Audio deepfake detectors perform unevenly across synthesis systems. Can frozen speech representations expose structure behind this variation? We construct a simple direction between genuine and synthetic WavLM embeddings and characterize each system’s position and spread along it. Across 61 MLAAD text-to-speech system–language groups, projected spread is strongly associated with mean detector difficulty across three runs (𝜌=0.60). It is the only feature surviving correction over 83 recorded tests, and leave-one-system-out ridge prediction gives R²=0.277. The genuine–synthetic directions also differ markedly across corpora, revealing domain-dependent representation geometry. As an auxiliary utterance score, the centroid projection reduces MLAAD detector equal error rate from 27.2% to 16.3%, improving on both component scores. Supervised probe comparisons further identify where adaptation gains originate. Together, these results establish a compact representation-space diagnostic of attack-specific detector behavior; the informative statistic and benefits of score adaptation depend on the corpus and detector.

The real-world usability of ASR models remains challenging, particularly for low-resource languages, where existing speech resources are often collected in clean studio environments. In this work, we introduce TeleASR-Amharic, a benchmark for evaluating Amharic ASR under various acoustic and telecommunication conditions. We analyze the major degradations observed in real telecommunications recordings and develop a benchmark that covers multiple channel conditions, environmental disturbances, and telecom-domain variations. Our results show that telecommunication degradation can substantially reduce recognition performance, making even high-performing ASR models impractical under severe conditions. For example, the WER of the best-performing model’s increases from 0.23 to 0.79 under severe telecommunication degradation, corresponding to a relative increase of 243% in recognition errors. We further investigate the effects of different noise and channel distortions and show that scaling training data and applying carefully designed telecommunication-aware augmentation substantially improve robustness. In particular, our best training configuration achieves a 23.6% relative WER reduction under extreme noise conditions. Together with the release of our telecommunications-domain data, these findings provide a reproducible benchmark for measuring progress in Amharic ASR while highlighting open challenges in developing robust speech technologies for real-world deployment.

Safety alignment in large audio-language models (LALMs) is typically evaluated through single-turn interactions with direct prompts. In real-world deployments, however, these models are often integrated into agent frameworks that introduce developer-controlled system prompts, tool-calling loops, and intermediate encoding steps between user speech and model input. This raises a practical question: can a text-based jailbreak remain effective after being converted to speech by an off-the-shelf text-to-speech (TTS) system and processed through an agent? We investigate this question using 270 prohibited questions spanning nine policy categories, an open-weight TTS model with 82 million parameters, and a minimal LangChain question-answering agent whose system prompt combines a persona with a fuzzing-derived template. Across three audio-capable models, we observe attack success rates (ASRs) ranging from 57.0% to 64.1%. To assess the impact of synthesis errors, we use automatic speech recognition to verify the generated audio and find that 87.4% of clips are transcribed exactly. Our analysis indicates that faithfully rendered speech alone achieves an ASR above 50% on every model tested, while manual evaluation of a 50-response sample agrees with the automatic judge in 92% of cases. These findings suggest that the agent framework does not compensate for the loss of safety robustness introduced by the text-to-audio transition. Even a readily available TTS pipeline requiring only minutes of computation can therefore provide a practical attack surface for transferring text-based jailbreaks to audio-agent settings.

Cross-model adversarial jailbreak transferability poses a security challenge for speech-language models (SLMs), as adversarial audio examples generated on one model can remain effective on other architectures. Previous work has shown that transferred attacks against SLMs are feasible, but it remains unclear how transferred adversarial inputs are reflected in the internal representations of different models. We investigate cross-model adversarial jailbreak transferability by combining behavioral evaluation with layer-wise activation analysis across heterogeneous SLMs. Using 386 PGD-based adversarial jailbreak examples provided by SPIRIT that satisfied SPIRIT’s original success criterion on the source model, Qwen2-Audio, we evaluate them on other SLMs without further optimization, revealing substantial differences in behavioral vulnerability across models. Conditional on source-model success, LLaMA-Omni reaches an attack success rate of 98.7% and Qwen2.5-Omni only 2.1%, while 86.5% of the examples also satisfy our stricter criterion on the source model Qwen2-Audio. We further analyze layer wise activation shifts between clean and adversarial inputs in LLaMA-Omni and the source Qwen2-Audio. In both models, activation shifts generally increase toward deeper transformer layers, with the largest changes occurring in the final layers. These findings characterize how adversarial inputs are reflected in internal representations under a cross-model transfer setting.

Audio deepfake research has focused on a few high resource languages, leaving human perception of synthesized Arabic speech unexplored. We present the current study of how human listeners perceive Arabic audio deepfakes. Thirty eight native speakers judged Modern Standard Arabic stimuli in two formats generated with proprietary and open-source models. The two formats are a binary task pairing genuine clips with text-to-speech counterparts and a unary task requiring single-clip authenticity judgments of voice-cloned political speech. The results showed that listeners performed only moderately above chance in both formats (binary: 62.9%; unary balanced accuracy: 64.6%). In the unary task, listeners showed a systematic bias toward judging audio as authentic (d'=0.77, c=0.27), accepting 45% of synthetic clips as real. Confidence was positively related to accuracy in the binary condition but inversely related in the unary condition. Because the two conditions also differ in synthesis method, speakers, and stimuli, we treat this as a descriptive contrast between conditions rather than an effect of task format. An exploratory coded analysis of participants’ rationales suggested that reasoning from subjective certainty was associated with lower accuracy and concrete perceptual cues with higher accuracy, while no cue category reliably predicted confidence. These findings suggest that individual listeners are an unreliable safeguard against Arabic fake audio detection, and motivate future direct comparisons with automatic detectors.

Most adversarial attacks on deep reinforcement learning (DRL) assume white-box access to the victim policy, which rarely holds in practice. This paper studies transfer-based black-box attacks on DRL: the attacker crafts observation perturbations on a white-box surrogate agent and feeds them to an unknown victim. We formulate the attack as return minimization under a per-step perturbation budget. We first show that transplanting transferable image-classification attacks (FGSM, MI-FGSM, and NI-FGSM) with a per-step objective yields perturbations that transfer but are no stronger than random noise of the same budget. We then propose a trajectory-level attack that optimizes a sequence of perturbations over a receding horizon through a differentiable model of the environment and a temperature-smoothed surrogate policy, with the same optimizers. On CartPole-v1 with ten DQN and DDQN agents and 100 surrogate–victim pairs, the trajectory-level attack outperforms per-step attacks and random noise in the white-box, cross-model, and cross-algorithm settings.