{"id":"c9e90f07-9bc2-49c6-ad9b-1fca534031d8","arxiv_id":"2412.05892","paper_version":4,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"PBI-Attack jailbreaks LVLMs without gradients by first injecting harmful text features into a benign image with a surrogate model, then alternating greedy text and image tweaks to maximize a toxicity scorer.","lead":"This paper presents PBI-Attack, a black-box jailbreak method for vision-language models that embeds harmful features into an image, then alternates greedy text and image perturbations to maximize toxicity. It reports attack success rates above 92% on open models and around 67% on GPT-4, Gemini, and Qwen-VL, outperforming ten prior jailbreak methods.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Reported ASR may be inflated by test-set leakage: Stage-1 optimization uses the same harmful corpus (likely the 520 AdvBench test prompts) as evaluation, making the attack overfit to the benchmark.","rationale":"After reading the paper, the most load-bearing condition for the central claim is the validity of the reported ASR. The reader's weakest assumption was transferability across model encoders, but the manuscript itself contains a more direct threat: the same harmful corpus appears to be used both for generating the visual prior (Stage 1, Eq. 2) and for evaluation on the standard 520-prompt AdvBench set. Since the optimization explicitly maximizes toxicity for each y_i in Y, any overlap between Y and the test set constitutes train/test leakage. This would inflate all claimed numbers and make the comparison against baselines unfair. This concern is concrete and checkable: a held-out evaluation with a disjoint Y would immediately reveal whether the reported advantage persists. I therefore recommend moving the verdict to REJECT pending this test, rather than the reader's CONDITIONAL, because the current evidence cannot support the central empirical claim if the overlap is confirmed. I agree with the reader only partially, as they noted the overlap as one of several concerns but did not make it the primary risk.","tokens_in":18741,"tokens_out":11200,"duration_ms":108314,"concrete_test":"Rerun the full PBI-Attack pipeline with a Stage-1 harmful corpus Y that is disjoint from the evaluation prompts, for example by using a separate set of 520 harmful instructions from a different benchmark (e.g., HarmBench) or by holding out a random 50% of AdvBench for evaluation only. Compare the resulting ASR with the numbers in Table 1 on the disjoint set. Additionally, report the Jaccard overlap between Y and the test prompts. If ASR drops by more than 10-15 percentage points on the disjoint set, or if the overlap is non-zero and ASR is higher on overlapping prompts, the current headline results are inflated by test-set leakage.","verdict_should_be":"REJECT","load_bearing_attack":"The central claim is that PBI-Attack achieves 92.5% ASR on open-source and 67.3% on closed-source LVLMs, outperforming ten baselines. For this claim to be valid, the attack must be evaluated on prompts not used during optimization. However, Section 5.1 states 'We use the same harmful content corpus to optimize benign images, following previous work (Qi et al., 2024)' while the test set is '520 prompts from AdvBench'. In Stage 1 (Algorithm 1, Eq. 2), the adversarial image is optimized by maximizing sum_i -T(x_adv, y_i) over the corpus Y = {y_i}. If Y includes or overlaps the 520 evaluation prompts, then the image is directly tuned to the test inputs, and the reported ASR reflects overfitting rather than black-box transferability. The paper does not report any held-out evaluation or the overlap ratio between Y and the test set. Since Qi et al. (2024) used AdvBench for both optimization and evaluation, the wording strongly suggests a train/test overlap. This would disadvantage baselines that do not optimize on the test set and would make the claimed improvements unreliable.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes PBI-Attack, a two-stage jailbreak attack against large vision-language models (LVLMs) that operates under a black-box threat model. In Stage 1, an adversarial image is produced by embedding features of a harmful corpus into a benign image using a surrogate LVLM's feature extractor and a toxicity scorer. In Stage 2, the image and text are alternately refined by greedy search to maximize response toxicity. Experiments on AdvBench report an average ASR of 92.5% on three open-source LVLMs (MiniGPT-4, InstructBLIP, LLaVA) and 67.3% on three closed-source LVLMs (Gemini, GPT-4, Qwen-VL), outperforming ten baselines. Ablations cover surrogate-model choice, initialization, and defenses.","tokens_in":19042,"tokens_out":6742,"duration_ms":61214,"significance":"If the reported results are reliable, this is a meaningful contribution: it demonstrates that a query-only attacker with a surrogate encoder and a toxicity API can jailbreak commercial LVLMs, and that alternating cross-modal greedy optimization is a practical and effective mechanism. The paper includes several valuable ablations (surrogate transfer in Tables 4-5, initialization in Table 3, stage-wise gains in Table 11) and releases its code. However, the main claim currently rests on an evaluation whose train/test separation is unverified, and the central optimization step in Eq. (3) is not fully specified, so the significance cannot be assessed without those issues being resolved.","major_comments":[{"comment":"The paper states in §5.1 that \"We use the same harmful content corpus to optimize benign images, following previous work (Qi et al., 2024)\" while the test set is \"520 prompts from AdvBench.