{"slug": "prosody-driven-jailbreaks-in-audio-llms-a-controlled-study-and-mechanistic", "title": "Prosody-driven Jailbreaks in Audio LLMs: A Controlled Study and Mechanistic Analysis", "summary": "A controlled study from arXiv (2607.26541v1) finds that varying speech delivery presets while holding transcript content fixed can jailbreak audio LLMs, with the Q=1 Panic preset achieving 38/95 successful attacks on Qwen2-Audio versus 4/95 for Neutral. The PJ-Break protocol and AdvAudio-Prosody benchmark show that emotional-delivery audio alone (44/95) is far more effective than emotional text alone (11/95), indicating matched-text speech delivery should be a first-class factor in audio LLM safety evaluation.", "body_md": "arXiv:2607.26541v1 Announce Type: cross\nAbstract: Audio-capable foundation models enable end-to-end spoken interaction, but they also introduce safety risks beyond transcript content. It remains unclear how much jailbreak capability can arise from matched-text variation in speech delivery rather than from lexical rewriting or broader style transfer. We study this question by holding transcript content fixed and varying six speech-delivery presets whose acoustic attributes may co-vary. We present PJ-Break, a black-box evaluation protocol with presets targeting arousal, authority, and speaking rate, together with AdvAudio-Prosody, a 600-sample benchmark with acoustically verified attributes. On the exact post-QC Qwen2-Audio panel, the Q=1 Panic (38/95), Anger (35/95), and Fast (32/95) presets are all well above Neutral (4/95). The fixed six-query pool covers 44/95 Qwen2-Audio seeds and 15/95 GPT-4o seeds and exceeds a matched-budget StyleBreak reimplementation (27/95) on Qwen2-Audio. A same-voice pool excluding the confounded Commanding condition still reaches 40/95, and a retained-panel ablation shows emotional-delivery audio alone (44/95) is far more effective than emotional text alone (11/95). Exploratory surrogate diagnostics and pilot mitigation observations are secondary, non-core analyses. Overall, matched-text speech delivery should be treated as a first-class factor in Audio LLM safety evaluation", "url": "https://wpnews.pro/news/prosody-driven-jailbreaks-in-audio-llms-a-controlled-study-and-mechanistic", "canonical_source": "https://www.machinebrief.com/news/prosody-driven-jailbreaks-in-audio-llms-a-controlled-study-a-nroa", "published_at": "2026-07-30 04:00:00+00:00", "updated_at": "2026-07-30 06:33:19.374167+00:00", "lang": "en", "topics": ["ai-safety", "large-language-models", "artificial-intelligence"], "entities": ["arXiv", "Qwen2-Audio", "GPT-4o", "PJ-Break", "AdvAudio-Prosody"], "alternates": {"html": "https://wpnews.pro/news/prosody-driven-jailbreaks-in-audio-llms-a-controlled-study-and-mechanistic", "markdown": "https://wpnews.pro/news/prosody-driven-jailbreaks-in-audio-llms-a-controlled-study-and-mechanistic.md", "text": "https://wpnews.pro/news/prosody-driven-jailbreaks-in-audio-llms-a-controlled-study-and-mechanistic.txt", "jsonld": "https://wpnews.pro/news/prosody-driven-jailbreaks-in-audio-llms-a-controlled-study-and-mechanistic.jsonld"}}