{"id":"67337707-048b-42df-9293-a945fe62f1d6","arxiv_id":"2412.05934","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A black-box jailbreak method distributes harmful semantics across text and image inputs and uses heuristic search to induce multimodal LLMs to answer harmful queries.","lead":"This paper introduces HIMRD, a black-box jailbreak attack that splits a malicious prompt into text and image parts and then searches for prompts that make multimodal AI models output harmful content. It reports high success rates on seven open-source and three commercial multimodal models, highlighting cross-modal safety gaps that defenses will need to address.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The reported ASR likely overstates attack effectiveness: the evaluation treats long non-refusal outputs as affirmative, and the inducing-search stop condition rewards any non-refusal response, so irrelevant or partially compliant outputs may be counted as jailbreaks.","rationale":"The reader identified the same load-bearing weak point: the evaluation protocol may count long, non-refusal outputs as successful jailbreaks, and the closed-source sample is small. My reading of Supplementary A.3 strengthens this: the I(·) stop condition for the inducing search returns 1 for any non-refusal output, so the attack is partially optimized against a refusal-avoidance proxy rather than against a strict semantic-harm criterion. That makes the reported ASR vulnerable to inflation even if every displayed example is a true jailbreak. I do not see a separate fatal flaw: the threat model is black-box; the method is fully described with code; the ablations isolate the contribution of the search stages; the representation-space analysis is supportive; and the comparison to Jailbreak in Pieces in the supplementary, while only on 90 samples, shows a modest but plausible improvement. The unresolved metric ambiguity is exactly why the paper should remain CONDITIONAL rather than REJECT: the attack demonstrably produces harmful outputs on some samples, but the quantitative claim of 90%/68% average ASR is not established until outputs are re-scored under a strict semantic criterion. My proposed test directly settles this, so the reader's verdict needs no change.","tokens_in":25697,"tokens_out":7287,"duration_ms":71726,"concrete_test":"Re-annotate all 210 closed-source victim outputs and a stratified random sample of 50 outputs per open-source model (350 total) with two human annotators, classifying each as: (a) directly provides actionable harmful instructions for the exact malicious target; (b) long but irrelevant, generic, or only partially compliant; or (c) refusal/evasive. Recompute ASR using only category (a) and compare with the paper's reported ASR; if the gap exceeds 10 percentage points, the lenient dual-criteria protocol is inflating the results. Compute bootstrap 95% confidence intervals on the closed-source 70-sample averages to check whether the claimed lead over baselines is significant.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is the quantitative ASR (90.86% open-source, 68.09% closed-source), so the success metric is load-bearing. Supplementary A.3 defines the refusal-detection protocol as: an output is refusal if it contains any predefined refusal prefix; otherwise it is deemed affirmative only when word count >= α=40. The evaluation function I(·) used to stop the inducing search returns 1 whenever the output lacks a refusal prefix, regardless of whether HarmBench judges the content harmful or on-target. Thus the search optimizes primarily for long, non-refusing text, and if the final ASR inherits this dual-criteria rule (as the supplementary wording suggests), generic or partially compliant 40+ word outputs are counted as successes. The shown attack examples are genuinely harmful and the method clearly works on some samples, but the headline numbers are not a clean measure of semantic jailbreak success. The closed-source average is also based on 70 samples per model, so a handful of misclassified outputs moves the average by several points.