{"id":"5971591d-c288-40d9-8acf-5f6fcc165667","arxiv_id":"2506.16760","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"CAMO hides harmful instructions across text and image using masked keywords and math-puzzle clues, making several LVLMs answer banned queries while evading common safety filters.","lead":"This paper describes a black-box jailbreak attack that splits a harmful request into masked text plus image-based math clues, so vision-language models reconstruct and answer it. The authors report high success on GPT-4 and Qwen models and claim perfect evasion of several safety filters, which matters for hardening deployed multimodal safety systems.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 100% defense-evasion rate is not supported: Table 3 lacks thresholds and sample sizes, and the OpenAI Moderation test uses a text-only surrogate rather than the actual multimodal attack.","rationale":"The paper's central claim rests on two pillars: (1) high ASR from cross-modal decomposition, and (2) 100% defense evasion. The ASR pillar is supported by consistent results across multiple models and by ablations, though the reader correctly notes that the keyword-selection dictionary is a critical dependency; removing it drops bomb-related ASR from 60% to 13.33% (Table 4). The defense-evasion pillar, however, is empirically fragile. Section 5 presents Table 3 with no sample sizes, no thresholds for the perplexity filter or toxicity classifier, and no confidence intervals. More importantly, the OpenAI Moderation test in Section 5.3 uses text-only surrogate inputs rather than the actual image+text CAMO prompts, so the claim that the real attack 'consistently bypasses' system-level moderation is not directly supported. If the defense results do not hold under replication, the paper's stealth contribution is substantially weakened, even though the basic jailbreak mechanism may still function. This concern does not invalidate the core attack idea, so a conditional verdict remains appropriate; however, the conditions should explicitly require a rigorous defense evaluation with the actual attack inputs, proper thresholds, and statistical reporting. I therefore partially agree with the reader's weakest assumption: the keyword-selection dependency is real, but the defense-evidence gap is at least as load-bearing for the paper's headline claims.","tokens_in":18227,"tokens_out":6404,"duration_ms":61364,"concrete_test":"Replicate Section 5 with N≥100 CAMO-generated prompts per category using the exact attack pipeline. (1) Set τ to the value from [12] (or report the CDF of log-PPL for attack vs benign prompts) and compute the pass rate with a 95% CI. (2) Run EasyOCR on the actual generated images and feed all extracted strings (including clue labels) to the toxicity classifier with the threshold used in [8]; report the pass rate. (3) For OpenAI Moderation, submit the actual text+image input to any endpoint that accepts images; if only text is accepted, explicitly state this limitation and instead measure the target model's refusal rate on the same input. If any pass rate is below 100%, the '100% evasion' claim is false.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Table 3 claims 100% evasion across three defenses, but the supporting experiments are underspecified in ways that directly affect the conclusion. Section 5.1 does not state the perplexity threshold τ from [12]; without it, '100% pass rate' cannot be interpreted—the reported average log-PPL (3.07) could be above or below the rejection boundary. Section 5.2 reports that EasyOCR-extracted text is classified non-toxic by LLaMA-2-Chat-7B, but it does not specify what text was extracted (clue labels such as '3:F' are likely benign digits/letters) or the toxicity classification threshold. Section 5.3 states that the OpenAI Moderation test used 'text-only inputs that embed semantically harmful visual clues,' not the actual image+text CAMO input; this surrogate does not test whether the real attack bypasses system-level moderation. No sample sizes, confidence intervals, or repeated-trial variability are reported for any defense. Because the central claim explicitly highlights '100% evasion rate,' this unsupported result is load-bearing: if any of the three defenses would flag the true attack prompt, the stealth component of CAMO's claimed contribution fails.