<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="alshahrani-niwa-2026-activation">
    <titleInfo>
        <title>Activation-Level Characterization of Cross-Model Adversarial Jailbreak Transferability in Speech Language Models</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Rahaf</namePart>
        <namePart type="family">Alshahrani</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Ayana</namePart>
        <namePart type="family">Niwa</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-11</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Proceedings of the Workshop on Secure, Safe, and Privacy-Preserving Speech and Audio AI (TrustAudio 2026)</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Nancy</namePart>
            <namePart type="given">F</namePart>
            <namePart type="family">Chen</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Yiming</namePart>
            <namePart type="family">Chen</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Xiaoxue</namePart>
            <namePart type="family">Gao</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Haizhou</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Björn</namePart>
            <namePart type="family">Schuller</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Berrak</namePart>
            <namePart type="family">Sisman</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Xianghu</namePart>
            <namePart type="family">Yue</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Hengqin, Zhuhai, China</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-452-1</identifier>
    </relatedItem>
    <abstract>Cross-model adversarial jailbreak transferability poses a security challenge for speech-language models (SLMs), as adversarial audio examples generated on one model can remain effective on other architectures. Previous work has shown that transferred attacks against SLMs are feasible, but it remains unclear how transferred adversarial inputs are reflected in the internal representations of different models. We investigate cross-model adversarial jailbreak transferability by combining behavioral evaluation with layer-wise activation analysis across heterogeneous SLMs. Using 386 PGD-based adversarial jailbreak examples provided by SPIRIT that satisfied SPIRIT’s original success criterion on the source model, Qwen2-Audio, we evaluate them on other SLMs without further optimization, revealing substantial differences in behavioral vulnerability across models. Conditional on source-model success, LLaMA-Omni reaches an attack success rate of 98.7% and Qwen2.5-Omni only 2.1%, while 86.5% of the examples also satisfy our stricter criterion on the source model Qwen2-Audio. We further analyze layer wise activation shifts between clean and adversarial inputs in LLaMA-Omni and the source Qwen2-Audio. In both models, activation shifts generally increase toward deeper transformer layers, with the largest changes occurring in the final layers. These findings characterize how adversarial inputs are reflected in internal representations under a cross-model transfer setting.</abstract>
    <identifier type="citekey">alshahrani-niwa-2026-activation</identifier>
    <location>
        <url>https://aclanthology.org/2026.trustaudio-1.4/</url>
    </location>
    <part>
        <date>2026-11</date>
        <extent unit="page">
            <start>29</start>
            <end>34</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T Activation-Level Characterization of Cross-Model Adversarial Jailbreak Transferability in Speech Language Models
%A Alshahrani, Rahaf
%A Niwa, Ayana
%Y Chen, Nancy F.
%Y Chen, Yiming
%Y Gao, Xiaoxue
%Y Li, Haizhou
%Y Schuller, Björn
%Y Sisman, Berrak
%Y Yue, Xianghu
%S Proceedings of the Workshop on Secure, Safe, and Privacy-Preserving Speech and Audio AI (TrustAudio 2026)
%D 2026
%8 November
%I Association for Computational Linguistics
%C Hengqin, Zhuhai, China
%@ 979-8-89176-452-1
%F alshahrani-niwa-2026-activation
%X Cross-model adversarial jailbreak transferability poses a security challenge for speech-language models (SLMs), as adversarial audio examples generated on one model can remain effective on other architectures. Previous work has shown that transferred attacks against SLMs are feasible, but it remains unclear how transferred adversarial inputs are reflected in the internal representations of different models. We investigate cross-model adversarial jailbreak transferability by combining behavioral evaluation with layer-wise activation analysis across heterogeneous SLMs. Using 386 PGD-based adversarial jailbreak examples provided by SPIRIT that satisfied SPIRIT’s original success criterion on the source model, Qwen2-Audio, we evaluate them on other SLMs without further optimization, revealing substantial differences in behavioral vulnerability across models. Conditional on source-model success, LLaMA-Omni reaches an attack success rate of 98.7% and Qwen2.5-Omni only 2.1%, while 86.5% of the examples also satisfy our stricter criterion on the source model Qwen2-Audio. We further analyze layer wise activation shifts between clean and adversarial inputs in LLaMA-Omni and the source Qwen2-Audio. In both models, activation shifts generally increase toward deeper transformer layers, with the largest changes occurring in the final layers. These findings characterize how adversarial inputs are reflected in internal representations under a cross-model transfer setting.
%U https://aclanthology.org/2026.trustaudio-1.4/
%P 29-34

Markdown (Informal)

[Activation-Level Characterization of Cross-Model Adversarial Jailbreak Transferability in Speech Language Models](https://aclanthology.org/2026.trustaudio-1.4/) (Alshahrani & Niwa, TrustAudio 2026)

• Activation-Level Characterization of Cross-Model Adversarial Jailbreak Transferability in Speech Language Models (Alshahrani & Niwa, TrustAudio 2026)

ACL

• Rahaf Alshahrani and Ayana Niwa. 2026. Activation-Level Characterization of Cross-Model Adversarial Jailbreak Transferability in Speech Language Models. In Proceedings of the Workshop on Secure, Safe, and Privacy-Preserving Speech and Audio AI (TrustAudio 2026), pages 29–34, Hengqin, Zhuhai, China. Association for Computational Linguistics.