Pith. sign in

REVIEW 2 major objections 4 minor 37 references

Prosody-driven Jailbreaks in Audio LLMs: A Controlled Study and Mechanistic Analysis

T0 review · 2 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Holding a harmful transcript fixed, switching from neutral to panic delivery lifts jailbreak success on an audio LLM from 4/95 to 38/95.

desk verdict Solid evidence that matched-text delivery changes Audio LLM jailbreak rates, but the prosody-vs-text attribution is undercut by an unmatched query budget in the ablation. read the letter →

arxiv 2607.26541 v1 pith:WGU4DFFH submitted 2026-07-29 cs.SD cs.CL

Jiachen Qian , Junyu Li This is my paper · ORCID
classification cs.SDcs.CL
keywords audiolargelanguagemodelsjailbreakattacksprosodymultimodalsafetyevaluationadversarialspeechdeliverytext-to-speech
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper asks whether an audio LLM's safety can be broken by changing only how a harmful request is spoken—its prosody—while keeping the words identical. It argues yes: on a 95-prompt panel, neutral delivery of a harmful transcript succeeds 4/95 times on Qwen2-Audio, while the same transcript delivered in panic (38/95), anger (35/95), or fast speech (32/95) succeeds much more often, and a fixed six-rendering pool reaches 44/95, beating a matched-budget style-transfer baseline. An ablation isolates delivery from wording: emotional audio without emotional text (44/95) far outperforms emotional text without emotional audio (11/95), making prosody the dominant driver. The paper concludes that matched-text speech delivery should be a first-class factor in audio-LLM safety evaluation.

What carries the argument

The central machinery is the PJ-Break protocol: a fixed harmful transcript rendered under six speech-delivery presets (Neutral, Panic, Anger, Commanding, Fast, Whisper) that target arousal, authority, and speaking rate, evaluated under a fixed query budget and acoustically verified through F0 variance, RMS intensity, spectral tilt, and speech rate. Its companion, AdvAudio-Prosody, is a 600-sample benchmark built on those presets. The load-bearing design choice is holding lexical content and, for five presets, speaker identity constant while allowing acoustic attributes to co-vary, so that any safety change is attributable to delivery rather than to wording. The ablation crossing emotional versus neutral text with emotional versus flat audio is what isolates prosody as the dominant factor, and the same-voice sensitivity analysis removes the one voice-confounded condition to confirm the effect is not just a voice switch.

What would settle it

Render the same six presets on a second, independent TTS engine (different voice characteristics) while matching F0, intensity, and rate; if the success jump over Neutral collapses, the effect was a TTS artifact rather than prosody. Alternatively, apply the presets to a second open-weight audio model and check whether the per-preset ordering (Panic > Anger > Fast > Neutral) replicates; failure to replicate would indicate a model- or stack-specific effect.

Watch

Extended reading notes

Core claim

Holding the transcript content and, in five of six conditions, the speaker voice fixed, the paper shows that measured jailbreak success on Qwen2-Audio jumps from 4/95 under neutral delivery to 38/95 under panic, 35/95 under anger, and 32/95 under fast delivery. A fixed best-of-six pool of the six presets reaches 44/95, exceeding a matched-budget StyleBreak reimplementation at 27/95 with a significant McNemar test, and the same-voice pool excluding the confounded Commanding condition still reaches 40/95. A retained-panel 2x2 ablation shows that emotional delivery audio alone (44/95) is far more effective than emotional text alone (11/95), with little additional gain from adding emotional wording on top of emotional audio (48/95). The paper's central claim is that matched-text variation in speech delivery creates a measurable audio-LLM safety failure mode that should be treated as a first-class evaluation factor.

Load-bearing premise

The measured increase in unsafe responses is caused by intended prosodic delivery (arousal, authority, pacing) rather than by uncontrolled acoustic artifacts of the TTS stack or by residual transcript-recognition differences.

