When Think-with-Image Meets Safety: What Determines Multimodal Jailbreak Robustness?

• URL: http://arxiv.org/abs/2605.27932v1
• Date: Wed, 27 May 2026 04:04:42 GMT
• Title: When Think-with-Image Meets Safety: What Determines Multimodal Jailbreak Robustness?
• Abstract summary: Think-with-image reasoning is emerging as a new inference paradigm for large vision-language models.<n>Across multiple vision-language models, explicit image-tool interaction yields the lowest attack success rates.<n>We introduce an image-tool safety vector framework that models image-tool invocation as a residual shift in hidden representations toward a safety-relevant direction.
• Score: 42.492554896054024
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Think-with-image reasoning is emerging as a new inference paradigm for large vision-language models, but its safety implications remain poorly understood. Existing systems already span multiple process designs, including direct response generation, text-only prior turn, visual-state manipulation, and explicit external image-tool invocation. In this paper, we ask which of these evaluated paradigms improves multimodal jailbreak robustness, and why. Across multiple vision-language models, explicit image-tool interaction yields the lowest attack success rates in our experiments, reducing jailbreak success by around 30% relative on average across the evaluated models. This finding is initially surprising: ASR remains low even when the returned image-tool output is manually overridden or itself unsafe-looking, but returns near direct-answering levels under text-only prior turn controls. These results indicate that the lower ASR is not explained by benign returned-image semantics or by the textual image-tool trace alone. To explain the pattern, we introduce an image-tool safety vector framework that models image-tool invocation as a residual shift in hidden representations toward a safety-relevant direction. Representation-level analyses and activation interventions support this account. Overall, our results suggest that explicit image-tool interaction is a promising design pattern for improving jailbreak robustness, while also motivating pipeline-specific safety evaluation.

