# Caa Eval

> Benchmarks large audio-language models against adversarial audio attacks using the CAA dataset, computing WER, ROUGE-L, cosine similarity, and coherence scores to assess robustness in conversational settings.

- Skill: `qhjqhj00/caa-eval` (Agent Skill)
- Install (CLI): `npx skillmds add qhjqhj00/caa-eval`
- Raw SKILL.md: https://api.skillmd.com/api/skills/qhjqhj00/caa-eval/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML, Research & Search, Model Training & Fine-tuning, Summarization
- Tags: Audio Attacks, Benchmark, Caa, Cosine Similarity, Lalm, Robustness, Rouge L, Wer
- Author: qhjqhj00 (https://skillmd.com/u/qhjqhj00)
- Updated: 2026-08-22
- Page: https://skillmd.com/skills/qhjqhj00/caa-eval

---


# caa-eval

> Who Can Withstand Chat-Audio Attacks? An Evaluation Benchmark for Large Audio-Language Models — Wanqi Yang et al. (2024) (arXiv:2411.14842, 2024)

## What this evaluates

Evaluates the robustness of Large Audio-Language Models (LALMs) against adversarial audio attacks in conversational settings. It probes response consistency, semantic preservation, and linguistic quality when audio inputs are perturbed with content, emotional, explicit, or implicit noise.

## Datasets

- **CAA** — total 1680; splits: test (1680); repo https://github.com/crystraldo/CAA

## Metrics

- `WER` **(primary)** — range: [0, 1]
  - Measures the discrepancy between responses to no-attack and attacked audio by quantifying the proportion of differing words. Lower scores indicate better robustness.
- `ROUGE-L` — range: [0, 1]
  - Assesses the overlap between two response sets, focusing on the longest common subsequences. Higher scores reflect better retention of essential information and structure.
- `COS` — range: [0, 1]
  - Measures the semantic similarity between the output from no-attack audio and attacked audio using cosine similarity. Higher scores indicate maintained semantic consistency.
- `NC` — range: [1, 5]
  - No-attack Coherence: Rates how well the no-attack response meaningfully answers the prompt on a 1-5 scale. Higher scores indicate stronger alignment.
- `ACoh` — range: [1, 5]
  - Attack Coherence: Rates how well the attacked response continues to answer the prompt on a 1-5 scale. Higher scores indicate better resilience to attacks.
- `ACor` — range: [1, 5]
  - Attack Correlation: Measures the correlation between the attacked and no-attack responses on a 1-5 scale. Higher scores indicate better retention of core meaning.
- `LR` — range: [1, 5]
  - Linguistic Robustness: Assesses grammatical correctness, sentence continuity, and logical flow on a 1-5 scale. Higher scores indicate preserved linguistic structure.

## Input / output format

**Input**: Audio samples (clean or perturbed with adversarial noise) paired with a conversational prompt/question. For some models, questions are formatted according to their specific prompt guides.

**Output**: Textual response generated by the LALM to the audio prompt.

## Scoring recipe

```python
def compute_metrics(resp_clean, resp_attacked, prompt):
    wer = edit_distance(resp_clean, resp_attacked) / max(len(resp_clean), len(resp_attacked))
    rouge_l = rouge_l_score(resp_clean, resp_attacked)
    cos = cosine_similarity(embed(resp_clean), embed(resp_attacked))
    nc = score_1_to_5(resp_clean, prompt)
    if nc == 1: return {'NC': 1, 'ACoh': 1, 'ACor': 1, 'LR': 1}
    acoh = score_1_to_5(resp_attacked, prompt)
    acor = score_1_to_5(resp_attacked, resp_clean)
    lr = score_1_to_5(resp_attacked, 'grammar, continuity, logic')
    return {'WER': wer, 'ROUGE-L': rouge_l, 'COS': cos, 'NC': nc, 'ACoh': acoh, 'ACor': acor, 'LR': lr}
```

## Common pitfalls

- Directionality confusion: WER is minimized (↓), while ROUGE-L, COS, NC, ACoh, ACor, and LR are maximized (↑).
- Cascading score rule: In GPT-4o/human evaluation, if NC=1, all other metrics (ACoh, ACor, LR) are automatically set to 1, which heavily penalizes averages if not explicitly handled.
- Text-based evaluation: Despite using audio inputs, the standard metrics compare the textual outputs, not the audio processing fidelity itself.

## Evidence (verbatim from paper)

> In this section, we evaluate the models by comparing their outputs on responses to no-attack audio with attacked audio using three key metrics: WER, ROUGE-L Lin ([2004]), and COS (Cosine Similarity).

## Citation

```bibtex
@misc{yang2024caa,
  title={Who Can Withstand Chat-Audio Attacks? An Evaluation Benchmark for Large Audio-Language Models},
  author={Wanqi Yang et al. (2024)},
  year={2024},
  note={arXiv:2411.14842}
}
```

- arXiv: 2411.14842