\" Qi et al. (2024) used AdvBench as their evaluation set, so the corpus used in Stage 1 likely equals or overlaps the test prompts. Because Eq. (2) sums the toxicity loss over that corpus, the adversarial image is directly optimized on the test inputs, which would inflate the ASR in Table 1 relative to baselines that do not optimize on the test set. The authors must specify the corpus composition and either use a disjoint held-out set for evaluation or report the overlap ratio; without this, the central empirical claim is unreliable.","section":"§5.1, Eq. (2)"},{"comment":"The update rule xp_adv = h^{-1}(h(xp_adv) - η∇L(xadv)) requires an inverse of the image feature extractor h(·), but h is not defined as invertible and no method for computing h^{-1} is given. Similarly, the superimposition operator ⊕ in Eq. (1) is described only as \"through an image feature extraction function h(·)\", which is not a concrete definition. These undefined operations are central to the algorithm, so the method is not reproducible from the paper. The authors should either define h^{-1} and ⊕ precisely or provide pseudocode that specifies how embedding-space updates are mapped back to image-space perturbations.","section":"§4.1, Eq. (3)"},{"comment":"The threat model in §3.2 states that \"The attacker has only black-box access to the target LVLM,\" but for the three open-source models the experiments use the target model itself as the surrogate (\"For open-source models, we utilize themselves as surrogate model\"). This means the open-source results require white-box access to the target's feature extractor, contradicting the stated threat model. The black-box claim should be explicitly scoped to the closed-source results (where MiniGPT-4 is the surrogate), and the open-source experiments should be described as a white-box or same-model setting; otherwise the title's \"Black-Box Jailbreak Attack\" overstates the contribution.","section":"§3.2 vs. §5.2"},{"comment":"The text claims that PBI-Attack \"performs comparably to top baselines in the low-budget regime (83.3% at 10h)\" and \"substantially surpasses all competitors when given more time.\" However, Table 7 shows UMK at 85.4% at 10h, which is higher than PBI's 83.3%, and at 5h UMK is 68.2% versus PBI's 66.6%. Only at 20h does PBI lead (94.2% vs. UMK 87.5%), but that comparison is confounded by PBI's longer training time (27.9h vs. under 10h for baselines in Table 6). The fixed-budget analysis should be reported with honest wording, and the total number of queries per attack should be stated, since query cost is the primary metric for a black-box attack.","section":"§5.2, Table 7"}],"minor_comments":[{"comment":"The conclusion says \"achieving an average attack success rate of 92.5% on three black-box LVLMs and 67.3% on three white-box LVLMs,\" which is the reverse of the results in Table 1 (92.5% on white-box/open-source, 67.3% on black-box/closed-source). This seems to be a typo and should be corrected.","section":"§7"},{"comment":"The abstract uses \"open-source\" and \"closed-source\" while the full text frequently uses \"white-box\" and \"black-box\"; these sets are not exactly the same (white-box access is assumed for open-source models in the experiments). The terminology should be aligned throughout.","section":"Abstract"},{"comment":"The greedy text-suffix selection requires querying the target model for each candidate suffix in the corpus Y^s, but the size of Y^s and the total number of queries per attack are not reported. The paper only mentions \"the number of candidates to 400\" for the text suffix, which is ambiguous.","section":"Algorithm 1, line 9"},{"comment":"The sentence \"We use the same harmful content corpus to optimize benign images, following previous work (Qi et al., 2024)\" is vague; even if the corpus is not the test set, the authors should name the corpus and report its size and content.","section":"§5.1, Datasets"},{"comment":"The attention-score visualization is qualitative and shows only one example; a quantitative measure (e.g., averaged attention change over the test set) would be more informative.","section":"Figure 3"},{"comment":"There are duplicate entries for Li et al. (2024b) and Li et al. (2025b) (same title \"Images are achilles' heel of alignment...\"), and a reference with an incomplete author list (\"Cheng et al.\" without year). These should be cleaned up.