Decoy Images Amplify Caption-Mediated Defenses Against Encoded Jailbreaks

Haoyu Zhang; Mohammad Zandsalimy; Shanu Sushmita; Shibo Zheng; Xiangchen Guan

REVIEW 2 major objections 2 minor 17 references

Decoy Images Amplify Caption-Mediated Defenses Against Encoded Jailbreaks

T0 review · 2 major / 2 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Adding an unrelated decoy image to an encoded jailbreak prompt flips a near-inert caption-mediated defense into an effective one, cutting attack success by up to 73 percentage points.

desk verdict The decoy effect is real and carefully measured, but the 'ECSO is inert on text' baseline is an implementation artifact: the repo skips the safety re-check on text-only inputs, so the headline amplification may just be switching a disabled branch back on. read the letter →

arxiv 2608.01043 v1 pith:DLE263XN submitted 2026-08-02 cs.CR cs.AI

Haoyu Zhang , Xiangchen Guan , Shibo Zheng , Mohammad Zandsalimy , Shanu Sushmita This is my paper · ORCID

classification cs.CRcs.AI

keywords encodedjailbreaksdecoyimagescaption-mediateddefensevision-languagemodelsattacksuccessrateimagepresenceblack-boxbenignrefusal

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper's claim is that encoded jailbreaks—harmful instructions hidden in math, logic, or code templates—become substantially easier to catch when a completely unrelated image accompanies them, because the safety mechanism that responds to images is different from the one that sees only text. Across five frontier VLMs and two encoded-attack families, a caption-mediated defense (ECSO) that leaves attack success essentially unchanged on text-only encoded input drops it by up to 73 percentage points once a content-free decoy is attached; 8 of 10 non-saturated cells show at least a 20-point drop, and every non-saturated contrast is significant under paired exact tests. The paper narrows the cause through three controls: blank canvases and natural photographs reproduce the effect on every model, open-weight models with no moderation layer replicate it, and a meaning-based non-symbolic encoder also works, so the trigger is image presence, not image content or vendor filtering. The result is presented as an observation about pipeline interaction, not a robust defense: unconditional decoy attachment raises benign refusal sharply, and the practical form is a detector-gated pipeline whose benefit is bounded by how reliably encoded inputs can be spotted.

What carries the argument

The load-bearing mechanism is ECSO's has_image branch: a query-level routing condition that sends any request carrying an image through a caption-then-safe-completion path. Attaching an information-free decoy makes that branch fire; the caption step reinjects the original request into a text-safety filter, and the safe-completion call forbids harmful output. The paper's pairing protocol—one canonical encoded prompt per cell shared across all variants—makes the text-versus-decoy contrast attributable to modality manipulation rather than encoder variance, and exact McNemar tests on those paired outcomes carry the statistics.

What would settle it

Instrument or reimplement ECSO with its has_image branch removed: if the decoy-versus-text ASR drop persists, image presence alone is not the cause. Concretely, run the identical paired protocol against a text-only defense that is provably blind to the image channel; a persistent drop would falsify the claimed mechanism. Alternatively, find one non-saturated model cell where a blank white decoy fails to reproduce the drop—that would shift the trigger from image presence to image content.

Watch

Extended reading notes

Core claim

The central discovery is that a caption-mediated defense does not need to see harmful content in the image—it only needs to see an image. ECSO conditions on whether the input has an image; when the decoy is attached, its captioning step re-injects the request into a text-side safety check that the encoded prompt had originally bypassed, and the 'eyes closed' safe-completion call then refuses. The paper shows this on a complete grid: on the strongest cell, undefended code-attack success of 83% stays at 83% under text-only ECSO but falls to 10% when the same encoded text is paired with a content-free decoy. The decoy alone, with no defense, moves ASR by at most 9 percentage points, so the effe

Load-bearing premise

The explanation depends on the untested assumption that the ASR drop comes from the defense pipeline branching on image presence—H1 in the paper—rather than from some unobserved vendor-side filter, judge artifact, or image-dependent quirk, because the closed pipeline cannot be inspected.

