Research map / Vision-language and multimodal / Multimodal LLMs
Distraction is All You Need for Multimodal Large Language Model Jailbreaking
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes CS-DJ, a black-box jailbreak for MLLMs that combines query decomposition into sub-query images with contrasting retrieved subimages (a "distraction" hypothesis), reaching 52.40% ASR and 74.10% EASR across four closed-source MLLMs.
Problem
Black-box jailbreaks of closed-source multimodal LLMs often rely on OOD visual inputs that are either gradient-dependent or easily detected by alignment; it is unclear how to exploit the visual space for effective black-box attacks.
Approach
Jailbreak success depends on the complexity of subimages rather than their content; composing a grid of contrasting (low-similarity) retrieved images plus harmful query fragments rendered as text images, with a harmless instruction, distracts the model's safety alignment (the Distraction Hypothesis).
Key results
- CS-DJ achieves average ASR of 52.40% and EASR of 74.10% across four closed-source MLLMs, versus Hades's much lower averages.
- On GPT-4o, 9 contrasting subimages raise ASR from 32.53% (similar-image selection) to 43.73%, and random noise images give only 20.00%.
- On open-source LLaVA-OneVision-Chat-7B, CS-DJ reaches 55.87% ASR vs 48.80% for Hades.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use CS-DJ instead of Hades | Closed-source MLLMs · Hades dataset, average across five categories (GPT-4o-mini, GPT-4o, GPT-4V, Gemini-1.5-Flash) | ASR (%): 6.08 -> 57.80; 5.51 -> 42.24; 20.33 -> 45.44; 9.20 -> 64.11 | Helped |
| Use CS-DJ instead of Hades | Closed-source MLLMs · Hades dataset, average across five categories (GPT-4o-mini, GPT-4o, GPT-4V, Gemini-1.5-Flash) | EASR (%): 12.00 -> 77.20; 10.13 -> 65.86; 45.06 -> 71.86; 14.79 -> 81.46 | Helped |
| Use CS-DJ instead of Hades | LLaVA-OneVision-Chat-7B · Hades dataset | ASR (%): 48.80 -> 55.87 | Helped |
| Use CS-DJ instead of FigStep or MM-SafetyBench | GPT-4o · Hades dataset | ASR (%): 3.73 -> 43.73; 5.86 -> 43.73 | Helped |
| Decompose the raw query into 3 sub-queries rather than using a raw-query image (ablation) | CS-DJ · Hades dataset (GPT-4o) | ASR (%): 3.20 -> 18.80 | Helped |
| Increase query decomposition from 3 to 6 sub-queries (ablation) | CS-DJ · Hades dataset (GPT-4o) | ASR (%): 18.80 -> 29.86 | Helped |
| Increase query decomposition from 6 to 9 sub-queries (ablation) | CS-DJ · Hades dataset (GPT-4o) | ASR (%): 29.86 -> 27.46 | Hurt |
| Add 9 most-contrasting visual subimages instead of using 9 most-similar images (ablation) | CS-DJ with 3 sub-queries · Hades dataset (GPT-4o) | ASR (%): 32.53 -> 43.73 | Helped |
| Use 9 most-similar visual subimages instead of repeating one most-similar image (ablation) | CS-DJ with 3 sub-queries · Hades dataset (GPT-4o) | ASR (%): 24.66 -> 32.53 | Helped |
| Use 9 contrasting, information-rich images instead of 9 random noise images (ablation) | CS-DJ with 3 sub-queries · Hades dataset (GPT-4o) | ASR (%): 20.00 -> 43.73 | Helped |
| Add role-guiding to task-guiding instruction (ablation) | CS-DJ with 3SQ+9CSI · Hades dataset (GPT-4o) | ASR (%): 32.00 -> 39.73 | Helped |
| Add visual-guiding to task- and role-guiding instruction (ablation) | CS-DJ with 3SQ+9CSI · Hades dataset (GPT-4o) | ASR (%): 39.73 -> 43.73 | Helped |
Surprising findings
- Random noise subimages barely improve ASR over query decomposition alone, suggesting subimage informational complexity matters rather than mere visual clutter.
- Distraction Distance (CLIP-based) does not reliably track ASR when subimage construction varies along multiple dimensions.
Limitations
- Distraction Distance metric uses CLIP space, which may not match the MLLM's semantic space and does not always track ASR.
- Theoretical foundation of the Distraction Hypothesis is admitted to be under development.
- Results on GPT-4o use a single trial; ablations are limited to GPT-4o and sub-query count is constrained by image encoder limits.
Experimental setup
Datasets: Hades dataset LLaVA-CC3M-Pretrain-595K
Benchmarks: Hades dataset
Metrics: ASR EASR Distraction Distance
Baselines: Hades FigStep MM-SafetyBench
Builds on: Hades FigStep MM-SafetyBench
Closest papers by meaning
- MIDAS: Multi-Image Dispersion and Semantic Reconstruction for Jailbreaking MLLMs (ICLR 2026 · similarity 0.92)
- Conceal, Reconstruct, Jailbreak: Exploiting the Reconstruction--Concealment Tradeoff in MLLMs (NeurIPS 2026 · similarity 0.90)
- FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts (AAAI 2025 · similarity 0.90)
- Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment (CVPR 2025 · similarity 0.89)
- SafePTR: Token-Level Jailbreak Defense in Multimodal LLMs via Prune-then-Restore Mechanism (NeurIPS 2025 · similarity 0.89)
- Jailbreak-AudioBench: In-Depth Evaluation and Analysis of Jailbreak Threats for Large Audio Language Models (NeurIPS 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.