DuplexJail: Safety Alignment Breaks Under Spoken Interruption in Full-Duplex Models

• URL: http://arxiv.org/abs/2609.09420v1
• Date: Tue, 08 Sep 2026 20:19:24 GMT
• Title: DuplexJail: Safety Alignment Breaks Under Spoken Interruption in Full-Duplex Models
• Abstract summary: Fixed-delay interruption raises whole-response attack success rates on AdvBench to 40.3% for PersonaPlex and 48.7% for PersonaPlexRL.<n>The refusal policy reaches 35.6% and 48.6%, respectively, with all trials scored regardless of whether an interruption occurs.<n>These findings identify spoken interruption as a jailbreak attack evaluating safety throughout ongoing full interaction.
• Score: 16.95513039797219
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Full-duplex speech models accept user speech while generating responses, creating an underexplored attack surface. We introduce DuplexJail, which delivers fixed, request-independent spoken prompts through the user audio channel. We compare fixed-delay interruption after the harmful request ends with refusal-triggered interruption following a cue in the model's streaming text. Across four open-source models and 720 harmful requests from AdvBench and HarmBench, fixed-delay interruption raises whole-response attack success rates on AdvBench to 40.3% for PersonaPlex and 48.7% for PersonaPlex-RL, increases of +33.8 and +39.3 percentage points. The refusal-triggered policy reaches 35.6% and 48.6%, respectively, with all trials scored regardless of whether an interruption occurs. Selected conditions also increase FLM-Audio's harmful-response rate, while BayLing-Duplex shows decreases. These findings identify spoken interruption as a jailbreak attack vector and motivate evaluating safety throughout ongoing full-duplex interaction.