Editorial extensions

If this is right

  • Audio LLM safety evaluation should treat matched-text prosodic variation as a first-class factor rather than as nuisance variation.
  • A fixed best-of-six delivery pool beats a matched-budget style-transfer baseline on Qwen2-Audio (44/95 vs 27/95), implying delivery presets are an efficient attack primitive under equal query budgets.
  • Emotional delivery audio alone outperforms emotional text alone (44/95 vs 11/95), so defenses that only filter lexical emotion will miss the primary attack channel.
  • The effect transfers descriptively to GPT-4o, Gemini 2.0 Flash, and SALMONN, with success above each model's transcript-preserving controls, though at lower absolute rates for closed-source GPT-4o.
  • Removing the only voice-confounded condition (Commanding) still leaves 40/95 pooled success, so the finding is not an artifact of a single speaker change.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The discrete presets show a dose-like pattern (F0-variance multiplier 2.4x for Panic and 0.4x for Whisper still elevate success), suggesting a continuous stress-test design that interpolates prosodic intensity could map the safety boundary more precisely than the paper's six preset points.
  • Whisper's elevated success (28/95) despite lower pitch and rate implies the mechanism may be any marked deviation from safety-tuning speech distribution rather than high arousal alone; an experiment varying spectral tilt while holding F0 and rate fixed could separate these accounts.
  • Because the attack fixes the transcript, transcript-level input filtering cannot distinguish these attacks from legitimate emotional speech, so defending audio endpoints would require prosody-aware anomaly detection, a consequence the paper only pilots.
  • If the surrogate refusal-direction shift is causal, activation-space interventions that restore the refusal direction under emotional input could become a targeted defense, extending the Pro-Guard pilot in a direction the paper did not test.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. The paper studies whether matched-text variation in speech delivery can jailbreak audio LLMs. The authors introduce PJ-Break, a black-box protocol with six TTS delivery presets (Neutral, Panic, Anger, Commanding, Fast, Whisper) on a fixed transcript set, and AdvAudio-Prosody, a 600-sample benchmark with acoustic verification. On the retained post-QC 95-seed Qwen2-Audio panel, single-query presets Panic (38/95), Anger (35/95), and Fast (32/95) far exceed Neutral (4/95), and the six-query pool reaches 44/95, above a matched-budget StyleBreak reimplementation (27/95). A same-voice pool excluding the voice-confounded Commanding condition still reaches 40/95. An ablation (Section 4.5) compares emotional audio with neutral text (44/95) against emotional text with flat audio (11/95) and concludes that prosody dominates lexical framing. The paper also includes exploratory surrogate diagnostics and a pilot mitigation note, both explicitly labeled non-core. The limitations section acknowledges acoustic co-variation, residual recognition differences, the Commanding voice change, and the non-release of data and code.

Significance. The Q=1 core result is valuable and well-controlled: holding transcript fixed and changing only the TTS delivery preset raises seed-level ASR from 4/95 to roughly 30-40/95 on an auditable open-weight model. The methodological discipline is a real strength: fixed, pre-registered-style QC exclusions with exact post-QC counts reported; a human-calibrated three-judge ensemble; statistical tests restricted to exact-count comparisons; a matched-budget head-to-head with StyleBreak; a same-voice sensitivity analysis; and explicit separation of core, descriptive, and exploratory claims. If the prosody-dominance claim is either properly controlled or appropriately softened, the paper would be a useful, honest contribution to audio-LLM safety evaluation. The current overstatement in the abstract and Section 4.5 is the main bar to acceptance.

