SpeechGuard: Exploring the Adversarial Robustness of Multimodal Large Language Models

TL;DR

SpeechGuard investigates adversarial robustness and jailbreaking risks in integrated speech-language systems used for Spoken QA. It introduces SpeechVerse, a two-stage SpeechGuard framework combining a Conformer audio encoder with backbones like Flan-T5-XL and Mistral-7B-Instruct, trained via ASR pre-adaptation and cross-modal instruction fine-tuning. The study shows that white-box perturbations can jailbreak safety guardrails with high success, transfer-based perturbations can cross architectures, and a simple time-domain noise flooding defense substantially reduces jailbreak effectiveness, with the SPR metric formalized as $SPR(x, x_o) = 10 \log_{10} ( \frac{\sum_{i=1}^{M} (x_o^i)^2}{\sum_{i=1}^{M} (x^i - x_o^i)^2} )$. These findings establish a practical evaluation framework and guidance for enhancing safety alignment in multimodal, speech-enabled large language systems, highlighting the need for robust defenses and further research into universal attack vectors.

Abstract

Integrated Speech and Large Language Models (SLMs) that can follow speech instructions and generate relevant text responses have gained popularity lately. However, the safety and robustness of these models remains largely unclear. In this work, we investigate the potential vulnerabilities of such instruction-following speech-language models to adversarial attacks and jailbreaking. Specifically, we design algorithms that can generate adversarial examples to jailbreak SLMs in both white-box and black-box attack settings without human involvement. Additionally, we propose countermeasures to thwart such jailbreaking attacks. Our models, trained on dialog data with speech instructions, achieve state-of-the-art performance on spoken question-answering task, scoring over 80% on both safety and helpfulness metrics. Despite safety guardrails, experiments on jailbreaking demonstrate the vulnerability of SLMs to adversarial perturbations and transfer attacks, with average attack success rates of 90% and 10% respectively when evaluated on a dataset of carefully designed harmful questions spanning 12 different toxic categories. However, we demonstrate that our proposed countermeasures reduce the attack success significantly.

Figures (5)

• Figure 1: Adversarial attacks setup to jailbreak speech language models trained for Spoken QA task. The striped block indicates an optional counter-measure module.
• Figure 2: Two types of transfer attacks studied: cross-model, and cross-prompt.
• Figure 3: Block diagram of the SpeechVerse architecture for training Speech Language Models (SLMs) to follow speech instructions and generate textual responses.
• Figure 4: Graph showing the cumulative % of successful attacks as a plot of the number of iterations required to attack $4$ different models.
• Figure 5: Graph showing the cumulative % of successful attacks as a plot of the number of iterations required to attack the S-FlanT5 model with and without TDNF defense.