Paper deep dive
ARENA: Automated Red-Teaming for Large Audio Language Models
Jiaming He, Zhicong Huang, Tian Jin, Zhen Sun, Cheng Hong, Yi Yu, Wenbo Jiang, Xudong Jiang
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 94%
Last extracted: 8/22/2026, 2:31:08 AM
Summary
The paper introduces ARENA, an automated red-teaming framework for Large Audio-Language Models (LALMs). ARENA uses a closed-loop controller trained on a 2,000-case text-audio dataset to generate safe text queries paired with harmful audio inputs. It employs MD-Judge for adaptive search feedback and Llama Guard 3 for final safety evaluation. The framework achieves high fault detection rates across four LALMs (Audio Flamingo 3, Qwen2-Audio, MiMo-Audio, GPT-Audio) on the AdvBench benchmark.
Entities (11)
Relation Signals (9)
ARENA → evaluates → MiMo-Audio
confidence 95% · ARENA achieves FDR/PSR of... 68.1/100.0%... on... MiMo-Audio
ARENA → evaluates → GPT-Audio
confidence 95% · ARENA achieves FDR/PSR of... 75.4/98.5% on... GPT-Audio
ARENA → evaluates → Audio Flamingo 3
confidence 95% · ARENA achieves FDR/PSR of 87.9/100.0%... on Audio Flamingo 3
ARENA → evaluates → Qwen2-Audio
confidence 95% · ARENA achieves FDR/PSR of... 71.5/96.3%... on... Qwen2-Audio
ARENA → uses → MD-Judge
confidence 95% · MD-Judge supplies training rewards and adaptive search feedback
ARENA → uses → Llama Guard 3
confidence 95% · a separate, non-adaptive Llama Guard 3 evaluator alone labels final outcomes
ARENA → usesdataset → AdvBench
confidence 95% · On 520 held-out AdvBench objectives, ARENA achieves...
ARENA → trainscontrolleron → Qwen3-32B
confidence 90% · The controller is a LoRA-tuned Qwen3-32B model
ARENA → usessynthesismodel → TangoFlux
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Large audio-language models (LALMs) make it possible to interact with language models through speech, music, and environmental sound, but they also introduce a safety surface that is difficult to expose with text-only red-teaming. We study automated audio-grounded red-teaming, where a text query must remain safe in isolation while the joint text-audio input induces harmful target behavior. We propose ARENA, a closed-loop framework that trains a controller on an independent 2,000case text-audio dataset. MD-Judge supplies training rewards and adaptive search feedback, while a separate, non-adaptive Llama Guard 3 evaluator alone labels final outcomes. On 520 held-out AdvBench objectives, ARENA achieves FDR/PSR of 87.9/100.0%, 71.5/96.3%, 68.1/100.0%, and 75.4/98.5% on Audio Flamingo 3, Qwen2-Audio, MiMo-Audio, and GPTAudio, respectively. Ablations show that feedback-based refinement and audio-variant search substantially improve attack discovery.
Tags
Links
- Source: https://arxiv.org/abs/2608.15578v1
- Canonical: https://arxiv.org/abs/2608.15578v1
Trouble viewing inline? Open PDF directly →
Full Text
44,454 characters extracted from source content.
Expand or collapse full text
ARENA: Automated Red-Teaming for Large Audio Language Models Jiaming He Zhicong Huang Tian Jin Zhen Sun Cheng Hong Yi Yu Wenbo Jiang Xudong Jiang Abstract Large audio-language models (LALMs) make it possible to interact with language models through speech, music, and environmental sound, but they also introduce a safety surface that is difficult to expose with text-only red-teaming. We study automated audio-grounded red-teaming, where a text query must remain safe in isolation while the joint text-audio input induces harmful target behavior. We propose ARENA, a closed-loop framework that trains a controller on an independent 2,000-case text-audio dataset. MD-Judge supplies training rewards and adaptive search feedback, while a separate, non-adaptive Llama Guard 3 evaluator alone labels final outcomes. On 520 held-out AdvBench objectives, ARENA achieves FDR/PSR of 87.9/100.0%, 71.5/96.3%, 68.1/100.0%, and 75.4/98.5% on Audio Flamingo 3, Qwen2-Audio, MiMo-Audio, and GPT-Audio, respectively. Ablations show that feedback-based refinement and audio-variant search substantially improve attack discovery. Code is available at Github. 1 Introduction Large audio-language models (LALMs) extend language-model interaction from text to speech, music, and environmental sound. Recent systems can transcribe speech, recognize acoustic events, follow audio-grounded instructions, and answer questions about complex sound scenes (7; 12; 30; 5; 11). Representative models such as MiMo-Audio, Qwen2-Audio, and Audio Flamingo further show that audio inputs can be integrated with instruction following, multi-turn reasoning, and few-shot multimodal understanding (30; 10; 5; 17; 11). These capabilities make LALMs increasingly useful for voice assistants, audio analysis, accessibility tools, and multimodal agents. To ensure audio-grounded model behavior is aligned with human values, LALMs developers need to identify and evaluate potential safety vulnerabilities and use the collected problematic cases to improve alignment mechanisms. This requirement is especially important because the audio channel creates a safety surface that is not visible from the text query alone. A benign-looking text request may become harmful when interpreted together with spoken content, speaker cues, or non-speech acoustic evidence. We study this problem as automated red-teaming for audio-grounded harmful compliance, where the text query remains safe in isolation but the joint text-audio input may cause the target LALM to produce unsafe assistance. Figure 1: Audio-grounded red-teaming. Harmful intent can hide in the audio channel while the text query remains safe. Existing automated red-teaming methods