major comments (2)
  1. [Section 4.5, Table 5, and Abstract] The headline claim that 'emotional-delivery audio alone (44/95) is far more effective than emotional text alone (11/95)' is not a budget-matched comparison. The NE cell (44/95) is exactly the six-condition best-of-six pool from Table 6, while EF appears to be a single Q=1 rendering. Section 4.2 explicitly warns that the pooled result is 'seed-level coverage under a fixed best-of-six protocol, not as a single-utterance effect or a strictly budget-matched comparison with the Q=1 controls.' To support the lexical-vs-prosody dominance claim, the paper needs a matched six-query emotional-text condition (e.g., six emotional-text rewrites rendered with flat audio), or the abstract and Section 4.5 must be weakened to the Q=1 evidence. Without this control, the conclusion 'prosody, rather than lexical framing, the dominant factor' is not established.
  2. [Title, Abstract, Sections 3.1 and 4.6] The paper is framed as 'Prosody-driven' jailbreaks, but the operational evidence supports 'speech-delivery presets matter' rather than 'prosody is the active ingredient.' The six presets co-vary on F0, intensity, rate, and voice quality, and Commanding changes speaker identity; the authors acknowledge this but do not isolate prosody from other acoustic or TTS-stack artifacts. The central safety failure mode is real and important, but the title and abstract overstate the mechanistic attribution. Either add an analysis that at least partially controls acoustic covariates (e.g., per-preset ASR versus measured F0/rate), or consistently replace 'prosody-driven' with 'delivery-driven' framing throughout.
minor comments (4)
  1. [Table 5] The table would be much clearer with a query-budget column (Q) for each row, since the NE row is a six-utterance pool while NN, EF, and EE appear to be single-utterance conditions.
  2. [Abstract] The phrase 'emotional-delivery audio alone (44/95)' should explicitly say 'a six-query pool of emotional-delivery audio' to avoid implying a single audio clip achieves 44/95.
  3. [Section 4.5, caption of Table 5] The abbreviations NN, EF, NE, and EE are not defined in the table caption; please define them in the caption or immediately preceding text.
  4. [Section 4.4, Table 4] The sentence 'Its gap over the Q=1 text-only control is descriptive because the query counts differ' is important; please consider adding an explicit cross-reference to Table 5 so readers do not conflate the same-voice pool result with a single-utterance effect.

Circularity Check

2 steps flagged · score 2.0 of 10

Core Q=1 benchmark is self-contained; the strongest attribution and pilot defense contain disclosed self-referential comparisons.

  1. other [Section 4.5, Table 5; cf. Section 4.2 query-budget caveat]
    "The ablation shows that emotional audio alone is far more effective than emotional text alone, while adding emotional wording on top of emotional audio provides only limited additional gain. This makes prosody, rather than lexical framing, the dominant factor in the observed attack effect."

    Table 5's NE row (neutral text + emotional audio) is 44/95, numerically identical to the Six-condition pool row in Table 6, i.e., it is the best-of-six pooled coverage and not a single-rendering condition. The EF row (emotional text + flat audio) is 11/95, a Q=1 condition, and Table 5 has no query-budget column. Section 4.2 explicitly warns that PJ-Break's pooled result 'should therefore be read as seed-level coverage under a fixed best-of-six protocol, not as a single-utterance effect or a strictly budget-matched comparison with the Q=1 controls.' The conclusion that prosody dominates lexical framing therefore reduces to a budget comparison (six-rendering pool vs single rendering) rather than a matched text-vs-prosody measurement.

  2. other [Section 4.1 'Potential Judge Biases'; Section 6.1, Table 8]
    "In addition, Llama-Guard-3 appears both in the judge ensemble and in Pro-Guard-Lite, which reduces evaluation independence for some defense-side comparisons."

    The defense-side ASR rows in Table 8 are scored by a judge ensemble that includes Llama-Guard-3, the same model reused inside Pro-Guard-Lite as a text-risk component. The judge is therefore not independent of the defense mechanism it evaluates, so the reported low ASR can be partly self-confirming by construction. The paper discloses this and explicitly demotes the defense rows to a pilot mitigation note rather than a standalone defense claim, so the circularity is real but not load-bearing for the core attack benchmark.

full rationale

The central empirical claim is measured against external judges and target models with no fitted parameters generating the counts: Q=1 Panic (38/95), Anger (35/95), and Fast (32/95) versus Neutral (4/95) are exact post-QC counts on an independent 95-seed panel, and the matched-budget StyleBreak comparison (44/95 vs 27/95 at Q=6) is an apples-to-apples query-budget evaluation under a shared judge protocol. This part of the derivation chain is self-contained and not circular. The circularity concerns are confined to (i) the Table 5 ablation, where the 'emotional audio alone' row reduces to the six-condition pooled result and is compared against a Q=1 emotional-text row, undercutting the 'prosody, rather than lexical framing, [is] the dominant factor' attribution despite the paper's own Section 4.2 caveat about not budget-matching pooled results to Q=1 controls; and (ii) the pilot Pro-Guard-Lite mitigation, whose evaluation reuses Llama-Guard-3 from the judge ensemble, an overlap the paper itself flags as reducing evaluation independence and demotes to a non-core note. Neither issue makes the core matched-text prosody finding circular, so a score of 2 is appropriate.