Editorial extensions

If this is right

Deployed caption-mediated defenses can gain a new capability without retraining: adding an image channel triggers a safety re-check that text-only encoded inputs currently evade.
The decoy class is not the secret: across the three decoy classes tested, amplification holds within a few points for a fixed model and attack, so picking a cheap, low-utility-cost decoy like a blank canvas preserves the safety gain.
The effect's headroom is capped by text-side saturation: cells where a strong text-side defense already pins ASR near zero show little or no amplification, so the mechanism is complementary to, not a replacement for, text-side filtering.
In gated deployment, the encoded-input detector's recall is the binding constraint: with near-perfect recall on one attack family the full gain is recovered while benign refusal returns to baseline; with low recall on the other, the defense collapses to the text baseline.
Under adaptive attacks that target the re-check, the gain degrades but does not disappear; the paper treats this as evidence against trivial bypass, not as proof of robustness.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The decoy can be used as a black-box probe: since ECSO's gain appears only when its has_image branch fires, sending a candidate encoded input with and without a decoy reveals, through the ASR difference, whether a caption-mediated re-check is present in a closed pipeline.
The paper leaves an untested adversarial move: putting the encoded payload inside the attached image to weaponize the decoy slot. Its ir_plain results suggest current frontier models are less vulnerable to image-resident content, but the gated pipeline was not tested against this, so it remains an open surface.
The safety-amplification versus utility-cost asymmetry—amplification roughly decoy-invariant while benign refusal depends on the decoy—implies decoy choice should be optimized separately from safety; a blank canvas already costs less utility than the default mountain image, and future deployments could tune this tradeoff.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

You should know: the central contrast in this paper is text+ECSO vs decoy+ECSO, and that contrast is undermined by the paper's own appendix. App D.1 shows that in their implementation, when has_image is false at INITIAL, steps 3a–3d collapse to just INITIAL — the TELL/CAP/SAFE chain never runs. So the "ECSO is near-inert on text" baseline is not the ECSO pipeline described in App A; it's a defense that was turned off. The decoy works by satisfying the has_image guard and re-enabling the safety re-check that should have run on text anyway. That is load-bearing, not a minor caveat.

What is genuinely good: the measurement discipline. Paired canonical encodings, exact McNemar tests, Wilson intervals, multi-judge re-scoring, three decoy classes, open-weight replications with no moderation layer, and a non-symbolic encoder. The direction and significance survive all those checks. The paper is also honest: it frames H1 as a hypothesis, acknowledges it cannot introspect closed pipelines, and reports the trivial-reject and utility costs carefully. The authors clearly know how to run a controlled experiment.

The soft spot is the baseline. The paper never benchmarks the original ECSO implementation on text-only encoded input. If they had, and the original also left text ASR at 83%, the amplification would be real and interesting. As it stands, the headline "ECSO is amplified by a decoy" is really "our ECSO harness only runs its safety chain when an image is present." The effect becomes a property of the repo, not of caption-mediated defenses generally.

That said, there is a residue that survives: on no_def, adding a decoy or rendering content into the image can trigger intrinsic image-side safety behaviors on several models. That is a separate, somewhat weaker observation, and it may be worth a footnote. But the paper's main contribution, as framed, does not hold up.

Who is this for? A reader who wants a worked example of how a black-box implementation detail can masquerade as a defense property. As a cautionary tale, it's excellent. As a claim about ECSO, it needs a corrected baseline before I'd trust it. I'd send it to review — the controls are strong enough that a serious referee should ask for the fix — but I would not cite it as evidence until the baseline is re-run.

Recommendation: reject in current form, but the fix is straightforward: run the original ECSO on text-only encoded inputs, and report whether the amplification survives. If it does, the paper becomes important. If not, the decoy finding is a bug report.

Referee Report

2 major / 2 minor

Summary. The paper reports a counter-intuitive empirical result: attaching a content-free decoy image to an encoded jailbreak prompt sharply lowers attack success rate (ASR) under a caption-mediated defense (ECSO) on several frontier VLMs and open-weight models, while leaving the same defense nearly inert on text-only encoded inputs. The authors propose two hypotheses (has_image branching in the defense pipeline, and intrinsic image-side safety), support them with three controls, and analyze a detector-gated deployment. The experimental apparatus is careful: paired canonical encodings, exact McNemar tests, Wilson intervals, multi-judge re-scoring, and replication on moderation-free models.