Related papers

• Automatic Red Teaming for Implicit Vulnerabilities of Text-to-Image Models [58.59008920408855]
  We propose Adversarial Probing for Implicit VulnErabilities (AdvPIE) to expose implicit vulnerabilities without requiring access to the parameters of target models.<n> AdvPIE adopts a policy agent to generate and refine implicit adversarial prompts based on the feedback from a judge agent.<n>Experiments on standard and safety-aligned T2I models show that AdvPIE1 effectively uncovers implicit vulnerabilities.
  arXiv  Detail & Related papers  (2026-09-05T13:45:09Z)
• The Illusion of High Utility in Safety Alignment of Text-to-Image Diffusion Models [49.67749928542536]
  Safety alignment of text-to-image (T2I) diffusion models aims to suppress harmful generations while preserving utility on benign prompts.<n>Recent methods often appear to deliver high safety with high utility, but this conclusion rests largely on coarse global utility metrics.<n>We show that when utility is measured with structured evaluation, this illusion breaks: onA (Text-to-Image Faithfulness evaluation with Question Answering)<n>We propose StructureAware Geometric Regularization (SAGE), a safety alignment objective that explicitly preserves embedding spread and inter-prompt relational structure.
  arXiv  Detail & Related papers  (2026-07-01T04:00:27Z)
• VPA-Guard: Defending and Benchmarking Image-to-Video Generation Against Visual Prompt Attacks [27.060981309996492]
  We present the first systematic benchmark for evaluating video generation safety under vision-centric prompt attacks.<n>We propose VPA-Guard, a retrieval-augmented and self-evolving defense framework.
  arXiv  Detail & Related papers  (2026-06-24T09:00:08Z)
• Hard to Read, Easy to Jailbreak: How Visual Degradation Bypasses MLLM Safety Alignment [10.937124527565606]
  Recent advancements in visual context compression enable MLLMs to process ultra-long contexts efficiently by rendering text into images.<n>We identify a critical vulnerability inherent to this paradigm: lowering image resolution inadvertently catalyzes jailbreaking.<n>Our work exposes a significant risk in vision-based compression and provides critical insights for the secure design of future MLLMs.
  arXiv  Detail & Related papers  (2026-05-08T05:19:23Z)
• CASCADE: Context-Aware Relaxation for Speculative Image Decoding [9.004650208708235]
  Autoregressive generation is a powerful approach for high-fidelity image synthesis.<n>Current approaches fail to achieve efficiency gains comparable to those observed in text generation.<n>We identify previously overlooked patterns in the target model's behavior that emerge naturally in tree-based speculative decoding.
  arXiv  Detail & Related papers  (2026-05-08T04:32:17Z)
• Diversity over Uniformity: Rethinking Representation in Generated Image Detection [22.020742109848317]
  We argue that reliably generated image detection should not depend on a single decision path but should preserve multiple judgment perspectives.<n>We propose an anti-feature-collapse learning framework that filters task-irrelevant components and suppresses excessive overlap among different forgery cues in the representation space.<n>This design maintains diverse and complementary evidence within the model, reduces reliance on a small set of salient cues, and enhances robustness under unseen generative settings.
  arXiv  Detail & Related papers  (2026-02-28T15:42:12Z)
• Jailbreaks on Vision Language Model via Multimodal Reasoning [10.066621451320792]
  We present a framework that exploits post-training Chain-of-Thought prompting to construct stealthy prompts capable of bypassing safety filters.<n>We also propose a ReAct-driven adaptive noising mechanism that iteratively perturbs input images based on model feedback.
  arXiv  Detail & Related papers  (2026-01-29T23:09:24Z)
• SafeGuider: Robust and Practical Content Safety Control for Text-to-Image Models [74.11062256255387]
  Text-to-image models are highly vulnerable to adversarial prompts, which can bypass safety measures and produce harmful content.<n>We introduce SafeGuider, a two-step framework designed for robust safety control without compromising generation quality.<n>SafeGuider demonstrates exceptional effectiveness in minimizing attack success rates, achieving a maximum rate of only 5.48% across various attack scenarios.
  arXiv  Detail & Related papers  (2025-10-05T10:24:48Z)
• ThinkFake: Reasoning in Multimodal Large Language Models for AI-Generated Image Detection [51.93101033997245]
  Increasing realism of AI-generated images has raised serious concerns about misinformation and privacy violations.<n>We propose ThinkFake, a novel reasoning-based and generalizable framework for AI-generated image detection.<n>We show that ThinkFake outperforms state-of-the-art methods on the GenImage benchmark and demonstrates strong zero-shot generalization on the challenging LOKI benchmark.
  arXiv  Detail & Related papers  (2025-09-24T07:34:09Z)
• Semantic-Aware Reconstruction Error for Detecting AI-Generated Images [22.83053631078616]
  We propose a novel representation, namely Semantic-Aware Reconstruction Error (SARE), that measures the semantic difference between an image and its caption-guided reconstruction.<n>SARE provides a robust and discriminative feature for detecting fake images across diverse generative models.<n>We also introduce a fusion module that integrates SARE into the backbone detector via a cross-attention mechanism.
  arXiv  Detail & Related papers  (2025-08-13T04:37:36Z)
• Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt [60.54666043358946]
  This paper introduces the Bi-Modal Adversarial Prompt Attack (BAP), which executes jailbreaks by optimizing textual and visual prompts cohesively. In particular, we utilize a large language model to analyze jailbreak failures and employ chain-of-thought reasoning to refine textual prompts.
  arXiv  Detail & Related papers  (2024-06-06T13:00:42Z)
• Improving Adversarial Robustness of Masked Autoencoders via Test-time Frequency-domain Prompting [133.55037976429088]
  We investigate the adversarial robustness of vision transformers equipped with BERT pretraining (e.g., BEiT, MAE) A surprising observation is that MAE has significantly worse adversarial robustness than other BERT pretraining methods. We propose a simple yet effective way to boost the adversarial robustness of MAE.
  arXiv  Detail & Related papers  (2023-08-20T16:27:17Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.