Research map / Adversarial robustness and security / Attacks on text and graphs
Exploring Visual Vulnerabilities via Multi-Loss Adversarial Search for Jailbreaking Vision-Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes MLAI, a white-box jailbreak for VLMs that uses scenario-matched DALL-E 3 initial images, flat-minima-based selection of multiple gradient-optimized adversarial images within a loss range, and multi-image collaborative attacks.
Problem
Gradient-based jailbreak attacks on vision-language models assume minimal-loss adversarial images are best, and generic initial images ignore the semantic link between image content and harmful scenario; the paper targets more effective jailbreaks of VLMs.
Approach
Generate scenario-matched initial images with DALL-E 3, optimize them via cross-entropy gradient updates with an L-infinity bound (32/255), then select a loss range via local slope/flat-minimum analysis and attack collaboratively with multiple adversarial images in that range.
Key results
- MLAI reaches 77.75% average ASR on MiniGPT-4 vs. 43.38% for the best prior method (Liu et al.), a 34.37-point gain.
- On LLaVA-2, MLAI achieves 82.80% average ASR, 12.77 points above the best prior method.
- Black-box transfer to Gemini, ChatGLM, and Qwen yields ASRs of 49.59%, 60.11%, and 54.97% on Illegal Activity, averaged over three scenarios with MiniGPT-4-trained images.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use MLAI instead of Liu et al. | MiniGPT-4 · SafetyBench (13 scenarios average) | ASR: 43.38% -> 77.75%; 34.37% | Helped |
| use MLAI instead of Liu et al. | LLaVA-2 · SafetyBench (13 scenarios average) | ASR: 70.03% -> 82.80%; 12.77% | Helped |
| transfer MLAI images trained on MiniGPT-4 | Gemini, ChatGLM, and Qwen · Black-box (Illegal Activity, Malware Generation, and Physical Harm) | ASR: 49.59%; 60.11%; 54.97% | Mixed |
| replace random initial images with scenario-matched images (ablation) | gradient-based VLM jailbreak attacks · SafetyBench scenarios | ASR | Helped |
| replace scenario-matched initial images with blank images (ablation) | MLAI · SafetyBench (Hate Speech and Fraud) | ASR | Hurt |
| replace scenario-matched initial images with irrelevant images (ablation) | MLAI · SafetyBench (Hate Speech and Fraud) | ASR | Hurt |
| select adversarial images in a loss range and attack collaboratively instead of using only the minimum-loss image (ablation) | gradient-based VLM jailbreak attacks · SafetyBench scenarios | ASR | Helped |
| vary the number of collaborative adversarial images (ablation) | MLAI · SafetyBench (Illegal Activity, Hate Speech, Legal Opinion, and Financial Advice) | ASR | Helped |
| vary the loss-range coefficient rho (ablation) | MLAI · SafetyBench (all scenarios) | ASR: rho=6 | Helped |
| add similarity-based image deduplication defense (ablation) | MLAI on MiniGPT-4 · SafetyBench (Fraud) | ASR: 22.99% | Hurt |
| use adversarial images with lower loss rather than moderately higher-loss images (ablation) | gradient-based VLM jailbreak attacks · multiple models and attack scenarios | ASR | Mixed |
Surprising findings
- Adversarial images with minimal loss do not necessarily yield the highest attack success rate; moderately higher loss images can perform better.
- Images that closely match a harmful scenario can be less effective when they depict the harmful action explicitly, since the model's refusal triggers on harmfulness.
Limitations
- Black-box transfer is evaluated on only 3 scenarios and 60 queries, and shows a 16.43% average drop versus white-box.
- Evaluation relies on a single harmfulness judge (Beaver-dam-7B) and the paper notes scenarios with abstract concepts are hard to visualize, limiting image-based attacks.
Experimental setup
Datasets: SafetyBench AdvBench
Benchmarks: SafetyBench AdvBench
Metrics: attack success rate
Baselines: Plain Text Liu et al. Qi et al.
Builds on: HADES BAP Qi et al. visual adversarial examples flat minima
Closest papers by meaning
- Visual Adversarial Examples Jailbreak Aligned Large Language Models (AAAI 2024 · similarity 0.92)
- Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models (ICLR 2024 · similarity 0.92)
- Attention! Your Vision Language Model Could Be Maliciously Manipulated (NeurIPS 2025 · similarity 0.91)
- Failures to Find Transferable Image Jailbreaks Between Vision-Language Models (ICLR 2025 · similarity 0.90)
- Steering Away from Harm: An Adaptive Approach to Defending Vision Language Model Against Jailbreaks (CVPR 2025 · similarity 0.90)
- JailBound: Jailbreaking Internal Safety Boundaries of Vision-Language Models (NeurIPS 2025 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.