Multilingual and Multi-Accent Jailbreaking of Audio LLMs

We appreciate Reviewer 57ot’s thorough reading and constructive feedback on our submission. Below, we address each of your concerns in turn.

Response to Reasons to Reject 1: Thank you for your insights. We agree that jailbreak vulnerabilities in other modalities are well-documented. However, our work goes beyond re-evaluation by introducing several novel and practical contributions that deepen our understanding of multimodal vulnerabilities—particularly in real-world, non-adversarial settings. First, we show that benign, naturally spoken prompts—across languages, accents, and environments—can significantly raise JSRs. These are realistic utterances likely to occur in deployed audio systems, making our findings directly actionable. Second, we identify a new audio-specific attack vector: combining multilingual/accent speech with natural acoustic perturbations. These arise organically (e.g., in public spaces or phone calls) and require no technical expertise, unlike traditional attacks. Third, we present the first benchmark dataset for adversarial multilingual/accent audio jailbreaks, evaluating five state-of-the-art LALMs, 7 accents, and 13 multiple languages—all evaluated using fully open-source models to ensure reproducibility and practical applicability. The perturbed inputs remain semantically coherent, as evidenced by high SQA accuracy and consistently unsafe outputs flagged by LLaMa-Guard.

---

Response to Reasons to Reject 2: Thank you for the suggestion. We have added 95% confidence intervals (CIs) using normal approximation to the binomial proportion (Table 1 below). These will be included in the revised Figure 2 with three additional languages. Notably, CIs for audio and text often do not overlap—indicating statistical differences.

Table 1:

---

Response to Reasons to Reject 3: We will move that paragraph to a new section of Discussion or combine with Section 7 as Discussion and Limitation. We will properly label it as a hypothesis in Section 5, reserving it for the discussion of future work.

---

Response to Reasons to Reject 4: Thank you for the suggestion. We agree that safety fine-tuning could strengthen defenses, but we focused on a zero-shot inference-time defense for its practicality. It avoids retraining, integrates via prompt modification, and aligns with workflows supported by APIs like OpenAI's [1]. Our method requires no new data and avoids risks tied to safe data quality. As noted in our response to Reviewer uBUp, our defense preserves utility: <2% drop in English SQA accuracy across 5 models. This plug-and-play method provides a lightweight safeguard for LALMs. That said, we view safety fine-tuning as a promising complementary direction for future work.

Reference: [1] OpenAI. “Audio API Guide.” https://platform.openai.com/docs/guides/audio

---

Response to Reasons to Reject 5: Thank you for the thoughtful comment. We agree that the general idea has been noted in prior work. However, our contribution is the first to systematically demonstrate this effect in the audio modality, which is increasingly central to real-world AI systems (e.g., voice assistants, multimodal agents). To clarify this distinction, we will revise the sentence in Section 1. Specifically, we show that even a human-intelligible audio perturbations can meaningfully compromise model safety, establishing audio as a standalone channel of vulnerability. As multimodal models expand in deployment, our findings underscore the importance of evaluating each input modality not in isolation, but as a possible attack vector. We view this as a timely and necessary step toward safeguarding next-generation multimodal systems, with audio representing a critical yet underexplored dimension.

Response to Reasons to Reject 6: Thank you for the suggestion. We will expand the caption in the following manner:

Overview of MULTI-AUDIOJAIL attack framework. a) Text-only Attack (Multilingual): English jailbreak prompts are translated into multiple target languages, converted to speech via TTS, and passed to an audio LLM — yielding low jailbreak success. b) **Audio-Only Attack (Multilingual / Multi-Accent): Raw audio prompts in different languages or accents (both native and synthetic) are fed directly into the LALM; some language/accent bypass safety filters while others still trigger refusal. c) Audio Perturbation Attack (Multilingual / Accent): Multilingual and multi-accent audio inputs are further modified with adversarial acoustic perturbations before inference, dramatically increasing jailbreak success across all variations.

---

Response to Reasons to Reject 7: Thank you for the suggestion. We will consider renaming our framework to Multi-AudioJail (MAJ) for clarity, updating all references accordingly.

We sincerely appreciate Reviewer nssE’s comments on our paper and we would like to address the reviewer’s concerning points as following:

Reasons to Reject 1: “It would be great if the authors can provide some examples as supplemental materials to show how the audio sounds as case studies.”

Response to Reasons to Reject 1: Thank you for the suggestion. We will upload supplementary audio examples of each perturbation scenario in the final version of our paper, allowing the reviewers to hear the perturbed samples directly.

---

Question 1: “Considering the uniqueness of audio, what's the fundamental difference between jailbreaking techniques for audio, image or text?”

Response to Question 1: Unlike text or images — where adversarial jailbreaks rely on carefully crafted prompts or pixel-level perturbations generated offline — audio introduces an analog channel of attack parameters that can be manipulated in real time. In our work, we demonstrate that simply altering a speaker’s accent or introducing natural acoustic effects (e.g., reverberation, echo, background noise, whispering) is sufficient to push a “safe” audio LLM out of its alignment distribution and trigger unsafe behaviors.