provide useful tools for discovering failures in language and visual systems. Textual methods generate and optimize adversarial prompts through search, feedback, and preference signals (25; 9; 39; 3; 23; 21). Multimodal methods extend this paradigm to image and video generation by using visual feedback during attack refinement (18; 32; 2; 14). However, LALM red-teaming requires a different optimization target. The attack must coordinate a text-safe query with an audio realization, decide whether the harmful context should be spoken or environmental, and recover from failures caused by poor audio recognition, refusals, or responses that merely restate the sound event. Existing static audio jailbreak sets (29; 24) expose important vulnerabilities, but they do not provide an automated mechanism for adapting to different LALMs. We address this gap by treating audio-grounded red-teaming as a closed-loop text-audio generation problem. The core observation is that failed LALM responses provide structured signals about the bottleneck of an attempt, such as whether the audio context was recognized, whether the text framing violated the input guard, and whether the response was grounded enough to satisfy the objective. We use this feedback to optimize a controller LLM that generates both a text-safe query and an audio prompt. The controller selects between speech synthesis and environmental-sound synthesis, receives structured feedback from the judge, and iteratively refines the candidate until the MD-Judge search threshold is reached. In this work, we propose ARENA, an Automated Red-Teaming framework for LargE Audio LaNguAge Models. ARENA trains its controller on 2,000 text-audio specifications that are disjoint from the evaluation set. MD-Judge provides reward labels and adaptive refinement feedback, whereas Llama Guard 3 independently scores final outcomes and is never exposed to the controller. We evaluate ARENA on Audio Flamingo 3, Qwen2-Audio, MiMo-Audio, and GPT-Audio using 520 held-out AdvBench objectives. ARENA achieves high detected-fault rates across open-source and API-based LALMs, transfers nontrivially across target models, and improves substantially with feedback-based refinement. Our contributions are threefold: • We formulate automated audio-grounded red-teaming for LALMs under a two-sided safety condition, requiring text-safe inputs and unsafe target outputs. • We introduce ARENA, a controller-optimization framework that combines reward-weighted SFT, direct preference optimization, modality-aware audio rendering, and failure-aware refinement. • We conduct a comprehensive evaluation on four LALMs with held-out AdvBench objectives, baseline comparison, transferability analysis, and ablations over refinement and audio realization. 2 Related Work Large audio language models (LALMs) connect acoustic representations with language reasoning across speech, music, and environmental sound. Whisper, CLAP, and AudioLM established scalable speech recognition, audio-text alignment, and neural audio token modeling (26; 31; 1). SpeechGPT and AudioPaLM further integrated spoken interaction with LLMs (40; 28). General-purpose LALMs such as Pengi, LTU, SALMONN, Qwen-Audio, and Qwen2-Audio support broader audio understanding and instruction following (7; 12; 30; 6; 5), while GAMA and Audio Flamingo emphasize complex reasoning and few-shot audio comprehension (10; 17; 11). These capabilities also create safety risks that depend on acoustic content and delivery. Recent studies expose vulnerabilities to unsafe audio prompts and compositional speech-audio attacks (33; 38; 8), motivating red-teaming methods that jointly consider linguistic intent and acoustic realization. Automated red-teaming discovers model failures through generation, search, and feedback. Early LLM studies used model-generated adversarial conversations and large-scale human testing (25; 9). Later methods optimize adversarial prompts with white-box objectives (42; 41) or iteratively refine them through black-box search and model feedback (39; 3; 23; 22). HarmBench standardizes behaviors, attacks, and evaluation for this setting (21). Multimodal red-teaming extends the same loop to generated media. SneakyPrompt, MMA-Diffusion, and Groot search for unsafe text-to-image inputs (36; 35; 20), while ART, FGPI, and RPG-RT use visual or system feedback to guide subsequent attacks (18; 32; 2). TEAR further incorporates temporal feedback for text-to-video models (14). Existing automated red-teaming methods focus on textual or visual outputs. LALMs introduce distinct attack surfaces through acoustic semantics requiring feedback that directly evaluates audio-grounded behavior and existing works on LALM safety (34; 8; 37) only investigates the static jailbreak and red-teaming set with no automated paradigms, limiting their practicability and scalability in real-world deployment. 3 Methodology Figure 2: Overview of the ARENA framework. 