Assumptions & free parameters 2 free parameters · 3 assumptions · 1 invented entities

The central claim rests on measurement choices such as the harm threshold and QC threshold, plus domain assumptions about judge validity, TTS fidelity, and seed representativeness. There are no fitted parameters in the attack evaluation itself. The only invented artifact is the pilot Pro-Guard defense, which has no independent evidence beyond the paper's own summary rows.

free parameters (2)
  • Substantive content threshold = >50 tokens beyond refusal phrases
    Hand-set criterion used to label a response as harmful; the authors report sensitivity checks preserve ordering, but the exact cutoff affects counts.
  • WER exclusion threshold = >=5% word error rate
    Hand-set QC threshold that removes seeds before evaluation and defines the retained 95-seed panel.
assumptions (3)
  • domain assumption Three-judge majority with the substantive-content rule is a valid operationalization of a harmful response.
    The paper calibrates against a 200-sample human study with Fleiss kappa 0.78, but the automatic harm label is still a validity assumption.
  • domain assumption Azure Neural TTS presets faithfully realize the intended prosodic conditions.
    Acoustic verification in Section 3.3 shows feature shifts, but synthesized audio is not natural human speech and may carry TTS artifacts.
  • domain assumption The 100 seed instructions from AdvBench and HarmBench are representative of harmful user requests.
    The retained panel covers six harm categories, but it is a convenience sample of existing jailbreak benchmarks, not a random sample of real-world speech.
invented entities (1)
  • Pro-Guard (Pro-Guard-Lite and Pro-Guard-Full)
    purpose: Pilot defense combining text risk, prosody anomaly, and decoder or response risk to reduce jailbreak success.
    Reported only as summary operating points on Qwen2-Audio; reuses Llama-Guard-3 from the judge stack, reducing independence, and is explicitly not deployment-ready.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Prosody-driven Jailbreaks in Audio LLMs: A Controlled Study and Mechanistic Analysis." pith.science (2026). https://pith.science/paper/WGU4DFFH

@misc{pith2026260726541,
  author       = {Pith},
  title        = {Pith review of: Prosody-driven Jailbreaks in Audio LLMs: A Controlled Study and Mechanistic Analysis},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WGU4DFFH}},
  note         = {Machine review of arXiv:2607.26541}
}
read the original abstract

Audio-capable foundation models enable end-to-end spoken interaction, but they also introduce safety risks beyond transcript content. It remains unclear how much jailbreak capability can arise from matched-text variation in speech delivery rather than from lexical rewriting or broader style transfer. We study this question by holding transcript content fixed and varying six speech-delivery presets whose acoustic attributes may co-vary. We present PJ-Break, a black-box evaluation protocol with presets targeting arousal, authority, and speaking rate, together with AdvAudio-Prosody, a 600-sample benchmark with acoustically verified attributes. On the exact post-QC Qwen2-Audio panel, the Q=1 Panic (38/95), Anger (35/95), and Fast (32/95) presets are all well above Neutral (4/95). The fixed six-query pool covers 44/95 Qwen2-Audio seeds and 15/95 GPT-4o seeds and exceeds a matched-budget StyleBreak reimplementation (27/95) on Qwen2-Audio. A same-voice pool excluding the confounded Commanding condition still reaches 40/95, and a retained-panel ablation shows emotional-delivery audio alone (44/95) is far more effective than emotional text alone (11/95). Exploratory surrogate diagnostics and pilot mitigation observations are secondary, non-core analyses. Overall, matched-text speech delivery should be treated as a first-class factor in Audio LLM safety evaluation

Figures

Figures reproduced from arXiv: 2607.26541 by the authors.

