arXiv:2510.26096cs.SDcs.CR2025-10NeurIPS被引 6

针对音频语言模型的新型安全漏洞,提出首个专用防御框架,通过触发安全捷径实现防护。

ALMGuard: Safety Shortcuts and Where to Find Them as Guardrails for Audio-Language Models

  • 识别通用安全捷径触发器,推理时激活以防御攻击
  • 在4个模型上将攻击成功率降至4.6%,同时保持正常任务性能
  • 适合关注多模态模型安全的研究者和开发者

近期音频-语言模型(ALMs)在多模态理解能力上取得显著进展,但音频模态也引入了新的独特漏洞。已有研究提出了专门针对ALMs的越狱攻击,表明直接迁移传统音频对抗攻击或文本大模型越狱防御策略对这些专有威胁基本无效。为此,我们提出ALMGuard,首个专为ALMs设计的防御框架。基于安全对齐捷径天然存在于ALMs中的假设,我们设计方法识别通用的捷径激活扰动(SAPs),作为推理时激活安全捷径的触发器。为进一步筛选有效触发器并保留模型在良性任务上的可用性,我们提出梅尔频谱梯度稀疏掩码(M-GSM),将扰动限制在对越狱敏感但对语音理解不敏感的梅尔频率通道内。理论分析与实证结果均证明该方法对已知和未知攻击具有鲁棒性。整体上,该方法在四个模型上将先进ALM特异性越狱攻击的平均成功率降至4.6%,同时在良性基准上保持相当的性能,确立了新基准。代码与数据见:https://github.com/WeifeiJin/ALMGuard。

原文摘要 · Abstract (English)

Recent advances in Audio-Language Models (ALMs) have significantly improved multimodal understanding capabilities. However, the introduction of the audio modality also brings new and unique vulnerability vectors. Previous studies have proposed jailbreak attacks that specifically target ALMs, revealing that defenses directly transferred from traditional audio adversarial attacks or text-based Large Language Model (LLM) jailbreaks are largely ineffective against these ALM-specific threats. To address this issue, we propose ALMGuard, the first defense framework tailored to ALMs. Based on the assumption that safety-aligned shortcuts naturally exist in ALMs, we design a method to identify universal Shortcut Activation Perturbations (SAPs) that serve as triggers that activate the safety shortcuts to safeguard ALMs at inference time. To better sift out effective triggers while preserving the model's utility on benign tasks, we further propose Mel-Gradient Sparse Mask (M-GSM), which restricts perturbations to Mel-frequency bins that are sensitive to jailbreaks but insensitive to speech understanding. Both theoretical analyses and empirical results demonstrate the robustness of our method against both seen and unseen attacks. Overall, \MethodName reduces the average success rate of advanced ALM-specific jailbreak attacks to 4.6% across four models, while maintaining comparable utility on benign benchmarks, establishing it as the new state of the art. Our code and data are available at https://github.com/WeifeiJin/ALMGuard.

音频语言模型模型安全越狱防御多模态

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。