REVIEW 20 cited by
FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
read the original abstract
Large Vision-Language Models (LVLMs) signify a groundbreaking paradigm shift within the Artificial Intelligence (AI) community, extending beyond the capabilities of Large Language Models (LLMs) by assimilating additional modalities (e.g., images). Despite this advancement, the safety of LVLMs remains adequately underexplored, with a potential overreliance on the safety assurances purported by their underlying LLMs. In this paper, we propose FigStep, a straightforward yet effective black-box jailbreak algorithm against LVLMs. Instead of feeding textual harmful instructions directly, FigStep converts the prohibited content into images through typography to bypass the safety alignment. The experimental results indicate that FigStep can achieve an average attack success rate of 82.50% on six promising open-source LVLMs. Not merely to demonstrate the efficacy of FigStep, we conduct comprehensive ablation studies and analyze the distribution of the semantic embeddings to uncover that the reason behind the success of FigStep is the deficiency of safety alignment for visual embeddings. Moreover, we compare FigStep with five text-only jailbreaks and four image-based jailbreaks to demonstrate the superiority of FigStep, i.e., negligible attack costs and better attack performance. Above all, our work reveals that current LVLMs are vulnerable to jailbreak attacks, which highlights the necessity of novel cross-modality safety alignment techniques. Our code and datasets are available at https://github.com/ThuCCSLab/FigStep .
Forward citations
Cited by 20 Pith papers
-
Securing Multimodal AI through Internal Information Decomposition
A one-class detector using first-token distributional consistency between text-only, vision-only, and joint predictions reduces multimodal jailbreak attack success rates to below 15% with ~2.4% utility loss.
-
Activation Steering Meets Preference Optimization: Defense Against Jailbreaks in Vision Language Models
A proposed VLM defense, SPO-VLM, combines activation steering with sequence-level preference optimization and claims lower jailbreak ASR and toxicity than ASTRA while retaining visual understanding.
-
The First Differentiable Transfer-Based Algorithm for Discrete MicroLED Repair
The submission's abstract announces a differentiable microLED repair planner, yet its full text is the LoD jailbreak-detection paper (arXiv 2508.09201v4), leaving the claimed result without any derivation.
-
Secure Tug-of-War (SecTOW): Iterative Defense-Attack Training with Reinforcement Learning for Multimodal Model Security
An iterative attacker-defender reinforcement learning method that makes a multimodal LLM refuse more jailbreak prompts without over-refusing ordinary queries.
-
Self-Aware Safety Augmentation: Leveraging Internal Semantic Understanding to Enhance Safety in Vision-Language Models
A tuning-free method that projects middle-layer semantic representations back onto early safety layers, improving vision-language model safety with minimal utility loss.
-
Bridging the Gap in Vision Language Models in Identifying Unsafe Concepts Across Modalities
Vision-language models consistently recognize unsafe content better from text than from images, and a simplified reinforcement learning fine-tune narrows that gap.
-
Attacker's Noise Can Manipulate Your Audio-based LLM in the Real World
Adversarial audio noise, optimized with audio augmentations, can trigger and distort the behavior of audio-based LLMs both digitally and when played through the air.
-
Con Instruction: Universal Jailbreaking of Multimodal Large Language Models via Non-Textual Modalities
Con Instruction embeds harmful textual instructions into adversarial images or audio by aligning their representations, achieving successful jailbreaks on several vision- and audio-language models.
-
AMIA: Automatic Masking and Joint Intention Analysis Makes LVLMs Robust Jailbreak Defenders
AMIA is an inference-only jailbreak defense that masks text-irrelevant image patches and prompts single-pass intention analysis, lifting average defense success on LVLMs from 52.4% to 81.7%.
-
Test-Time Immunization: A Universal Defense Framework Against Jailbreaks for (Multimodal) Large Language Models
TIM detects jailbreaks at test time using a gist-token classifier and adaptively fine-tunes the model with LoRA on detected harmful prompts, cutting attack success rates to near zero on tested benchmarks.
-
Audio Jailbreak Attacks: Exposing Vulnerabilities in SpeechGPT in a White-Box Framework
By appending optimized token sequences to harmful speech, the authors achieve up to 89% attack success rate on SpeechGPT across six forbidden categories.
-
Backdoor Cleaning without External Guidance in MLLM Fine-tuning
BYE filters backdoored training images from MLLM fine-tuning by clustering low attention entropy across selected layers.
-
When the Prompt Becomes Visual: Vision-Centric Jailbreak Attacks for Large Image Editing Models
Picture-only instructions can jailbreak large image editing models with up to 80.9% attack success; a simple appended safety trigger mitigates the threat.
-
Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation
Sparse autoencoder activation perturbation (SFPF) applied on top of existing jailbreak prompts raises attack success rate on Qwen3-32B, but with no defense evaluation and weak reproducibility.
-
Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message
Trojan Horse Prompting injects malicious instructions into a fabricated assistant message in the API chat history, aiming to bypass Gemini's safety filters, but no quantitative evidence is provided.
-
Seeing the Threat: Vulnerabilities in Vision-Language Models to Adversarial Attack
A two-stage evaluation framework and token-projection analysis show that LVLMs encode harmful semantic cues from images even without OCR, while remaining vulnerable to cross-modal attacks.
-
VSCBench: Bridging the Gap in Vision-Language Model Safety Calibration
A new benchmark, VSCBench, measures oversafety and undersafety in vision-language models and shows that most models, including proprietary ones, are miscalibrated on at least one safety dimension.
-
A Multimodal Automatic Redteaming Evaluation based on Atomic Jailbreak Strategy Decoupling and Combination
A new jailbreak framework, HACA, combines atomic text and image attack strategies selected by a cross-modal planner and generates attacks with LLMs and text-to-image models, reaching 95.48% average attack success acro...
-
Blockchain Network Analysis using Quantum Inspired Graph Neural Networks & Ensemble Models
The submission's abstract claims a quantum-inspired GNN with a CP-decomposition layer reaches 74.8% F2 on blockchain fraud detection, but the uploaded full text is an unrelated paper on VLM agent security.
-
From Hallucinations to Jailbreaks: Rethinking the Vulnerability of Large Foundation Models
The paper argues hallucinations and jailbreaks share the same optimization dynamics and shows that defenses for one also reduce the other, but the theoretical support is largely circular.
Discussion (0). Sign in to comment.