Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

The Alignment Curse: Cross-Modality Jailbreak Transfer in Omni-Models

Yupeng Chen, Junchi Yu, Aoxi Liu, Philip Torr, Adel Bibi

TL;DR

This work identifies the alignment curse: strong cross-modality alignment in omni-models can enable textual jailbreak vulnerabilities to transfer to the audio modality. It formalizes a representation-level framework linking input modality and output safety, proving that small KL divergence between text- and audio-induced representations implies similar unsafe outcomes across modalities. Empirically, text-transferred audio attacks via TTS are as effective as, or more effective than, dedicated audio attacks across multiple omni-models and remain potent under audio-only threat models, with strong cross-model transfer observed. The findings underscore a practical safety risk and advocate defenses that explicitly address cross-modality alignment rather than treating modalities in isolation.

Abstract

Recent advances in end-to-end trained omni-models have significantly improved multimodal understanding. At the same time, safety red-teaming has expanded beyond text to encompass audio-based jailbreak attacks. However, an important bridge between textual and audio jailbreaks remains underexplored. In this work, we study the cross-modality transfer of jailbreak attacks from text to audio, motivated by the semantic similarity between the two modalities and the maturity of textual jailbreak methods. We first analyze the connection between modality alignment and cross-modality jailbreak transfer, showing that strong alignment can inadvertently propagate textual vulnerabilities to the audio modality, which we term the alignment curse. Guided by this analysis, we conduct an empirical evaluation of textual jailbreaks, text-transferred audio jailbreaks, and existing audio-based jailbreaks on recent omni-models. Our results show that text-transferred audio jailbreaks perform comparably to, and often better than, audio-based jailbreaks, establishing them as simple yet powerful baselines for future audio red-teaming. We further demonstrate strong cross-model transferability and show that text-transferred audio attacks remain effective even under a stricter audio-only access threat model.

The Alignment Curse: Cross-Modality Jailbreak Transfer in Omni-Models

TL;DR

This work identifies the alignment curse: strong cross-modality alignment in omni-models can enable textual jailbreak vulnerabilities to transfer to the audio modality. It formalizes a representation-level framework linking input modality and output safety, proving that small KL divergence between text- and audio-induced representations implies similar unsafe outcomes across modalities. Empirically, text-transferred audio attacks via TTS are as effective as, or more effective than, dedicated audio attacks across multiple omni-models and remain potent under audio-only threat models, with strong cross-model transfer observed. The findings underscore a practical safety risk and advocate defenses that explicitly address cross-modality alignment rather than treating modalities in isolation.

Abstract

Recent advances in end-to-end trained omni-models have significantly improved multimodal understanding. At the same time, safety red-teaming has expanded beyond text to encompass audio-based jailbreak attacks. However, an important bridge between textual and audio jailbreaks remains underexplored. In this work, we study the cross-modality transfer of jailbreak attacks from text to audio, motivated by the semantic similarity between the two modalities and the maturity of textual jailbreak methods. We first analyze the connection between modality alignment and cross-modality jailbreak transfer, showing that strong alignment can inadvertently propagate textual vulnerabilities to the audio modality, which we term the alignment curse. Guided by this analysis, we conduct an empirical evaluation of textual jailbreaks, text-transferred audio jailbreaks, and existing audio-based jailbreaks on recent omni-models. Our results show that text-transferred audio jailbreaks perform comparably to, and often better than, audio-based jailbreaks, establishing them as simple yet powerful baselines for future audio red-teaming. We further demonstrate strong cross-model transferability and show that text-transferred audio attacks remain effective even under a stricter audio-only access threat model.
Paper Structure (45 sections, 4 theorems, 23 equations, 3 figures, 4 tables)

This paper contains 45 sections, 4 theorems, 23 equations, 3 figures, 4 tables.

Table of Contents

  1. Introduction
  2. Related Works
  3. Multimodal Large Language Models
  4. Jailbreak Attacks
  5. From Modality Alignment to Jailbreak Transfer
  6. Preliminary: Preprocessing and Training of Omni-Models
  7. Input Preprocessing
  8. Token to Embedding
  9. End-to-End Training
  10. Bridging Model Utility and Safety
  11. The Alignment Curse
  12. Threat Model
  13. Model Access
  14. Modality Access
  15. Experiment
  16. ...and 30 more sections

Key Result

Theorem 3.2

If the representation distributions satisfy then for any measurable set of outputs $\mathcal{U} \subseteq \mathcal{Y}$,

Figures (3)

  • Figure 1: Strong cross-modality alignment inadvertently propagates textual vulnerabilities to the audio modality, which we term the alignment curse.
  • Figure 2: Layer-wise KL divergence between text- and audio-induced representations on Qwen2.5-Omni-7B under different input conditions. From left to right: different jailbreak methods; different voice tones (PAP prompts rendered with gpt-4o-mini-tts); different speaking speeds (PAP prompts rendered with gpt-4o-mini-tts); and different text-to-speech (TTS) models (using PAP prompts). The dashed horizontal line denotes the $KL=2.0$ threshold (i.e., the curse line).
  • Figure 3: t-SNE visualization of last token's hidden states of the last layer.

Theorems & Definitions (8)

  • Definition 3.1: Modality-Conditioned Output Probability
  • Theorem 3.2: Distributional Representation Alignment Implies Output Consistency
  • Definition 3.3: Modality-Conditioned Unsafe Output Probability
  • Corollary 3.4: Cross-Modality Jailbreak Transfer
  • Lemma 1.1: Pinsker's inequality
  • proof
  • Remark 1.2
  • Corollary 1.3: Cross-Modality Defense Transfer