Title: ALMGuard: Safety Shortcuts and Where to Find Them as Guardrails for Audio–Language Models
Venue: NeurIPS 2025
Accepted: yes
Keywords: Audio-Language Model

Jailbreaking

Blue-teaming

AI Safety
Abstract: Recent advances in Audio-Language Models (ALMs) have significantly improved multimodal understanding capabilities. However, the introduction of the audio modality also brings new and unique vulnerability vectors. Previous studies have proposed jailbreak attacks that specifically target ALMs, revealing that defenses directly transferred from traditional audio adversarial attacks or text-based Large Language Model (LLM) jailbreaks are largely ineffective against these ALM-specific threats.
To address this issue, we propose ALMGuard, the first defense framework tailored to ALMs. 
Based on the assumption that safety-aligned shortcuts naturally exist in ALMs, we design a method to identify universal Shortcut Activation Perturbations (SAPs) that serve as triggers that activate the safety shortcuts to safeguard ALMs at inference time.
To better sift out effective triggers while preserving the model’s utility on benign tasks, we further propose Mel-Gradient Sparse Mask (M-GSM), which restricts perturbations to Mel-frequency bins that are sensitive to jailbreaks but insensitive to speech understanding.
Both theoretical analyses and empirical results demonstrate the robustness of our method against both seen and unseen attacks. Overall, \MethodName reduces the average success rate of advanced ALM-specific jailbreak attacks to 4.6\% across four models, while maintaining comparable utility on benign benchmarks, establishing it as the new state of the art. Our code and data are available at https://github.com/WeifeiJin/ALMGuard.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents a lightweight, training-free method named ALMGuard that enhances the refusal robustness of audio language models by injecting universal perturbations into the input audio’s Mel-spectrogram. The perturbation is optimized using a sparse frequency mask (M-GSM) that targets model-sensitive frequency bands, with the goal of reducing harmful responses to adversarial inputs (e.g., audio jailbreaks) while preserving utility on benign tasks. The approach is evaluated on multiple models (e.g., Qwen2-Audio, GPT-4o, LTU) and attack types, showing consistent improvements in refusal accuracy without significant task degradation.\n\nSTRENGTHS AND WEAKNESSES:\nStrength:\n1. This paper proposes a practical, training-free, and model-agnostic defense approach that can be directly applied at inference time.\n2. The proposed ALMGuard demonstrates strong empirical robustness across several models and diverse attack types.\n3. This work introduces a novel spectral masking strategy (M-GSM) to sparsify perturbations in critical frequency bands.\n\nWeakness:\n1. While the authors highlight that only 50 adversarial samples are used to optimize the perturbation and mask, it would strengthen the claims of generalizability and robustness if an ablation study were provided to assess the impact of training data scale on SAP performance. For instance, how does performance vary when using 50 vs 100 vs 200 training samples?\n2. The perturbation and sparse mask are trained using a fixed set of 50 samples. However, it remains unclear how sensitive the performance is to the choice of training data. An ablation evaluating the variance across different training subsets would strengthen the claims of robustness and generalizability.\n\nBy the way, I found this paper quite interesting and inspiring. It offers some valuable ideas and represents a solid piece of work.\n\nQUESTIONS:\nWhile the paper evaluates ALMGuard’s transferability across different models, it does not explore whether different LALMs inherently exhibit distinct spectral sensitivities or adversarial vulnerability patterns. For example, comparing the learned M-GSM masks or gradient maps between models like Qwen2-Audio and LLama-omni could shed light on model-specific behaviors. \n\nI’m also curious how models with reasoning capabilities, such as Audio-CoT models, might respond differently under similar perturbations. Of course, I understand if it is beyond the current scope to conduct such experiments—this is merely a suggestion for future exploration, and I’d be happy to hear the authors' thoughts on this topic.\n\nOthers see weakness.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 4, "DATE": "2025-06-12"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper ALMGuard, a novel defense framework designed to protect Audio-Language Models (ALMs) from jailbreak attacks, which exploit unique vulnerabilities in the audio modality. ALMGuard operates by identifying safety-aligned shortcuts within ALMs and activating them using Shortcut Activation Perturbations (SAPs), universal acoustic alterations applied at inference time. To minimize disruption to benign tasks, the framework employs a Mel-Gradient Sparse Mask (M-GSM), which precisely targets perturbations to Mel-frequency bins sensitive to jailbreak mitigation but insensitive to speech understanding. This approach significantly reduces attack success rates while maintaining model availability, demonstrating strong robustness against both known and unknown threats.\n\nSTRENGTHS AND WEAKNESSES:\nThe paper elaborates on a timely topic. Other than conventional LLMs, only some research has evaluated audio input as an attack surface specifically, and even less has shown defenses.\n\nThe core hypothesis driving ALMGuard is that well-aligned ALMs inherently possess safety shortcuts, which are \"latent pathways or input sensitivities\" that can steer models towards safer behavior when correctly triggered. The proposed approach centres on identifying and activating these intrinsic safety shortcuts without requiring model retraining. \n\n**Strengths**\n\nThe paper provides theoretical analyses supporting ALMGuard's generalisation capabilities and its minimal impact on benign examples.\n\nIn addition, the experimental evaluation includes the most important aspects of a security analysis, which include unseen attacks, an adaptive attacker, and the measurement of utility. The paper also compares with other (text-based) defenses to show their effectiveness in all these cases.\n\n**Weaknesses**\n\nI would like to see more limitations for the adaptive attack, such as the fact that it will fail at some point. Defending against a very strong attacker will also have a price, such as utility. Showing this would make the paper more solid. \n\nThe paper does not discuss or evaluate over-the-air scenarios. For audio, it is normally not the case that the audio is fed into the LLM directly, but normally, there is a transmission happening that is recorded via a microphone. This transmission alters the signal, and the paper’s evaluation does not consider this case.\n\nQUESTIONS:\nNo further questions beyond what is already mentioned in the comments above.\n\nLIMITATIONS:\nAdd something related to over-the-air transmission.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-14"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nWith multimodal LLMs getting more and more common, this work aims to focus on AudioLLMs. In particular, this work aims to defend the AudioLLMs from jailbreaking. To do so, this paper formulates this similar to white box adversarial attack, but for finding the perturbation that defends, as well as keep the benign task performance in tact. A novel sensitivity based mask is then developed to only update certain mel bins, and with this, they call their method ALMGuard. Experiments are conducted to show its defending ability (low attack success rate) for multiple attacks and model backbones.\n\nSTRENGTHS AND WEAKNESSES:\n## Strengths\n- Paper is easy to parse, and idea is simple, and from the experiments it seem to work.\n- I like the idea of gradient sensitivity based bin masking. \n\n## Weakness \n- Given the nature of this paper where it creates a defense mechanism by adding a helpful noise on some restricted mel-bins, I think it is easy to create an adversarial jailbreak on this. For example, one can just try to break this defense system, by adversarially changing the input to output \"Sure, here’s a .... \" for any jailbreak prompts (similar to GCG -- Universal and Transferable Adversarial Attacks on Aligned Language Models)\n- Why only worry about ASR as benign task? Can it not be the case that even though ASR performance remains unaffected, but on AudioLLM benchmarks the performance degrades? I believe an evaluation of tasks proposed in AudioFlamingo-2 should be considered. \n- Should mask not be updated once every gradient step I believe that gradient would change as a function of applied $\\delta$ at that step. \n- Given the results in Table~3 I am not so sure if masking is a make or break. Can one not try with stronger $\\ell_{\\infty}$ constraint and get the results similar to ALMGuard? \n- The theoretical results mentioned in the paper are rather known learning theory results based on uniform convergence and offer nothing new, and hence proofs are also not useful as far as the paper is concerned. Therefore, as far as theory is concerned, the claims should be toned down.\n\nQUESTIONS:\nN/A\n\nLIMITATIONS:\n- Given the nature of this paper where it creates a defense mechanism by adding a helpful noise on some restricted mel-bins, I think it is easy to create an adversarial jailbreak on this. For example, one can just try to break this defense system, by adversarially changing the input to output \"Sure, here’s a .... \" for any jailbreak prompts (similar to GCG -- Universal and Transferable Adversarial Attacks on Aligned Language Models)", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 4, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-02"}