Figure 1
Figure 1. PJ-Break evaluation pipeline. A fixed harmful transcript is rendered under six delivery conditions and evaluated with [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Measured aggregate acoustic-feature shifts rela [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Schematic view of the layer-14 refusal-direction analysis. Coordinates and region geometry are conceptual (not [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

37 extracted references · 15 canonical work pages

  1. [1]

    Hafemann, Jérôme Rony, Ismail Ben Ayed, Patrick Cardinal, and Alessandro L

    Sajjad Abdoli, Luiz G. Hafemann, Jérôme Rony, Ismail Ben Ayed, Patrick Cardinal, and Alessandro L. Koerich. 2019. Universal Adversarial Audio Perturbations. arXiv preprint arXiv:1908.03173. doi:10.48550/arXiv.1908.03173

    arXiv doi:10.48550/arxiv.1908.03173 2019

  2. [2]

    Anthropic. 2024. Introducing Claude 3.5 Sonnet. Anthropic News. Accessed 2026-07-27. https://www.anthropic.com/news/claude-3-5-sonnet

    work page 2024

  3. [3]

    Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, and Neel Nanda. 2024. Refusal in Language Models Is Mediated by a Single Direction. InAdvances in Neural Information Processing Systems 37 (NeurIPS 2024). Curran Associates, Inc., 136037–136083. Originally released as arXiv:2406.11717. doi:10.52202/079017-4322

    arXiv 2024

  4. [4]

    Chang, Sungbok Lee, and Shrikanth S

    Carlos Busso, Murtaza Bulut, Chi-Chun Lee, Abe Kazemzadeh, Emily Mower, Samuel Kim, Jeannette N. Chang, Sungbok Lee, and Shrikanth S. Narayanan. 2008. IEMOCAP: Interactive Emotional Dyadic Motion Capture Database.Language Resources and Evaluation42, 4 (2008), 335–359. doi:10.1007/S10579-008-9076-6

    doi:10.1007/s10579-008-9076-6 2008

  5. [5]

    Nicholas Carlini and David Wagner. 2018. Audio Adversarial Examples: Targeted Attacks on Speech-to-Text. In2018 IEEE Security and Privacy Workshops (SPW). IEEE, 1–7. Originally released as arXiv:1801.01944. doi:10.1109/SPW.2018.00009

    arXiv 2018

  6. [6]

    Guangke Chen, Fu Song, Zhe Zhao, Xiaojun Jia, Yang Liu, Yanchen Qiao, Weizhe Zhang, Weiping Tu, Yuhong Yang, and Bo Du. 2026. AudioJailbreak: Jailbreak Attacks against End-to-End Large Audio-Language Models.IEEE Transactions on Dependable and Secure Computing23, 3 (2026), 6085–6102. doi:10.1109/TDSC. 2026.3661073

    arXiv 2026

  7. [7]

    Hao Cheng, Erjia Xiao, Jing Shao, Yichi Wang, Le Yang, Chao Shen, Philip H. S. Torr, Jindong Gu, and Renjing Xu. 2025. Jailbreak-AudioBench: In-Depth Evaluation and Analysis of Jailbreak Threats for Large Audio Language Models. InAdvances in Neural Information Processing Systems 38, Datasets and Benchmarks Track. Curran Associates, Inc. https://proceeding...

    work page 2025

  8. [8]

    Yunfei Chu, Jin Xu, Qian Yang, Haojie Wei, Xipin Wei, Zhifang Guo, Yichong Leng, Yuanjun Lv, Jinzheng He, Junyang Lin, Chang Zhou, and Jingren Zhou

Show all 37 references
  1. [9]

    Maureen de Seyssel, Marvin Lavechin, Hadrien Titeux, Arthur Thomas, Gwendal Virlet, Andrea Santos Revilla, Guillaume Wisniewski, Bogdan Ludusan, and Emmanuel Dupoux. 2023. ProsAudit, a Prosodic Benchmark for Self-Supervised Speech Models. InInterspeech 2023. ISCA, Dublin, Irel...

    2023 arXiv

  2. [10]

    Kamel, and Fakhri Karray

    Moataz El Ayadi, Mohamed S. Kamel, and Fakhri Karray. 2011. Survey on Speech Emotion Recognition: Features, Classification Schemes, and Databases.Pattern Recognition44, 3 (2011), 572–587. doi:10.1016/j.patcog.2010.09.020

    2011 doi

  3. [11]

    Scherer, Björn W

    Florian Eyben, Klaus R. Scherer, Björn W. Schuller, Johan Sundberg, Elisabeth André, Carlos Busso, Laurence Y. Devillers, Julien Epps, Petri Laukka, Shrikanth S. Narayanan, and Khiet P. Truong. 2016. The Geneva Minimalistic Acoustic Parame- ter Set (GeMAPS) for Voice Research ...

