Elamur Research⌕
☰
home / papers / 2026 / Now You Hear Me: Audio Narrative Attacks Against Large Audio–Language Models

Now You Hear Me: Audio Narrative Attacks Against Large Audio–Language Models

Paper · 2026 · Ye Yu, Haibo Jin, Yaoning Yu et al.

Summary

The paper asks whether the way something is said, and not only its wording, can make large audio–language models (LALMs) ignore their safety training. The authors build a black-box jailbreak that turns harmful text prompts into narrative-style speech. An instruction-following TTS model (GPT-4o Mini TTS) voices the prompts in deliberately chosen delivery styles, such as therapeutic, performative, authoritative or urgent. The styles draw on social-influence ideas like the Media Equation and forced compliance, and the underlying instruction is left unchanged. The attack targets end-to-end LALMs (GPT-4o Realtime, Gemini 2.0 Flash, Qwen2.5-Omni) and is tested on benchmarks including AdvBench and JailbreakBench. Stylized speech beats both plain-text prompts and acoustically perturbed baselines, and reaches 98.26% attack success on Gemini 2.0 Flash. The effect persists with human-recorded voices and with a second TTS engine. The main implication is that alignment tuned only on text leaves a gap in voice interfaces. Defenses need to account for prosody and speaker intent as well as content.

Key points

  • Stylized delivery raised attack success rate (ASR) by up to 26% over baselines. The best result was 98.26% on Gemini 2.0 Flash.
  • With identical JailbreakBench content, an "Urgent Directive" voice beat a neutral one:
    • GPT-4o Realtime: 1.0% → 1.6%
    • Gemini 2.0 Flash: 4.3% → 5.6%
  • On 20 human-recorded AdvBench prompts, "Authoritative Demand" outperformed text:
    • GPT-4o: 55% vs 50%
    • Gemini-2.0-Flash: 70% vs 60%
  • When audio was generated with Gemini-2.0-Flash TTS (50 AdvBench prompts), the same trend held:
    • GPT-4o: 54% vs 46% for text
    • Gemini: 78% vs 76% for text
  • Stated limitations:
    • The attack is weaker on the smaller Qwen2.5-Omni, which tends to produce garbled output instead.
    • The delivery styles are hand-crafted.
    • Only English was evaluated, so the effect on Ukrainian or other languages is untested.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓University of Illinois Urbana-ChampaignUrbana · United States209 works · 71,394 citations🎓Boise State UniversityBoise · United States4 works · 93 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksArts and Humanities · 17,450 worksLanguage and Linguistics · 17,296 works

🧭 Topics 2Research subjects and languages the work is about.Language models & pretraining · 3,894 worksSpeech & spoken language · 519 works

Cite

Cite as Ye Yu, Haibo Jin, Yaoning Yu, Jun Zhuang and Haohan Wang. 2026. Now You Hear Me: Audio Narrative Attacks Against Large Audio–Language Models. Proceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.eacl-long.278

@inproceedings{yu2026now,
  title = {{Now You Hear Me: Audio Narrative Attacks Against Large Audio–Language Models}},
  author = {Ye Yu, Haibo Jin, Yaoning Yu, Jun Zhuang and Haohan Wang},
  booktitle = {Proceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.eacl-long.278},
  url = {https://doi.org/10.18653/v1/2026.eacl-long.278}
}

