AEGIS: Audio Endogenous Guarding via Internal Signals Against Large Audio-Language Model Jailbreaks

Yu-Ling Liao*, Tzu-Chin Chiu*, Zong-You Chen*, Chi-Lei Tsai*, Shao-Yuan Lo — National Taiwan University (*equal contribution)

Code for the ICASSP 2027 submission. AEGIS keeps the target audio-language model frozen and adds a mid-layer risk gate that conditionally drives late-layer safety adapters, with closed-loop scaling at inference.

Contents

On this page: Repository layout · Setup · Data · Running AEGIS · Protocol · Ablations · Tests · Citation

Repository layout

aegis/                        defense runtime; every script runs from any directory
  model_registry.py           ModelAdapter interface, registry, Qwen2-Audio and Phi-4 adapters
  adapters_gemma_voxtral.py   Gemma 4 E4B-it and Voxtral-Small-24B adapters
  adapters_ultravox_vita.py   Ultravox v0.5 and VITA-1.5 adapters
  train_gate_lora.py          joint training of the risk gate and the safety adapters
  run_defense.py              gated inference with closed-loop scaling (--score-only: gate scores)
  run_model.py                undefended generation
  judge.py                    Llama-Guard-3-8B safety judge
  refusal.py                  refusal regex for the over-refusal metric
  extract_hidden.py, analysis/  hidden-state probes for layer selection
scripts/
  prepare_data.py             downloaded datasets -> manifests (+ in-domain test splits)
  run_baseline.sh             step 0: undefended responses, judgments, training files
  run_aegis.sh                steps 1-4 for one protocol (PROTOCOL=indomain or lobo)
  run_ablation.sh             the Full and Always-on ablations
  models.sh                   per-model gate layer, intervention layers, prompt mode
  build_trainsets.py, calibrate_threshold.py, summarize.py
data/splits/                  in-domain train/test ids used in the paper
docs/                         method, results, analyses, porting guide
tests/                        CPU tests of the evaluation protocol

Setup

pip install -r requirements.txt

Each model needs a Transformers version that can load it. The upstreams disagree, so we used one environment per model family:

• Models load from the Hub by default. To run offline, point the override variable at a local snapshot.
• Llama-Guard-3-8B, Gemma 4, and the Llama-3.1 backbone that Ultravox downloads are gated on the Hub. Accept their licenses and run huggingface-cli login, or set GUARD and AEGIS_LLAMA31_PATH to local copies.
• VITA-1.5 needs its GitHub code: clone https://github.com/VITA-MLLM/VITA and set AEGIS_VITA_REPO to the checkout (default: external/VITA).
• Hardware: one 48 GB GPU is enough for most models. Gemma 4 training needs a single card with at least ~40 GB, because the 262k-vocabulary loss does not shard well. Voxtral Small needs two 48 GB cards (DEVICE=auto shards the model; the gate and adapters follow the layers they hook). Qwen2-Audio and Phi-4 also benefit from DEVICE=auto on the long AJail clips.

Data

Download the five datasets as described in data/README.md, then build the manifests:

python scripts/prepare_data.py --data-root data --out-dir data/manifests

The script checks the row counts used in the paper: AJail 1,490, JALM 946, SACRED 1,364, XSTest 250, Benign_train 215. It also writes the in-domain test splits (718 / 499 / 683 rows) from the id lists in data/splits/.

Running AEGIS

For each model (PY is the Python of that model's environment; JUDGE_PY can point to a different environment for Llama Guard):

MODEL=gemma4_e4b_it PY=python DEVICE=cuda:0 bash scripts/run_baseline.sh                  # step 0
MODEL=gemma4_e4b_it PROTOCOL=indomain PY=python DEVICE=cuda:0 bash scripts/run_aegis.sh   # in-domain
MODEL=gemma4_e4b_it PROTOCOL=lobo     PY=python DEVICE=cuda:0 bash scripts/run_aegis.sh   # LOBO

Every stage is resumable; rerun the same command after an interruption. Outputs go to runs/<model>/:

baseline/                        undefended responses; <bench>_judged.jsonl = Llama Guard labels
train/train_{indomain,lobo}_<bench>.jsonl
<protocol>/<bench>/adapter/      router_head.pt, late_adapters.pt, config.json
<protocol>/<bench>/scores/       gate scores on XSTest and on the evaluation set
<protocol>/<bench>/threshold.json
<protocol>/<bench>/defended/     defended responses and their judgments
<protocol>/summary.json          unsafe rate, over-refusal, gate AUROC per benchmark

Protocol

• Evaluation settings. In-domain: AEGIS is trained on a benchmark's train split and evaluated on its held-out test split, one adapter per benchmark. The splits are 50/50, seed 42, grouped by prompt so variants of the same request stay on one side; the ids are in data/splits/. LOBO (leave one benchmark out): AEGIS is trained on the other two benchmarks and evaluated on the whole held-out benchmark. In both settings the evaluated data never takes part in threshold selection, and XSTest is never used for training.
• Training data (scripts/build_trainsets.py). Benign audio is Benign_train with the model's own undefended answers as targets. Benign prompts that look harmful and that the model refused at baseline are dropped. Harmful targets are generic refusal templates. The number of harmful clips equals the number of benign clips. Seed 42.
• Optimisation. AdamW, learning rate 2e-4, 4 epochs, gradient accumulation 8, LoRA rank 16, λ_BCE = 1.0, λ_L1 = 0.01.
• Prompt. Qwen2-Audio receives the audio only (PROMPT_MODE=native); the other models receive the audio plus one fixed text prompt. The gate reads a prompt-dependent hidden state, so an adapter is valid only under the prompt mode it was trained with.
• Threshold (scripts/calibrate_threshold.py). XSTest ids are sorted and split alternately into a validation half and a test half. The threshold is the smallest gate score whose added over-refusal on the validation half is at most 10%, counted on prompts the undefended model answered.
• Closed loop. The refusal probability sums the next-token probability of refusal openers at the last layer. In-domain runs use the multilingual opener list (, set by ), so non-English refusals count.

Ablations

MODEL=qwen2_audio VARIANT=full bash scripts/run_ablation.sh        # LoRA on all layers, no gate
MODEL=qwen2_audio VARIANT=always_on bash scripts/run_ablation.sh   # AEGIS layers, no gate

Tests

python -m unittest discover tests

Citation

@misc{liao2027aegis,
  title  = {{AEGIS}: Audio Endogenous Guarding via Internal Signals Against Large Audio-Language Model Jailbreaks},
  author = {Liao, Yu-Ling and Chiu, Tzu-Chin and Chen, Zong-You and Tsai, Chi-Lei and Lo, Shao-Yuan},
  note   = {Submitted to ICASSP 2027},
  year   = {2026}
}

License

The code is released under the MIT License. The base models (e.g. Gemma 4, Llama 3.1 in Ultravox, Llama-Guard-3-8B) and the benchmarks keep their own licenses and terms of use.