    2016

  4. [12]

    Soumya Suvra Ghosal, Souradip Chakraborty, Vaibhav Singh, Tianrui Guan, Mengdi Wang, Ahmad Beirami, Furong Huang, Alvaro Velasquez, Dinesh Manocha, and Amrit Singh Bedi. 2025. Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment. In2025 ...

    2025

  5. [13]

    John Hughes, Sara Price, Aengus Lynch, Rylan Schaeffer, Fazl Barez, Sanmi Koyejo, Henry Sleight, Erik Jones, Ethan Perez, and Mrinank Sharma. 2024. Best- of-N Jailbreaking. arXiv preprint arXiv:2412.03556. doi:10.48550/arXiv.2412.03556

    2024 doi arXiv

  6. [14]

    Weifei Jin, Yuxin Cao, Junjie Su, Minhui Xue, Jie Hao, Ke Xu, Jin Song Dong, and Derui Wang. 2025. ALMGuard: Safety Shortcuts and Where to Find Them as Guardrails for Audio-Language Models. InAdvances in Neural Information Processing Systems 38. Curran Associates, Inc., 9052–9...

    2025

  7. [15]

    Mintong Kang, Chejian Xu, and Bo Li. 2025. AdvWave: Stealthy Adversarial Jailbreak Attack against Large Audio-Language Models. InThe Thirteenth In- ternational Conference on Learning Representations. OpenReview.net, Singapore. Originally released as arXiv:2412.08608. https://i...

    2025 arXiv

  8. [16]

    Hongyi Li, Chengxuan Zhou, Chu Wang, Sicheng Liang, Yanting Chen, Qinlin Xie, Jiawei Ye, and Jie Wu. 2026. StyleBreak: Revealing Alignment Vulnerabilities in Large Audio-Language Models via Style-Aware Audio Jailbreak.Proceedings of the AAAI Conference on Artificial Intelligen...

    2026

  9. [17]

    Rao Ma, Mengjie Qian, Vyas Raina, Mark Gales, and Kate Knill. 2025. Universal Acoustic Adversarial Attacks for Flexible Control of Speech-LLMs. InFindings of the Association for Computational Linguistics: EMNLP 2025. Association for Computational Linguistics, 18248–18262. doi:...

    2025 doi

  10. [18]

    Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. 2024. HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal. InProceedings of the ...

    2024 arXiv

  11. [19]

    Meta Llama Team. 2024. Llama-Guard-3-8B. Hugging Face model card. Accessed 2026-07-27. https://huggingface.co/meta-llama/Llama-Guard-3-8B

    2024

  12. [20]

    Microsoft. 2026. Text to speech quickstart - Speech service - Foundry Tools. Microsoft Learn. Accessed 2026-07-27. https://learn.microsoft.com/en-us/azure/ ai-services/speech-service/get-started-text-to-speech

    2026

  13. [21]

    OpenAI. 2024. GPT-4o System Card. OpenAI. Accessed 2026-07-27. https: //openai.com/index/gpt-4o-system-card/

    2024

  14. [22]

    Zifan Peng, Yule Liu, Zhen Sun, Mingchen Li, Zeren Luo, Jingyi Zheng, Wenhan Dong, Xinlei He, Xuechao Wang, Yingjie Xue, Shengmin Xu, and Xinyi Huang

  15. [23]

    Raghuveer Peri, Sai Muralidhar Jayanthi, Srikanth Ronanki, Anshu Bhatia, Karel Mundnich, Saket Dingliwal, Nilaksh Das, Zejiang Hou, Goeric Huybrechts, Srikanth Vishnubhotla, Daniel Garcia-Romero, Sundararajan Srinivasan, Kyu Prosody-driven Jailbreaks in Audio LLMs: A Controlle...

    2026

  16. [24]

    Sundar Pichai, Demis Hassabis, and Koray Kavukcuoglu. 2024. Introducing Gemini 2.0: our new AI model for the agentic era. The Keyword (Google Blog). Accessed 2026-07-27. https://blog.google/innovation-and-ai/models- and-research/google-deepmind/google-gemini-ai-update-december-2024/

    2024

  17. [25]

    Paul K. Rubenstein, Chulayuth Asawaroengchai, Duc Dung Nguyen, Ankur Bapna, Zalán Borsos, Félix de Chaumont Quitry, Peter Chen, Dalia El Badawy, Wei Han, Eugene Kharitonov, Hannah Muckenhirn, Dirk Padfield, James Qin, Danny Rozenberg, Tara Sainath, Johan Schalkwyk, Matt Sharif...

