Metraipolis › archive › dc_045ee8e29bb9

AEGIS: Audio Endogenous Guarding via Internal Signals Against Large Audio-Language Model Jailbreaks — arXiv:2609.29287

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.29287
License (as archived): CC0-1.0
Archived: 2026-10-08T04:53:28.573Z
SHA-256 of the archived text: 2e8f71234e52e2d8caa2f9b1917a8c0c12888205a4abe365f1811867447de480
Stable URL of this page: https://metraipolis.com/documento/dc_045ee8e29bb9

How to cite

AEGIS: Audio Endogenous Guarding via Internal Signals Against Large Audio-Language Model Jailbreaks — arXiv:2609.29287 — arXiv (en), https://arxiv.org/abs/2609.29287 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_045ee8e29bb9 (Metraipolis archive dc_045ee8e29bb9, sha256 2e8f71234e52e2d8caa2f9b1917a8c0c12888205a4abe365f1811867447de480)

BibTeX

@misc{dc045ee8e29bb9,
  title = {AEGIS: Audio Endogenous Guarding via Internal Signals Against Large Audio-Language Model Jailbreaks — arXiv:2609.29287},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.29287},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_045ee8e29bb9; sha256 2e8f71234e52e2d8caa2f9b1917a8c0c12888205a4abe365f1811867447de480},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.29287. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Large audio-language models (LALMs) expand language models to process and interpret audio, but also expose them to heterogeneous audio jailbreaks. We ask whether successful jailbreaks reflect failures to recognize harmful intent or failures occurring after such recognition. Layer-wise probing reveals the latter: risk-related information remains decodable from intermediate representations, yet the internal risk signal fails to translate into refusal in later-layer processing. We identify this discrepancy as the risk-to-refusal gap. Building on this finding, we propose AEGIS, a detect-then-intervene defense whose mid-layer risk gate selectively activates downstream safety adapters. Across six LALMs and three heterogeneous audio jailbreak benchmarks, AEGIS reduces the average unsafe rate from 17.9% to 0.4%, while causing only a marginal increase in over-refusal on benign inputs. These results establish selective internal intervention as an effective path toward more robust refusal in LALMs. The code is available at this https URL .

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-09-25 in cs.CR).
Categorie arXiv: Sound (cs.SD) ; Cryptography and Security (cs.CR).
Pagina del lavoro: https://arxiv.org/abs/2609.29287 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-08T04:30:43.852Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-09-25?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).