Significance. If the central interpretation were established, the finding would be a useful observation about how image presence interacts with defense pipelines in black-box VLMs, with practical implications for deployment and for understanding encoded jailbreaks. The paper is transparent about its limitations and avoids overclaiming robustness. However, the headline claim depends on a baseline that the paper's own appendix shows is not generated by the ECSO defense in its full form, which casts doubt on the interpretation that the decoy activates a latent safety re-check. The empirical pattern itself is real, but its attribution is currently insufficiently supported.

major comments (2)

[App. D.1 and §4.2] The text-only ECSO baseline is not ECSO. App. D.1 states that when has_image is false at INITIAL, 'steps 3a–3d collapse to just INITIAL', meaning the TELL/CAP/SAFE chain described in App. A never runs. The text+ECSO cell in Table 1 is therefore identical to the no-defense text cell. The claim that 'ECSO is near-inert on text' (§4.2) is an artifact of this early return. The paper never benchmarks the original ECSO on text-only encoded inputs, so the contrast text+ECSO vs. decoy+ECSO conflates 'turning on the defense' with 'image presence'. This is load-bearing for the headline amplification claim; the controls (blank canvas, open-weight replication) reuse the same implementation and do not resolve it. Please either run a faithful text-only ECSO baseline (e.g., by removing the has_image guard when possible) or explicitly reframe the claim as a property of this implementation's has_image br
[§5 H1] H1 is presented as an untestable black-box hypothesis, but the paper's own code already contains the has_image branch that H1 posits. The paper should verify its own implementation and clearly separate 'what our implementation does' from 'what we conjecture about closed pipelines'. Without a faithful text-only baseline, the open-weight replication (Table 5) and decoy-class controls (Table 9) are all consistent with the same implementation artifact and do not independently support the defense-class interpretation. This needs to be addressed before the central claim can be accepted.

minor comments (2)

[Figure 1 caption] The caption reads '[(text ASR) (decoy ASR)]' with two spaces; this likely should be '(text ASR) − (decoy ASR)'.
[App. A] The CAP prompt 'Based on the REQUEST, describe the image' presumes an image is present. If the original ECSO pipeline is applied to text-only inputs, this prompt may not be well-defined; the paper should clarify whether the original ECSO is defined for text-only inputs at all, and if not, how a meaningful text+ECSO baseline should be constructed.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the headline amplification is a measured contrast against external benchmarks; the sole self-citation (formal-logic encoder) is not load-bearing and is independently reproduced by other encoders.

full rationale

The paper's central claim is empirical: ASR(text+ECSO) vs ASR(decoy+ECSO) on HarmBench, with shared canonical encodings and paired exact McNemar tests. No parameter is fitted to the outcome and no equation defines the effect into existence. The only author-overlapping citation is the formal-logic encoder from Zhang et al. (2026); the amplification is also reproduced with code-completion (Ren et al. 2024), set-theory (Bethany et al. 2024), semantic camouflage (Yan et al. 2025), and classical Chinese (Huang et al. 2026), so the central result does not reduce to that self-citation. The App. D.1 walkthrough states that on the text-only variant 'has_image is false at INITIAL, so steps 3a–3d collapse to just INITIAL'; this is an implementation-specific baseline choice and a potential correctness threat to the 'ECSO near-inert on text' interpretation, but it is not circular — the text-vs-decoy contrast is still externally measured, and the paper explicitly labels the mechanism as a hypothesis (Section 5: 'H1 is our best account of the data, not an established fact'). Predictions P1/P2 in App. E are auxiliary tests of that hypothesis, not fitted quantities relabeled as predictions. No self-definitional reduction, no fitted-input-as-prediction, and no imported uniqueness theorem appears. The Limitation section also candidly flags the closed-pipeline uncertainty. Therefore no circular step is exhibited; score 0.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The paper makes an empirical observation with no fitted parameters or newly postulated entities. It relies on standard benchmark labels and on the pairing protocol. The main assumptions are domain assumptions about judge validity and about the causal inference to pipeline behavior, which the paper itself flags as hypotheses.