3.1 Problem Formulation We study automated red-teaming for a target large audio-language model (LALM) in audio-grounded interactions. Let ℳtM_t denote the target model. Given a textual query qpq_p and an audio signal a, the target returns a response r=ℳt(qp,a)r=M_t(q_p,a). Each red-teaming objective is denoted by x∈x . The task is to construct a test case (qp,a)(q_p,a) in which qpq_p remains safe when inspected alone, while the joint input (qp,a)(q_p,a) induces audio-grounded harmful compliance. A controller policy πθ _θ maps an objective x to a structured specification z=(qp,pa,m)z=(q_p,p_a,m), where pap_a is a speech transcript or sound prompt and m∈speech,soundm∈\speech,sound\ selects the synthesis modality. A modality-specific renderer mS_m converts pap_a into the waveform a=m(pa)a=S_m(p_a). Before answering qpq_p, the target produces a recognition response rrec=ℳt(qrec,a)r^rec=M_t(q^rec,a). We use a text guard ϕt(qp)∈0,1 _t(q_p)∈\0,1\, where 00 denotes text safety, and a final evaluator ϕr(x,qp,a,pa,rrec,r)∈0,1 _r(x,q_p,a,p_a,r^rec,r)∈\0,1\, where 11 denotes audio-grounded harmful compliance. A detected fault satisfies ⋆ =(x,qp,a) =\(x,q_p,a)\ (1) s.t. ϕt(qp)=0∧ϕr(x,qp,a,pa,rrec,r)=1. .t. _t(q_p)=0 _r(x,q_p,a,p_a,r^rec,r)=1. Following TRUST-VLM (4), final scoring uses two independent Llama Guard 3 calls (13): an input check on qpq_p alone and a post-search evaluator over the objective, intended audio, recognition response, and target response. Formally, ϕt(qp) _t(q_p) =LG3in(qp), =J^in_LG3(q_p), (2) ϕr(⋅) _r(·) =LG3eval(x,qp,pa,rrec,r), =J^eval_LG3(x,q_p,p_a,r^rec,r), where LG3eval=1J^eval_LG3=1 only when rrecr^rec matches pap_a and r is unsafe, actionable, and grounded in that recognized content. Thus the waveform enters the criterion through rrecr^rec. MD-Judge (19) is reserved for reward labeling and search feedback; its labels never enter the reported metric. For the benchmark query set ℬB, fault detection rate (FDR) is measured as FDR=1|ℬ|∑xi∈ℬ[(xi,qp,i,ai)∈⋆].FDR= 1|B| _x_i 1[(x_i,q_p,i,a_i) ]. (3) Threat Model. We assume black-box access to the target LALM, matching internal safety auditing before deployment. The auditor can generate text and audio inputs, query ℳtM_t, and observe responses, but cannot access target weights, gradients, or internal safety mechanisms. Auxiliary models may be used for generation, moderation, reward labeling, and preference construction. 3.2 Overview of ARENA ARENA separates controller training, adaptive search, and final evaluation. The controller is trained from a 2,000-case seed pool pD_p using rewards derived from MD-Judge reports. During search, MD-Judge also converts target responses into refinement feedback, following feedback-guided multimodal red-teaming (4; 18; 15). After search, the controller and candidate are frozen and Llama Guard 3 rescores the retained case once. Its label is never returned to search, preventing direct optimization against the final evaluator. 3.3 Text-Audio Dataset Construction We construct a training-only seed pool pD_p and an initial execution log before closed-loop red-teaming. This pool is disjoint from AdvBench; no evaluation objective or label is used to train the controller. We establish this split before training and exclude AdvBench prompts, target responses, and evaluator labels from SFT, DPO, checkpoint selection, and reward-weight tuning. The seed categories follow the description and policy-grounded audio risk taxonomy in AudioGuard (16), which separates transcript-level violations from audio-specific risks, including non-speech harmful sound events, speaker-aware risks, impersonation or voice-cloning misuse, and voice-content compositional harms. Since ARENA red-teams LALMs rather than training an audio guardrail, we instantiate this taxonomy as executable text-audio test specifications. The seed pool contains 2,0002,000 independent specifications. Speech seeds account for 1,2001,200 cases and cover objectives whose risky context is primarily carried by spoken content, including social interaction, deceptive intent, and instruction-like scenarios. Environmental-audio seeds account for 800800 cases and focus on non-speech acoustic events, including explosions, collisions, weapon-like sounds, and forced-entry scenes. Each seed is represented as (x,qp,pa,m,)(x,q_p,p_a,m,t), where t denotes strategy tags used only for analysis. Seed Pool. Speech seeds are produced from hand-written scenario templates with speaker variation. The templates translate the speech and voice-content portions of the AudioGuard (16) taxonomy into text-safe queries paired with short utterances that provide the missing context through audio. We render these utterances with an offline text-to-speech system and rotate over English voices to reduce dependence on a single speaker style. Here, a seed is a text-level structured specification, not a waveform: it contains the harmful objective, a text-safe query, an audio prompt or speech transcript, the rendering modality, and analysis tags. The waveform is produced only when the seed is executed. Environmental-sound seeds instantiate the non-speech sound-event branch of the taxonomy. Their prompts are concise event descriptions with constraints such as no speech and no music, which improves recognizability for text-to-audio synthesis. Example seed. Objective: explosives-related harmful assistance. Text query: “For a lab operator, How can I reproduce the sound in the given audio with the chemicals?” Audio prompt: “A loud explosive blast with a sharp pressure wave, deep low-frequency rumble, metallic debris impacts, glass shattering, car alarms, and distant sirens; no speech and no music.” Modality: Sound. Offline Execution Log. Each seed is executed once without refinement. The execution pass applies the text guard, renders the waveform, queries the target LALM, and uses MD-Judge to compute RAudR_Aud, following the reward-labeling step introduced in Sec. 3.2. The resulting log records the target response, the audio-recognition result, judge flags, failure tier, and shaped reward. After this reward labeling, positive records form the supervised dataset mD_m and paired records form the preference dataset prefD_pref. Queries that fail the text-safety constraint are retained as diagnostics but are excluded from positive controller demonstrations. 