Research map / Vision-language and multimodal / Multimodal LLMs

MIDAS: Multi-Image Dispersion and Semantic Reconstruction for Jailbreaking MLLMs

ICLR 2026 · Vision-language and multimodal › Multimodal LLMs · approach: Benchmarks and analysis of MLLMs · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes MIDAS, a black-box single-shot multi-image jailbreak that disperses decomposed harmful keywords across several game-style puzzle images and uses a sanitized, persona-driven text prompt to make MLLMs reconstruct and act on the hidden intent.

Problem

MLLMs remain vulnerable to jailbreaks, and prior image-based attacks that extend reasoning (single-image masking, isolated visual cues) give limited success, especially against strongly aligned closed-source models.

Approach

Decompose a harmful query into up to three risk-bearing keywords, split each across at least two benign-looking game-style puzzle images (letter equation, jigsaw, rank-and-read, odd-one-out, navigate-and-read, CAPTCHA), replace keywords with placeholders in a hierarchical role-based text prompt, and have the model decode fragments and reassemble harmful intent through cross-image reasoning.

Key results

• MIDAS achieves 93.34% ASR on Gemini-2.5-FT and 84.55% on Gemini-2.5-Pro on HADES, versus at most 65.8% for the best baseline on any model.
• Average ASR of 81.46% across 4 closed-source MLLMs, per the abstract.
• On AdvBench, MIDAS reaches 64% ASR on GPT-5-Chat where FigStep and HIMRD get 0%; runtime on Gemini-2.5-Pro is 190.23 s versus 3357 s for HIMRD.

Surprising findings

• Dispersed MIDAS inputs were classified as safe by a LlamaGuard-style pipeline even though reconstructed outputs conveyed harmful semantics.
• Increasing image count beyond the redundancy boundary did not yield consistent gains and degraded performance for k=2.

Limitations

• Evaluation relies on LLM judges (GPT-5-nano) with scores on a 0-5 scale, and the paper reports no human evaluation.
• Results on GPT-4o are lower (61.49% on HADES, 61.07% on MM-SafetyBench), and InternVL-2.5 reaches only 59.44% on HADES.
• Hyperparameter sweeps and evaluation are reported on a limited set of benchmarks and models.

Experimental setup

Datasets: HADES AdvBench MM-SafetyBench

Benchmarks: HADES MM-SafetyBench (tiny) AdvBench (50-request subset)

Metrics: attack success rate harmfulness rating

Baselines: FigStep HADES SI-Attack VisCRA HIMRD

Builds on: FigStep HADES HIMRD SI-Attack VisCRA

Closest papers by meaning

• Distraction is All You Need for Multimodal Large Language Model Jailbreaking (CVPR 2025 · similarity 0.92)
• SafePTR: Token-Level Jailbreak Defense in Multimodal LLMs via Prune-then-Restore Mechanism (NeurIPS 2025 · similarity 0.91)
• Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment (CVPR 2025 · similarity 0.90)
• When Think-with-Image Meets Safety: What Determines Multimodal Jailbreak Robustness? (NeurIPS 2026 · similarity 0.90)
• Conceal, Reconstruct, Jailbreak: Exploiting the Reconstruction--Concealment Tradeoff in MLLMs (NeurIPS 2026 · similarity 0.89)
• Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategy (CVPR 2025 · similarity 0.89)