Related papers

• Realtime-Venus: A full-duplex interaction system with asynchronous delegation [59.69745588222872]
  We present Realtime, Realtime Omni audio visual interaction and Realtime-Audio Spoken for spoken interaction.<n>Each model serves as complete conversational, integrating continuous perception, conversational control, and native speech generation.
  arXiv  Detail & Related papers  (2026-09-12T08:56:50Z)
• Causal Analysis and Mitigation of Spurious Onsets in Full-Duplex Speech LLMs [3.502729154227436]
  We find that speech probability spikes by over nine orders of magnitude in one 80-ms frame.<n>Our method suppresses 13/13 Moshi and 9/9 PersonaPlex spurious onsets, while preserving 40 genuine responses per model.<n>Our method requires no retraining and runs in real-time, with 95th-percentile decision time below 61 ms, within the 80-ms frame budget.
  arXiv  Detail & Related papers  (2026-09-11T19:03:36Z)
• Continue, Adapt, or Yield: In-Turn Adaptation to Overlapping Speech in Full-Duplex Agents [2.745780834143671]
  We introduce Duplex Cue, an evaluation of thisemphin adaptation in full voice agents.<n>In a single-model study using 300 human-confirmed unscripted English conversations, we compare recorded human responses generated while replaying listener's cues.<n>Speakers adapt in 68.2% of cases, compared with 32.4% for PersonaPlex.
  arXiv  Detail & Related papers  (2026-09-11T17:46:10Z)
• SteerDuplex: Steerable Duplex Speech Dialogue Models [47.277615720741046]
  Full spoken dialogue model fine-tuned on natural conversations and synthetic dialogues targeting following instruction, vocal delivery, reasoning, and interaction.<n>We apply two-stage reinforcement learning (RL) with hybrid rewards, combining verifiable interaction checks and judge-based feedback to improve response continuity.<n> RL further raises source-clean interruption response from 72.5% to 82.5% and reduces synthetic pause barge-in from 26.5% to 9%.
  arXiv  Detail & Related papers  (2026-09-11T09:22:46Z)
• BayLing-Duplex: Native Full-Duplex Speech Dialogue with a Single Autoregressive LLM [37.246890931249496]
  BayLing-Duplex is a native full-generation SpeechLM that decides where to listen, when to speak, and sacrifice when to stop with no auxiliary turn-taking module.<n>It reaches 92% turn-taking success and 100% interruption success on InstructS2S-Eval, while improving speech-response score from 2.17 to 3.39 over Moshi.
  arXiv  Detail & Related papers  (2026-06-12T15:01:51Z)
• Multi-Faceted Interactivity Alignment in Full-Duplex Speech Models [53.470209949659115]
  We propose a post-training alignment method that improves full spoken dialogue models through RL.<n>We address the four canonical axes of interactivity: handling turn-taking, back-channel pause, and user interruption.<n>An extra-based reward for response quality prevents semantic degradation.
  arXiv  Detail & Related papers  (2026-06-09T17:46:55Z)
• Strengthening Polymorphic Prompt Assembling: Dynamic Separator Generation Against Emerging Prompt Injection Attacks [2.8988874060074163]
  Polymorphic Prompt Assembling (PPA) defends LLM agents against prompt injections by randomly selecting separator pairs from a fixed pool to isolate user input from system instructions.<n>We propose a dynamic per-request separator generation using domain-separated SHA-256 digests keyed on the timestamp, session identifier, and nonce.<n>Each assembled prompt receives a unique cryptographic (BEGIN, END) canary pair, thereby limiting leakage exposure to a single request.
  arXiv  Detail & Related papers  (2026-05-28T20:10:04Z)
• Full-Duplex-Bench-v3: Benchmarking Tool Use for Full-Duplex Voice Agents Under Real-World Disfluency [61.68376148916503]
  We introduce Full-Duplex-Bench-v3 (FDB-v3), a benchmark for evaluating spoken language models under naturalistic speech conditions and multi-step tool use.<n>Unlike prior work, our dataset consists entirely of real human audio annotated for five disfluency categories, paired with scenarios requiring chained API calls across four task domains.<n>We evaluate six model configurations -- GPT-Realtime, Gemini Live 2.5, Gemini Live 3.1, Grok, Ultravox v0.7, and a traditional Cascaded pipeline (Whisper$rightarrow$rightarrow$TTS) -- across accuracy, latency, and turn-
  arXiv  Detail & Related papers  (2026-04-06T16:46:52Z)
• Privacy-Preserving End-to-End Full-Duplex Speech Dialogue Models [62.35104196350636]
  We show that SALM-Duplex leakage persists across all layers with SALM-Duplex showing stronger leakage in early layers while Moshi leaks uniformly, and that Linkability rises sharply within the first few turns.<n>We propose two streaming anonymization setups using StreamVoiceAnon: a front-end (AnonW2W) and a feature-domain replacement (AnonW2F)
  arXiv  Detail & Related papers  (2026-03-09T10:01:24Z)
• Echoes of Human Malice in Agents: Benchmarking LLMs for Multi-Turn Online Harassment Attacks [10.7231991032233]
  Large Language Model (LLM) agents are powering a growing share of interactive web applications, yet remain vulnerable to misuse and harm.<n>We present the Online Harassment Agentic Benchmark consisting of: (i) a synthetic multi-turn harassment conversation dataset, (ii) a multi-agent (e.g., harasser, victim) simulation informed by repeated game theory, (iii) three jailbreak methods attacking agents across memory, planning, and fine-tuning, and (iv) a mixed-methods evaluation framework.
  arXiv  Detail & Related papers  (2025-10-16T01:27:44Z)
• The Alignment Waltz: Jointly Training Agents to Collaborate for Safety [80.16102254128518]
  WaltzRL is a novel multi-agent reinforcement learning framework that formulates safety alignment as a collaborative, positive-sum game.<n>At the core of WaltzRL is a Dynamic Improvement Reward (DIR) that evolves over time based on how well the conversation agent incorporates feedback.<n>Our experiments, conducted across five diverse datasets, demonstrate that WaltzRL significantly reduces both unsafe responses and overrefusals.
  arXiv  Detail & Related papers  (2025-10-09T14:03:05Z)
• Chain-of-Thought Reasoning in Streaming Full-Duplex End-to-End Spoken Dialogue Systems [82.70507055599093]
  We propose a Streaming Chain-of-Thought (CoT) framework for Duplex SDS.<n>We create intermediate targets-aligned user transcripts and system responses for each block.<n>Experiments show that our approach produces more coherent and interpretable responses than existing duplex methods.
  arXiv  Detail & Related papers  (2025-10-02T14:33:05Z)
• FLEXI: Benchmarking Full-duplex Human-LLM Speech Interaction [49.83226596963294]
  Speech-computer human interaction enables real-time spoken dialogue systems.<n>Modelling and benchmarking these models remains a fundamental challenge.<n>We introduce FLEXI, the first benchmark for full-human spoken interaction.
  arXiv  Detail & Related papers  (2025-09-26T11:57:42Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.