{"id":"8a39adbd-905b-4a07-b910-3d2d85b6da2a","arxiv_id":"2502.07987","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A single optimized image, trained through the vision and language modules, makes aligned multimodal LLMs produce dangerous responses across diverse prompts and some models.","lead":"A single custom-made image can make several multimodal AI assistants drop their safety training and produce harmful responses to many questions. The paper highlights a practical risk for developers and policymakers who deploy vision-language models.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Reported ASR may be inflated by judge bias: the 'Sure, here it is' control alone raises ASR on Phi to 41.3%, so the up-to-81% ASR may not measure actual harmful content.","rationale":"The reader's weakest assumption identifies the same load-bearing concern: the ASR metric depends on an Oracle with low precision and recall, and the target phrase itself may be driving the 'unsafe' labels. This is the most serious threat to the central claim because the abstract's quantitative headline (up to 81% ASR, state-of-the-art comparison) and the cross-model universality claim both inherit this measurement problem. The appendix's concrete examples of harmful outputs provide qualitative evidence that the phenomenon exists, so the paper should not be rejected outright; however, the numerical claims need to be re-derived with human-verified labels. Since the reader already arrived at a CONDITIONAL verdict and my analysis supports that condition, no verdict adjustment is needed.","tokens_in":13642,"tokens_out":6164,"duration_ms":60253,"concrete_test":"Take a fresh random sample of 200 SafeBench responses for Ours-MA and 200 for the Reference condition on Phi and Llava. Have two independent annotators, blind to condition, label whether each response contains concrete disallowed content (e.g., step-by-step instructions for money laundering) as opposed to merely beginning with an affirmative phrase. Recompute ASR with these human labels and with the Gemma Oracle. Also, as a direct probe of judge bias, prepend 'Sure, here it is' to 100 safe reference responses and measure how often the Oracle labels them unsafe. If the Gemma-vs-human ASR gap exceeds 20 points, or the phrase-only control is mostly flagged unsafe, the reported ASR is dominated by judge bias; if human-labeled ASR for Ours-MA stays near 60% or higher, the central claim survives.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central quantitative claim—that a single image achieves up to 81% ASR and outperforms baselines—rests entirely on the Gemma-3-4B-it Oracle, which labels a response unsafe without seeing the query (Sec. 4.2). Appendix B reports precision 0.637 and recall 0.442 on a manually labeled sample; with reference response rates of only 2–14% (Table 2), precision 0.637 implies many Oracle 'unsafe' labels are false positives. More directly, the 'Sure, here it is' baseline in Table 2 is a control that manually prepends the attack's own target phrase to model outputs, yet it raises ASR on Phi from 2.2% to 41.3% and on Llava from 14.4% to 36.6%. Because Sec. 3.3 optimizes the image to produce exactly this phrase, a response that merely begins with the harmless target phrase is likely counted as an attack success. The Ours-MA variant reaches 65–81%, but its target phrases are also affirmative and may trigger the same judge bias. Thus the headline ASR numbers do not yet establish that unsafe content—rather than a target phrase—was generated. The Appendix A examples show real harmful outputs, so the phenomenon likely exists, but the load-bearing quantitative comparison is not yet supported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a universal adversarial attack on multimodal LLMs. The method optimizes a single synthetic image via gradients through the vision encoder and language head so that, when paired with any textual prompt, the model responds with a targeted phrase (e.g., 'Sure, here it is') or otherwise unsafe content. The authors evaluate on SafeBench and MM-SafetyBench across four models (Phi-3.5, Llama-3.2, Qwen2-VL, Llava-1.5), report attack success rates (ASR) up to 81%, and demonstrate cross-model transfer through leave-one-out experiments. Variants include multi-answer targets, Gaussian blur, and localized perturbations.","tokens_in":13947,"tokens_out":2634,"duration_ms":23081,"significance":"If the quantitative results hold, the work demonstrates a serious and practical vulnerability: a single image artifact that can override alignment across multiple multimodal LLMs and partly transfer to unseen models. The paper ships qualitative evidence (Table 9) that real harmful content is elicited, so the phenomenon itself is credible. The method is a combination of known techniques (white-box gradient optimization, universal perturbations, adversarial training on multiple models), but the claimed state-of-the-art ASR and cross-model