Research map / Vision-language and multimodal / Multimodal LLMs
Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that benign-looking adversarial images, optimized in CLIP's embedding space to match malicious triggers and paired with generic text prompts, can jailbreak VLMs like LLaVA and LLaMA-Adapter V2 without LLM access.
Problem
Text-only jailbreak defenses in aligned LLMs can be bypassed through the vision modality of vision-language models, and existing image attacks require full white-box access to the VLM, so it is unclear whether attackers with only vision-encoder access can jailbreak VLMs.
Approach
Decompose a harmful prompt into a generic text instruction plus an image whose CLIP embedding matches a malicious trigger (text, OCR text, visual, or combined). The adversarial image is optimized only through the CLIP vision encoder by L2 embedding matching, so the attack needs no LLM access.
Key results
- Combined OCR+visual trigger attacks on LLaVA reach 0.870 average human-judged ASR, versus 0.007 for textual-trigger attacks.
- On LLaMA-Adapter V2, combined-trigger attacks reach 0.633 average ASR, with visual trigger at 0.608 and OCR trigger at 0.604.
- Indirect hidden prompt injection reaches average success of 0.81 on LLaVA and 0.42 on LLaMA-Adapter V2 with the combined trigger.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace the textual trigger target with an OCR textual, visual, or combined trigger target (ablation) | Compositional jailbreak attack on LLaVA · 8 jailbreak scenarios (Avg.) | ASR: 0.007 -> 0.849; 0.007 -> 0.849; 0.007 -> 0.870 | Helped |
| Replace the textual trigger target with an OCR textual, visual, or combined trigger target (ablation) | Compositional jailbreak attack on LLaMA-Adapter V2 · 8 jailbreak scenarios (Avg.) | ASR: 0.006 -> 0.604; 0.006 -> 0.608; 0.006 -> 0.633 | Helped |
| Use combined OCR textual and visual trigger targets instead of an OCR textual or visual target (ablation) | Compositional jailbreak attack on LLaVA · 8 jailbreak scenarios (Avg.) | ASR: 0.849 -> 0.870 | Helped |
| Use combined OCR textual and visual trigger targets instead of an OCR textual or visual target (ablation) | Compositional jailbreak attack on LLaMA-Adapter V2 · 8 jailbreak scenarios (Avg.) | ASR: 0.604 -> 0.633; 0.608 -> 0.633 | Helped |
| Replace a textual trigger target with an OCR textual trigger target (ablation) | Jailbreak attack on LLaMA-Adapter V2 · Jailbreak outputs | Perspective Tox.: 2.28 -> 33.21 | Helped |
| Replace an OCR textual trigger target with a visual trigger target (ablation) | Jailbreak attack on LLaMA-Adapter V2 · Jailbreak outputs | Perspective Tox.: 33.21 -> 36.26 | Helped |
| Use combined OCR textual and visual trigger targets instead of visual trigger targets (ablation) | Jailbreak attack on LLaMA-Adapter V2 · Jailbreak outputs | Perspective Tox.: 36.26 -> 46.74 | Helped |
| Use combined visual and OCR trigger targets instead of visual trigger targets (ablation) | Indirect hidden prompt injection on LLaVA · Indirect hidden prompt injection (Avg.) | ASR: 0.75 -> 0.81 | Helped |
| Use combined visual and OCR trigger targets instead of OCR textual trigger targets (ablation) | Indirect hidden prompt injection on LLaMA-Adapter V2 · Indirect hidden prompt injection (Avg.) | ASR: 0.40 -> 0.42 | Helped |
Surprising findings
- Adversarial images optimized toward textual CLIP embeddings almost never jailbreak (ASR around 0.7%), attributed to the modality gap in CLIP's embedding space.
- Direct hidden prompt injection via adversarial images succeeds only rarely, often below 0.2 at temperature 1.0, because CLIP-trained models treat images as descriptions rather than instructions.
Limitations
- Human-only evaluation by three annotators; no standardized automatic ASR metric as used in prior work.
- Results on LLaMA-Adapter V2 are lower, which the authors attribute to weaker image understanding rather than greater safety.
- Direct hidden prompt injection success is low, with abstract instruction targets being hard to embed.
Experimental setup
Datasets: AdvBench OpenAI prohibited usage scenarios (8 categories)
Benchmarks: OpenAI prohibited scenarios (8 categories, custom) AdvBench subset
Metrics: attack success rate toxicity score Fleiss' Kappa
Baselines: Textual trigger OCR textual trigger Visual trigger
Builds on: LLaVA CLIP AutoPrompt Adam
Closest papers by meaning
- Visual Adversarial Examples Jailbreak Aligned Large Language Models (AAAI 2024 · similarity 0.93)
- Exploring Visual Vulnerabilities via Multi-Loss Adversarial Search for Jailbreaking Vision-Language Models (CVPR 2025 · similarity 0.92)
- Failures to Find Transferable Image Jailbreaks Between Vision-Language Models (ICLR 2025 · similarity 0.91)
- VERA-V: Variational Inference Framework for Jailbreaking Vision-Language Models (ICML 2026 · similarity 0.90)
- JailBound: Jailbreaking Internal Safety Boundaries of Vision-Language Models (NeurIPS 2025 · similarity 0.90)
- Jailbreaking Vision-Language Models via Dissonance-Guided Suffix Optimization and Image-Phrase Injection (CVPR 2026 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.