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes HIMRD, a black-box jailbreak attack against multimodal large language models (MLLMs). The method splits a malicious prompt into two seemingly harmless parts: one part is embedded as typographic text in an image and the other is placed in the user text prompt. A heuristic search, driven by an auxiliary LLM, iteratively refines two text components, an understanding-enhancing prompt pu and an inducing prompt pi, to make the target MLLM reconstruct the malicious intent and answer affirmatively. Experiments on seven open-source MLLMs and three closed-source MLLMs report average attack success rates of 90.86% and 68.09%, respectively, outperforming several baselines including FigStep and MM-SafetyBench. The paper also includes ablations, a representation-space analysis, and additional experiments on SORRY-Bench.","tokens_in":25915,"tokens_out":5080,"duration_ms":47066,"significance":"If the reported ASR numbers are accurate, the paper demonstrates a practical, black-box attack that bypasses current MLLM safety alignment by distributing harmful semantics across text and visual modalities. The method is simple, code is released, and the evaluation covers multiple open- and closed-source models with comparisons to strong baselines. The two-stage search for understanding-enhancing and inducing prompts is a useful contribution, and the representation visualization in Figure 5 offers some mechanistic insight. However, the headline quantitative claims rest on an evaluation protocol that may count long non-refusal outputs as successes, and the closed-source results are based on only 70 samples per model. These issues need to be resolved before the reported ASR values can be accepted as a clean measure of semantic jailbreak effectiveness.","major_comments":[{"comment":"","section":"Supplementary A.3 and Section 4.1"},{"comment":"","section":"Section 4.3"},{"comment":"","section":"Table 5 and Section B.2"},{"comment":"","section":"Equations (8)-(10) and Algorithm 1"}],"minor_comments":[{"comment":"","section":"Table 3"},{"comment":"","section":"Section 3.1"},{"comment":"","section":"Table 5"},{"comment":"","section":"Section 4.5 and Figure 5"},{"comment":"","section":"References"},{"comment":"","section":"Table 1 and Table 4"}],"recommendation":"major_revision","confidential_remarks":"The paper presents a plausible and practical attack, and the shown examples are genuinely harmful, so the work is within scope for a security venue. The main blocker is the evaluation: the ASR definition is ambiguous and appears lenient, and the closed-source results are statistically fragile. If the authors can clarify and tighten the evaluation, and re-report the numbers under a stricter protocol, the paper would be much stronger. I would also encourage checking the arithmetic in Table 3 and the typos throughout, as they undermine confidence in the experimental reporting."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Dear colleague,\n\nThe gist: HIMRD is a real black-box jailbreak that distributes a harmful prompt across text and image and then searches for two prompt types. The examples shown are genuinely harmful, and the code is out. But the headline ASR numbers should be read with caution: the success criterion is lenient, and the closed-source numbers rest on 70 samples per model.\n\nWhat's new: the specific combination of multimodal risk distribution with the two-stage heuristic search for understanding-enhancing and inducing prompts. The risk-distribution idea itself is close to Jailbreak in Pieces, which only appears in the supplementary comparison; the main text should have positioned against it. The search over pu and pi is the more distinctive piece. Ten victim models, ablations, time-cost comparison, and a defense-resistance test are all there; that is solid work for an attack paper.\n\nSoft spots, in order of weight. First, the evaluation protocol: per Supplementary A.3, a response counts as affirmative if it lacks a refusal prefix and has at least 40 words. The I(·) function used to stop the inducing search returns 1 whenever there is no refusal prefix, regardless of whether the content is on-target. So part of the reported ASR probably includes irrelevant or partially compliant long outputs. The four shown examples are genuinely harmful, so the method works, but the 90.86% and 68.09% figures are not a clean measure of semantic jailbreak success. Second, the closed-source experiments use 70 samples per model; a handful of misclassified outputs shifts the average by several points. Third, the attack is optimized with the same HarmBench judge that later measures ASR; that is standard for jailbreak papers and not fatal, but it should be stated. Fourth, Table 5's \"HIMRD with defense\" lacks implementation details, so the defense-resistance claim is under-supported.\n\nThe math and threat model are straightforward and coherent; no circular derivation.\n\nI'd send this to a serious referee. The work is useful for red-teaming and defense research, and the core attack idea is plausible. But the revision should tighten the evaluation protocol, report error bars or larger closed-source samples, and move the Jailbreak in Pieces comparison into the main text.