These perturbations are fundamentally different because:

• They occur naturally (e.g., regional accents, tunnel echoes) and do not require model access or optimization;
• They can be applied dynamically during live conversations with voice assistants, making them harder to detect or pre-filter;
• They exploit the continuous, time-varying nature of sound—creating a far richer attack surface than the discrete tokens used in text or static pixels in images.

By leveraging analog acoustic manipulations that any user or man-in-the-middle device could introduce, we reveal a novel and practical class of jailbreaks that is unique to the audio modality.

Hi Reviewer nssE,

I've read through your review for Submission 612 and wanted to touch base on a few points to ensure we have a shared understanding.

• Regarding the paper's novelty, your review suggests the area of multilingual/multi-accent audio jailbreaking is "overlooked" and positions this as a "good starting point." The authors, however, cite multiple prior works in this domain on Page 1 and in Section 2.2. I'm trying to reconcile these observations – could you clarify how you see this paper's contribution as a foundational "starting point" in that context?

• You positively noted the "comprehensive experiments." To help me see it from your perspective, could you highlight which aspects of the experimental setup, analysis, or specific results you felt were particularly strong or insightful? The review doesn't go into these details, and I think it would be valuable for the discussion.

• The "Reasons To Reject" focuses on adding audio examples. While a good suggestion, this seems more like a minor revision. Do you have any actual reasons to reject?

Your overall assessment is extremely positive (8/10, 5/5 confidence), and I'm not seeing the strengths you've identified. A bit more detail on your reasoning for these points would be very helpful.

Thank you!

We thank the reviewer for the thoughtful critique and for recognizing the value of our Multi-AudioJail framework and dataset. Below, we address each of your concerns and outline planned revisions

Response to Reasons to Reject 1: Thank you for highlighting the importance of distinguishing between refusals due to unintelligible audio and those caused by true safe detection. To address this, we conducted an evaluation using perturbed safe audio inputs with the same accent and adversarial settings. Our goal is to verify whether the model could still understand and respond appropriately to benign queries when the same distortions were applied.

As shown in the table below, SQA accuracy on both Whisper and Reverb Teisco inputs remained high across all models and the three example accents shown. This suggests that models retain core utility under perturbation (full results will be included in the final version of our paper). These results reinforce that LALMs still understand benign content under realistic distortions, and elevated JSRs in harmful queries cannot be attributed to intelligibility loss. Our results confirm that jailbreaks stem from genuine safety vulnerabilities in LALMs under realistic input conditions and not from degraded audio.

---

Response to Reasons to Reject 2: Thank you for the thoughtful suggestion. We agree that analyzing the relationship between WER and JSR is valuable for assessing whether high JSRs are due to transcription errors. Our results show that acoustic perturbations preserve utility while significantly increasing vulnerability:

• As shown in Table 5, Echo and Whisper produce low WERs (0.108 and 0.102) but significantly increase JSRs (e.g., +42.21 for German under Whisper, Table 13), indicating the model comprehends the input rather than failing to transcribe.
• We also followed [1, 2] to force transcription via explicit instructions (e.g., "Transcribe the input audio."), but these consistently failed when the input was phrased as a question. In such cases, models either answered semantically or refused due to safety filters.

This highlights a key challenge in speech QA: transcription and response generation are tightly coupled. If models failed to understand the input, outputs would be off-topic and marked “safe.” Instead, coherent but unsafe responses confirm that models comprehend the content but fail to enforce safety.

References:

[1] https://huggingface.co/MERaLiON/MERaLiON-AudioLLM-Whisper-SEA-LION

[2] https://huggingface.co/openbmb/MiniCPM-o-2_6

---

Response to Reasons to Reject 3: We understand that our phrasing on “cross-lingual phonetics interaction" may have introduced ambiguity. Our intention was to emphasize that applying acoustic perturbations to multilingual/accent audio inputs substantially increase JSRs. To clarify this point, we will revise the sentence in the abstract as follows:

• “…a hierarchical evaluation pipeline revealing that applying acoustic perturbations (e.g., reverberation, echo, whisper effects) to multilingual and multi-accent audio inputs significantly amplifies jailbreak success rates (JSRs) ...

Response to Reasons to Reject 4: We focused on Western languages because current LALMs tend to handle them more reliably. In our preliminary trials with non-Western languages (e.g., Chinese, Korean, Arabic), models often produced incorrect or off-topic outputs—likely due to limited multilingual training. Additionally, high-quality TTS was inconsistent for several of those languages. To ensure fair and consistent evaluation, we selected languages with robust model support and TTS quality. Expanding to more diverse languages is an important direction we plan to explore as model and TTS capabilities improve.

