Research map / Vision-language and multimodal / Multimodal LLMs
Safe + Safe = Unsafe? Exploring How Safe Images Can Be Exploited to Jailbreak Large Vision-Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that seemingly safe images plus safe prompts can make LVLMs produce harmful content, and proposes Safety Snowball Agent (SSA), an agent that generates jailbreak images with tools and snowballs harmful multi-turn responses.
Problem
LVLM safety guardrails may not cover risks introduced by the visual modality; existing jailbreaks exploit alignment flaws with crafted harmful inputs, whereas this work asks whether safe inputs alone can trigger harmful outputs.
Approach
Combine an LVLM's universal reasoning (overinterpreting relations between safe images and text) with a "safety snowball effect" (an initial committed response makes later harmful responses easier), orchestrated by an agent that retrieves or synthesizes jailbreak images and iteratively prompts the target model.
Key results
- SSA reaches 88.6% jailbreak success rate on MM-SafetyBench against GPT-4o, versus at most 0.93 baseline (SD) for GPT.
- On SafeAttack-Bench, GPT-4o harmfulness score rises from 0.67 (direct) to 4.45 with SSA.
- Harmfulness scores for snowball responses to safe images are comparable to unsafe images (4.45 vs 4.48 on GPT).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply SSA instead of TYPO on MM-SafetyBench | GPT-4o · MM-SafetyBench | JSR: 0.006 -> 0.886 | Helped |
| Apply SSA instead of SD on MM-SafetyBench | Qwen-VL2 · MM-SafetyBench | JSR: 0.392 -> 0.881 | Helped |
| Apply SSA instead of TYPO_SD on MM-SafetyBench | Intern-VL · MM-SafetyBench | JSR: 0.402 -> 0.866 | Helped |
| Apply SSA instead of TYPO_SD or TYPO on MM-SafetyBench | VILA · MM-SafetyBench | JSR: 0.897 -> 0.882 | Mixed |
| Add initial response using SSA (ablation) | GPT-4o · SafeAttack-Bench | harmfulness score (Average): 0.67 -> 2.45 | Helped |
| Add initial response using SSA (ablation) | Intern-VL · SafeAttack-Bench | harmfulness score (Average): 0.70 -> 2.15 | Helped |
| Add initial response using SSA (ablation) | VILA · SafeAttack-Bench | harmfulness score (Average): 1.84 -> 1.71 | Hurt |
| Add initial response using SSA (ablation) | Qwen-VL2 · SafeAttack-Bench | harmfulness score (Average): 0.95 -> 1.91 | Helped |
| Add a jailbreak image without unsafe context (ablation) | GPT-4o SSA · SafeAttack-Bench | harmfulness score (Average): 0.67 -> 2.45 | Helped |
| Add unsafe context without a jailbreak image (ablation) | GPT-4o SSA · SafeAttack-Bench | harmfulness score (Average): 0.67 -> 2.16 | Helped |
| Add unsafe context when the jailbreak image is present (ablation) | GPT-4o SSA · SafeAttack-Bench | harmfulness score (Average): 2.45 -> 4.45 | Helped |
| Add a jailbreak image when unsafe context is present (ablation) | GPT-4o SSA · SafeAttack-Bench | harmfulness score (Average): 2.16 -> 4.45 | Helped |
Surprising findings
- Safe images can yield harmfulness scores on par with or above unsafe images, e.g., 4.45 vs 4.48 for GPT.
- Activation patterns of top unsafe neurons are similar for safe and unsafe image jailbreaks when unsafe content is generated.
Limitations
- Attack targets are black-box APIs or hosted open models, with evaluation depending on GPT-4o as judge.
- Reliance on GPT-4o for intent recognition and evaluation; judge-based harmfulness scores are subjective.
- SafeAttack-Bench is small (269 images) and the paper does not clearly release it.
Experimental setup
Datasets: MM-SafetyBench COCO ImageNet Celebrity Face Politics 101
Benchmarks: MM-SafetyBench SafeAttack-Bench
Metrics: jailbreak success rate harmfulness score (0-5)
Baselines: Direct query SD TYPO TYPO_SD
Builds on: MM-SafetyBench prefilling attacks CLIP
Closest papers by meaning
- When Think-with-Image Meets Safety: What Determines Multimodal Jailbreak Robustness? (NeurIPS 2026 · similarity 0.92)
- JailBound: Jailbreaking Internal Safety Boundaries of Vision-Language Models (NeurIPS 2025 · similarity 0.92)
- SafePTR: Token-Level Jailbreak Defense in Multimodal LLMs via Prune-then-Restore Mechanism (NeurIPS 2025 · similarity 0.91)
- FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts (AAAI 2025 · similarity 0.91)
- Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategy (CVPR 2025 · similarity 0.91)
- Risk Awareness Injection: Calibrating Vision-Language Models for Safety without Compromising Utility (ICML 2026 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.