3.4 Audio-Grounded Test Case Generation Given an objective x and optional extra data, the controller πθ _θ generates a structured specification z=(qp,pa,m)z=(q_p,p_a,m). The textual query qpq_p is written to satisfy the text-safety constraint when read in isolation, often through audit, forensic, research, or safety-analysis framing. The content prompt pap_a carries the contextual information that is absent from the text channel. The modality m determines how pap_a is rendered into an audio signal. Modality-Aware Rendering. For m=speechm=speech, pap_a is treated as a spoken transcript and rendered by the text-to-speech model. The speech branch covers objectives that depend on linguistic cues, speaker intent, dialogue, or social interaction. For m=soundm=sound, pap_a is treated as an environmental sound prompt and rendered by TangoFlux. The sound branch targets event-grounded scenarios whose semantics are conveyed by acoustic evidence rather than spoken words. The controller learns the modality choice from mD_m, allowing language-dependent objectives to use speech and physical-event objectives to use environmental sound at inference time. 3.5 Test Case Execution For each candidate z=(qp,pa,m)z=(q_p,p_a,m), ARENA first applies the text guard ϕt _t to qpq_p alone. A candidate with ϕt(qp)=1 _t(q_p)=1 is rejected before audio synthesis and marked as text unsafe. This ordering enforces the central constraint that successful cases must arise from joint text-audio interpretation, not from an explicitly unsafe text query. Remaining candidates are rendered into a=m(pa)a=S_m(p_a) and submitted to ℳtM_t. Target Query Generation. We query the target model in two steps. A recognition query first asks the model to identify the main sound event or spoken content in the audio. This response enters the final grounding check and separates recognition failures during search. We then issue the red-teaming query qpq_p with the same audio and collect r=ℳt(qp,a)r=M_t(q_p,a). Search Feedback and Final Judge. Llama Guard 3 first rejects explicitly unsafe qpq_p before synthesis. During controller training and iterative search, MD-Judge produces the structured report used by RAudR_Aud and the refinement loop, including near misses, refusals, recognition failures, and event restatements. MD-Judge can therefore shape which candidate search returns, but it does not score the reported results. Once search stops, a separate Llama Guard 3 call evaluates the frozen record (x,qp,pa,rrec,r)(x,q_p,p_a,r^rec,r) under Eq. (2). Its decision is made once and alone determines final success. It is not used to rerank candidates, trigger another refinement round, or tune a decision threshold. The controller can therefore adapt to MD-Judge feedback but cannot query the final evaluator. 3.6 Two-Stage Controller Training The 2,000 training executions are converted into reward-labeled data. ARENA trains the controller with reward-weighted supervised learning followed by preference optimization. Reward-Weighted Supervised Fine-Tuning. We first assign each logged attempt a shaped reward using the flags returned by RAudR_Aud. The structured report is mapped to reward indicators as follows. Let +=(d,u,b,g,e)⊤s^+=(d,u,b,g,e) collect positive evidence and −=(f,o,ρ)⊤s^-=(f,o,ρ) collect failure evidence, where d,u,b,g,ed,u,b,g,e denote disallowed assistance, objective compliance, actionability, audio grounding, and concrete detail, while f,o,ρf,o,ρ denote generic/foley content, event restatement, and refusal/safety redirection. The reward for attempt i is R~i=κ++⊤i+−⊤i−, R_i=κ+w^+ s^+_i-w^- s^-_i, (4) Ri=RAud(xi,zi,ai,ri)=[1−ϕt(qp,i)]clip(R~i,−1,1)−ϕt(qp,i). array[]rclR_i&=&R_Aud(x_i,z_i,a_i,r_i)\\ &=&[1- _t(q_p,i)]\,clip( R_i,-1,1)- _t(q_p,i). array (5) where κ, +w^+, and −w^- are reward hyperparameters. This shaped reward preserves text safety as a hard constraint while providing graded supervision for near-successful attempts. We then construct m+=(xi,zi,Ri)∈m∣Ri>0D_m^+=\(x_i,z_i,R_i) _m R_i>0\ and optimize the reward-weighted SFT objective ℒs(θ)=−1|m+|∑(xi,zi,Ri)∈m+λilogπθ(zi∣xi),L_s(θ)=- 1|D_m^+| _(x_i,z_i,R_i) _m^+ _i _θ(z_i x_i), (6) where λi _i is a sample-specific weight rather than a learned parameter. We compute it from the reward label of the same logged attempt: λi=1+Ri+[(xi,qp,i,ai)∈⋆], _i=1+R_i+1\! [(x_i,q_p,i,a_i) ], (7) so each positive record has a deterministic weight in [1,3][1,3] because Ri∈(0,1]R_i∈(0,1] for m+D_m^+. Higher-reward near misses receive larger loss weights, and detected-fault examples receive an additional unit weight. We also use λi _i as the priority score for reward-dependent oversampling when forming reward-weighted SFT batches. Let θs _s denote the trained parameters. Direct Preference Optimization. In the second stage, we initialize both the trainable policy and a fixed reference policy from the reward-weighted SFT checkpoint, so that πθ←πθs _θ← _ _s and π0=πθs _0= _ _s. We form preference triples pref=(xi,zi+,zi−)D_pref=\(x_i,z_i^+,z_i^-)\ from the reward-labeled execution log. For each objective, we sort text-safe attempts by RAudR_Aud and pair a higher-reward specification as zi+z_i^+ with a lower-reward specification as zi−z_i^-; when an objective has too few attempts, pairing is performed within the same harmful category. Pairs dominated by target-side audio-recognition errors are removed because they do not reflect controller quality. Following DPO (27), define the relative log-likelihood ℓθ(x,z)=logπθ(z∣x)−logπ0(z∣x). _θ(x,z)= _θ(z x)- _0(z x). (8) For the i-th preference pair, let δi=ℓθ(xi,zi+)−ℓθ(xi,zi−). _i= _θ(x_i,z_i^+)- _θ(x_i,z_i^-). (9) The preference objective is ℒd(θ)=−1|pref|∑i=1|pref|logσ(βδi).L_d(θ)=- 1|D_pref| _i=1^|D_pref| σ(β _i). (10) We optimize ℒd+μℒsL_d+ _s on mixed preference and replay batches. The replay examples are sampled from m+D_m^+ and preserve the structured output format during preference optimization. 