universality would be a meaningful addition to the adversarial robustness literature. The principal weakness is that the evaluation oracle is demonstrably biased toward the attack's own target phrase, so the headline quantitative claims are not yet supported.","major_comments":[{"comment":"The ASR metric relies on Gemma-3-4B-it as an oracle that judges responses without seeing the input prompt (Sec. 4.2). Appendix B reports precision 0.637 and recall 0.442 on a manually annotated sample (Table 8). With reference ASR values of only 2–14% (Table 2), this precision level implies a substantial number of false positives. More directly, the 'Sure, here it is' text-prefix baseline in Table 2 raises ASR on Phi from 2.2% to 41.3% and on Llava from 14.4% to 36.6%, even though the prefix itself is not harmful. Because the attack is explicitly optimized to produce that phrase (§3.3), the reported ASR values likely measure the oracle's tendency to flag the target phrase rather than actual unsafe content. The claim of up to 81% ASR for Ours-MA (Table 2) is therefore not established as a measure of harmful response generation.","section":"§4.2, Appendix B, Table 2"},{"comment":"No error bars, number of seeds, or statistical significance tests are reported for any ASR result. Adversarial image optimization can be sensitive to initialization and hyperparameters, and the differences between some methods are small (e.g., 15.0 vs. 17.2 on Phi in Table 2). Without variance estimates, it is impossible to determine whether the observed improvements over baselines are reliable. The paper should report mean and standard deviation over multiple independent optimization runs and evaluations.","section":"Tables 2–7"},{"comment":"The training objective forces the model to begin responses with 'Sure, here it is' for any prompt, including safe ones. The paper does not report the rate at which this target phrase appears on benign, safe queries (e.g., 'What is the capital of France?') or the false-positive rate of the attack on safe prompts. Such a control is needed to separate two effects: (i) the attack genuinely enables harmful content, versus (ii) the attack simply induces a generic affirmative prefix that the oracle misclassifies as unsafe. Reporting ASR on a safe query set would clarify whether the optimization produces prompt-agnostic refusal suppression or only a judge-triggering artifact.","section":"§3.3, Table 2"}],"minor_comments":[{"comment":"Typo: 'auniversal' should be 'a universal'.","section":"Abstract"},{"comment":"The row labeled 'GCC' should be 'GCG' to match the description in Section 2.5 and the other tables.","section":"Table 2"},{"comment":"The bar chart is difficult to read because many values are printed in small font and the baseline labels are truncated; Table 2 is clearer.","section":"Figure 3"},{"comment":"The model name is inconsistent: 'Gemma-3-4B-it' appears in §4.2 and Table 8, while 'Gemma-3-4B-it' and 'Gemma-3-4B-it' are used elsewhere. Also, the description of the manual annotation dataset (sample size, annotator agreement) is omitted.","section":"Appendix B"},{"comment":"The training dataset descriptions (100 safe questions, 50 adversarial questions) are minimal; it is unclear whether validation and test queries come from the same distribution and whether the SafeBench evaluation uses all 23 risk scenarios.","section":"§2.4"}],"recommendation":"major_revision","confidential_remarks":"The core phenomenon is plausible and the qualitative examples are compelling, but the evaluation methodology for the headline ASR numbers is not sound. The oracle bias is serious enough that the current quantitative claims should not be published without re-evaluation. The authors should replace or augment the Gemma-3 oracle with a judge that is validated against the target phrase baseline, report results on safe prompts, and provide error bars. If the numbers change substantially, the paper's contribution becomes weaker (though still possibly publishable as a demonstration of a real vulnerability). The title and abstract claim 'universal' attack and state-of-the-art success rates; both should be tempered until the evaluation is robust. This is fixable within the scope of a normal revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core phenomenon is real: Table 9 shows the attacked LLaVA producing actual harmful content rather than a refusal, and the multi-model joint optimization (training one image on four architectures at once) goes beyond a parameter scan of Visual Adversarial Examples. The multi-answer sampling, quantization-robust training, and blur/localization ablations are useful engineering contributions, and the paper is honest enough to include a judge-model comparison appendix and a limitations section. If I work on multimodal safety, I would cite this for the cross-model attack recipe.