Adaptive Multimodal Reasoning Jailbreaks

Description

The paper reports a black-box jailbreak evaluation in which a ReAct-style loop adaptively rewrites unsafe text prompts and selectively applies blur, DCT filtering, or recoloring to image regions identified as safety-sensitive. The combined cross-modal strategy is intended to make harmful image-text requests appear less objectionable to a vision-language model while preserving enough semantics to elicit an answer. This is a specific, security-relevant evaluation, although the reported results were not independently verified and were obtained with Gemini safety filters configured to BLOCK NONE.

Examples

See the primary source for the paper's evaluation and defensive reproduction context: https://arxiv.org/abs/2601.22398 (opens in a new tab)

Impact

Successful exploitation can reduce refusal behavior for harmful multimodal requests, undermining safety-policy enforcement and the integrity of VLM moderation. The paper reports ASR increases on SPA-VL Harm from 10.57% for original inputs to 52.08% for combined ReAct rewriting and image noising, and on VLGuard unsafe subsets from 33.94% to 49.77%; these are paper-reported measurements under its evaluation setup, not independently verified facts.

Affected Systems

• Vision-language model applications that accept combined image and text inputs
• Multimodal safety filters that evaluate text and visual signals separately or rely on static filtering
• VLM deployments exposing iterative feedback or refusal signals to untrusted users

Mitigation Steps

• Evaluate safety using joint image-text semantics rather than independent modality filters.
• Test refusal robustness against iterative, feedback-driven prompt rewriting and localized image transformations using safety benchmarks such as VLGuard and SPA-VL.
• Limit attacker-visible safety feedback and repeated adaptive retries where appropriate.
• Apply defense-in-depth: input screening, multimodal policy classification, output moderation, and conservative refusal handling.
• Do not rely solely on configurable provider safety thresholds; validate behavior under production filter settings.
• Use independent safety evaluators and human review for benchmark validation rather than relying only on model self-assessment.

Evidence

• https://arxiv.org/abs/2601.22398 (opens in a new tab) — abstract states that the framework uses post-training Chain-of-Thought prompting and ReAct-driven adaptive image noising to bypass safety filters.
• https://arxiv.org/html/2601.22398 (opens in a new tab) — Section 3 describes a five-step ReAct prompt-rewriting loop and localized Gaussian blur, DCT filtering, and recoloring of safety-sensitive image regions.
• https://arxiv.org/html/2601.22398 (opens in a new tab) — Section 4 identifies VLGuard and SPA-VL as evaluation datasets and Gemini-2.0-Flash via Google’s Generative AI API as the sole victim model.
• https://arxiv.org/html/2601.22398 (opens in a new tab) — Section 4 notes that Gemini adjustable safety filters were set to BLOCK NONE and explicitly says further tests under more rigorous block settings are needed.
• https://arxiv.org/html/2601.22398 (opens in a new tab) — Table 1 reports ASR values including SPA-VL Harm 10.57% original versus 52.08% combined ReAct rewriting and noise, and VLGuard Image Unsafe 33.94% original versus 49.77% combined.
• https://arxiv.org/html/2601.22398 (opens in a new tab) — Section 4 explains that output safety was judged using model-generated factual and counterfactual safety scores with a 10-point margin rule, which limits the strength of the reported evaluation.