Reproduce “On Optimizing Multimodal Jailbreaks for Spoken Language Models” on OpenResearch

About this paper

Aravind Krishnan, Karolina Stańczak, Dietrich Klakow

This research introduces JAMA, a joint optimization method for multimodal adversarial attacks on Spoken Language Models (SLMs), and SAMA, a computationally efficient approximation. It demonstrates that combining text and audio perturbations significantly increases SLM jailbreak rates by 1.5x to 20x compared to unimodal attacks, challenging current unimodal safety evaluation paradigms.

Key insights

• Robustness to unimodal adversarial optimization does not transfer effectively to the multimodal setting; joint text and audio attacks substantially amplify SLM vulnerabilities.
• Text and audio perturbations in joint attacks appear to interact by perturbing complementary components of the model's decision boundary, leading to enhanced jailbreak success.
• Multimodal attacks induce distinct and separable subspaces in the SLM's embedding space compared to unimodal attacks and benign inputs, suggesting unique adversarial mechanisms.

Summary by alphaXiv.