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces CAMO, a single-turn, black-box jailbreak attack for large vision-language models (LVLMs). The method masks sensitive keywords in the text prompt and distributes character-level clues into an image via simple arithmetic-indexed lookups; the LVLM must solve the math questions, read the image indices, reconstruct the masked word, and then answer the harmful question. The authors report attack success rates up to 81.82% on GPT-4.1-nano and 96.97% on Qwen2-VL-72B-Instruct, along with fewer input tokens than several baselines. They also claim a 100% evasion rate against three defenses: a perplexity-based filter, an OCR-based toxicity classifier, and OpenAI's moderation API. The paper includes ablations of the keyword set, text template, math encoding, and visual input, as well as hyperparameter sensitivity studies.","tokens_in":18478,"tokens_out":4088,"duration_ms":48965,"significance":"If the empirical claims hold, the paper demonstrates a practical and transferable vulnerability in current LVLMs: a benign-looking multimodal prompt can induce restricted content generation without gradient access or multi-turn interaction. The cross-modal decomposition idea is novel relative to text-suffix and image-OCR attacks, and the paper's ablation study is a strength because it isolates the contribution of each component. The reported token-efficiency advantage over DRA and PAPs is also a useful practical point. However, the load-bearing '100% evasion' claim is not adequately supported by the current experimental write-up, the judge-based ASR metric lacks validation and error bars, and the formal query-complexity bound in Section 3.5 is not mathematically justified as stated. These issues are fixable but require more than editorial polishing.","major_comments":[{"comment":"The central claim of a 100% evasion rate is not supported by the reported experiments. In Section 5.1, the perplexity threshold τ from [12] is never stated; the average log-PPL values (3.07 for attack prompts, 3.47 for harmful questions) cannot be interpreted as a '100% pass rate' without knowing τ and without per-sample counts. In Section 5.2, the paper does not report what text EasyOCR actually extracted; if the extracted text consists only of clue labels such as '3:F' and '6:I', then the OCR-based classifier is not being tested on the reconstructed harmful keyword, and the toxicity threshold for LLaMA-2-Chat-7B is also unspecified. In Section 5.3, the OpenAI Moderation test uses 'text-only inputs that embed semantically harmful visual clues' rather than the actual image+text CAMO input, so it does not establish that the real multimodal attack bypasses system-level moderation. The paper should either report the full defense evaluation with thresholds, sample sizes, and the actual attack inputs, or scale back the '100% evasion' claim accordingly.","section":"Section 5, Table 3"},{"comment":"The ASR evaluation rests on a single judge model (GPT-4o-2024-08-06) with a fixed rating threshold (>5), but the paper provides no validation of this judge against human labels, no confidence intervals, and no repeated-trial variability. Since each AdvBench-M category contains roughly 30 samples, differences such as 53.33% versus 56.67% in Table 1 correspond to a difference of about one sample; many reported margins are within sampling noise. In addition, the hyperparameters r and k are tuned on the same benchmark (Figures 7 and 8), so the reported ASRs likely overstate the attack's performance on unseen prompts. The authors should report per-category sample sizes, confidence intervals or exact binomial bounds, and a validation protocol that does not select hyperparameters on the test benchmark.","section":"Section 4.1, Tables 1 and 2"},{"comment":"Equation (12) is not a valid upper bound on the expected number of queries as stated. For example, if every state has success probability p_s = 0.9 and the state space has |S| = 5, the right-hand side equals 0.5, while the expected number of queries to first success is at least 1. Summing (1 - p_s) over states is not equivalent to the expected number of failures before success under any standard sequential-search model without additional assumptions. The paper should either replace this expression with a correct bound (e.g., based on the tail-sum formula for waiting times) or explicitly label it as a heuristic approximation, and should avoid claiming a formal upper bound.","section":"Section 3.5, Eq. (12)"},{"comment":"The ablation shows that removing the manually curated sensitive keyword set reduces bomb-related ASR from 60.00% to 13.33%, indicating that the attack's success depends critically on this domain-specific dictionary. The paper describes the method as 'automatic keyword extraction' in Section 4.2, but Algorithm 1 requires a manually curated dictionary D (plus optional extra terms) and a fallback policy. The authors should clearly state that the method requires a curated list of sensitive terms for each new domain, and should discuss how such a list would be constructed in practice; the current Limitation section acknowledges the manual tuning of r and k but does not fully own the dictionary dependency.","section":"Section 3.1 and Table 