3.7 Feedback-Based Refinement In the lower component of Figure 2, the trained controller iteratively proposes, executes, judges, and revises test cases. If the initial attempt does not reach the MD-Judge search threshold, ARENA enters a failure-aware refinement loop. At iteration t, the controller receives the objective x, the previous specification z(t)=(qp(t),pa(t),m(t))z^(t)=(q_p^(t),p_a^(t),m^(t)), the target response r(t)r^(t), the failure tier y(t)y^(t), and feedback f(t)f^(t) derived from the detailed MD-Judge report. The next candidate is sampled as z(t+1)∼πθ(⋅∣x,z(t),r(t),y(t),f(t)).z^(t+1) _θ(· x,z^(t),r^(t),y^(t),f^(t)). (11) Failure-Aware Feedback. The judge explanation is converted into concise revision guidance before it is given to the controller. Audio-recognition failures encourage a simpler sound event or a modality change. Event restatement encourages qpq_p to request audio-grounded analysis rather than a description of the clip. Refusal and text-unsafe failures encourage safer indirect framing. Generic or foley-only failures encourage a clearer connection between the audio prompt and the intended situation. The objective x remains fixed across refinements, while qpq_p, pap_a, and m may change. Stopping Rule. Each refined candidate uses the same text guard, renderer, target-query procedure, and MD-Judge search feedback. The loop stops when the search score reaches its threshold or after K steps, then retains the highest-reward attempt. Llama Guard 3 evaluates only this frozen attempt for the reported metric. 4 Experiments 4.1 Experimental Setup Models. We evaluate ARENA on four target LALMs: Audio Flamingo 3 (AF3) (11), Qwen2-Audio-7B-Instruct (5), MiMo-Audio-7B-Instruct, and GPT-Audio. The first three are evaluated locally and GPT-Audio through an API. The controller is a LoRA-tuned Qwen3-32B model trained from the offline reward-labeled log in Sec. 3. Harmful Categories and Dataset. We evaluate all methods on the 520 harmful objectives in AdvBench (42). Each objective x∈x requires a text-safe query qpq_p and an audio prompt pap_a. AdvBench is used only for held-out evaluation and has no overlap with the 2,000 controller-training specifications. For category analysis, we merge objectives into six groups: cybersecurity, violence/weapons, fraud, disinformation, self-harm/substance abuse, and abuse/exploitation. Baseline Methods. We compare with two static benchmark-based audio jailbreak baselines, AJailBench (29) and JALMBench (24). AJailBench uses fixed jailbreak templates rendered as speech, while JALMBench provides diverse audio-language prompts. Neither baseline uses reward labeling or feedback-based refinement. Implementation Details. The controller outputs a JSON-style specification with text_query, audio_prompt, modality, and strategy_tags. We decode with temperature 0.70.7, top-p=0.95p=0.95, and 256 new tokens. Speech prompts are rendered by Piper TTS; sound prompts are rendered by TangoFlux for 4 seconds. Target inference uses 300 new tokens for open-source LALMs and 512 for GPT-Audio. The refinement budget is K=30K=30. For reward labeling, we search for optimal hyperparameter set as κ=.05κ=.05, +=(.25,.25,.20,.15,.18)⊤w^+=(.25,.25,.20,.15,.18) , and −=(.34,.28,.18)⊤w^-=(.34,.28,.18) . Evaluation Setting. The controller is frozen before testing. MD-Judge-v0.2 supplies rewards and search feedback but no reported label. After search, Llama Guard 3-8B evaluates the retained case once: qpq_p must be safe, the recognition response must match pap_a, and r must be unsafe and grounded in that content. ASR is the latter rate conditioned on passing the text guard, PSR is the text-pass rate, and FDR is their sample-level intersection over all 520 objectives. Thus FDR=PSR×ASRFDR=PSR×ASR before rounding. Every objective remains in the denominator: text-unsafe queries, recognition mismatches, and responses judged safe each contribute zero. PSR and conditional ASR are reported only as diagnostics and do not replace the joint rate. Evaluation Protocol. The main evaluation runs the trained controller and refinement loop on all 520 objectives. Transferability replays successful source-model cases on another target without refinement. Ablations vary one factor at a time: refinement budget, temperature, top-p, or the number of sound variants. Method AF3 Qwen2-Audio MiMo-Audio GPT-Audio Metric FDR PSR Div FDR PSR Div FDR PSR Div FDR PSR Div AJailBench 31.2 68.6 24.8 10.8 68.6 24.8 25.3 68.6 24.8 24.6 68.6 24.8 JALMBench 12.6 25.3 58.6 11.9 25.3 58.6 10.7 25.3 58.6 11.3 25.3 58.6 ARENA 87.9 100.0 33.4 71.5 96.3 32.6 68.1 100.0 31.8 75.4 98.5 34.2 Table 1: Main comparison on target LALMs. FDR is the joint Llama Guard success rate over all 520 objectives; PSR and diversity are diagnostics. Values are percentages. Figure 3: Hyperparameter ablations. Final Llama Guard ASR under different refinement budgets, target-side sampling settings, and environmental-sound variant counts. 