AudioGuard: Toward Comprehensive Audio Safety Protection Across Diverse Threat Models

The paper introduces AudioGuard, a unified guardrail system featuring SoundGuard and ContentGuard, alongside the policy-based AudioSafetyBench benchmark, to comprehensively detect and mitigate diverse audio safety threats including non-speech events, speaker impersonation, and harmful voice-content combinations.

The Gist

Imagine you've built a super-smart robot assistant that can talk, listen, and even mimic voices. It's like having a magical butler who can tell jokes, read stories, and even sound like your favorite celebrity. But here's the problem: just because the words are safe doesn't mean the sound is safe.

If you only check the text of what the robot says, you might miss dangerous things hidden in the audio itself. For example, a robot could say "I'm fine" in a calm voice while the background noise is a scream, or it could sound exactly like a child while saying something inappropriate.

This paper introduces AudioGuard, a new "security system" designed to catch these audio-specific dangers that old systems miss. Here's how it works, broken down into simple concepts:

1. The Problem: The "Text-Only" Blind Spot

Think of current safety systems like a bouncer at a club who only reads the guest list.

• If the guest list (the text transcript) says "Hello, I'm here to dance," the bouncer lets them in.
• But what if the guest is actually screaming in terror, or the music is playing a sound that triggers a panic attack, or the guest is a child pretending to be an adult?
• The bouncer can't hear the tone, the background noise, or the voice identity. They only see the written words.

The authors realized that as AI gets better at speaking, we need a bouncer who can hear the whole picture, not just read the script.

2. The Solution: A Two-Part Security Team (AudioGuard)

Instead of hiring one giant, expensive, slow robot to check everything at once, the authors built AudioGuard, which acts like a specialized security team with two distinct roles:

Role A: The "Sound Detective" (SoundGuard)

• What it does: This detective listens to the raw audio waves before they are turned into words.
• What it catches: It spots things text can't describe.
  • The "Gunshot": Is there a loud bang or explosion in the background?
  • The "Distress Scream": Is someone crying or in pain?
  • The "Imposter": Does this voice sound like a famous celebrity or a child?
• Analogy: Imagine a security guard who can smell smoke even if the fire alarm hasn't gone off yet. They detect the physical danger of the sound itself.

Role B: The "Script Reader" (ContentGuard)

• What it does: This team member first converts the audio into text (like a stenographer) and then reads the text to check for bad words or harmful ideas.
• What it catches: Hate speech, scams, misinformation, or sexual content.
• Analogy: This is the traditional bouncer checking the guest list for banned names.

The "Manager" (The Integration)

• What it does: The Sound Detective and the Script Reader send their reports to a Manager. The Manager combines the clues.
• The Magic: The Manager can make complex decisions.
  • Scenario: "The text is safe, BUT the voice sounds like a child AND the text is about drugs." -> BLOCK.
  • Scenario: "The text is about a movie plot, BUT the background sound is a real gunshot." -> BLOCK.
  • Scenario: "The text is safe, the voice is an adult, and the background is quiet." -> ALLOW.

3. The Training Ground: AudioSafetyBench

To teach this security team how to spot dangers, the authors built a massive training gym called AudioSafetyBench.

• The Gym: They created over 10,000 test cases involving different languages, voices (including children and celebrities), and sounds (from gunshots to sexual noises).
• The Red Team: They hired "hackers" (Red Teamers) to try to trick the system with clever audio tricks, just like a fire drill.
• The Result: This benchmark is the first of its kind to test both the input (what the user says) and the output (what the AI generates) across all these weird and dangerous audio scenarios.

4. Why It's Better (The Results)

When they tested AudioGuard against other top-tier AI safety systems:

• Accuracy: It caught way more dangers, especially the tricky ones where the voice and the words combined to create a risk (like a child's voice saying something harmful).
• Speed: It was much faster. While other systems took 3+ seconds to decide (like a slow, overthinking robot), AudioGuard made decisions in about 1.4 seconds.
• Efficiency: It's cheaper to run because it doesn't need a giant, super-powerful computer to do everything at once; it uses specialized, smaller tools for specific jobs.

The Big Picture

AudioGuard is like upgrading from a text-only security guard to a full-sensory security team. It understands that in the world of audio, how something sounds is just as important as what is said. By separating the "sound" check from the "meaning" check, it creates a safer, faster, and smarter way to protect users from audio-based harms.

Technical Summary

1. Problem Statement

As foundation models increasingly integrate audio interfaces (voice assistants, TTS, voice cloning), ensuring safety has become significantly more complex than simply moderating "unsafe text spoken aloud." Current safety systems face several critical gaps:

• Audio-Native Risks: Harmful events exist purely in the waveform (e.g., gunshots, distress screams, sexual sounds) that text-based moderation cannot detect.
• Speaker Attributes & Impersonation: Risks arise from who is speaking (e.g., child voices, celebrity impersonation) rather than just what is said.
• Compositional Risks: Safety violations often depend on the combination of voice and content (e.g., a child's voice delivering sexual content, or a celebrity voice spreading misinformation).
• Lack of Standardization: Existing benchmarks and guardrails are often text-centric, lack a unified risk taxonomy for audio, or rely on monolithic Audio-LLMs that are costly, slow, and brittle in real-world scenarios.

2. Methodology

The authors propose a two-pronged approach: creating a comprehensive benchmark to define the problem space and developing a modular guardrail system to solve it.