4"}],"minor_comments":[{"comment":"There is a typo in 'a a predefined stopword set' and the variable D is used both for the sensitive dictionary and for the tokenized/POS-tagged sequence in Algorithm 1, which is confusing.","section":"Section 3.1"},{"comment":"Equation (6) uses floor for the character masking length while Equation (8) uses ceiling for the same quantity; the inconsistency should be resolved and stated once.","section":"Equations (6) and (8)"},{"comment":"The qualitative examples refer to 'GPT-4.1-mini', but the model list in Section 4.1 includes GPT-4.1-nano; please clarify which model was actually used and why it is not in the model evaluation table.","section":"Section 4.3"},{"comment":"The per-category sample sizes are not listed in the tables or figures beyond the statement that each category has roughly 30 samples; exact counts are needed to interpret the percentages and to verify the total across categories.","section":"Figures 6 and 7 and Tables 1 and 2"},{"comment":"The paper does not provide code or data for the curated dictionary, the exact prompt templates, or the image-rendering procedure; releasing these would be important for reproducing the reported ASR numbers.","section":"General reproducibility"}],"recommendation":"major_revision","confidential_remarks":"The paper fits the scope of the journal and the underlying idea is interesting, but the headline '100% evasion' claim, the judge-only evaluation, and the theoretical bound in Eq. (12) all need substantive work. The deficiencies are fixable through additional experiments and more careful reporting; I do not see a fundamental flaw that would require rejection. The paper includes a content warning and engages with existing defensive baselines, which is appropriate for red-teaming work."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague, bottom line up front: CAMO is worth knowing about. The core construction—masking sensitive keywords, using arithmetic answers as indices into an OCR map embedded in an image, and letting the LVLM reassemble the harmful instruction through multi-step reasoning—is a real new attack design in the black-box LVLM jailbreak space. It is not just a recombination of DRA or FigStep. The paper reports plausible ASR numbers across several proprietary and open models (81.82% on GPT-4.1-nano, 96.97% on Qwen2-VL), and the ablations, especially the drop from 60% to 13.33% when the keyword set is removed, support the claim that the components matter. The token-efficiency comparison is also meaningful. The limitation section is honest about untested models and manually tuned hyperparameters.\n\nThe soft spots are concentrated in Section 5, and the stress-test note is correct about them. The 100% evasion claim is load-bearing for the paper's 'stealth' contribution, but Table 3 has no thresholds, no sample sizes, no error bars, and the three tests are not actually testing the real attack. The perplexity filter section never states tau from [12], so a 100% pass rate is uninterpretable. The OCR test runs EasyOCR on the image and classifies whatever text is extracted—likely clue labels like '3:F'—with LLaMA-2-Chat-7B, which says nothing about whether the harmful intent is detected. Most tellingly, the OpenAI Moderation test used text-only surrogates, not the actual image+text CAMO prompt, so it cannot support 'system-level moderation is bypassed.' This needs to be fixed or the claim retracted.\n\nThere is also a technical issue in Eq. (12). The expression sums (1 - p_s(r,k)) over all states as an upper bound on expected queries. That is not a valid bound in general: it ignores the stopping rule after success and the conditional nature of reaching later states, and p_s is not defined as a conditional probability. The query-cost analysis should be redone or dropped; it is not central to the empirical contribution.\n\nThe sample sizes are small (~30 per category) and the judge is GPT-4o with no human validation or error bars. For a claimed state-of-the-art result, that is thin but not disqualifying—these are standard weaknesses in this literature. The authors should release the keyword dictionary and code; the ablation suggests the dictionary is doing a lot of work.