assumptions (5)

domain assumption HarmBench and JailbreakBench LLM judges (gpt-5-nano) yield valid harm/refusal labels.
Used to define ASR and benign refusal throughout; §3, App. H shows judge-dependence of absolute levels but consistency of paired direction.
domain assumption Paired canonical encoding: the single encoded t per (model, defense, encoding) cell makes text-vs-decoy outcomes paired per prompt.
§2 and App. E; basis for McNemar tests.
domain assumption Decoy images are information-free with respect to q.
§2, §4.4; supported by blank-canvas and photograph controls in App. F.
domain assumption Black-box threat model precludes pipeline introspection, so causal claims about defense internals are hypotheses.
§1, §5: H1/H2 are stated as constrained hypotheses, not confirmed mechanisms.
ad hoc to paper The ECSO implementation faithfully represents the caption-mediated defense class; original ECSO's behavior on text-only encoded inputs is not separately benchmarked.
App. A provides the reimplementation; D.1 shows text-only collapses to INITIAL, a design choice that shapes the 'inert on text' baseline.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Decoy Images Amplify Caption-Mediated Defenses Against Encoded Jailbreaks." pith.science (2026). https://pith.science/paper/DLE263XN

@misc{pith2026260801043,
  author       = {Pith},
  title        = {Pith review of: Decoy Images Amplify Caption-Mediated Defenses Against Encoded Jailbreaks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DLE263XN}},
  note         = {Machine review of arXiv:2608.01043}
}

abstract

We report a counter-intuitive interaction between image inputs and existing black-box defenses on Vision--Language Models (VLMs): pairing an encoded jailbreak prompt with an unrelated decoy image can sharply lower attack success rate (ASR). The operative change is in the defense pipeline, not in the image. Across five frontier VLMs, two encoded-attack families, and three black-box defenses, a caption-mediated defense (ECSO) that leaves ASR essentially unchanged on text-only encoded input drops it by up to $73$pp once a content-free decoy is attached; every non-saturated contrast is significant under exact McNemar tests. We advance two hypotheses for this pattern, supported by indirect evidence rather than pipeline introspection, since a black-box threat model precludes inspecting vendor internals: caption-mediated defenses branch on image presence, and intrinsic image-side safety engages on image-resident content. Three controls constrain the explanation. Blank-canvas and natural-photograph decoys reproduce the effect on every model, implicating image presence rather than content; the effect replicates on three open-weight VLMs served with no moderation layer, so it is not a vendor-filtering artifact; and a non-symbolic, meaning-based encoder reproduces it, so it is not specific to symbolic obfuscation. Attaching a decoy unconditionally is not deployable --- it raises benign refusal to $20$--$79\%$, an inflation of $+10$ to $+67$pp --- but gating attachment on a lightweight encoded-input detector returns benign refusal to the text baseline while preserving the safety gain wherever the detector fires, making detector recall the binding constraint. Under adaptive attacks that target the caption-mediated re-check, the effect degrades but holds. We frame this as an observation about pipeline interaction, not as a robust defense.

Figures

Figures reproduced from arXiv: 2608.01043 by the authors.

**Figure 1.** ECSO amplification per (model, attack) cell: (text ASR) − (decoy ASR) in pp, across 5 models × 2 attack families = 10 cells. Positive bars: ECSO catches more harmful queries under decoy than text-only. 8/10 cells show ≥ +20pp; the outlier is claude-sonnet-4-6 + code_attack, where Anthropic API content filtering saturates the text baselines (see Limitations). coy relative to text. Each bar is (text ASR) − (decoy AS… view at source ↗

**Figure 2.** Three input variants. text: encoded text on text channel, no image. ir_plain: placeholder text + typographic image of encoded text (content lives in image). decoy: encoded text on text channel + contentunrelated decoy image (content lives in text; image only triggers multimodal code paths in defenses). ir_plain typographic image. The ir_plain renderer produces a 1024×N white-background PNG of the encoded text, siz… view at source ↗

**Figure 3.** Decoy images. (a) “mountain” is the textpseudo-image used throughout [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

17 extracted references · 11 canonical work pages

[1]

Emet Bethany, Mazal Bethany, Juan Arturo Nolazco Flores, Sumit Kumar Jha, and Peyman Najafirad. 2024. https://arxiv.org/abs/2409.11445 Jailbreaking large language models with symbolic mathematics . Preprint, arXiv:2409.11445

arXiv 2024
[2]

