Research map / Vision-language and multimodal / Multimodal LLMs

FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts

AAAI 2025 · Vision-language and multimodal › Multimodal LLMs · approach: VLM capability analysis · 58 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes FigStep, a black-box jailbreak that renders harmful instructions as typographic images paired with a benign incitement prompt, bypassing LVLM text safety alignment, and introduces the SafeBench dataset.

Problem

LVLMs inherit safety alignment from their underlying LLMs, but the visual modality may not be safety-aligned, so harmful requests delivered as images can bypass refusals; the paper asks whether LLM safety alignment provides a false sense of safety for LVLMs.

Approach

Convert a paraphrased harmful instruction (e.g., "Steps to manufacture illegal drugs.") into a typographic image with numbered list items, and pair it with a neutral text prompt asking the model to fill in the empty list, so the harmful content never appears in the text channel. Requires only black-box queries and no perturbation optimization.

Key results

• FigStep achieves 82.50% average ASR across six open-source LVLMs versus 44.80% for vanilla text queries on SafeBench.
• On MiniGPT4-Llama-2-CHAT-7B, FigStep reaches 82.60% ASR versus 23.80% for vanilla queries.
• FigStep_pro raises ASR on GPT-4V to 70%, compared with 34% for FigStep and 18% baseline.

Measured effects reported in the paper

Surprising findings

• Embedding analysis shows typographic prompts make benign and harmful query embeddings overlap, while text-only prompts separate them, suggesting visual embeddings are not safety-aligned.
• Stronger safety-aligned Llama-2-based MiniGPT4 is jailbroken at high rates via images, undermining trust in LLM-inherited safety.

Limitations

• Manual evaluation of responses is costly and AI judge underestimates ASR (e.g., 72% vs 92% on LLaVA).
• Effectiveness on GPT-4V/4o is reduced by an OCR-based moderation tool, requiring a multi-image variant.
• Performance depends on the model's OCR and instruction-following ability; MiniGPT4-Vicuna-7B shows hallucinated responses.

Experimental setup

Datasets: SafeBench SafeBench-Tiny LLaVA-Bench-in-the-wild

Benchmarks: SafeBench SafeBench-Tiny

Metrics: attack success rate perplexity

Baselines: Vanilla text query GCG CipherChat DeepInception ICA MultiLingual VRP QR JP VAE

Builds on: GCG Jailbreak in Pieces EasyJailbreak LLaVA-1.5 MiniGPT-4

Closest papers by meaning

• Jailbreaking Vision-Language Models Through the Visual Modality (ICML 2026 · similarity 0.91)
• Safe + Safe = Unsafe? Exploring How Safe Images Can Be Exploited to Jailbreak Large Vision-Language Models (NeurIPS 2025 · similarity 0.91)
• JailBound: Jailbreaking Internal Safety Boundaries of Vision-Language Models (NeurIPS 2025 · similarity 0.90)
• VERA-V: Variational Inference Framework for Jailbreaking Vision-Language Models (ICML 2026 · similarity 0.90)
• When Think-with-Image Meets Safety: What Determines Multimodal Jailbreak Robustness? (NeurIPS 2026 · similarity 0.90)
• When the Prompt Becomes Visual: Vision-Centric Jailbreak Attacks for Large Image Editing Models (ICML 2026 · similarity 0.90)