen, Y . Wu, M. Backes, and Y . Zhang, “V oice jailbreak attacks against gpt-4o,” arXiv preprint arXiv:2405.19103 , 2024

    2024 arXiv

  2. [11]

    Autodan: Generating stealthy jailbreak prompts on aligned large language models,

    X. Liu, N. Xu, M. Chen, and C. Xiao, “Autodan: Generating stealthy jailbreak prompts on aligned large language models,” arXiv preprint arXiv:2310.04451, 2023

    2023 arXiv

  3. [12]

    " do anything now

    X. Shen, Z. Chen, M. Backes, Y . Shen, and Y . Zhang, “" do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , 2024, pp. 1671–1685

    2024

  4. [13]

    Universal and transferable adversarial attacks on aligned language models,

    A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson, “Universal and transferable adversarial attacks on aligned language models,” arXiv preprint arXiv:2307.15043 , 2023

    2023 arXiv

  5. [14]

    Gpt-4v system card,

    OpenAI, “Gpt-4v system card,” December 2023, accessed: 2025-04-03. [Online]. Available: https://openai.com/research/gpt-4v-system-card

    2023

  6. [15]

    Com- prehensive assessment of jailbreak attacks against llms,

    J. Chu, Y . Liu, Z. Yang, X. Shen, M. Backes, and Y . Zhang, “Com- prehensive assessment of jailbreak attacks against llms,” arXiv preprint arXiv:2402.05668, 2024

    2024 arXiv

  7. [16]

    Catastrophic jailbreak of open-source llms via exploiting generation,

    Y . Huang, S. Gupta, M. Xia, K. Li, and D. Chen, “Catastrophic jailbreak of open-source llms via exploiting generation,” arXiv preprint arXiv:2310.06987, 2023

    2023 arXiv

  8. [17]

    Figstep: Jailbreaking large vision-language models via typographic visual prompts,

    Y . Gong, D. Ran, J. Liu, C. Wang, T. Cong, A. Wang, S. Duan, and X. Wang, “Figstep: Jailbreaking large vision-language models via typographic visual prompts,” arXiv preprint arXiv:2311.05608 , 2023

    2023 arXiv

  9. [18]

    Multi-step jailbreaking privacy attacks on chatgpt,

    H. Li, D. Guo, W. Fan, M. Xu, J. Huang, F. Meng, and Y . Song, “Multi-step jailbreaking privacy attacks on chatgpt,” arXiv preprint arXiv:2304.05197, 2023

    2023 arXiv

  10. [19]

    Harmbench: A standardized evaluation framework for automated red teaming and robust refusal,

    M. Mazeika, L. Phan, X. Yin, A. Zou, Z. Wang, N. Mu, E. Sakhaee, N. Li, S. Basart, B. Li et al. , “Harmbench: A standardized evaluation framework for automated red teaming and robust refusal,” arXiv preprint arXiv:2402.04249, 2024

    2024 arXiv

  11. [20]

    A strongreject for empty jailbreaks,

    A. Souly, Q. Lu, D. Bowen, T. Trinh, E. Hsieh, S. Pandey, P. Abbeel, J. Svegliato, S. Emmons, O. Watkins et al. , “A strongreject for empty jailbreaks,” arXiv preprint arXiv:2402.10260 , 2024

    2024 arXiv

  12. [21]

    Jailbroken: How does llm safety training fail?

    A. Wei, N. Haghtalab, and J. Steinhardt, “Jailbroken: How does llm safety training fail?” Advances in Neural Information Processing Sys- tems, vol. 36, pp. 80 079–80 110, 2023

    2023

  13. [22]

    Defending chatgpt against jailbreak attack via self-reminders,

    Y . Xie, J. Yi, J. Shao, J. Curl, L. Lyu, Q. Chen, X. Xie, and F. Wu, “Defending chatgpt against jailbreak attack via self-reminders,” Nature Machine Intelligence, vol. 5, no. 12, pp. 1486–1496, 2023

    2023

  14. [23]

    Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts,

    J. Yu, X. Lin, Z. Yu, and X. Xing, “Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts,” arXiv preprint arXiv:2309.10253, 2023

    2023 arXiv

  15. [24]

