Research map / Adversarial robustness and security / Attacks on text and graphs
MMJ-Bench: A Comprehensive Study on Jailbreak Attacks and Defenses for Vision Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces MMJ-Bench, a unified pipeline and public benchmark that evaluates six jailbreak attacks and four defenses on six open VLMs for attack success, defense effectiveness, and MM-Vet utility.
Problem
Jailbreak attacks and defenses for vision-language models are evaluated on inconsistent datasets, target models, and metrics, so their effectiveness cannot be compared directly.
Approach
A unified four-step evaluation workflow (data collection, jailbreak case generation, response generation, evaluation) that runs all attacks and defenses on the same HarmBench harmful queries and MM-Vet utility tasks with shared metrics (ASR via GPT-4 and HarmBench classifier, MM-Vet score).
Key results
- Across attacks, average ASR is highest for Hades (0.541 under GPT-4 judge) and ADV-inf/ImgJP is highest under HarmBench classifier (0.421 average), while Qwen-VL has the lowest average ASR (0.258 GPT-4, 0.167 HarmBench).
- VLGuard is the most effective defense, reducing ASR to 0 on LLaVA-v1.5 and LLaVA-v1.6 across attacks, but leaves Qwen-VL with residual ASR (e.g., 0.33 under FigStep).
- Detection-based defenses JailGuard and CIDER reduce MM-Vet utility, e.g., CIDER drops LLaVA-v1.5 from 0.31 to 0.19 and Qwen-VL from 0.49 to 0.29.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use Hades rather than the other evaluated attacks | VLM jailbreak attacks · HarmBench | ASR (GPT4): 0.541 | Helped |
| Use ImgJP rather than the other evaluated attacks | VLM jailbreak attacks · HarmBench | ASR (HarmBench classifier): 0.421 | Helped |
| Use generation-based attacks instead of optimization-based attacks | VLM jailbreak attacks · HarmBench | ASR | Mixed |
| Evaluate generation-based attacks with GPT4 rather than the HarmBench classifier | VLM jailbreak attack evaluation · HarmBench | ASR | Helped |
| Apply VLGuard safety fine-tuning | LLaVa-v1.5 and LLaVa-v1.6 · Jailbreak attacks | ASR | Helped |
| Apply VLGuard safety fine-tuning | Qwen-VL · Jailbreak attacks | ASR | Mixed |
| Use AdaShield-A for generation-based attacks | VLM jailbreak defense · FigStep and MM-SafetyBench | ASR | Helped |
| Use CIDER for optimization-based attacks | VLM jailbreak defense · ADV-16, ADV-inf, and ImgJP | ASR | Helped |
| Use detection-based defenses, JailGuard or CIDER | VLMs on normal tasks · MM-Vet | MM-Vet score | Hurt |
| Apply VLGuard or AdaShield-A rather than detection-based defenses | VLMs on normal tasks · MM-Vet | MM-Vet score | Mixed |
Surprising findings
- Lower ASR does not necessarily indicate stronger safety: InstructBLIP and MiniGPT4 appear robust to FigStep partly because they fail to understand the task.
- GPT-4 and the HarmBench classifier disagree on generation-based attack success, with GPT-4 consistently reporting higher ASR.
Limitations
- Only six attacks, four defenses, and six VLM variants are evaluated, and the benchmark is intended to be extended later.
- Evaluation relies on GPT-4 and HarmBench classifier judges, which disagree on several attacks.
- Some defenses (InstructBLIP for VLGuard, MiniGPT4-13b) are missing from the evaluation due to lack of fine-tuning scripts.
Experimental setup
Datasets: HarmBench MM-Vet VLGuard training set
Benchmarks: MMJ-Bench HarmBench MM-Vet
Metrics: attack success rate MM-Vet score ASR reduction
Baselines: FigStep MM-SafetyBench Hades VisualAdv ImgJP AttackVLM VLGuard JailGuard AdaShield CIDER
Builds on: HarmBench MM-Vet FigStep VisualAdv VLGuard
Closest papers by meaning
- The VLLM Safety Paradox: Dual Ease in Jailbreak Attack and Defense (NeurIPS 2025 · similarity 0.93)
- JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models (NeurIPS 2024 · similarity 0.92)
- Retention Score: Quantifying Jailbreak Risks for Vision Language Models (AAAI 2025 · similarity 0.92)
- JailBound: Jailbreaking Internal Safety Boundaries of Vision-Language Models (NeurIPS 2025 · similarity 0.91)
- Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMs (NeurIPS 2024 · similarity 0.91)
- Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment (CVPR 2025 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.