Pappas, Florian Tram\` e r, Hamed Hassani, and Eric Wong

Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J. Pappas, Florian Tram\` e r, Hamed Hassani, and Eric Wong. 2024. Jailbreakbench: An open robustness benchmark for jailbreaking large language models. In Advances in Neural Information Processing Systems, v...

work page 2024
[3]

Peng Ding, Jun Kuang, ZongYu Wang, Xuezhi Cao, Xunliang Cai, Jiajun Chen, and Shujian Huang. 2025. https://doi.org/10.18653/v1/2025.findings-acl.325 Why not act on what you know? unleashing safety potential of LLM s via self-aware guard enhancement . In Findings of the Association for Computational Linguistics: ACL 2025, pages 6279--6299

doi:10.18653/v1/2025.findings-acl.325 2025
[4]

Soumya Suvra Ghosal, Souradip Chakraborty, Vaibhav Singh, Tianrui Guan, Mengdi Wang, Ahmad Beirami, Furong Huang, Alvaro Velasquez, Dinesh Manocha, and Amrit Singh Bedi. 2025. Immune: Improving safety against jailbreaks in multi-modal llms via inference-time alignment. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (C...

work page 2025
[5]

Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. 2025. https://doi.org/10.1609/aaai.v39i22.34568 Figstep: Jailbreaking large vision-language models via typographic visual prompts . Proceedings of the AAAI Conference on Artificial Intelligence, 39(22):23951--23959

doi:10.1609/aaai.v39i22.34568 2025
[6]

Kwok, and Yu Zhang

Yunhao Gou, Kai Chen, Zhili Liu, Lanqing Hong, Hang Xu, Zhenguo Li, Dit-Yan Yeung, James T. Kwok, and Yu Zhang. 2024. https://doi.org/10.1007/978-3-031-72643-9_23 Eyes closed, safety on: Protecting multimodal llms via image-to-text transformation . In Computer Vision -- ECCV 2024, pages 388--404. Springer-Verlag

doi:10.1007/978-3-031-72643-9_23 2024
[7]

Xun Huang, Simeng Qin, Xiaoshuang Jia, Ranjie Duan, Huanqian Yan, Zhitao Zeng, Fei Yang, Yang Liu, and Xiaojun Jia. 2026. https://arxiv.org/abs/2602.22983 Obscure but effective: Classical chinese jailbreak prompt optimization via bio-inspired search . Preprint, arXiv:2602.22983

work page arXiv 2026
[8]

Yifan Li, Hangyu Guo, Kun Zhou, Wayne Xin Zhao, and Ji-Rong Wen. 2025 a . Images are achilles' heel of alignment: Exploiting visual vulnerabilities for jailbreaking multimodal large language models. In Computer Vision -- ECCV 2024, pages 174--189. Springer Nature Switzerland

work page 2025

Show all 17 references

[9]

Yu Li, Han Jiang, and Zhihua Wei. 2025 b . https://doi.org/10.18653/v1/2025.findings-acl.613 D e TAM : Defending LLM s against jailbreak attacks via targeted attention modification . In Findings of the Association for Computational Linguistics: ACL 2025, pages 11781--11797

2025 doi
[10]

Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. 2025. Mm-safetybench: A benchmark for safety evaluation of multimodal large language models. In Computer Vision -- ECCV 2024, pages 386--403

2025
[11]

Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. 2024. Harmbench: a standardized evaluation framework for automated red teaming and robust refusal. In Proceedings of the...

2024
[12]

Qibing Ren, Chang Gao, Jing Shao, Junchi Yan, Xin Tan, Wai Lam, and Lizhuang Ma. 2024. https://doi.org/10.18653/v1/2024.findings-acl.679 C ode A ttack: Revealing safety generalization challenges of large language models via code completion . In Findings of the Association for ...

2024 doi
[13]

Rui Yang Tan, Yujia Hu, and Roy Ka-Wei Lee. 2026. https://arxiv.org/abs/2603.21697 Structured visual narratives undermine safety alignment in multimodal large language models . Preprint, arXiv:2603.21697

2026 arXiv
[14]

Han Wang, Gang Wang, and Huan Zhang. 2025. Steering away from harm: An adaptive approach to defending vision language model against jailbreaks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 29947--29957

2025
[15]

Jihui Yan, Xiaocui Yang, Daling Wang, Shi Feng, Yifei Zhang, and Yinzhi Zhao. 2025. https://doi.org/10.18653/v1/2025.findings-acl.745 S emantic C amo: Jailbreaking large language models through semantic camouflage . In Findings of the Association for Computational Linguistics:...