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper has a strong core idea and useful ablations, but the main empirical claim currently depends on an unverified separation between the harmful corpus used for prior optimization and the test prompts. If the corpus overlaps the test set, the reported ASR would be an artifact of overfitting rather than transferability. The undefined h^{-1} in Eq. (3) and the threat-model mismatch for open-source models also need to be fixed before the contribution can be assessed. I would recommend asking the authors to rerun the main evaluation with a disjoint corpus or to report the overlap and re-analyze the results accordingly."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Best read as an empirical red-teaming contribution. The two-stage idea—surrogate-learned visual prior, then alternating greedy text-suffix and image-prefix search against a toxicity scorer—is not in the cited baselines, and the ablations (Table 11, Table 3) make a decent case that both stages earn their keep. The code link and three-repeat standard deviations are also in the paper's favor.\n\nThe soft spots are real but fixable. The biggest is the potential test-set leakage. Section 5.1 says the harmful corpus used to optimize benign images is the same as in Qi et al. 2024, and the test set is 520 AdvBench prompts. If that corpus overlaps those 520 prompts, Stage 1 literally tunes the prior image against the evaluation prompts, and the gap over baselines (especially Advimage, its closest relative) is inflated. The paper needs a held-out split or at least an overlap measurement. This is not a side issue; it's the difference between a transferable attack and a benchmark overfit.\n\nSecond, Eq. (3) updates xp_adv via h^{-1}(...) without defining h^{-1} or explaining how an embedding-space update maps back to pixels. The text says it follows Wang et al. 2024b, but readers can't reproduce Stage 1 from the paper alone. That's a genuine method-section gap.\n\nThird, the \"first\" claim in the Limitations section—'first adversarial jailbreak attack method that performs iterative optimization based on the target model's response'—is not supported and is probably false; UMK and Arondight do query-based iterative optimization. The related work and contributions should be toned down.\n\nMinor: the abstract and conclusion swap 'white-box' and 'black-box' in the opening sentence of the conclusion (92.5% on three 'black-box' LVLMs vs 67.3% on three 'white-box' LVLMs); the tables show the reverse. Needs a typo fix.\n\nThe central idea holds up: using a surrogate to embed a harmful-feature prior, then bimodal greedy search, is a plausible transferable attack, and the transfer tables (Table 4/5) suggest it generalizes across surrogates. But the reported advantage over Advimage (the closest baseline) is exactly where the leakage concern bites hardest.\n\nWho is this for: red-teamers and safety evaluators who want a practical black-box baseline. Deserves a serious referee; I'd send it out, but with the leakage question as the first thing the authors must resolve. My own verdict: not ready as-is, but likely salvageable.","headline":"A useful black-box jailbreak recipe with strong reported numbers, but the train/test overlap and the undefined feature inversion need to be resolved before the headline ASR is credible.","tokens_in":19561,"tokens_out":2413,"would_cite":false,"duration_ms":23566,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A query-only attack that embeds harmful text features into an image with a surrogate LVLM and then greedily alternates text and image perturbations reaches 92.5% attack success on open LVLMs and 67.3% on closed LVLMs.","keywords":["jailbreak attack","vision-language models","black-box attack","adversarial perturbation","toxicity maximization","bimodal optimization","transferable attack","red teaming"],"falsifier":"Run PBI-Attack against a closed-source LVLM whose vision encoder is from a different architectural family than the surrogate (for example, an encoder trained without contrastive language-image pretraining) and measure ASR; a drop to the without-attack baseline would show the transferability assumption fails.","tokens_in":18556,"feed_emoji":"🔓","tokens_out":8785,"duration_ms":70490,"temperature":0.7,"pith_summary":"The paper proposes PBI-Attack, a two-stage jailbreak method for large vision-language models (LVLMs) that operates without access to the target model's gradients. Stage one uses a white-box surrogate LVLM to extract features from a harmful-text corpus and embed them into a benign image, creating a transferable prior. Stage two alternates greedy search over text suffixes and image perturbations, each step choosing the candidate that maximizes an external toxicity scorer's response. On 520 AdvBench prompts, the method reports average attack success rates of 92.5% on MiniGPT-4, InstructBLIP, and LLaVA, and about 67.3% on Gemini, GPT-4, and Qwen-VL, outperforming ten baselines.","feed_headline":"Blind attack cracks six vision-language models, up to 92.5%","feed_subtitle":"Surrogate-embedded toxic image plus greedy text swap beats ten baselines on GPT-4, Gemini, Qwen.","key_machinery":"The central object is the two-stage objective and alternating greedy loop. Stage 1 minimizes $L(x_{\\mathrm{adv}}) = \\sum_i [-T(x_{\\mathrm{adv}}, y_i) + \\lambda \\|h(x_{\\mathrm{adv}}) - g(y_i)\\|]$, where $T$ is an external toxicity scorer, $h$ and $g$ are surrogate image and text encoders, and optimization is projected