References

64 references, 16 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Gati Aher, Rosa I. Arriaga, and Adam Tauman Kalai. 2023. Using large language models to simulate multiple humans and replicate human subject studies. Preprint, arXiv:2208.10264. find
  2. Keyu An, Qian Chen, Chong Deng, Zhihao Du, Changfeng Gao, Zhifu Gao, Yue Gu, Ting He, Hangrui Hu, Kai Hu, Shengpeng Ji, Yabin Li, Zerui Li, Heng Lu, Haoneng Luo, Xiang Lv, Bin Ma, Ziyang Ma, Chongjia Ni, and 14 others. 2024. Funaudiollm: Voice understanding and generation foundation models for natur… — [arXiv:2407.04051](https://arxiv.org/abs/2407.04051) find
  3. Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J. Pappas, Florian Tramer, Hamed Hassani, and Eric Wong. 2024a. Jailbreakbench: An open robustness benchmark for jailbreaking large language models. P…
  4. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. 2024b. Jailbreaking black box large language models in twenty queries. Preprint, arXiv:2310.08419.
  5. Dazhong Chen, Yi-Cheng Lin, Yuchen Huang, Ziwei Gong, Di Jiang, Zeying Xie, Yi R., and Fung. 2025a. Cantoasr: Prosody-aware asr-lalm collaboration for low-resource cantonese. Preprint, arXiv:2511.04139. — [arXiv:2511.04139](https://arxiv.org/abs/2511.04139) find
  6. Guangke Chen, Fu Song, Zhe Zhao, Xiaojun Jia, Yang Liu, Yanchen Qiao, and Weizhe Zhang. 2025b. Audiojailbreak: Jailbreak attacks against end-to-end large audio-language models. Preprint, arXiv:2505.14103. — [arXiv:2505.14103](https://arxiv.org/abs/2505.14103) find
  7. Hao Cheng, Erjia Xiao, Jing Shao, Yichi Wang, Le Yang, Chao Shen, Philip Torr, Jindong Gu, and Renjing Xu. 2025. Jailbreak-audiobench: In-depth evaluation and analysis of jailbreak threats for large audio language models. Preprint, arXiv:2501.13772. — [arXiv:2501.13772](https://arxiv.org/abs/2501.13772) find
  8. Chun Wai Chiu, Linghan Huang, Bo Li, Huaming Chen, and Kim-Kwang Raymond Choo. 2025. ‘do as i say not as i do’: A semi-automated approach for jailbreak prompt attack against multimodal llms. Preprint, arXiv:2502.00735. — [arXiv:2502.00735](https://arxiv.org/abs/2502.00735) find
  9. Tiehan Cui, Yanxu Mao, Peipei Liu, Congying Liu, and Datao You. 2025a. Exploring jailbreak attacks on LLMs through intent concealment and diversion. In Findings of the Association for Computational Linguistics: ACL 2025, pages 20754–20768, Vienna, Austria. Association for Computational Linguistics. find
  10. Wenqian Cui, Dianzhi Yu, Xiaoqi Jiao, Ziqiao Meng, Guangyan Zhang, Qichao Wang, Yiwen Guo, and Irwin King. 2025b. Recent advances in speech language models: A survey. Preprint, arXiv:2410.03751.
  11. Maureen de Seyssel, Antony D’Avirro, Adina Williams, and Emmanuel Dupoux. 2024. EmphAssess : a prosodic benchmark on assessing emphasis transfer in speech-to-speech models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 495–507, Miami, Florida, USA.… find
  12. Soham Deshmukh, Benjamin Elizalde, Rita Singh, and Huaming Wang. 2024. Pengi: An audio language model for audio tasks. Preprint, arXiv:2305.11834. — [arXiv:2305.11834](https://arxiv.org/abs/2305.11834) find
  13. Chaoyou Fu, Haojia Lin, Xiong Wang, Yi-Fan Zhang, Yunhang Shen, Xiaoyu Liu, Haoyu Cao, Zuwei Long, Heting Gao, Ke Li, Long Ma, Xiawu Zheng, Rongrong Ji, Xing Sun, Caifeng Shan, and Ran He. 2025. Vita-1.5: Towards gpt-4o level real-time vision and speech interaction. Preprint, arXiv:2501.01957. — [arXiv:2501.01957](https://arxiv.org/abs/2501.01957) find
  14. Sreyan Ghosh, Sonal Kumar, Ashish Seth, Chandra Kiran Reddy Evuru, Utkarsh Tyagi, S Sakshi, Oriol Nieto, Ramani Duraiswami, and Dinesh Manocha. 2024. Gama: A large audio-language model with advanced audio understanding and complex reasoning abilities. Preprint, arXiv:2406.11768.