\n\nWho is this for: people working on LVLM safety and red-teaming. The attack design is a useful addition to the toolbox. The defense-evaluation section is a good example of how not to overclaim. I would send it to peer review—yes, it deserves referee time—but with a clear request to correct Section 5, fix Eq. (12), and report error bars. I would cite the construction if I were writing on multimodal jailbreaks.","headline":"CAMO is a genuinely new single-query black-box jailbreak construction with strong reported ASR, but the paper overclaims the 100% defense-evasion result and one theoretical bound is wrong.","tokens_in":19011,"tokens_out":2892,"would_cite":true,"duration_ms":31312,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that splitting a harmful prompt into benign-looking text and image pieces makes leading vision-language models reassemble the harmful intent and answer it, with 81.82% success on GPT-4.1-nano and 96.97% on…","keywords":["jailbreak attacks","large vision-language models","cross-modal obfuscation","black-box attacks","multimodal safety","prompt decomposition","content moderation","adversarial examples"],"falsifier":"Run CAMO on harmful prompts where the sensitive term is replaced by a synonym not present in the paper's dictionary, such as 'explosive device' instead of 'bomb', and measure attack success; the claim predicts a sharp drop in ASR whenever the harmful token is not selected. A second decisive test is to insert a defense that first solves the arithmetic clues, reads the indexed characters, and checks the reconstructed word before answering, which should reduce the reported 100% evasion rate to near zero if the reconstruction mechanism is what carries the attack.","tokens_in":18030,"feed_emoji":"🧩","tokens_out":6226,"duration_ms":62176,"temperature":0.7,"pith_summary":"This paper claims that a single-turn, black-box query can make large vision-language models produce restricted content by splitting the harmful instruction into pieces no safety filter sees as dangerous on its own. The method, CAMO, masks the sensitive words in the text and hides the missing characters inside an image as a character-lookup puzzle, then relies on the model's cross-modal reasoning to reassemble the original question and answer it. On GPT-4.1-nano it reports an 81.82% attack success rate, on Qwen2-VL-72B-Instruct 96.97%, and it reports 100% evasion of three defenses: perplexity filtering, OCR keyword detection, and OpenAI's moderation API. The paper argues this exposes a structural blind spot in current safety filters, which check each modality in isolation rather than jointly. If correct, it would mean that current alignment and moderation practices do not handle instructions whose danger emerges only after multimodal composition.","feed_headline":"Splitting prompts across text and image defeats GPT-4.1-nano safety","feed_subtitle":"Masked words plus a math-puzzle image slip past perplexity, OCR, and moderation checks every time in the paper's tests.","key_machinery":"The carrying mechanism is cross-modal obfuscation with an arithmetic-indexed image lookup: for each masked character, a math question supplies a numeric answer used as a spatial index into an OCR-visible map in the image, so the model must solve the math, read the indexed character, and reassemble the keyword. This forces multi-step reasoning across modalities and makes the harmful intent invisible to unimodal detectors. The model that follows the chain has effectively reconstructed the harmful instruction by itself, so the malicious intent never appears as a single surface token in the input.","core_discovery":"The central claim is that a harmful instruction can be decomposed into a set of individually benign multimodal fragments and then reconstructed by the target model itself, without any gradient access, iterative optimization, or multi-turn dialogue. Concretely, each sensitive keyword is partially masked in the text, and the missing characters are placed in an image with positional indices; simple arithmetic questions in the text tell the model which index to read. The model that solves the arithmetic, reads the image, and reassembles the word has effectively performed the jailbreak on its own, while each fragment in isolation passes perplexity-based and OCR-based filters and the moderation API. The paper reports attack success rates up to 81.82% on GPT-4.1-nano and 96.97% on Qwen2-VL-72B-Instruct, with substantially fewer input tokens than earlier black-box attacks.","pith_inferences":["Editorial inference: the manual keyword dictionary is the hardest constraint, so the attack could likely be automated further by replacing dictionary-and-POS selection with an LLM that decides which tokens to mask, possibly raising success on unseen harmful domains.","Editorial inference: a defense that reconstructs the masked word from the image before moderation, effectively running the same cross-modal reasoning the attack exploits, would likely neutralize this specific scheme at least until the encoding is made harder.","Editorial inference: the same decomposition principle might extend beyond jailbreaks to other safety-relevant properties, such as leaking private information or triggering malicious tool calls, because it only requires the model to compose benign fragments.","Editorial inference: the reported 100% defense evasion is measured on a fixed set of filters; an adaptive