Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

ALMGuard: Safety Shortcuts and Where to Find Them as Guardrails for Audio-Language Models

Weifei Jin, Yuxin Cao, Junjie Su, Minhui Xue, Jie Hao, Ke Xu, Jin Song Dong, Derui Wang

TL;DR

ALMGuard addresses safety vulnerabilities in Audio-Language Models by triggering inherent safety shortcuts with a universal Shortcuts Activation Perturbation applied to Mel-spectrograms. The perturbation is directed by Mel-Gradient Sparse Mask to concentrate changes in a small set of frequency bands that mitigate jailbreaks while preserving benign speech understanding. The framework yields strong defense across multiple ALMs and attack types, including unseen adversaries, with minimal overhead and limited degradation in utility. Theoretical analyses support generalization and benign-task bounds, and experiments demonstrate near-zero-cost deployment and robust protection in realistic settings, offering a practical guardrail for multimodal LLMs.

Abstract

Recent advances in Audio-Language Models (ALMs) have significantly improved multimodal understanding capabilities. However, the introduction of the audio modality also brings new and unique vulnerability vectors. Previous studies have proposed jailbreak attacks that specifically target ALMs, revealing that defenses directly transferred from traditional audio adversarial attacks or text-based Large Language Model (LLM) jailbreaks are largely ineffective against these ALM-specific threats. To address this issue, we propose ALMGuard, the first defense framework tailored to ALMs. Based on the assumption that safety-aligned shortcuts naturally exist in ALMs, we design a method to identify universal Shortcut Activation Perturbations (SAPs) that serve as triggers that activate the safety shortcuts to safeguard ALMs at inference time. To better sift out effective triggers while preserving the model's utility on benign tasks, we further propose Mel-Gradient Sparse Mask (M-GSM), which restricts perturbations to Mel-frequency bins that are sensitive to jailbreaks but insensitive to speech understanding. Both theoretical analyses and empirical results demonstrate the robustness of our method against both seen and unseen attacks. Overall, \MethodName reduces the average success rate of advanced ALM-specific jailbreak attacks to 4.6% across four models, while maintaining comparable utility on benign benchmarks, establishing it as the new state of the art. Our code and data are available at https://github.com/WeifeiJin/ALMGuard.

ALMGuard: Safety Shortcuts and Where to Find Them as Guardrails for Audio-Language Models

TL;DR

ALMGuard addresses safety vulnerabilities in Audio-Language Models by triggering inherent safety shortcuts with a universal Shortcuts Activation Perturbation applied to Mel-spectrograms. The perturbation is directed by Mel-Gradient Sparse Mask to concentrate changes in a small set of frequency bands that mitigate jailbreaks while preserving benign speech understanding. The framework yields strong defense across multiple ALMs and attack types, including unseen adversaries, with minimal overhead and limited degradation in utility. Theoretical analyses support generalization and benign-task bounds, and experiments demonstrate near-zero-cost deployment and robust protection in realistic settings, offering a practical guardrail for multimodal LLMs.

Abstract

Recent advances in Audio-Language Models (ALMs) have significantly improved multimodal understanding capabilities. However, the introduction of the audio modality also brings new and unique vulnerability vectors. Previous studies have proposed jailbreak attacks that specifically target ALMs, revealing that defenses directly transferred from traditional audio adversarial attacks or text-based Large Language Model (LLM) jailbreaks are largely ineffective against these ALM-specific threats. To address this issue, we propose ALMGuard, the first defense framework tailored to ALMs. Based on the assumption that safety-aligned shortcuts naturally exist in ALMs, we design a method to identify universal Shortcut Activation Perturbations (SAPs) that serve as triggers that activate the safety shortcuts to safeguard ALMs at inference time. To better sift out effective triggers while preserving the model's utility on benign tasks, we further propose Mel-Gradient Sparse Mask (M-GSM), which restricts perturbations to Mel-frequency bins that are sensitive to jailbreaks but insensitive to speech understanding. Both theoretical analyses and empirical results demonstrate the robustness of our method against both seen and unseen attacks. Overall, \MethodName reduces the average success rate of advanced ALM-specific jailbreak attacks to 4.6% across four models, while maintaining comparable utility on benign benchmarks, establishing it as the new state of the art. Our code and data are available at https://github.com/WeifeiJin/ALMGuard.

Paper Structure

This paper contains 32 sections, 4 theorems, 28 equations, 5 figures, 7 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Preliminaries and Related Work
  3. ALMGuard
  4. Problem Formulation
  5. Mel-Gradient Sparse Mask
  6. Optimization of ALMGuard
  7. Theoretical Analyses
  8. Generalization to Unseen Examples and Attacks
  9. Bounded Impact on Benign Examples
  10. Experiments
  11. Experimental Setup
  12. Defense Performance
  13. Impact on Benign Examples
  14. Ablation Study
  15. Conclusion
  16. ...and 17 more sections

Key Result

Theorem 1

Assume the training set $\mathcal{D}^{\text{jb}}$ consists of $n$i.i.d. jailbreak examples sampled from the real-world distribution $\mathcal{D}^{\text{real}}$. Suppose the safety loss $\mathcal{L}_{\text{safe}}$ is bounded in $[0, 1]$. Then, for any fixed perturbation $\delta$ and any confidence le

Figures (5)

  • Figure 1: Success Rate of Attack (SRoA) on LLaMA-Omni under different methods. All defenses are evaluated under AdvWave attacks kangadvwave. The ALM-specific strategy yields significantly better performance than transferred methods.
  • Figure 2: Gradients of Mel-frequency bins for jailbreak mitigation and ASR tasks. Each point represents a Mel bin, with lower indices corresponding to lower frequencies. The plot reveals widespread insensitivity across both tasks.
  • Figure 3: Impact of hyperparameter $k$.
  • Figure 4: Performance against adaptive attacks.
  • Figure 5: Heatmap visualizing score-based ranking of Mel bins. The x-axis denotes Mel bin indices, with darker colors indicating higher ranks; the top-8 ranks are annotated.

Theorems & Definitions (7)

  • Definition 1: Empirical and Population Safety Risk
  • Theorem 1: Safety Risk Generalization Bound
  • Proposition 1: Benign Task Deviation Bound
  • Theorem 1: Safety Risk Generalization Bound
  • proof
  • Proposition 1: Benign Task Deviation Bound
  • proof