Evaluation of Audio Language Models for Fairness, Safety, and Security

Abstract

Audio large language models (ALLMs) have recently advanced spoken interaction by integrating speech processing with large language models. However, existing evaluations of fairness, safety, and security (FSS) remain fragmented, largely because ALLMs differ fundamentally in how acoustic information is represented and where semantic reasoning occurs. Differences that are rarely made explicit. As a result, evaluations often conflate structurally distinct systems, obscuring the relationship between model design and observed FSS behavior. In this work, we introduce a structural taxonomy (system-level and representational) of ALLMs that categorizes systems along two axes: the form of audio input representation (e.g., discrete vs. continuous) and the locus of semantic reasoning (e.g., cascaded, multimodal, or audio-native). Building on the taxonomy, we propose a unified evaluation framework that assesses semantic invariance under paralinguistic variation, refusal and toxicity behavior under unsafe prompts, and robustness to adversarial audio perturbations. We apply this framework to two representative systems and observe systematic differences in refusal rates, attack success, and toxicity between audio and text inputs. Our findings demonstrate that FSS behavior is tightly coupled to how acoustic information is integrated into semantic reasoning, underscoring the need for structure-aware evaluation of audio language models.

Figures (7)

• Figure 1: ALLM taxonomy's overview: based on model's architecture and its capability to process speech input, audio models can be divided into 3 main types : cascaded systems that can process only text tokens, audio-native systems that can process only audio tokens/embeddings, and audio-text multimodal systems that can process both text and audio tokens.
• Figure 2: Test Set Generation Pipeline: We prepared the audio evaluation dataset in two main steps: a) audio generation, where text prompts for semantic and reference audios for acoustic information were used to synthesize audios, b) task-specific dataset generation, where generated audios are transformed to align trustworthy axes for FSS evaluation.
• Figure 3: Fairness Eval.: Tonality distribution per model along accent fairness group. Top Row: Microsoft's Phi, Bottom Row: Alibaba's Qwen2. First column: Benign data, second column: Child Abuse, third column: Political Controversy, fourth column: Financial Crime. Results are plotted for 6 accents.
• Figure 4: Fairness Eval: Ordinal Equalized Odds (OEO) of Accents (first row) and Emotions (second row). They are compared against Phi4 (first column) and Qwen2 (second column). It represents how safety severity changes across subgroup for the same semantic intent.
• Figure 5: Safety Eval. Comprehension-aware Attack Success Rate for Qwen2 and Phi4 across unsafe categories.