  15. Wonjune Kang, Junteng Jia, Chunyang Wu, Wei Zhou, Egor Lakomkin, Yashesh Gaur, Leda Sari, Suyoun Kim, Ke Li, Jay Mahadeokar, and Ozlem Kalinli. 2025b. Frozen large language models can perceive paralinguistic aspects of speech. In Interspeech 2025, interspeech_2025, page 4323–4327. ISCA. find
  16. Xingang Guo, Fangxu Yu, Huan Zhang, Lianhui Qin, and Bin Hu. 2024. Cold-attack: Jailbreaking llms with stealthiness and controllability. Preprint, arXiv:2402.08679. — [arXiv:2402.08679](https://arxiv.org/abs/2402.08679) find
  17. Hui Li, Changhao Jiang, Hongyu Wang, Ming Zhang, Jiajun Sun, Zhixiong Yang, Yifei Cao, Shihan Dou, Xiaoran Fan, Baoyu Fan, Tao Ji, Tao Gui, Qi Zhang, and Xuanjing Huang. 2026. Cmdar: A chinese multi-scene dynamic audio reasoning benchmark with diverse challenges. Preprint, arXiv:2509.22461. — [arXiv:2509.22461](https://arxiv.org/abs/2509.22461) find
  18. Isha Gupta, David Khachaturov, and Robert Mullins. 2025. "i am bad": Interpreting stealthy, universal and robust audio jailbreaks in audio-language models. Preprint, arXiv:2502.00718. — [arXiv:2502.00718](https://arxiv.org/abs/2502.00718) find
  19. Joshua Guyer, Pablo Briñol, Thomas Vaughan-Johnston, Leandre Fabrigar, Lorena Moreno, and Richard Petty. 2021. Paralinguistic features communicated through voice can affect appraisals of confidence and evaluative judgments. Journal of Nonverbal Behavior. find
  20. Joshua Guyer, Leandre Fabrigar, and Thomas Vaughan-Johnston. 2018. Speech rate, intonation, and pitch: Investigating the bias and cue effects of vocal confidence on persuasion. Personality and Social Psychology Bulletin, 00:1–17. find
  21. Joshua Guyer, Thomas Vaughan-Johnston, Leandre Fabrigar, Borja Paredes, Pablo Briñol, and Minqian Shen. 2024. Vocal speed and processing of persuasive messages: Curvilinear processing effects. Journal of Nonverbal Behavior, 49:171–203. find
  22. Yangsibo Huang, Samyak Gupta, Mengzhou Xia, Kai Li, and Danqi Chen. 2023. Catastrophic jailbreak of open-source llms via exploiting generation. Preprint, arXiv:2310.06987.
  23. HuggingFace. 2024. Speech to speech: An effort for an open-sourced and modular gpt-4o. https://github.com/huggingface/speech-to-speech. ↗
  24. John Hughes, Sara Price, Aengus Lynch, Rylan Schaeffer, Fazl Barez, Sanmi Koyejo, Henry Sleight, Erik Jones, Ethan Perez, and Mrinank Sharma. 2024. Best-of-n jailbreaking. Preprint, arXiv:2412.03556. — [arXiv:2412.03556](https://arxiv.org/abs/2412.03556) find
  25. Shengpeng Ji, Yifu Chen, Minghui Fang, Jialong Zuo, Jingyu Lu, Hanting Wang, Ziyue Jiang, Long Zhou, Shujie Liu, Xize Cheng, Xiaoda Yang, Zehan Wang, Qian Yang, Jian Li, Yidi Jiang, Jingzhen He, Yunfei Chu, Jin Xu, and Zhou Zhao. 2024. Wavchat: A survey of spoken dialogue models. Preprint, arXiv:241… find
  26. Mintong Kang, Chejian Xu, and Bo Li. 2024. Advwave: Stealthy adversarial jailbreak attack against large audio-language models. Preprint, arXiv:2412.08608. — [arXiv:2412.08608](https://arxiv.org/abs/2412.08608) find
  27. Wonjune Kang, Junteng Jia, Chunyang Wu, Wei Zhou, Egor Lakomkin, Yashesh Gaur, Leda Sari, Suyoun Kim, Ke Li, Jay Mahadeokar, and Ozlem Kalinli. 2025a. Frozen large language models can perceive paralinguistic aspects of speech. Preprint, arXiv:2410.01162. — [arXiv:2410.01162](https://arxiv.org/abs/2410.01162) find
  28. Xuan Li, Zhanke Zhou, Jianing Zhu, Jiangchao Yao, Tongliang Liu, and Bo Han. 2024. Deepinception: Hypnotize large language model to be jailbreaker. Preprint, arXiv:2311.03191.
