ARENA: Automated Red-Teaming for Large Audio Language Models

Jiaming He; Zhicong Huang; Tian Jin; Zhen Sun; Cheng Hong; Yi Yu; Wenbo Jiang; Xudong Jiang

cs.SDAug 16, 2026

ARENA: Automated Red-Teaming for Large Audio Language Models

Authors: Jiaming He, Zhicong Huang, Tian Jin, Zhen Sun, Cheng Hong, Yi Yu, Wenbo Jiang, Xudong Jiang

Organizations: Nanyang Technological University, Singapore · Ant Group, China · The Chinese University of Hong Kong, Shenzhen, China · Jilin University, China ·

Abstract

Large audio-language models (LALMs) make it possible to interact with language models through speech, music, and environmental sound, but they also introduce a safety surface that is difficult to expose with text-only red-teaming. We study automated audio-grounded red-teaming, where a text query must remain safe in isolation while the joint text-audio input induces harmful target behavior. We propose ARENA, a closed-loop framework that trains a controller on an independent 2,000case text-audio dataset. MD-Judge supplies training rewards and adaptive search feedback, while a separate, non-adaptive Llama Guard 3 evaluator alone labels final outcomes. On 520 held-out AdvBench objectives, ARENA achieves FDR/PSR of 87.9/100.0%, 71.5/96.3%, 68.1/100.0%, and 75.4/98.5% on Audio Flamingo 3, Qwen2-Audio, MiMo-Audio, and GPTAudio, respectively. Ablations show that feedback-based refinement and audio-variant search substantially improve attack discovery.

Figures & tables

Figure 1: Audio-grounded red-teaming. Harmful intent can hide in the audio channel while the text query remains safe.

Figure 2: Overview of the ARENA framework.

Method	AF3			Qwen2-Audio			MiMo-Audio			GPT-Audio
Metric	FDR	PSR	Div	FDR	PSR	Div	FDR	PSR	Div	FDR	PSR	Div
AJailBench	31.2	68.6	24.8	10.8	68.6	24.8	25.3	68.6	24.8	24.6	68.6	24.8
JALMBench	12.6	25.3	58.6	11.9	25.3	58.6	10.7	25.3	58.6	11.3	25.3	58.6
ARENA	87.9	100.0	33.4	71.5	96.3	32.6	68.1	100.0	31.8	75.4	98.5	34.2

Table 1: Main comparison on target LALMs. FDR is the joint Llama Guard success rate over all 520 objectives; PSR and diversity are diagnostics. Values are percentages.

Figure 3: Hyperparameter ablations. Final Llama Guard ASR under different refinement budgets, target-side sampling settings, and environmental-sound variant counts.

Target	Avg. Attempts
AF3	9.2
Qwen2-Audio	9.1
MiMo-Audio	12.5
GPT-Audio	11.4

Table 2: Average refinement attempts on AdvBench 520.

Source	AF3	Qwen2	MiMo	GPT-Audio
AF3	87.9	59.7	60.0	50.4
Qwen2	57.0	74.2	37.1	41.0
MiMo	58.6	67.5	68.1	52.2
GPT-Audio	63.7	53.0	51.8	76.5

Table 3: Transferability . Cells report final Llama Guard ASR.

Figure 4: Category-level ASR. Final Llama Guard ASR of ARENA across six consolidated harmful categories.

Figure 5: Category-level diversity of ARENA test cases.

Audio-Language Model Evaluation

Audio-language model evaluation tests whether systems understand speech, music, and environmental sound reliably, fairly, and with evidence grounded in audio.

See all 206 papers

Audio Jailbreaks in Large Audio-Language Models: Taxonomy, Attack-Defense Analysis, and Cost-Aware Evaluation
May 28, 2026Bo-Han Feng, Yu-Hsuan Li Liang, Chien-Feng Liu +2Audio-Language Model Evaluation Audio-Language Models
National Taiwan University
Audio Hallucination Attacks: Probing the Reliability of Large Audio Language Models
Mar 31, 2026Ashish Seth, Sonal Kumar, Ramaneswaran Selvakumar +5Audio-Language Model Evaluation LLM Reliability
University of Maryland, College Park · Adobe Research
AEGIS: Audio Endogenous Guarding via Internal Signals Against Large Audio-Language Model Jailbreaks
Sep 24, 2026Yu-Ling Liao, Tzu-Chin Chiu, Zong-You Chen +2Audio-Language Models Jailbreak Defense
National Taiwan University

May 28, 2026J/K move · Enter open · S save

Audio Jailbreaks in Large Audio-Language Models: Taxonomy, Attack-Defense Analysis, and Cost-Aware Evaluation

Bo-Han Feng, Yu-Hsuan Li Liang, Chien-Feng Liu, You-Hsuan Chang+1

National Taiwan University

Audio-Language Model Evaluation Audio-Language Models LLM Jailbreak Attacks Jailbreak Defense

Open paper AskPDF arXiv

Large Audio Language Models (LALMs) expand jailbreak risks from token-level prompting to the full speech perception-to-reasoning pipeline, where unsafe behavior can be induced through semantics, acoustic style, signal artifacts, or internal representations. Existing work studies these risks under heterogeneous threat models and evaluation protocols, making it difficult to compare attack practicality or defense utility. This paper provides a unified taxonomy and a controlled empirical evaluation of LALM jailbreak attacks and defenses. We organize prior work into semantic, acoustic, signal, and embedding-layer attacks; guard-based, training-free, and training-based defenses; and cross-modal, audio-native, and interactive benchmarks. We then evaluate representative attacks and defenses across ten open-source LALMs, measuring not only attack success rate but also benign refusal and latency. Our results show that Acoustic Best-of-N reveals strong worst-case audio-space vulnerabilities, Narrative Framing is an effective low-latency semantic threat, and current defenses trade robustness against benign usability. These findings support cost- and utility-aware evaluation as a necessary complement to success-rate-only LALM safety benchmarks.

Abstract

Audio-Language Model Evaluation

Explore similar work

Audio Jailbreaks in Large Audio-Language Models: Taxonomy, Attack-Defense Analysis, and Cost-Aware Evaluation

Audio Hallucination Attacks: Probing the Reliability of Large Audio Language Models

AEGIS: Audio Endogenous Guarding via Internal Signals Against Large Audio-Language Model Jailbreaks