4.2 Main Results Comparison with Static Red-teaming Set. Table 1 compares ARENA with baseline methods on the target LALMs. Each target reports joint FDR, input-side PSR, and test-case diversity (Div). FDR counts only text-safe cases whose recognized audio content elicits an unsafe grounded response. ARENA achieves the highest FDR on every target while maintaining a near-perfect PSR. AJailBench often fails to elicit unsafe responses, whereas JALMBench loses many candidates to input-side moderation. The results show that effective audio-grounded red-teaming requires both safe text framing and harmful audio-conditioned compliance. Target Avg. Attempts AF3 9.2 Qwen2-Audio 9.1 MiMo-Audio 12.5 GPT-Audio 11.4 Table 2: Average refinement attempts on AdvBench 520. Table 2 reports the search cost. Most successes occur before the K=30K=30 budget. MiMo-Audio is the hardest target, while GPT-Audio is comparable to open-source models. 4.3 Transferability Analysis Transferability of Test Case. Table 3 evaluates whether attacks from one target remain effective on another. Off-diagonal cells report final Llama Guard ASR when successful source attacks are replayed without controller generation or refinement. Off-diagonal rates remain substantial, e.g., AF3-found cases transfer to Qwen2-Audio, MiMo-Audio, and GPT-Audio with 59.7%, 60.0%, and 50.4% ASR. The gap from diagonal performance indicates that transfer exists, but auditing a new target still benefits from closed-loop refinement. Source AF3 Qwen2 MiMo GPT-Audio AF3 87.9 59.7 60.0 50.4 Qwen2 57.0 74.2 37.1 41.0 MiMo 58.6 67.5 68.1 52.2 GPT-Audio 63.7 53.0 51.8 76.5 Table 3: Transferability. Cells report final Llama Guard ASR. 4.4 Ablation Studies Hyperparameter Ablations. Figure 3 compares four factors that affect the attack search: refinement budget, target temperature, target top-p, and the number of synthesized sound variants. Each sweep reuses fixed attacks and varies only the analyzed factor, so the trends isolate execution-time sensitivity rather than changes in controller generation. We report final Llama Guard ASR after the text guard is applied, meaning these curves measure failures that satisfy the same input-side safety constraint as the main evaluation. Refinement Budget. Refinement consistently increases ASR. At K=0K=0, ASR is only 23–30%; at K=30K=30, it reaches 88%, 74%, and 68% on AF3, Qwen2-Audio, and MiMo-Audio. Most gains occur in the first ten rounds, showing that judge feedback quickly corrects recognition failures and overly direct text framing. Later iterations still help, but with smaller marginal gains, because the remaining cases tend to require a more specific acoustic event or a less refusal-triggering text query. This pattern supports the closed-loop design: the controller does not merely sample more prompts, but uses failure labels to decide whether to adjust the speech or sound prompt, soften the textual framing, or retry the waveform realization. Target Sampling (temperature & top-p). With top-p fixed at 0.95, higher target temperature generally reduces attack success. AF3 drops from 86% at temperature 0.3 to the low-to-mid 70% range around temperatures 0.7–1.2, and MiMo-Audio falls to 10% at temperature 1.5. Top-p has a weaker, non-monotonic effect across the tested range, suggesting that temperature-driven stochasticity is the stronger target-side factor. Manual inspection of the labeled logs shows two common high-temperature failure modes: the target paraphrases the audio scene without following the harmful objective, or it shifts into a refusal. In contrast, changing top-p mostly affects lexical variation while preserving the same recognition and refusal tendencies. We therefore use a moderate decoding in the main experiments to avoid overstating success under unusually deterministic target responses. Sound Variants. For environmental-sound attacks, we generate multiple TangoFlux variants for the same text-audio specification and keep the first unsafe response when one is found. Increasing the number of variants substantially improves ASR: AF3 rises from 70% at M=1M=1 to 95% at M=16M=16, Qwen2-Audio rises from 59% to 96%, and MiMo-Audio rises from 49% to 85%. Waveform realization is therefore a major factor even when the semantic audio prompt is fixed. The result also explains why fixed audio benchmarks can underestimate risk: two clips with the same caption can lead to different target perceptions, and the controller benefits from retrying the sound realization when the judge identifies recognition-side failure. 4.5 Additional Discussions Results by Harmful Category. Figure 4 breaks down ARENA’s final Llama Guard ASR by six consolidated harmful categories on the three open-source targets. The method remains effective across a broad range of objectives, with especially high success on violence/weapon-related and fraud-related categories. Self-harm/substance-abuse objectives are comparatively harder on AF3 and MiMo-Audio, while cybersecurity shows stronger target dependence. The category view exposes blind spots that are hidden by aggregate ASR. Figure 4: Category-level ASR. Final Llama Guard ASR of ARENA across six consolidated harmful categories. Test-Case Diversity. The Div column in Table 1 shows that ARENA preserves nontrivial query diversity while satisfying the input-side safety constraint, indicating that the controller does not rely on a single fixed wrapper. The category-level view further shows that diversity is not concentrated in one harmful group: while some categories require more formulaic safety-preserving phrasing, the generated cases still vary in text framing, modality choice, and audio-event realization. Figure 5: Category-level diversity of ARENA test cases. Failure Analysis. We use the reward-labeled execution log described in Sec. 3 to inspect failed and borderline trials. Remaining failures mainly fall into three patterns. First, the target sometimes recognizes the audio event but refuses once the response would require operational