A. AudioSafetyBench (The Benchmark)

To address the lack of standardized evaluation, the authors constructed AudioSafetyBench, the first policy-grounded benchmark for audio-input and audio-output safety.

• Taxonomy: Derived from safety policies of 20+ real-world platforms (Zoom, Spotify, Discord, etc.), the taxonomy covers:
  • Non-speech harmful sound events.
  • Impersonation and voice-cloning misuse.
  • Voice–content compositional risks.
  • Multilingual policy violations.
• Data Generation:
  • Red Teaming: Large-scale generation of unsafe instances across diverse threat models (input moderation, output screening, voice cloning pipelines).
  • Synthesis: Controlled synthesis of audio using TTS and voice cloning to create specific speaker attributes (child, celebrity) and mix non-speech sounds with speech.
  • Hard Benign: Inclusion of ambiguous but safe audio (e.g., sirens in movies) to test for false positives.
  • Scale: 10,000+ labeled instances across 17 languages and 50+ speaker identities.

B. AudioGuard (The Solution)

The authors propose AudioGuard, a unified, modular guardrail that decouples audio-native detection from semantic reasoning, avoiding the pitfalls of monolithic Audio-LLM judges. It consists of three components:

1. SoundGuard (Waveform-Level Detection):

   • Function: Directly analyzes the audio waveform to detect audio-native cues.
   • Capabilities: Identifies speaker attributes (child voice, celebrity impersonation) and non-speech events (gunfire, distress, sexual sounds).
   • Architecture: A lightweight audio classifier built on a pretrained speaker encoder (ECAPA-TDNN) with an MLP head for multi-label classification.

2. ContentGuard (Semantic Moderation):

   • Function: Handles policy-grounded semantic violations in the spoken content.
   • Pipeline: Audio $\rightarrow$ ASR (Automatic Speech Recognition, using Whisper-Large-v3) $\rightarrow$ TextGuard.
   • TextGuard: A fine-tuned instruction-tuned LLM (Gemma-3) that predicts content risk (fraud, hate speech, etc.) from the transcript.
   • Robustness: Trained with "TTS $\rightarrow$ ASR" round-trip noise augmentation to handle ASR artifacts and distribution shifts.

3. Compositional Integration:

   • Mechanism: Combines the output vectors from SoundGuard ($s$) and ContentGuard ($c$) using a rule-based logic system.
   • Decision Logic: Policies are defined as conjunctions of thresholds (e.g., IF (Child_Voice == True) AND (Sexual_Content == True) THEN Block).
   • Benefit: This allows for interpretable, scenario-specific decisions (e.g., stricter rules for voice cloning pipelines vs. voice chat) without retraining the underlying models.

3. Key Contributions

1. Red-Teaming Driven Risk Discovery: A comprehensive, policy-grounded taxonomy capturing audio-native, speaker-aware, and compositional risks.
2. AudioSafetyBench: A standardized benchmark enabling fine-grained diagnosis of audio safety across languages, voices, and application scenarios, filling a critical gap in the literature.
3. AudioGuard Framework: A novel, efficient guardrail architecture that separates waveform-level cue detection from semantic moderation, offering superior accuracy and lower latency compared to monolithic models.
4. Training Insights: Discovery that fine-tuning TextGuard on English-only data generalizes effectively to 17 other languages, and that explicit noise augmentation improves robustness against ASR errors.

4. Experimental Results

The authors evaluated AudioGuard on AudioSafetyBench and four external benchmarks (Nemotron-Audio, Jailbreak-AudioBench, Omni-SafetyBench, AdvWave).

• Accuracy: AudioGuard achieved a 0.871 average accuracy, significantly outperforming strong Audio-LLM baselines like Gemini 3 (0.740) and GPT-Audio (0.672).
  • Compositional Risks: The gap was widest in "voice-content compositional" scenarios (e.g., Child Voice + Sexual Content), where AudioGuard reached 0.832 vs. 0.357 for Gemini 3.
  • Non-Speech Events: AudioGuard achieved 0.876 accuracy on non-speech sounds, whereas transcript-based baselines struggled (often <0.50) as they lack acoustic context.
• Latency: AudioGuard demonstrated substantially lower latency (1.423s) compared to proprietary baselines like Gemini 3 (3.245s) and GPT-Audio (2.542s), making it more viable for real-time deployment.
• Cross-Lingual Generalization: TextGuard trained on English data showed strong F1 score improvements across all 17 languages in the benchmark, proving effective zero-shot transfer.

5. Significance

This work represents a paradigm shift in audio safety:

• Beyond Text: It moves the field away from treating audio merely as "text spoken aloud," recognizing that safety risks are inherent to the waveform and speaker identity.
• Efficiency & Interpretability: By decomposing the task, AudioGuard offers a more efficient and interpretable alternative to expensive, black-box Audio-LLM judges.
• Real-World Applicability: The modular design allows developers to swap components or adjust rules for specific threat models (e.g., voice cloning vs. voice chat) without retraining the entire system.
• Standardization: AudioSafetyBench provides the community with a necessary tool to rigorously evaluate and compare future audio safety systems.

In conclusion, the paper demonstrates that a hybrid approach—combining specialized waveform detectors with semantic text moderation—is essential for achieving robust, scalable, and interpretable safety in the next generation of audio-enabled AI systems.