ARENA: Automated Red-Teaming for Large Audio Language Models
| Source: arXiv AI
Tags: red-teaming, audio language models, AI safety, jailbreaking, Qwen2-Audio, Audio Flamingo, multimodal
ARENA is an automated red-teaming framework for large audio-language models that crafts audio inputs which, combined with safe text queries, induce harmful outputs — achieving attack success rates of 87.9% on Audio Flamingo 3, exposing safety blind spots invisible to text-only testing.
Details
As audio-language models (LALMs) like Qwen2-Audio, Audio Flamingo 3, and MiMo-Audio become more capable, standard text-only red-teaming misses an entire attack surface: the joint audio+text input space. A text query might be perfectly safe in isolation, but when paired with a crafted audio input, the combined input can trigger harmful model behavior. ARENA addresses this with a closed-loop attack framework trained on 2,000 text-audio pairs. It uses MD-Judge for training rewards and adaptive search feedback, while a separate Llama Guard 3 evaluator labels final outcomes independently to avoid circular self-evaluation. On 520 held-out AdvBench objectives, ARENA achieves FDR/PSR (Fooling Detection Rate / Prompt Success Rate) of 87.9/100.0% on Audio Flamingo 3, 71.5/96.3% on Qwen2-Audio, 68.1/100.0% on MiMo-Audio, and 75.4/98.5% on GPTAudio. The high attack success rates across all four tested models indicate that audio-language model safety is substantially undertested in current evaluation pipelines. The framework's closed-loop design with adaptive search is the key technical contribution — it can discover novel attack patterns automatically rather than relying on hand-crafted adversarial audio. For AI safety teams and companies shipping multimodal products with voice input, this is directly actionable: existing text-based safety evaluations are insufficient for audio-capable models.