  29. Guan-Ting Lin, Cheng-Han Chiang, and Hung yi Lee. 2024a. Advancing large language models to capture varied speaking styles and respond properly in spoken conversations. Preprint, arXiv:2402.12786. find
  30. Guan-Ting Lin, Prashanth Gurunath Shivakumar, Ankur Gandhe, Chao-Han Huck Yang, Yile Gu, Shalini Ghosh, Andreas Stolcke, Hung yi Lee, and Ivan Bulyko. 2024b. Paralinguistics-enhanced large language modeling of spoken dialogue. Preprint, arXiv:2312.15316. — [arXiv:2312.15316](https://arxiv.org/abs/2312.15316) find
  31. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2024. Autodan: Generating stealthy jailbreak prompts on aligned large language models. Preprint, arXiv:2310.04451.
  32. Binhao Ma, Hanqing Guo, Zhengping Jay Luo, and Rui Duan. 2025. Audio jailbreak attacks: Exposing vulnerabilities in speechgpt in a white-box framework. Preprint, arXiv:2505.18864. — [arXiv:2505.18864](https://arxiv.org/abs/2505.18864) find
  33. Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. 2024. Tree of attacks: Jailbreaking black-box llms automatically. Preprint, arXiv:2312.02119.
  34. Stanley Milgram. 1963. Behavioral study of obedience. Journal of Abnormal and Social Psychology, 67(4):371–378. find
  35. OpenAI. 2024b. Chatgpt can now see, hear, and speak. https://openai.com/index/chatgpt-can-now-see-hear-and-speak/. ↗
  36. OpenAI. 2024. Gpt-4o: Openai’s new flagship model. https://openai.com/index/hello-gpt-4o/. Accessed: 2025-07-29. ↗
  37. OpenAI. 2025. Gpt-4o mini tts (text-to-speech) model. Online model documentation. https://platform.openai.com/docs/models/gpt-4o-mini-tts. ↗
  38. Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. 2023. Fine-tuning aligned language models compromises safety, even when users do not intend to! Preprint, arXiv:2310.03693.
  39. Jaechul Roh, Virat Shejwalkar, and Amir Houmansadr. 2025. Multilingual and multi-accent jailbreaking of audio llms. Preprint, arXiv:2504.01094. — [arXiv:2504.01094](https://arxiv.org/abs/2504.01094) find
  40. Morteza Rohanian and Michael Krauthammer. 2025. Optimizing speech language models for acoustic consistency. Preprint, arXiv:2509.26276. — [arXiv:2509.26276](https://arxiv.org/abs/2509.26276) find
  41. Vinu Sankar Sadasivan, Shoumik Saha, Gaurang Sriramanan, Priyatham Kattakinda, Atoosa Chegini, and Soheil Feizi. 2024. Fast adversarial attacks on language models in one gpu minute. Preprint, arXiv:2402.15570. find
  42. Francesco Salvi, Manoel Horta Ribeiro, Riccardo Gallotti, and Robert West. 2025. On the conversational persuasiveness of gpt-4. Nature Human Behaviour, 9(8):1645–1653. find
  43. Xinyue Shen, Yixin Wu, Michael Backes, and Yang Zhang. 2024. Voice jailbreak attacks against gpt-4o. Preprint, arXiv:2405.19103. — [arXiv:2405.19103](https://arxiv.org/abs/2405.19103) find
  44. Yasuaki Sumita, Koh Takeuchi, and Hisashi Kashima. 2024. Cognitive biases in large language models: A survey and mitigation experiments. Preprint, arXiv:2412.00323. — [arXiv:2412.00323](https://arxiv.org/abs/2412.00323) find
  45. Xingpeng Sun, Haoming Meng, Souradip Chakraborty, Amrit Singh Bedi, and Aniket Bera. 2024. Beyond text: Utilizing vocal cues to improve decision making in llms for robot navigation tasks. Preprint, arXiv:2402.03494. — [arXiv:2402.03494](https://arxiv.org/abs/2402.03494) find
  46. Sundar Pichai and Demis Hassabis and the Gemini Team. 2024. Introducing Gemini 2.0: our new ai model for the agentic era. https://blog.google/technology/google-deepmind/google-gemini-ai-update-december-2024/. Accessed: 2025-07-29. ↗
  47. Jen tse Huang, Wenxuan Wang, Eric John Li, Man Ho LAM, Shujie Ren, Youliang Yuan, Wenxiang Jiao, Zhaopeng Tu, and Michael Lyu. 2024. On the humanity of conversational AI: Evaluating the psychological portrayal of LLMs. In The Twelfth International Conference on Learning Representations. find