2025 doi
[16]

Haoyu Zhang, Mohammad Zandsalimy, and Shanu Sushmita. 2026. https://arxiv.org/abs/2605.03441 Exposing llm safety gaps through mathematical encoding:new attacks and systematic analysis . Preprint, arXiv:2605.03441

2026 arXiv
[17]

Ziyi Zhang, Zhen Sun, Zongmin Zhang, Jihui Guo, and Xinlei He. 2025. https://doi.org/10.18653/v1/2025.findings-emnlp.494 Fc-attack: Jailbreaking multimodal large language models via auto-generated flowcharts . In Findings of the Association for Computational Linguistics: EMNLP...

2025 doi

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

Emet Bethany, Mazal Bethany, Juan Arturo Nolazco Flores, Sumit Kumar Jha, and Peyman Najafirad. 2024. https://arxiv.org/abs/2409.11445 Jailbreaking large language models with symbolic mathematics . Preprint, arXiv:2409.11445

arXiv 2024

[2] [2]

Pappas, Florian Tram\` e r, Hamed Hassani, and Eric Wong

Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J. Pappas, Florian Tram\` e r, Hamed Hassani, and Eric Wong. 2024. Jailbreakbench: An open robustness benchmark for jailbreaking large language models. In Advances in Neural Information Processing Systems, v...

work page 2024

[3] [3]

Peng Ding, Jun Kuang, ZongYu Wang, Xuezhi Cao, Xunliang Cai, Jiajun Chen, and Shujian Huang. 2025. https://doi.org/10.18653/v1/2025.findings-acl.325 Why not act on what you know? unleashing safety potential of LLM s via self-aware guard enhancement . In Findings of the Association for Computational Linguistics: ACL 2025, pages 6279--6299

doi:10.18653/v1/2025.findings-acl.325 2025

[4] [4]

Soumya Suvra Ghosal, Souradip Chakraborty, Vaibhav Singh, Tianrui Guan, Mengdi Wang, Ahmad Beirami, Furong Huang, Alvaro Velasquez, Dinesh Manocha, and Amrit Singh Bedi. 2025. Immune: Improving safety against jailbreaks in multi-modal llms via inference-time alignment. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (C...

work page 2025

[5] [5]

Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. 2025. https://doi.org/10.1609/aaai.v39i22.34568 Figstep: Jailbreaking large vision-language models via typographic visual prompts . Proceedings of the AAAI Conference on Artificial Intelligence, 39(22):23951--23959

doi:10.1609/aaai.v39i22.34568 2025

[6] [6]

Kwok, and Yu Zhang

Yunhao Gou, Kai Chen, Zhili Liu, Lanqing Hong, Hang Xu, Zhenguo Li, Dit-Yan Yeung, James T. Kwok, and Yu Zhang. 2024. https://doi.org/10.1007/978-3-031-72643-9_23 Eyes closed, safety on: Protecting multimodal llms via image-to-text transformation . In Computer Vision -- ECCV 2024, pages 388--404. Springer-Verlag

doi:10.1007/978-3-031-72643-9_23 2024

[7] [7]

Xun Huang, Simeng Qin, Xiaoshuang Jia, Ranjie Duan, Huanqian Yan, Zhitao Zeng, Fei Yang, Yang Liu, and Xiaojun Jia. 2026. https://arxiv.org/abs/2602.22983 Obscure but effective: Classical chinese jailbreak prompt optimization via bio-inspired search . Preprint, arXiv:2602.22983

work page arXiv 2026

[8] [8]

Yifan Li, Hangyu Guo, Kun Zhou, Wayne Xin Zhao, and Ji-Rong Wen. 2025 a . Images are achilles' heel of alignment: Exploiting visual vulnerabilities for jailbreaking multimodal large language models. In Computer Vision -- ECCV 2024, pages 174--189. Springer Nature Switzerland

work page 2025