\n\nThe soft spot is the evaluation. The Oracle (gemma-3-4b-it) labels a response unsafe without seeing the prompt, and Appendix B reports precision 0.637 and recall 0.442 on a manually annotated subset. That already means a substantial fraction of \"unsafe\" labels are false positives. More directly, the paper's own control prepends \"Sure, here it is\" to the model's output and raises ASR on Phi from 2.2% to 41.3%. Since the attack is optimized to produce exactly that affirmative phrase, a response that merely starts with the target phrase is likely counted as success even if the rest is benign. So the up-to-81% ASR numbers for Ours-MA are not yet convincing as measures of harmful content. The cross-model leave-one-out results are also mixed, with several held-out models near their reference rates, so the \"universal\" claim is overstated.\n\nThe missing seeds, error bars, and code (promised under Apache-2.0 but not yet available) make the quantitative claims hard to verify. These are fixable, and the examples in Table 9 show the attack does work in at least some cases. The best path is to re-run the evaluation with a stronger judge or human labels, report per-response breakdowns, and narrow the universality claim to models the image was jointly optimized for.\n\nThis is a conditional accept at best, but it deserves a serious referee: the phenomenon is credible, the method has a new joint-training component, and the flaws are in evaluation rather than in the core idea. I would send it to peer review with a request for re-analysis, not desk-reject it.","headline":"The multi-model joint optimization is a genuine extension of Qi et al., but the headline ASR numbers likely overstate the attack because the judge flags the target phrase itself as unsafe.","tokens_in":630,"tokens_out":759,"would_cite":true,"duration_ms":24289,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that a single optimized image can override safety alignment in several multimodal LLMs and partly transfer to unseen models, achieving higher attack success rates than text-only universal prompts.","keywords":["adversarial attack","universal perturbation","multimodal LLM","jailbreak","safety alignment","vision-language model","attack success rate","cross-model transfer"],"falsifier":"Have human annotators label the exact responses the paper counts as successful attacks, and compare the human-based ASR to the judge-based ASR on the same responses; if the judge is flagging the presence of the target phrase 'Sure, here it is' rather than actual unsafe content, the human-based ASR would be substantially lower, especially for 'Ours' and baseline 'Sure, here it is' rows.","tokens_in":13450,"feed_emoji":"🖼️","tokens_out":4520,"duration_ms":34487,"temperature":0.7,"pith_summary":"This paper tries to establish that a single synthetic image, optimized by gradient backpropagation through a multimodal LLM's vision encoder and language head, can override safety alignment and force the model to begin responses with a target phrase such as 'Sure, here it is' even for harmful prompts. The authors show on SafeBench and MM-SafetyBench that this universal visual attack achieves higher attack success rates than text-only universal prompts and prior multimodal baselines, with rates up to 81% on some models. They also show that an image trained jointly on several models transfers partly to an unseen model, and that a multi-answer variant produces more natural-sounding unsafe responses. If true, this would mean current vision-language alignment is fragile in a way that text-only attacks are not, and that a single distributed image could pose a practical threat across deployed systems.","feed_headline":"A single image can jailbreak aligned multimodal LLMs","feed_subtitle":"Universal visual attack beats text-only jailbreaks and transfers across models.","key_machinery":"The load-bearing object is the universal adversarial image $z = z_0 + g(z_1)$, where $z_0$ is a grayscale base image and $g(z_1) = \\gamma_1 \\tanh(z_1)$ is a bounded trainable perturbation. The optimization minimizes the masked cross-entropy loss of a fixed target answer (or a sampled answer in the multi-answer variant) with gradients flowing through the language model, the vision-language adapter, and the vision encoder. Additional components are random noise for quantization robustness, Gaussian blurring to reduce high-frequency artifacts, and randomized local cropping to concentrate perturbations in salient regions. This machinery is what makes a single image serve as a prompt-universal jailbreak and, when the loss is summed over multiple models, a cross-model jailbreak.","core_discovery":"The central discovery is that high-dimensional visual input provides a universal attack surface for aligned multimodal LLMs: a single perturbation image, optimized against a masked cross-entropy loss on target answer tokens, can redirect the model's generation for a wide range of textual prompts, including prompts the model was trained to refuse. The attack works by minimizing the loss