{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2024:ZBAWP3GRTCBSUPTKWOVXSQYKYM","short_pith_number":"pith:ZBAWP3GR","schema_version":"1.0","canonical_sha256":"c84167ecd198832a3e6ab3ab79430ac31e38f2a6e674159ffb790116bf48cf13","source":{"kind":"arxiv","id":"2410.03489","version":2},"attestation_state":"computed","paper":{"title":"Gradient-based Jailbreak Images for Multimodal Fusion Models","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Erik Brinkman, Florian Tram\\`er, Hannah Korevaar, Ivan Evtimov, Javier Rando","submitted_at":"2024-10-04T14:59:39Z","abstract_excerpt":"Augmenting language models with image inputs may enable more effective jailbreak attacks through continuous optimization, unlike text inputs that require discrete optimization. However, new multimodal fusion models tokenize all input modalities using non-differentiable functions, which hinders straightforward attacks. In this work, we introduce the notion of a tokenizer shortcut that approximates tokenization with a continuous function and enables continuous optimization. We use tokenizer shortcuts to create the first end-to-end gradient image attacks against multimodal fusion models. We evalu"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2410.03489","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-10-04T14:59:39Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"31168036d805faff8ecafa5d540a8da6315bf19ceb7e14cb2da33c9d200a9313","abstract_canon_sha256":"2bbfa4dae7f9c8a82a38474863c135053a0d121083c8f6b433b79c8ab65bb6a1"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T09:24:38.844783Z","signature_b64":"q3vo/HNTP5GdgxbpvKL2Re/pQPahqg63O8Os1Ul2RgESPpPtNYG5+VTyFc8YRUR9kLTcb60axyiu01JV6LA9Aw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"c84167ecd198832a3e6ab3ab79430ac31e38f2a6e674159ffb790116bf48cf13","last_reissued_at":"2026-07-05T09:24:38.844292Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T09:24:38.844292Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Gradient-based Jailbreak Images for Multimodal Fusion Models","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Erik Brinkman, Florian Tram\\`er, Hannah Korevaar, Ivan Evtimov, Javier Rando","submitted_at":"2024-10-04T14:59:39Z","abstract_excerpt":"Augmenting language models with image inputs may enable more effective jailbreak attacks through continuous optimization, unlike text inputs that require discrete optimization. However, new multimodal fusion models tokenize all input modalities using non-differentiable functions, which hinders straightforward attacks. In this work, we introduce the notion of a tokenizer shortcut that approximates tokenization with a continuous function and enables continuous optimization. We use tokenizer shortcuts to create the first end-to-end gradient image attacks against multimodal fusion models. We evalu"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2410.03489","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2410.03489/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2410.03489","created_at":"2026-07-05T09:24:38.844364+00:00"},{"alias_kind":"arxiv_version","alias_value":"2410.03489v2","created_at":"2026-07-05T09:24:38.844364+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2410.03489","created_at":"2026-07-05T09:24:38.844364+00:00"},{"alias_kind":"pith_short_12","alias_value":"ZBAWP3GRTCBS","created_at":"2026-07-05T09:24:38.844364+00:00"},{"alias_kind":"pith_short_16","alias_value":"ZBAWP3GRTCBSUPTK","created_at":"2026-07-05T09:24:38.844364+00:00"},{"alias_kind":"pith_short_8","alias_value":"ZBAWP3GR","created_at":"2026-07-05T09:24:38.844364+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":4,"internal_anchor_count":0,"sample":[{"citing_arxiv_id":"2605.10764","citing_title":"Break the Brake, Not the Wheel: Untargeted Jailbreak via Entropy Maximization","ref_index":27,"is_internal_anchor":false},{"citing_arxiv_id":"2606.26566","citing_title":"Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Models","ref_index":56,"is_internal_anchor":false},{"citing_arxiv_id":"2605.10764","citing_title":"Break the Brake, Not the Wheel: Untargeted Jailbreak via Entropy Maximization","ref_index":27,"is_internal_anchor":false},{"citing_arxiv_id":"2605.04261","citing_title":"Laundering AI Authority with Adversarial Examples","ref_index":52,"is_internal_anchor":false}]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/ZBAWP3GRTCBSUPTKWOVXSQYKYM","json":"https://pith.science/pith/ZBAWP3GRTCBSUPTKWOVXSQYKYM.json","graph_json":"https://pith.science/api/pith-number/ZBAWP3GRTCBSUPTKWOVXSQYKYM/graph.json","events_json":"https://pith.science/api/pith-number/ZBAWP3GRTCBSUPTKWOVXSQYKYM/events.json","paper":"https://pith.science/paper/ZBAWP3GR"},"agent_actions":{"view_html":"https://pith.science/pith/ZBAWP3GRTCBSUPTKWOVXSQYKYM","download_json":"https://pith.science/pith/ZBAWP3GRTCBSUPTKWOVXSQYKYM.json","view_paper":"https://pith.science/paper/ZBAWP3GR","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2410.03489&json=true","fetch_graph":"https://pith.science/api/pith-number/ZBAWP3GRTCBSUPTKWOVXSQYKYM/graph.json","fetch_events":"https://pith.science/api/pith-number/ZBAWP3GRTCBSUPTKWOVXSQYKYM/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/ZBAWP3GRTCBSUPTKWOVXSQYKYM/action/timestamp_anchor","attest_storage":"https://pith.science/pith/ZBAWP3GRTCBSUPTKWOVXSQYKYM/action/storage_attestation","attest_author":"https://pith.science/pith/ZBAWP3GRTCBSUPTKWOVXSQYKYM/action/author_attestation","sign_citation":"https://pith.science/pith/ZBAWP3GRTCBSUPTKWOVXSQYKYM/action/citation_signature","submit_replication":"https://pith.science/pith/ZBAWP3GRTCBSUPTKWOVXSQYKYM/action/replication_record"}},"created_at":"2026-07-05T09:24:38.844364+00:00","updated_at":"2026-07-05T09:24:38.844364+00:00"}