---

Response to Reasons to Reject 5: Thank you for the thoughtful question. Yes, we manually reviewed all TTS-generated synthetic accent audio samples to confirm their intelligibility. Based on this inspection, we verified that all clean synthetic samples were intelligible to human listeners. To further support this, we will include example audio clips for each perturbation type in our supplementary materials.

We computed average WERs for clean synthetic and natural accents using Whisper-large-v3. As shown in the table below, these inputs are highly intelligible in unperturbed form. While not model-specific, these WERs serve as a global proxy for intelligibility, since LALMs operate in end-to-end QA mode without exposing transcriptions (see Response to Reason to Reject 3). Importantly, JSRs remain low on clean inputs but increase sharply under perturbations, indicating the models understand the harmful content but fail to apply safety constraints. If the audio had been unintelligible, outputs would have been off-topic and flagged as “safe” by LLaMa-Guard. These findings reinforce our conclusion: LALMs preserve semantic understanding under perturbation, and high JSRs reflect safety failures—not transcription errors.

---

Response to Reasons to Reject 6: There could be many such perturbations since audio modality allows unlimited flexibility including what we did and background noise/chatter but we wanted to focus on the few perturbations and explore them in-depth. Therefore, our work establishes a lower bound on safety vulnerability of LALMs. We would also like to emphasize that one of our motivations was to explore how even seemingly benign environmental sounds can act as unintentional adversarial perturbations, without malicious intent from the user. To further expand on this, we will consider incorporating our own approach of blending background noises with diverse accents and languages, which could reveal novel interactions between naturalistic acoustic interference and linguistic variation. This would allow us to build on past work while offering a unique angle aligned with our multilingual attack focus.

---

Response to Reasons to Reject 7: Thank you for the correction. We will proofread and address any additional copy edits.

Reasons to Reject 1: “The reduction in word error rates (WER), and SQA accuracy in multilingual and multi-accent attacks indicate that the utility of the audio LLMs is also reduced with the increase in attack success rates. This could indicate that these input distributions are out-of-distribution for all types of inputs - both benign and adversarial.”

Response to Reasons to Reject 1:
Thanks for the suggestion and we agree that adversarial prompts are often out-of-distribution (OOD) relative to the model’s safety alignment data. Indeed, prior works [1, 2] have shown that simple transformations (e.g., mixup, visual/textual blending) applied to harmful prompts can “OOD-ify” them, thereby bypassing safety filters. These findings reinforce a key observation in jailbreak literature: many failures stem from the distributional gap between safety-aligned inputs and adversarial ones.

Our work builds on this by examining various adversarial audio inputs. Importantly, our experiments show that LALMs retain meaningful comprehension of harmful queries even after perturbation. This is because the resulting responses are coherent and contextually relevant — and consistently flagged as “unsafe” by LLaMa-Guard. If the inputs had been incomprehensible, the model’s outputs would have been off-topic and thus automatically filtered as “safe”. Therefore, the elevated JSRs point to failures in safety enforcement, not degradation of language understanding.

References:
[1] Jeong et al. “Playing the Fool: Jailbreaking LLMs and MLLMs with out-of-distribution strategy”
[2] Peng et al. “Logic Jailbreak: Efficiently Unlocking LLM Safety Restrictions through Formal Logical Expressions”

---

Reasons to Reject 2: “Hence, the increased attack success rates could indeed be in distributions where the model has low utility and hence may not be usable in downstream applications. This analysis of high attack success rates in data distributions with high utility needs to be explored to further make this finding compelling.”

Response to Reasons to Reject 2:
Thank you for raising this important point. While adversarial queries are indeed out-of-distribution from the perspective of the model’s safety alignment, our findings show that audio manipulations preserve the general utility of LALMs even under attack settings. Specifically, transformations such as echo, whisper, and Teisco reverberation result in a low WER of less than 0.26 across six languages (Table 5), while SQA accuracy for benign prompts remains between 8% and 98% (avg. 67.4%) across five non-English languages (Table 7). Despite this, the same perturbations increase JSRs by 27–48 percentage points (Table 1).

This confirms that the models continue to process and understand the input audio effectively, even in perturbed conditions. The rise in attack success is not due to low utility or input degradation, but rather due to breakdown in safety filtering while preserving the harmful intent in acoustically altered inputs.

---

Reasons to Reject 3: “In evaluating the defense, applying the same attacks on benign prompts would also reduce the utility of the prompts - this needs to be measured and contrasted with the jailbreak attacks to understand the efficacy of the defense proposed as the instructions would uniformly apply to benign prompts as well.”

Response to Reasons to Reject 3:
Thank you for your suggestion. To quantify the impact of our defense on benign audio queries, we measured English SQA accuracy with our defense. The models achieved 88.0% (DiVA), 97.0% (MeraLiON), 96.0% (MiniCPM), 85.0% (Qwen2), and 84.0% (Ultravox), which is < 2% change compared to corresponding clean-inputs baseline. This demonstrates that our defense does not materially degrade benign SQA performance.

---