Reproduce “SPIRIT: Patching Speech Language Models against Jailbreak Attacks” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Amirbek Djanibekov, Nurdaulet Mukhituly, Kentaro Inui, Hanan Aldarmaki, Nils Lukas
Researchers at MBZUAI investigated noise-based adversarial jailbreak attacks on Speech Language Models (SLMs) and found leading open-source models highly vulnerable, achieving attack success rates up to 100%. They developed and validated network-level intervention strategies, with 'activation patching' proving most effective in mitigating these attacks while preserving model utility.
Key insights
- State-of-the-art open-source SLMs like Qwen2-Audio and LLaMa-Omni are significantly vulnerable to noise-based jailbreak attacks, with LLaMa-Omni showing higher attack success rates but Qwen2-Audio generating more harmful content.
- Defense interventions applied at the language model (LM) component consistently yield a superior balance between defense success and utility preservation compared to those applied in the audio encoder (AE).
- Activation patching, particularly within the LM, offers a more effective utility-security trade-off than simple input denoising or random noise addition, maintaining conversational utility and speech recognition performance while mitigating attacks.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.