defense allowed to evolve after seeing the attack would be a harder test of the method."],"forward_implications":["If the claim is correct, safety filters that score text and image independently cannot catch this class of attacks, because each modality is benign when scored alone.","Commercial LVLM APIs that expose single-turn image-plus-text queries would be vulnerable without any access to gradients or internal states.","Reported success increases with both the fraction of masked words and the fraction of masked characters, suggesting that finer-grained fragmentation produces even harder-to-detect prompts.","The attack transfers across model families and deployment settings, so a single crafted prompt may work against unknown future models.","The low token count, roughly 179 tokens versus 387 to 1420 for the compared attacks, would make large-scale automated abuse financially feasible."],"supporting_citations":[{"why":"Supplies the 520 harmful-instruction benchmark that the attack is evaluated on.","marker":"[39]"},{"why":"Supplies the multimodal AdvBench-M benchmark with eight threat categories.","marker":"[21]"},{"why":"FigStep is the closest image-and-text baseline and provides the OCR-defense evaluation setup.","marker":"[8]"},{"why":"AP is a text baseline and the source of the attack-success-rate evaluation protocol.","marker":"[4]"},{"why":"DRA is a text baseline that also uses disguise-and-reconstruction prompting.","marker":"[17]"},{"why":"HADES is the image-based baseline that renders keywords directly into images.","marker":"[14]"},{"why":"Defines the perplexity-based filter that CAMO claims to bypass with 100% evasion.","marker":"[12]"},{"why":"OpenAI's Moderation API is the system-level defense that CAMO claims to evade.","marker":"[22]"}],"fun_headline_variants":["Benign fragments reconstruct jailbreak, fooling GPT-4.1-nano","Obfuscated jailbreak hides harmful words in images and math","Cross-modal trick makes LVLMs jailbreak themselves undetected","Splitting text and image payloads sneaks past GPT-4.1-nano","Few-query attack splits prompts, fooling LVLM safety"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The entire attack depends on the keyword selection step finding the genuinely sensitive word in the prompt; if the manually built dictionary and part-of-speech tagger miss the harmful term, the masked prompt is either still detected or the model cannot reconstruct the harmful intent, and the reported success rates collapse.","fun_headline_variants_meta":{"raw":{"variants":["Benign fragments reconstruct jailbreak, fooling GPT-4.1-nano","Obfuscated jailbreak hides harmful words in images and math","Cross-modal trick makes LVLMs jailbreak themselves undetected","Splitting text and image payloads sneaks past GPT-4.1-nano","Few-query attack splits prompts, fooling LVLM safety"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000653,"raw_usage":{"total_tokens":2979,"prompt_tokens":920,"completion_tokens":2059,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":536,"completion_tokens_details":{"reasoning_tokens":1961}},"tokens_in":536,"tokens_out":2059,"duration_ms":15347,"temperature":1.0,"reasoning_tokens":1961,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T23:38:23.328935+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run CAMO on harmful prompts where the sensitive term is replaced by a synonym not present in the paper's dictionary, such as 'explosive device' instead of 'bomb', and measure attack success; the claim predicts a sharp drop in ASR whenever the harmful token is not selected. A second decisive test is to insert a defense that first solves the arithmetic clues, reads the indexed characters, and checks the reconstructed word before answering, which should reduce the reported 100% evasion rate to near zero if the reconstruction mechanism is what carries the attack.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the 520 harmful-instruction benchmark that the attack is evaluated on."},{"cited_title":"In: Proceedings of the AAAI Confer- ence on Artificial Intelligence","cited_arxiv_id":null,"evidence_quote":"FigStep is the closest image-and-text baseline and provides the OCR-defense evaluation setup."},{"cited_title":"In: 33rd USENIX Security Symposium (USENIX Security 24)","cited_arxiv_id":null,"evidence_quote":"DRA is a text baseline that also uses disguise-and-reconstruction prompting."},{"cited_title":"In: European Conference on Computer Vision","cited_arxiv_id":null,"evidence_quote":"HADES is the image-based baseline that renders keywords directly into images."},{"cited_title":"https://platform.openai.com/ docs/guides/moderation (2024), accessed: 2024-02-09","cited_arxiv_id":null,"evidence_quote":"OpenAI's Moderation API is the system-level defense that CAMO claims to evade."}],"review_version":1}