Benchmark Tests LLM Safety in Vehicle Voice Command Authorization

Summary

Large language models are increasingly used in vehicle voice assistants, where translating a natural-language request into an action creates a safety-critical authorization problem. This study introduces a 202-scenario benchmark with reference decisions across seven outcomes: execute, refuse, clarify, require confirmation, defer to manual control, trigger an emergency response, or make no tool call. The scenarios vary speaker role, authentication status, vehicle state, and tool availability, factors that earlier evaluations did not isolate in the pre-action decision. The authors test two local open-weight models and three API-based LLMs using Decision Alignment and safety-specific error metrics. Alignment ranges from 40.1% for Llama 3.2 3B to 89.1% for Gemini 3.1 Pro Preview, while the API models score from 83.2% to 89.1% without statistically significant differences among them. Despite these results, the API models still produce two to three False Executes across 161 scenarios where execution was not appropriate, and confirmation and manual-control decisions remain persistent failure areas. A controlled Llama 3.2 3B ablation reaches 40.1% alignment under a structured authorization policy, compared with 28.2-29.2% for schema-only and generic-safety baselines, but structured prompting does not remove False Executes. The paper concludes that LLM decisions cannot serve as the sole safety mechanism: deployment should add an independent enforcement layer that checks tool permissions and vehicle-state constraints before any vehicle function is invoked.