\n\nRecommendation: accept for peer review, expect major revision.","headline":"A plausible and well-engineered multimodal jailbreak whose headline ASR numbers are inflated by a lenient success criterion and small closed-source samples, but the core attack idea is real and worth a serious referee.","tokens_in":26449,"tokens_out":1925,"would_cite":true,"duration_ms":17747,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A black-box attack that splits a malicious prompt across text and image bypasses current MLLM safety mechanisms.","keywords":["jailbreak attack","multimodal large language models","black-box attack","safety alignment","typographic attack","risk distribution","heuristic search","attack success rate"],"falsifier":"Re-score the generated outputs with human annotation or a stricter classifier that requires the requested harmful procedure to actually appear; if success drops far below 90 percent, the practical threat claim is overstated. A second check: feed only the textual fragment (no typographic image) to the same models; if the success rate does not fall substantially, the multimodal distribution is not doing the causal work the paper assigns it.","tokens_in":25524,"feed_emoji":"🔓","tokens_out":6730,"duration_ms":59669,"temperature":0.7,"pith_summary":"The paper proposes HIMRD, a black-box jailbreak attack that splits a harmful request into two fragments so that neither the text nor the image alone carries the full harmful intent. An automated heuristic search then crafts two textual prompts — an understanding-enhancing prompt and an inducing prompt — that lead the model to reassemble the fragments and produce a harmful answer. Reported attack success rates average 90.86% across seven open-source multimodal LLMs and 68.09% across three closed-source ones, beating six prior methods. If the results hold, the central lesson is that current MLLM safety alignment inspects each modality separately and can be evaded by distributing semantics across modalities without any gradient access.","feed_headline":"Jailbreak splits its payload across text and image: 90% success","feed_subtitle":"Two auto-searched prompts make models reassemble the split phrase; open models fail 90% of the time.","key_machinery":"The central mechanism is multimodal risk distribution combined with heuristic-induced search. Risk distribution (Eqs. 5–7) uses an auxiliary LLM to split the malicious prompt $t$ into $t_1$ and $t_2$, requiring the judge $J$ to classify each fragment as harmless while $t_1 \\oplus t_2 = t$; the fragments are placed in a typographic image and in the text respectively. Heuristic-induced search (Eqs. 8–11) then iteratively generates an understanding-enhancing prompt $p_u$ that pushes the model to reconstruct the full intent in its completion, and an inducing prompt $p_i$ that biases the model toward an affirmative answer; both are scored by binary evaluation functions, and failed prompts are stored to guide the next candidates. This two-stage loop is what turns a semantically split input into a concrete harmful output.","core_discovery":"The central claim is that a malicious prompt $t$ can be decomposed into two parts $t_1$ and $t_2$ such that each part individually passes a safety judge ($J(t_1)=J(t_2)=0$) while the concatenation $t_1 \\oplus t_2 = t$ remains harmful. HIMRD places one part in a typographic image and the other in the text, adds an image caption generated by a text-to-image model to support reconstruction, and then runs two successive black-box search loops: first to find an understanding-enhancing prompt $p_u$ satisfying an understanding score threshold $\\gamma_u$, then an inducing prompt $p_i$ satisfying an inducing score threshold $\\gamma_i$. Search functions $S_u$ and $S_i$ take previously failed prompts as input and ask an auxiliary LLM to produce new candidates, and the loops stop at the thresholds or after $N_1$, $N_2$ iterations. The paper reports 90.86% average ASR on seven open-source models and 68.09% on three closed-source models, with the largest gains over baselines on the strongest closed model, where HIMRD reaches 44.29% versus 18.57% for the best prior method.","pith_inferences":["Extension not in the paper: the same distribution–reconstruction principle could likely be ported to audio or video channels, since any per-modality safety filter has the same blind spot.","The authors' reliance on an auxiliary LLM for splitting and search means the attack cost is tied to another capable model; a cheaper auxiliary would make the threat model broader, while a less capable one might lower ASR — a natural stress