    Multilingual jailbreak challenges in large language models,

    Y . Deng, W. Zhang, S. J. Pan, and L. Bing, “Multilingual jailbreak challenges in large language models,” arXiv preprint arXiv:2310.06474, 2023

    2023 arXiv

  16. [25]

    Low-resource languages jailbreak gpt-4,

    Z.-X. Yong, C. Menghini, and S. H. Bach, “Low-resource languages jailbreak gpt-4,” arXiv preprint arXiv:2310.02446 , 2023

    2023 arXiv

  17. [26]

    Jailbreaking black box large language models in twenty queries, 2024,

    P. Chao, A. Robey, E. Dobriban, H. Hassani, G. J. Pappas, and E. Wong, “Jailbreaking black box large language models in twenty queries, 2024,” URL https://arxiv. org/abs/2310.08419

    2024 arXiv

  18. [27]

    Tree of attacks: Jailbreaking black-box llms automatically,

    A. Mehrotra, M. Zampetakis, P. Kassianik, B. Nelson, H. Anderson, Y . Singer, and A. Karbasi, “Tree of attacks: Jailbreaking black-box llms automatically,” Advances in Neural Information Processing Systems , vol. 37, pp. 61 065–61 105, 2024

    2024

  19. [28]

    Smoothllm: Defending large language models against jailbreaking attacks,

    A. Robey, E. Wong, H. Hassani, and G. J. Pappas, “Smoothllm: Defending large language models against jailbreaking attacks,” arXiv preprint arXiv:2310.03684, 2023

    2023 arXiv

  20. [29]

    Vlattack: Multimodal adversarial attacks on vision-language tasks via pre-trained models,

    Z. Yin, M. Ye, T. Zhang, T. Du, J. Zhu, H. Liu, J. Chen, T. Wang, and F. Ma, “Vlattack: Multimodal adversarial attacks on vision-language tasks via pre-trained models,” Advances in Neural Information Process- ing Systems, vol. 36, pp. 52 936–52 956, 2023

    2023

  21. [30]

    Probing the robustness of vision-language pretrained models: A multimodal adversarial attack approach,

    J. Guan, T. Ding, L. Cao, L. Pan, C. Wang, and X. Zheng, “Probing the robustness of vision-language pretrained models: A multimodal adversarial attack approach,” arXiv preprint arXiv:2408.13461 , 2024

    2024 arXiv

  22. [31]

    Image-based multimodal models as intruders: Trans- ferable multimodal attacks on video-based mllms,

    L. Huang, X. Jiang, Z. Wang, W. Mo, X. Xiao, B. Han, Y . Yin, and F. Zheng, “Image-based multimodal models as intruders: Trans- ferable multimodal attacks on video-based mllms,” arXiv preprint arXiv:2501.01042, 2025

    2025

  23. [32]

    Hubert: Self-supervised speech representation learning by masked prediction of hidden units,

    W.-N. Hsu, B. Bolte, Y .-H. H. Tsai, K. Lakhotia, R. Salakhutdinov, and A. Mohamed, “Hubert: Self-supervised speech representation learning by masked prediction of hidden units,” IEEE/ACM transactions on audio, speech, and language processing , vol. 29, pp. 3451–3460, 2021

    2021

  24. [33]

    Speech resynthesis from discrete disentangled self-supervised representations,

    A. Polyak, Y . Adi, J. Copet, E. Kharitonov, K. Lakhotia, W.- N. Hsu, A. Mohamed, and E. Dupoux, “Speech resynthesis from discrete disentangled self-supervised representations,” arXiv preprint arXiv:2104.00355, 2021

    2021 arXiv

  25. [34]

    Usage policies,

    OpenAI, “Usage policies,” 2024, accessed: 2025-04-03. [Online]. Available: https://openai.com/policies/usage-policies

    2024

  26. [35]

    Nisqa: A deep cnn- self-attention model for multidimensional speech quality prediction with crowdsourced datasets,

    G. Mittag, B. Naderi, A. Chehadi, and S. Möller, “Nisqa: A deep cnn- self-attention model for multidimensional speech quality prediction with crowdsourced datasets,” arXiv preprint arXiv:2104.09494 , 2021

    2021 arXiv

  27. [36]

    Openai text-to-speech (tts) models,

    OpenAI, “Openai text-to-speech (tts) models,” https://platform.openai.com/docs/models/tts, 2024

    2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.