of the fixed target response while the perturbation is constrained with a tanh-scaled additive tensor, and robustness to quantization is added by injecting noise at each optimization step. The paper reports that an image optimized jointly over three or four models retains high attack success on each and shows partial transfer to a held-out architecture.","pith_inferences":["The paper's own Table 2, where prepending the phrase 'Sure, here it is' raises ASR on Phi from 2.2% to 41.3%, suggests the judge may treat the target phrase as unsafe regardless of content; a defense-aware evaluator could therefore report lower effective attack success. This is an inference, not the paper's claim.","A practical extension would be to test whether the same single image degrades performance when the model must answer a question about the image itself rather than a separate textual prompt, since the attack is trained on text queries unrelated to the image content.","The 'Localize' and 'Blur' variants suggest the adversarial signal is not purely high-frequency; testing the attack against JPEG compression or image resizing in a deployed pipeline would reveal whether real-world distribution is as fragile as the benchmark suggests."],"forward_implications":["If this attack generalizes as claimed, a single adversarially crafted image distributed online could force aligned multimodal LLMs to produce disallowed content across many prompts, not just one query.","The cross-model leave-one-out results imply that an attacker with white-box access to a few open models may obtain a transferable image that degrades safety on unseen black-box models, without needing query-specific optimization.","The multi-answer variant implies that detection systems matching a fixed phrase can be evaded, since the model can be steered toward a variety of affirmative malicious responses.","The method's dependence on white-box access identifies a concrete target for defense: if gradient-based optimization through the vision encoder is blocked or made noisy, the universal image loses efficacy."],"supporting_citations":[{"why":"Supplies the GCG-transferable text-only universal suffix baseline that the visual attack must beat.","marker":"(Zou et al., 2023)"},{"why":"Provides the Visual Adversarial Examples baseline, a prior universal visual perturbation jailbreak.","marker":"(Qi et al., 2023)"},{"why":"Provides SafeBench, the primary evaluation benchmark covering 23 risk scenarios.","marker":"(Ying et al., 2024)"},{"why":"Provides MM-SafetyBench, the second evaluation benchmark with 1,680 queries across 13 scenarios.","marker":"(Liu et al., 2024b)"},{"why":"Supplies Gemma-3-4B-it, the Oracle judge used for attack success rate evaluation.","marker":"(Team et al., 2025)"},{"why":"Source of the randomized local cropping technique used in the Localize variant.","marker":"(Li et al., 2025)"},{"why":"Demonstrates that optimized single images can trigger unsafe responses in aligned models, motivating the universal image approach.","marker":"(Carlini et al., 2024)"}],"fun_headline_variants":["Universal visual jailbreak: one image, many attacks","Single image overrides alignment in multimodal LLMs","One image to jailbreak them all: multimodal LLM attack","Image-based universal attack beats text-only jailbreaks","Cross-model adversarial image forces unsafe responses"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The reported attack success rates rest on the assumption that the Gemma-3-4B-it judge, shown only the model's response, correctly labels unsafe content; Appendix B reports its precision at 0.637 and recall at 0.442 on a manually annotated subset, and prepending the target phrase alone raises ASR on one model from 2.2% to 41.3%.","fun_headline_variants_meta":{"raw":{"variants":["Universal visual jailbreak: one image, many attacks","Single image overrides alignment in multimodal LLMs","One image to jailbreak them all: multimodal LLM attack","Image-based universal attack beats text-only jailbreaks","Cross-model adversarial image forces unsafe responses"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000238,"raw_usage":{"total_tokens":1459,"prompt_tokens":844,"completion_tokens":615,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":460,"completion_tokens_details":{"reasoning_tokens":552}},"tokens_in":460,"tokens_out":615,"duration_ms":5498,"temperature":1.0,"reasoning_tokens":552,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-08T11:13:32.111736+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Have human annotators label the exact responses the paper counts as successful attacks, and compare the human-based ASR to the judge-based ASR on the same responses; if the judge is flagging the presence of the target phrase 'Sure, here it is' rather than actual unsafe content, the human-based ASR would be substantially lower, especially for 'Ours' and baseline 'Sure, here it is' rows.","supporting_citations":[],"review_version":1}