  48. Thomas Vaughan-Johnston, Joshua Guyer, Leandre Fabrigar, and Charlie Shen. 2021. The role of vocal affect in persuasion: The civa model. Journal of Nonverbal Behavior, 45. find
  49. Dingdong Wang, Mingyu Cui, Dongchao Yang, Xueyuan Chen, and Helen Meng. 2024. A comparative study of discrete speech tokens for semantic-related tasks with large language models. Preprint, arXiv:2411.08742. — [arXiv:2411.08742](https://arxiv.org/abs/2411.08742) find
  50. Tinghao Xie, Xiangyu Qi, Yi Zeng, Yangsibo Huang, Udari Madhushani Sehwag, Kaixuan Huang, Luxi He, Boyi Wei, Dacheng Li, Ying Sheng, Ruoxi Jia, Bo Li, Kai Li, Danqi Chen, Peter Henderson, and Prateek Mittal. 2025. Sorry-bench: Systematically evaluating large language model safety refusal. Preprint,…
  51. Zhifei Xie and Changqiao Wu. 2024. Mini-omni: Language models can hear, talk while thinking in streaming. Preprint, arXiv:2408.16725.
  52. Jin Xu, Zhifang Guo, Jinzheng He, Hangrui Hu, Ting He, Shuai Bai, Keqin Chen, Jialin Wang, Yang Fan, Kai Dang, Bin Zhang, Xiong Wang, Yunfei Chu, and Junyang Lin. 2025. Qwen2.5-omni technical report. Preprint, arXiv:2503.20215.
  53. Yaoxun Xu, Shi-Xiong Zhang, Jianwei Yu, Zhiyong Wu, and Dong Yu. 2024a. Comparing discrete and continuous space llms for speech recognition. Preprint, arXiv:2409.00800. — [arXiv:2409.00800](https://arxiv.org/abs/2409.00800) find
  54. Zhao Xu, Fan Liu, and Hao Liu. 2024b. Bag of tricks: Benchmarking of jailbreak attacks on llms. Preprint, arXiv:2406.09324. find
  55. Hao Yang, Lizhen Qu, Ehsan Shareghi, and Gholamreza Haffari. 2024a. Audio is the achilles’ heel: Red teaming audio large multimodal models. Preprint, arXiv:2410.23861. find
  56. Qian Yang, Jin Xu, Wenrui Liu, Yunfei Chu, Ziyue Jiang, Xiaohuan Zhou, Yichong Leng, Yuanjun Lv, Zhou Zhao, Chang Zhou, and Jingren Zhou. 2024b. Air-bench: Benchmarking large audio-language models via generative comprehension. Preprint, arXiv:2402.07729.
  57. Zonghao Ying, Aishan Liu, Xianglong Liu, and Dacheng Tao. 2024. Unveiling the safety of gpt-4o: An empirical study using jailbreak attacks. Preprint, arXiv:2406.06302. — [arXiv:2406.06302](https://arxiv.org/abs/2406.06302) find
  58. Jiahao Yu, Xingwei Lin, Zheng Yu, and Xinyu Xing. 2024. Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts. Preprint, arXiv:2309.10253.
  59. Alex Zant and Jonah Berger. 2019. How the voice persuades. Journal of Personality and Social Psychology, 118:661–682. find
  60. Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. 2024. How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms. Preprint, arXiv:2401.06373.
  61. Guoming Zhang, Xiaohui Ma, Huiting Zhang, Zhijie Xiang, Xiaoyu Ji, Yanni Yang, Xiuzhen Cheng, and Pengfei Hu. 2024. LaserAdv: Laser adversarial attacks on speech recognition systems. In 33rd USENIX Security Symposium (USENIX Security 24), pages 3945–3961, Philadelphia, PA. USENIX Association. find
  62. Peiyan Zhang, Haibo Jin, Liying Kang, and Haohan Wang. 2025. Guardval: Dynamic large language model jailbreak evaluation for comprehensive safety testing. Preprint, arXiv:2507.07735. — [arXiv:2507.07735](https://arxiv.org/abs/2507.07735) find
  63. Wei Zhao, Zhe Li, Yige Li, Ye Zhang, and Jun Sun. 2024. Defending large language models against jailbreak attacks via layer-specific editing. Preprint, arXiv:2405.18166. find
  64. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. Preprint, arXiv:2307.15043.

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/yu-2026-now-you-hear-me-audio/