← Back to all news
arXiv AI By Boyuan Chen, Yehia Dawoud, Hailemariam Mersha, Minghao Shao, Siddharth Garg, Ramesh Karri, Muhammad Shafique

Which Image Property Carries the Jailbreak? A Controlled Dissection of Image-to-Text Jailbreaks

Read the original on arXiv AI →

The study investigates which image properties enable jailbreak attacks on multimodal models by analyzing four attack families across 313 prompts and five models, including an appendix evaluation of InternVL3.5-8B. It finds that attack images significantly increase success rates compared to benign images, while factors such as tile entropy, JPEG size, and tile count do not reliably predict attack tiles. Only the E4 manipulation, which removes query-specific relatedness, shows a measurable effect on attack success rates, though overall conclusions depend on the rubric judge used.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv AI.

Related stories

arXiv AI
Aug 11

Decoy Images Amplify Caption-Mediated Defenses Against Encoded Jailbreaks

arXiv:2608. 01043v2 Announce Type: replace-cross Abstract: We report a counter-intuitive interaction between image inputs and existing black-box defenses on Vision--Language Models (VLMs): pairing an encoded jailbreak prompt with an unrelated decoy image can sharply lower attack success rate (ASR).

By Haoyu Zhang, Xiangchen Guan, Shibo Zheng, Mohammad Zandsalimy, Shanu Sushmita
llmsmultimodalsafety
More like this →
arXiv Computer Vision
Aug 31

Fully Unleashing the Multimodal Attacker: Meta-Adaptive Jailbreaking of Vision-Language Models

The paper introduces Meta-Adaptive Multimodal Jailbreaking (MAMJ), a method that jointly optimizes an attack strategy prompt and attacker weights to generate more effective jailbreaks against vision‑language models. Using an LLM‑based critique to refine the strategy and group‑level success‑rate rewards to update the weights, MAMJ achieves high attack success rates on MM‑SafetyBench, outperforming existing baselines by up to 24.1 percentage points. The learned attacker also transfers to unseen models and remains robust against typical defenses, highlighting a systemic vulnerability in current VLMs.

By Benlei Cui, Shen Pang, Yuke Wang, Xuemei Dong, Yuwen Zhai, Jingqun Tang, Haiyang Yu, Hui Xue, Longtao Huang, Haiwen Hong
llmsmultimodalsafety
More like this →