Research map / Adversarial robustness and security / Attacks on text and graphs

Conceal, Reconstruct, Jailbreak: Exploiting the Reconstruction--Concealment Tradeoff in MLLMs

NeurIPS 2026 · Adversarial robustness and security › Attacks on text and graphs · approach: LLM jailbreak and injection defense · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes concealment-aware character-removal jailbreaks for MLLMs, where the victim reconstructs a hidden harmful query from selected low-keyword-alignment variants, plus keyword-related generated distractor images, reaching up to ~99.7% ASR.

Problem

Obfuscation-based black-box jailbreaks of MLLMs must balance reconstruction (victim recovers the harmful query) against concealment (filters miss the harmful intent), and existing transformations (FlipAttack, SI, CS-DJ) balance this poorly.

Approach

Identifies a reconstruction-concealment tradeoff, shows random character removal balances it better than existing obfuscations, then selects character-removed variants greedily by low CLIP keyword alignment and mutual diversity, distributes them across text/typographic channels in five prompting strategies, and adds keyword-generated distractor images.

Key results

• TTV-GDI reaches 78.67% ASR (GPT judge) on GPT-5.4-nano versus 25.73% for the strongest baseline CS-DJ.
• On Kimi K2.5, TTV-GDI reaches 99.73% ASR_HB versus 27.73% for FlipAttack.
• GDI outperforms generic distractor images (DI) across all seven reported models for TxtV and TTV, e.g., 89.60 vs 77.07 on Llama-3.2-11B-Vision for TxtV.

Surprising findings

• Attack success follows an inverted-U pattern in character-removal ratio, rising then falling as reconstruction degrades.
• Random character removal achieves reconstruction far stronger than FlipAttack, SI, and CS-DJ while matching FlipAttack's concealment.

Limitations

• Evaluation limited to a single dataset (HADES) with single-keyword procedure.
• Multi-trial protocol (max over 5 trials) inflates ASR relative to single-trial evaluation.
• GDI requires an offline image-generation step adding preprocessing cost.

Experimental setup

Datasets: HADES LLaVA-CC3M-Pretrain-595K

Benchmarks: HADES

Metrics: attack success rate toxicity score detailedness exact match edit similarity CLIP similarity

Baselines: FigStep HADES CS-DJ FlipAttack SI

Builds on: FlipAttack CS-DJ SI-Attack HADES FigStep

Closest papers by meaning

• Distraction is All You Need for Multimodal Large Language Model Jailbreaking (CVPR 2025 · similarity 0.90)
• MIDAS: Multi-Image Dispersion and Semantic Reconstruction for Jailbreaking MLLMs (ICLR 2026 · similarity 0.89)
• SafePTR: Token-Level Jailbreak Defense in Multimodal LLMs via Prune-then-Restore Mechanism (NeurIPS 2025 · similarity 0.88)
• Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategy (CVPR 2025 · similarity 0.88)
• FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts (AAAI 2025 · similarity 0.87)
• The VLLM Safety Paradox: Dual Ease in Jailbreak Attack and Defense (NeurIPS 2025 · similarity 0.87)