Research map / Adversarial robustness and security / Attacks on text and graphs

Retention Score: Quantifying Jailbreak Risks for Vision Language Models

AAAI 2025 · Adversarial robustness and security › Attacks on text and graphs · approach: Vision-language model robustness · 1 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Retention Score (Retention-I and Retention-T), an attack-agnostic, margin-based robustness certificate that scores VLM jailbreak risk using diffusion-generated image/paraphrased text samples and a toxicity judge, instead of running costly jailbreak attacks.

Problem

Assessing jailbreak risks of vision-language models is costly and attack-dependent, and existing robustness evaluation via adversarial attacks is not persistent since stronger attacks may exist; black-box VLM APIs are hard to audit.

Approach

Scores VLM robustness as the mean margin between non-toxic and toxic judgments over diffusion-generated semantically similar images (Retention-I) and diffusion-paraphrased prompts encoded via BART (Retention-T), with a claimed L2 certified radius, requiring only forward passes rather than optimization-based attacks.

Key results

• Retention-I ranks MiniGPT-4 (0.5774) > InstructBLIP (0.5130) > LLaVA (0.2434), consistent with ASR ordering (42.49%, 49.96%, 58.36%).
• Adding a vision module lowers Retention-T for LLaVA (-0.0872, ASR +8.4%) and InstructBLIP (-0.1658, ASR +55.9%), while MiniGPT-4 is nearly unchanged (-0.0017).
• Retention Score reduces computation time by about 2-30x relative to the image and text jailbreak attacks.

Measured effects reported in the paper

Surprising findings

• Gemini security settings strongly change Retention-I (Gemini-None ~0.25 vs. ~1.2 for other settings), and GPT-4V's score (~1.21) sits near Gemini's Some/Most settings.
• Most VLMs with visual components appear less robust than their plain LLM counterparts.

Limitations

• Certificate is only for L2-norm perturbations; text attacks would need L0-type certificates.
• Relies on a Lipschitz/Gaussian-smoothing argument with asymptotic guarantees as sample count goes to infinity, using a small number of prompts (50 images, 20 AdvBench queries).
• Toxicity judgment depends on the judge (Perspective API or LLaMA-70B), and Gemini blocked responses are scored as zero toxicity.

Experimental setup

Datasets: RealToxicityPrompts AdvBench Harmful Behaviors

Benchmarks: RealToxicityPrompts AdvBench Harmful Behaviors

Metrics: Retention-I Retention-T attack success rate wall-clock run-time

Baselines: MiniGPT-4 image attack (Qi et al.) AutoDAN GCG CLEVER Score

Builds on: GREAT Score CLEVER Score AutoDAN Qi et al. visual adversarial examples

Closest papers by meaning

• MMJ-Bench: A Comprehensive Study on Jailbreak Attacks and Defenses for Vision Language Models (AAAI 2025 · similarity 0.92)
• JailBound: Jailbreaking Internal Safety Boundaries of Vision-Language Models (NeurIPS 2025 · similarity 0.91)
• Steering Away from Harm: An Adaptive Approach to Defending Vision Language Model Against Jailbreaks (CVPR 2025 · similarity 0.90)
• Exploring Visual Vulnerabilities via Multi-Loss Adversarial Search for Jailbreaking Vision-Language Models (CVPR 2025 · similarity 0.90)
• Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks (CVPR 2025 · similarity 0.89)
• Failures to Find Transferable Image Jailbreaks Between Vision-Language Models (ICLR 2025 · similarity 0.89)