gradient descent in the encoder's feature space. Stage 2 greedily selects from candidate pools the text suffix $y$ and image perturbation $x$ that maximize $T(x_{\\mathrm{adv}}, y_{\\mathrm{adv}})$ at each step, alternating modalities until a toxicity threshold is reached.","core_discovery":"The central claim is that black-box jailbreaking of an LVLM can be decomposed into two cooperating optimizations. First, in the embedding space of a surrogate LVLM, a benign image is aligned with the text embeddings of a harmful corpus while the same image is simultaneously pushed to raise a toxicity scorer's output. Second, a loop greedily appends the text suffix that most increases toxicity for the current image, then superimposes the image perturbation that most increases toxicity for the updated text; the paper argues this bidirectional alternation, rather than unimodal or one-shot optimization, is what produces the high success rates.","pith_inferences":["Because the recipe needs only a feature extractor and a scorer, the same two-stage template should port to other safety domains such as privacy leaks or misinformation by swapping the scorer; the paper does not test this.","The closed-source success rate of about 67.3% may be an upper bound for current encoder families, since a future closed model with a sufficiently different vision encoder could break the transferability assumption.","The method's cost, with ten queries averaged per candidate and thousands of iterations, limits practical use; a variance-reduction scheme could cut queries without necessarily losing success, but the paper does not explore this."],"forward_implications":["A query-only attacker who has a surrogate LVLM and a public toxicity API can jailbreak commercial multimodal models such as GPT-4 and Gemini at success rates above 63%.","Alternating greedy optimization across image and text outperforms optimizing each modality separately or in a one-way interaction.","An external toxicity score is a usable black-box training signal for jailbreak optimization even when the model's jailbreak probability is unavailable.","Adversarial images optimized on open-source surrogates transfer to closed-source targets, so white-box access to the specific target is not required.","Random input perturbation and a safety-centric system prompt reduce attack success but do not fully block it."],"supporting_citations":[{"why":"Supplies the harmful content corpus and the Advimage baseline whose setup the paper follows.","marker":"Qi et al., 2024"},{"why":"Provides the AdvBench test prompts and the GCG baseline.","marker":"Zou et al., 2023"},{"why":"Provides the UMK baseline and the feature-space projected gradient descent template used in Stage 1.","marker":"Wang et al., 2024b"},{"why":"Supplies the greedy candidate-selection strategy used in the bimodal loop.","marker":"Yin et al., 2024"},{"why":"Provides the Detoxify toxicity classifier used as an optimization and evaluation signal.","marker":"Hanu and Unitary team, 2020"},{"why":"Supplies the HarmBench-based attack success rate evaluation.","marker":"Mazeika et al., 2024"},{"why":"Supplies MiniGPT-4, the main surrogate and a white-box target.","marker":"Zhu et al., 2023"},{"why":"Supplies BLIP, the feature extractor used for image and text embeddings.","marker":"Li et al., 2022"}],"fun_headline_variants":["Black-box bimodal jailbreak tops 92.5% on six LVLMs","Surrogate-guided attack cracks GPT-4, Gemini at up to 92%","Prior-guided interactive jailbreak beats ten baselines","Toxic image and greedy text swap break open- and closed-source VLMs","Alternating bimodal optimization hits 92.5% attack success rate"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack assumes that an image optimized in the feature space of a surrogate LVLM, through the loss in Eq. (2), will carry its harmful features across to a different black-box target model; if the target's image encoder is too different, the prior may not transfer and the greedy search starts from a weak initialization.","fun_headline_variants_meta":{"raw":{"variants":["Black-box bimodal jailbreak tops 92.5% on six LVLMs","Surrogate-guided attack cracks GPT-4, Gemini at up to 92%","Prior-guided interactive jailbreak beats ten baselines","Toxic image and greedy text swap break open- and closed-source VLMs","Alternating bimodal optimization hits 92.5% attack success rate"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000184,"raw_usage":{"total_tokens":1298,"prompt_tokens":904,"completion_tokens":394,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":520,"completion_tokens_details":{"reasoning_tokens":297}},"tokens_in":520,"tokens_out":394,"duration_ms":4662,"temperature":1.0,"reasoning_tokens":297,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T20:13:33.245262+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run PBI-Attack against a closed-source LVLM whose vision encoder is from a different architectural family than the surrogate (for example, an encoder trained without contrastive language-image pretraining) and measure ASR; a drop to the without-attack baseline would show the transferability assumption fails.","supporting_citations":[],"review_version":1}