test.","The paper's refusal-prefix-plus-word-count evaluation may count verbose evasions as successes; a human study of the outputs would clarify how much real harmful content is actually produced.","If this style of attack is confirmed, a concrete defensive direction is to make the model internally reconstruct and paraphrase the user's request after fusion and apply a safety check to that reconstruction, which would short-circuit the reassembly step."],"forward_implications":["If correct, any safety mechanism that judges text and image separately can be evaded by the same split-and-reassemble scheme, so defenses must evaluate the joint meaning after fusion.","The two-stage search converges within five iterations per stage, meaning the attack is practical against black-box API models without gradients or internal access.","The method transfers to closed-source models: GPT-4o, Gemini-1.5-Pro, and Qwen-VL-Max all show substantial ASR, with Qwen-VL-Max at 95.71%.","The reported resilience to image denoising and perplexity-based text filtering suggests standard input preprocessing will not block the attack."],"supporting_citations":[{"why":"Supplies the distribution–reconstruction jailbreak idea that HIMRD extends from text-only to multimodal settings.","marker":"[33]"},{"why":"Provides the typographic-image baseline and the SafeBench dataset categories used for evaluation.","marker":"[14]"},{"why":"Serves as the automated judge that decides whether a model output counts as a successful jailbreak.","marker":"[38]"},{"why":"Offers the MM-SafeBench baseline and the observation that images relevant to the malicious prompt increase attack performance.","marker":"[34]"},{"why":"One of the compared grey-box attacks and a representative of text-centric jailbreak methods that fail against multimodal defenses.","marker":"[29]"},{"why":"One of the compared white-box bi-modal attacks that HIMRD is measured against on open-source models.","marker":"[60]"},{"why":"Text-to-image model used to generate the context image that helps the victim model reconstruct the harmful prompt.","marker":"[11]"}],"fun_headline_variants":["Splitting malicious prompts across image and text jails MLLMs 90%","Two auto-searched prompts make models reassemble split harmful phrase","HIMRD jails MLLMs by splitting risk across modalities: 90% success","Splitting harmful prompts across image and text yields 90% jailbreak rate","Black-box HIMRD splits risk across modalities, hits 90% jailbreak"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The reported success depends on an automated judge that counts any output with no refusal prefix and at least 40 words as a jailbreak, which can overcount long, irrelevant, or only partially compliant responses.","fun_headline_variants_meta":{"raw":{"variants":["Splitting malicious prompts across image and text jails MLLMs 90%","Two auto-searched prompts make models reassemble split harmful phrase","HIMRD jails MLLMs by splitting risk across modalities: 90% success","Splitting harmful prompts across image and text yields 90% jailbreak rate","Black-box HIMRD splits risk across modalities, hits 90% jailbreak"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000915,"raw_usage":{"total_tokens":3993,"prompt_tokens":1071,"completion_tokens":2922,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":687,"completion_tokens_details":{"reasoning_tokens":2817}},"tokens_in":687,"tokens_out":2922,"duration_ms":18399,"temperature":1.0,"reasoning_tokens":2817,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T20:10:50.156272+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-score the generated outputs with human annotation or a stricter classifier that requires the requested harmful procedure to actually appear; if success drops far below 90 percent, the practical threat claim is overstated. A second check: feed only the textual fragment (no typographic image) to the same models; if the success rate does not fall substantially, the multimodal distribution is not doing the causal work the paper assigns it.","supporting_citations":[{"cited_title":"Making them ask and answer: Jail- breaking large language models in few queries via disguise and reconstruction","cited_arxiv_id":null,"evidence_quote":"Supplies the distribution–reconstruction jailbreak idea that HIMRD extends from text-only to multimodal settings."},{"cited_title":"Mm-safetybench: A benchmark for safety eval- uation of multimodal large language models","cited_arxiv_id":null,"evidence_quote":"Offers the MM-SafeBench baseline and the observation that images relevant to the malicious prompt increase attack performance."}],"review_version":1}