comments: SUMMARY:
This paper proposes a novel jailbreak defense method for Audio-Language Models (ALMs). Based on the assumption that safety-aligned shortcuts naturally exist in ALMs, the method identifies universal Shortcut Activation Perturbations (SAPs) that serve as triggers to activate the safeguard of ALMs during inference. A further proposed Mel-Gradient Sparse Mask (M-GSM) also realizes jailbreak defense by restricting jailbreak sensitive Mel-frequency bins. Experiments demonsrate that the ALMGuard could reach SOTA in defending against the most advanced jailbreak attacks on ALMs.

STRENGTHS AND WEAKNESSES:
Strengths:
1. This paper is well written with clear description of their proposed defense methods and comprehensive experiments to prove its effectiveness.
2. Theoretical analyses are provided to examine the generalization of their defense method ALMGuard, further strengthen their main claims and statements on the increased defense performance.
3. The ALMGuard could realize defense without significantly hurting the model availability.

Weaknesses:
1. More defense baselines are needed such as the diffusion based defense [1].

[1] Wu, Shutong, Jiongxiao Wang, Wei Ping, Weili Nie, and Chaowei Xiao. "Defending against adversarial audio via diffusion model." arXiv preprint arXiv:2303.01507 (2023).

QUESTIONS:
No other questions.

LIMITATIONS:
yes
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-12