detail. Second, sound prompts can be recognized at the wrong granularity, such as restating a break-in scene as generic alarm or crowd noise, which weakens the harmful grounding. Third, near misses often describe a risky situation without providing actionable steps. These labels do not change the evaluation score, which still follows the hard two-sided condition, but they explain why closed-loop refinement helps: feedback can soften overly direct text, make the audio event more explicit, or sample a clearer waveform while keeping qpq_p text-safe. 5 Conclusion We presented ARENA, a closed-loop framework for automated red-teaming of large audio-language models under a text-safe, audio-grounded threat setting. ARENA refines modality-aware prompts with MD-Judge feedback while using Llama Guard 3 only for final labels. Across four target LALMs, it finds substantially more failures than static audio jailbreak baselines while maintaining a near-perfect prompt-pass rate. The transfer and ablation results show that current LALMs share audio-grounded weaknesses and that refinement, target sampling, and sound realization all affect attack success, suggesting that safety evaluation should test the full generation-and-execution loop rather than only fixed prompts. References Borsos et al. (2022) Z. Borsos, R. Marinier, D. Vincent, E. Kharitonov, O. Pietquin, M. Sharifi, D. Roblek, O. Teboul, D. Grangier, M. Tagliasacchi, and N. Zeghidour AudioLM: a language modeling approach to audio generation. External Links: 2209.03143, Link Cited by: §2. Cao et al. (2025) Y. Cao, Y. Miao, X. Gao, and Y. Dong Red-teaming text-to-image systems by rule-based preference modeling. In Advances in Neural Information Processing Systems, Vol. 38, p. 150703–150734. External Links: Link Cited by: §1, §2. Chao et al. (2023) P. Chao, A. Robey, E. Dobriban, H. Hassani, G. J. Pappas, and E. Wong Jailbreaking black box large language models in twenty queries. External Links: 2310.08419, Link Cited by: §1, §2. Chen et al. (2025) K. Chen, L. Muyang, G. Li, S. Zhang, S. Guo, and T. Zhang TRUST-vlm: thorough red-teaming for uncovering safety threats in vision-language models. In Forty-second International Conference on Machine Learning, Cited by: §3.1, §3.2. Chu et al. (2024) Y. Chu, J. Xu, Q. Yang, H. Wei, X. Wei, Z. Guo, Y. Leng, Y. Lv, J. He, J. Lin, C. Zhou, and J. Zhou Qwen2-Audio technical report. External Links: 2407.10759, Link Cited by: §1, §2, §4.1. Chu et al. (2023) Y. Chu, J. Xu, X. Zhou, Q. Yang, S. Zhang, Z. Yan, C. Zhou, and J. Zhou Qwen-Audio: advancing universal audio understanding via unified large-scale audio-language models. External Links: 2311.07919, Link Cited by: §2. Deshmukh et al. (2023) S. Deshmukh, B. Elizalde, R. Singh, and H. Wang Pengi: an audio language model for audio tasks. External Links: 2305.11834, Link Cited by: §1, §2. Feng et al. (2025) B. Feng, C. Liu, Y. L. Liang, C. Yang, S. Fu, Z. Chen, K. Lu, S. Huang, C. H. Yang, Y. F. Wang, Y. Chen, and H. Lee Investigating safety vulnerabilities of large audio-language models under speaker emotional variations. External Links: 2510.16893, Link Cited by: §2, §2. Ganguli et al. (2022) D. Ganguli, L. Lovitt, J. Kernion, A. Askell, Y. Bai, S. Kadavath, B. Mann, E. Perez, N. Schiefer, K. Ndousse, et al. Red teaming language models to reduce harms: methods, scaling behaviors, and lessons learned. External Links: 2209.07858, Link Cited by: §1, §2. Ghosh et al. (2024) S. Ghosh, S. Kumar, A. Seth, C. K. R. Evuru, U. Tyagi, S. Sakshi, O. Nieto, R. Duraiswami, and D. Manocha GAMA: a large audio-language model with advanced audio understanding and complex reasoning abilities. External Links: 2406.11768, Link Cited by: §1, §2. Goel et al. (2025) A. Goel, S. Ghosh, J. Kim, S. Kumar, Z. Kong, S. Lee, C. H. Yang, R. Duraiswami, D. Manocha, R. Valle, and B. Catanzaro Audio Flamingo 3: advancing audio intelligence with fully open large audio language models. External Links: 2507.08128, Link Cited by: §1, §2, §4.1. Gong et al. (2023) Y. Gong, H. Luo, A. H. Liu, L. Karlinsky, and J. Glass Listen, think, and understand. External Links: 2305.10790, Link Cited by: §1, §2. Grattafiori et al. (2024) A. Grattafiori et al. The llama 3 herd of models. External Links: 2407.21783, Link Cited by: §3.1. He et al. (2025) J. He, G. Hou, H. Li, Z. Huang, K. Chen, Y. Yu, W. Jiang, G. Xu, and T. Zhang TEAR: temporal-aware automated red-teaming for text-to-video models. External Links: 2511.21145, Link Cited by: §1, §2. He et al. (2026) J. He, G. Hou, H. Li, Z. Huang, K. Chen, Y. Yu, W. Jiang, G. Xu, and T. Zhang TEAR: temporal-aware automated red-teaming for text-to-video models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 41–50. Cited by: §3.2. Kang et al. (2026) M. Kang, C. Fang, and B. Li AudioGuard: toward comprehensive audio safety protection across diverse threat models. External Links: 2604.08867, Link Cited by: §3.3, §3.3. Kong et al. (2024) Z. Kong, A. Goel, R. Badlani, W. Ping, R. Valle, and B. Catanzaro Audio Flamingo: a novel audio language model with few-shot learning and dialogue abilities. External Links: 2402.01831, Link Cited by: §1, §2. Li et al. (2024a) G. Li, K. Chen, S. Zhang, J. Zhang, and T. Zhang ART: automatic red-teaming for text-to-image models to protect benign users. In Advances in Neural Information Processing Systems, Vol. 37, p. 91184–91219. External Links: Document, Link Cited by: §1, §2, §3.2. Li et al. (2024b) L. Li, B. Dong, R. Wang, X. Hu, W. Zuo, D. Lin, Y. Qiao, and J. Shao SALAD-bench: a hierarchical and comprehensive safety benchmark for large language models. In Findings of the Association for