Full duplex speech models vulnerable to spoken interruption attacks
DuplexJail: Safety Alignment Breaks Under Spoken Interruption in Full-Duplex Models
Cryptography and SecuritySound
Summary
Full-duplex speech models can listen to users while speaking back, but this creates new ways to trick them. The authors found that playing certain fixed spoken messages during or after harmful requests can make these models respond incorrectly, bypassing safety rules. They tested different interruption timings and multiple speech models, showing some models became more likely to produce harmful content. This reveals a new type of security risk for voice assistants and similar systems.
What this means in practice
- •For voice assistant developers: Detect and mitigate spoken interruption attacks to improve safety in full-duplex conversational AI systems.
- •For security auditors: Evaluate voice-interactive AI systems for vulnerabilities from continuous user input during response generation.
Authors
Jaechul Roh, Deepak Chandran, Amir Houmansadr, Andrea Fanelli
Abstract
Full-duplex speech models accept user speech while generating responses, creating an underexplored attack surface. We introduce DuplexJail, which delivers fixed, request-independent spoken prompts through the user audio channel. We compare fixed-delay interruption after the harmful request ends with refusal-triggered interruption following a cue in the model's streaming text. Across four open-source models and 720 harmful requests from AdvBench and HarmBench, fixed-delay interruption raises whole-response attack success rates on AdvBench to 40.3% for PersonaPlex and 48.7% for PersonaPlex-RL, increases of +33.8 and +39.3 percentage points. The refusal-triggered policy reaches 35.6% and 48.6%, respectively, with all trials scored regardless of whether an interruption occurs. Selected conditions also increase FLM-Audio's harmful-response rate, while BayLing-Duplex shows decreases. These findings identify spoken interruption as a jailbreak attack vector and motivate evaluating safety throughout ongoing full-duplex interaction.