    2023 doi arXiv

  18. [26]

    Klaus R. Scherer. 2003. Vocal Communication of Emotion: A Review of Research Paradigms.Speech Communication40, 1–2 (2003), 227–256. doi:10.1016/S0167- 6393(02)00084-5

    2003 doi

  19. [27]

    Xinyue Shen, Yixin Wu, Michael Backes, and Yang Zhang. 2024. Voice Jailbreak Attacks Against GPT-4o. arXiv preprint arXiv:2405.19103. doi:10.48550/arXiv. 2405.19103

    2024 doi arXiv

  20. [28]

    RJ Skerry-Ryan, Eric Battenberg, Ying Xiao, Yuxuan Wang, Daisy Stanton, Joel Shor, Ron Weiss, Rob Clark, and Rif A. Saurous. 2018. Towards End-to-End Prosody Transfer for Expressive Speech Synthesis with Tacotron. InProceedings of the 35th International Conference on Machine L...

    2018

  21. [29]

    Zirui Song, Qian Jiang, Mingxuan Cui, Mingzhe Li, Lang Gao, Zeyu Zhang, Zixiang Xu, Yanbo Wang, Guangxian Ouyang, Zhenhao Chen, and Xiuying Chen

  22. [30]

    Guangzhi Su, Shuchang Huang, Yutong Ke, Zhuohang Liu, Long Qian, and Kaizhu Huang. 2025. SmoothGuard: Defending Multimodal Large Language Models with Noise Perturbation and Clustering Aggregation. In2025 IEEE International Conference on Data Mining Workshops (ICDMW). IEEE, 182...

    2025

  23. [31]

    Changli Tang, Wenyi Yu, Guangzhi Sun, Xianzhao Chen, Tian Tan, Wei Li, Lu Lu, Zejun Ma, and Chao Zhang. 2024. SALMONN: Towards Generic Hearing Abilities for Large Language Models. InThe Twelfth International Conference on Learning Representations. OpenReview.net, Vienna, Austr...

    2024 arXiv

  24. [32]

    Yuxuan Wang, Daisy Stanton, Yu Zhang, RJ Skerry-Ryan, Eric Battenberg, Joel Shor, Ying Xiao, Ye Jia, Fei Ren, and Rif A. Saurous. 2018. Style Tokens: Unsuper- vised Style Modeling, Control and Transfer in End-to-End Speech Synthesis. In Proceedings of the 35th International Co...

    2018

  25. [33]

    Yudong Yang, Xuezhen Zhang, Zhifeng Han, Siyin Wang, Jimin Zhuang, Zengrui Jin, Jing Shao, Guangzhi Sun, and Chao Zhang. 2025. Speech-Audio Compositional Attacks on Multimodal LLMs and Their Mitigation with SALMONN-Guard. arXiv preprint arXiv:2511.10222. doi:10.48550/arXiv.2511.10222

    2025 doi

  26. [34]

    Zico Kolter, and Matt Fredrikson

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. 2023. Universal and Transferable Adversarial Attacks on Aligned Language Models. arXiv preprint arXiv:2307.15043. doi:10.48550/arXiv.2307. 15043

    2023 doi arXiv

  27. [2024]

    arXiv preprint arXiv:2407.10759

    Qwen2-Audio Technical Report. arXiv preprint arXiv:2407.10759. doi:10. 48550/arXiv.2407.10759

    doi arXiv

  28. [2025]

    arXiv preprint arXiv:2505.17568

    JALMBench: Benchmarking Jailbreak Vulnerabilities in Audio Language Models. arXiv preprint arXiv:2505.17568. doi:10.48550/arXiv.2505.17568

    doi

  29. [2026]

    InProceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)

    Audio Jailbreak: An Open Comprehensive Benchmark for Jailbreaking Large Audio-Language Models. InProceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). Association for Computational Linguistics, 27294–27308. doi:10.1865...

    doi

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.