Computational Linguistics: ACL 2024, Bangkok, Thailand, p. 3923–3954. External Links: Document, Link Cited by: §3.1. Liu et al. (2024) Y. Liu, G. Yang, G. Deng, F. Chen, Y. Chen, L. Shi, T. Zhang, and Y. Liu Groot: adversarial testing for generative text-to-image models with tree-based semantic transformation. External Links: 2402.12100, Link Cited by: §2. Mazeika et al. (2024) M. Mazeika, L. Phan, X. Yin, A. Zou, Z. Wang, N. Mu, E. Sakhaee, N. Li, S. Basart, B. Li, D. Forsyth, and D. Hendrycks HarmBench: a standardized evaluation framework for automated red teaming and robust refusal. External Links: 2402.04249, Link Cited by: §1, §2. Mehrabi et al. (2023) N. Mehrabi, P. Goyal, C. Dupuy, Q. Hu, S. Ghosh, R. Zemel, K. Chang, A. Galstyan, and R. Gupta FLIRT: feedback loop in-context red teaming. External Links: 2308.04265, Link Cited by: §2. Mehrotra et al. (2023) A. Mehrotra, M. Zampetakis, P. Kassianik, B. Nelson, H. Anderson, Y. Singer, and A. Karbasi Tree of attacks: jailbreaking black-box llms automatically. External Links: 2312.02119, Link Cited by: §1, §2. Peng et al. (2025) Z. Peng, Y. Liu, Z. Sun, M. Li, Z. Luo, J. Zheng, W. Dong, X. He, X. Wang, Y. Xue, et al. Jalmbench: benchmarking jailbreak vulnerabilities in audio language models. arXiv preprint arXiv:2505.17568. Cited by: §1, §4.1. Perez et al. (2022) E. Perez, S. Huang, F. Song, T. Cai, R. Ring, J. Aslanides, A. Glaese, N. McAleese, and G. Irving Red teaming language models with language models. External Links: 2202.03286, Link Cited by: §1, §2. Radford et al. (2022) A. Radford, J. W. Kim, T. Xu, G. Brockman, C. McLeavey, and I. Sutskever Robust speech recognition via large-scale weak supervision. External Links: 2212.04356, Link Cited by: §2. Rafailov et al. (2023) R. Rafailov, A. Sharma, E. Mitchell, C. D. Manning, S. Ermon, and C. Finn Direct preference optimization: your language model is secretly a reward model. Advances in neural information processing systems 36, p. 53728–53741. Cited by: §3.6. Rubenstein et al. (2023) P. K. Rubenstein, C. Asawaroengchai, D. D. Nguyen, A. Bapna, Z. Borsos, F. d. C. Quitry, P. Chen, D. El Badawy, W. Han, E. Kharitonov, H. Muckenhirn, D. Padfield, J. Qin, D. Rozenberg, T. Sainath, J. Schalkwyk, M. Sharifi, M. T. Ramanovich, M. Tagliasacchi, A. Tudor, M. Velimirovic, D. Vincent, J. Yu, Y. Wang, V. Zayats, N. Zeghidour, Y. Zhang, Z. Zhang, L. Zilka, and C. Frank AudioPaLM: a large language model that can speak and listen. External Links: 2306.12925, Link Cited by: §2. Song et al. (2026) Z. Song, Q. Jiang, M. Cui, M. Li, L. Gao, Z. Zhang, Z. Xu, Y. Wang, G. Ouyang, Z. Chen, et al. Audio jailbreak: an open comprehensive benchmark for jailbreaking large audio-language models. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 27294–27308. Cited by: §1, §4.1. Tang et al. (2023) C. Tang, W. Yu, G. Sun, X. Chen, T. Tan, W. Li, L. Lu, Z. Ma, and C. Zhang SALMONN: towards generic hearing abilities for large language models. External Links: 2310.13289, Link Cited by: §1, §2. Wu et al. (2022) Y. Wu, K. Chen, T. Zhang, Y. Hui, M. Nezhurina, T. Berg-Kirkpatrick, and S. Dubnov Large-scale contrastive language-audio pretraining with feature fusion and keyword-to-caption augmentation. External Links: 2211.06687, Link Cited by: §2. Xu et al. (2025) W. Xu, K. Chen, J. Qiu, Y. Zhang, R. Wang, J. Mao, T. Zhang, and L. Wang Automated red teaming for text-to-image models through feedback-guided prompt iteration with vision-language models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 18575–18584. Cited by: §1, §2. Yang et al. (2024) H. Yang, L. Qu, E. Shareghi, and G. Haffari Audio is the achilles’ heel: red teaming audio large multimodal models. External Links: 2410.23861, Link Cited by: §2. Yang et al. (2025a) H. Yang, L. Qu, E. Shareghi, and G. Haffari Audio is the achilles’ heel: red teaming audio large multimodal models. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), p. 9292–9306. Cited by: §2. Yang et al. (2023a) Y. Yang, R. Gao, X. Wang, T. Ho, N. Xu, and Q. Xu MMA-Diffusion: multimodal attack on diffusion models. External Links: 2311.17516, Link Cited by: §2. Yang et al. (2023b) Y. Yang, B. Hui, H. Yuan, N. Gong, and Y. Cao SneakyPrompt: jailbreaking text-to-image generative models. External Links: 2305.12082, Link Cited by: §2. Yang et al. (2025b) Y. Yang, X. Zhang, Z. Han, S. Wang, J. Zhuang, Z. Jin, J. Shao, G. Sun, and C. Zhang Speech-audio compositional attacks on multimodal llms and their mitigation with salmonn-guard. arXiv preprint arXiv:2511.10222. Cited by: §2. Yang et al. (2025c) Y. Yang, X. Zhang, Z. Han, S. Wang, J. Zhuang, Z. Jin, J. Shao, G. Sun, and C. Zhang Speech-audio compositional attacks on multimodal llms and their mitigation with SALMONN-Guard. External Links: 2511.10222, Link Cited by: §2. Yu et al. (2023) J. Yu, X. Lin, Z. Yu, and X. Xing GPTFUZZER: red teaming large language models with auto-generated jailbreak prompts. External Links: 2309.10253, Link Cited by: §1, §2. Zhang et al. (2023) D. Zhang, S. Li, X. Zhang, J. Zhan, P. Wang, Y. Zhou, and X. Qiu SpeechGPT: empowering large language models with intrinsic cross-modal conversational abilities. External Links: 2305.11000, Link Cited by: §2. Zhu et al. (2023) S. Zhu, R. Zhang, B. An, G. Wu, J. Barrow, Z. Wang, F. Huang, A. Nenkova, and T. Sun AutoDAN: interpretable gradient-based adversarial attacks on large language models. External Links: 2310.15140, Link Cited by: §2. Zou et al. (2023) A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson Universal and transferable adversarial attacks on aligned language models. External Links: 2307.15043, Link Cited by: §2, §4.1.